A trusted data sharing method, system, device, and storage medium for the Internet of Things

Abstract

This application discloses a trusted data sharing method, system, device, and storage medium for the Internet of Things (IoT), relating to the field of blockchain technology. The method includes: establishing a target consortium blockchain; providing users with a decentralized identity software development kit (SDK) or a digital identity executable file; determining the digital identity ID of each user; encrypting authenticated device data to obtain encrypted data; storing the encrypted data in IPFS; obtaining a hash value; storing a policy encrypted text determined based on the hash value, access policy, and data decryption key of the encrypted data in the target consortium blockchain; obtaining the policy encrypted text according to the digital identity ID and access request; verifying the target user's identity; decrypting the policy encrypted text using the verified target user to obtain a hash value and a data decryption key; obtaining the encrypted data using the hash value; and decrypting the encrypted data using the data decryption key to obtain the device data. This achieves secure data storage and secure access for the IoT.

Description

Technical Field

[0001] This invention relates to the field of blockchain technology, and in particular to a trusted data sharing method, system, device, and storage medium for the Internet of Things. Background Technology

[0002] With the convergence and development of the Internet of Things (IoT) and next-generation information technologies, more and more devices are connecting to the network, leading to an explosive growth in IoT data. The massive amounts of data generated and transmitted pose challenges to device and data security and privacy. Based on blockchain technology, this invention aims to provide a trusted IoT data sharing method through device authentication, secure data storage, and access control, thereby enabling the secure flow and reliable use of IoT data.

[0003] Traditional blockchain data storage often stores metadata in plaintext / ciphertext format in IPFS (InterPlanetary File System). Decryption of ciphertext storage requires the transmission of the data owner's private key, making it vulnerable to cyberattacks and data leaks. Meanwhile, trusted data sharing in the Internet of Things (IoT) involves processes such as device data collection, storage, transmission, and processing. Inventors often address specific problems in specific scenarios, making it difficult to develop replicable and scalable solutions. The authenticity and reliability of devices must also be verified before trusted data sharing. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a trusted data sharing method, system, device, and storage medium for the Internet of Things (IoT), which can solve the problems of trusted access for IoT devices, secure data storage for IoT, and secure access. The specific solution is as follows:

[0005] In a first aspect, this application discloses a trusted data sharing method for the Internet of Things, comprising:

[0006] Establish a target consortium blockchain and provide all users with a decentralized identity software development kit or digital identity executable file to determine the digital identity ID of each user in the target consortium blockchain;

[0007] The newly connected IoT devices are authenticated, and the device data of the authenticated IoT devices are symmetrically encrypted to obtain the corresponding ciphertext. The ciphertext is stored in IPFS to obtain the corresponding hash value. The policy ciphertext, determined by encryption processing based on the hash value, access policy, and the data decryption key corresponding to the ciphertext, is stored in the target consortium blockchain.

[0008] The policy ciphertext is obtained from the target consortium blockchain based on the digital identity ID corresponding to the target user and the access request. The target user is authenticated based on the access policy. The authenticated target user is used to decrypt the policy ciphertext to obtain the corresponding hash value and the data decryption key.

[0009] The target user uses the hash value to obtain the encrypted data from IPFS, and then uses the data decryption key to decrypt the encrypted data to obtain the device data.

[0010] Optionally, the method further includes:

[0011] If the user is logging in for the first time, real-name authentication is performed on the user. A decentralized identity software development kit or digital identity executable file is provided to the user who has passed the real-name authentication to determine the user's digital identity ID in the target consortium chain, and the digital identity ID is written into the target consortium chain.

[0012] Optionally, the method further includes:

[0013] The decentralized identity software development kit or digital identity executable file is installed on the IoT device and run to obtain the device ID, target public key, and target private key of the IoT device, and the device ID, the target public key, and the target private key are stored in the target consortium blockchain.

[0014] Optionally, the authentication of newly connected IoT devices includes:

[0015] The target plaintext is encrypted using the IoT device to obtain the encrypted plaintext. The encrypted plaintext is then decrypted using the target public key in the target consortium blockchain to determine the decrypted plaintext.

[0016] The authentication of the IoT device is completed based on the determination of whether the decrypted plaintext is consistent with the target plaintext.

[0017] Based on the device name of the IoT device, determine whether the IoT device belongs to the target enterprise, so as to complete the information verification of the IoT device based on the corresponding judgment result;

[0018] The authentication of the IoT device for the first time is completed through the identity verification and information verification.

[0019] Optionally, after authenticating the IoT device connected for the first time, the process further includes:

[0020] The device ID, device name, company, authentication status, and access time of the authenticated IoT device are written into the target consortium blockchain.

[0021] Optionally, the method further includes:

[0022] If the access policy is updated, the policy ciphertext is decrypted so that the new policy ciphertext can be determined by the new access policy, the data decryption key of the re-encrypted data ciphertext, and the hash value corresponding to the re-encrypted data ciphertext, and the policy ciphertext is uploaded to the target consortium blockchain; the re-encrypted data ciphertext is the data ciphertext that is re-encrypted after decrypting the policy ciphertext.

[0023] The new strategy ciphertext is compared with the previous strategy ciphertext by the target smart contract on the target consortium blockchain to complete the corresponding data replacement.

[0024] Optionally, the step of obtaining the policy ciphertext from the target consortium blockchain based on the digital identity ID corresponding to the target user and the access request, authenticating the target user based on the access policy, and decrypting the policy ciphertext using the authenticated target user includes:

[0025] The digital identity ID corresponding to the target user is matched with the identity information in the target consortium blockchain, and the identity of the target user is determined according to the corresponding matching result to determine whether the identity of the target user meets the preset identity verification conditions.

[0026] If not, then obtaining the encrypted policy text is prohibited;

[0027] If so, the policy ciphertext is obtained from the target consortium blockchain according to the access request, and the user attributes of the target user are compared with the access policy, so as to determine whether the target user has passed the authentication based on the corresponding comparison result;

[0028] If the authentication is successful, the policy ciphertext is decrypted.

[0029] If the authentication fails, decryption of the policy ciphertext is prohibited.

[0030] Secondly, this application discloses an Internet of Things (IoT) trusted data sharing system, comprising:

[0031] The digital identity ID determination module is used to build the target consortium blockchain and provide all users with a decentralized identity software development kit or digital identity executable file to determine the digital identity ID of each user in the target consortium blockchain.

[0032] The policy ciphertext storage module is used to authenticate IoT devices that are connected for the first time, and to symmetrically encrypt the device data of the authenticated IoT devices to obtain the corresponding data ciphertext. The data ciphertext is stored in IPFS to obtain the corresponding hash value. The policy ciphertext, determined by encryption processing based on the hash value, access policy and the data decryption key corresponding to the data ciphertext, is stored in the target consortium blockchain.

[0033] The policy ciphertext decryption module is used to obtain the policy ciphertext from the target consortium blockchain according to the digital identity ID corresponding to the target user and the access request, authenticate the target user based on the access policy, and use the authenticated target user to decrypt the policy ciphertext to obtain the corresponding hash value and the data decryption key.

[0034] The device data acquisition module is used to obtain the encrypted data from the IPFS by the target user using the hash value, and to decrypt the encrypted data using the data decryption key to obtain the device data.

[0035] Thirdly, this application discloses an electronic device, including:

[0036] Memory, used to store computer programs;

[0037] A processor for executing the computer program to implement the Internet of Things trusted data sharing method as described above.

[0038] Fourthly, this application discloses a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the aforementioned Internet of Things trusted data sharing method.

[0039] This application, when sharing trusted IoT data, first establishes a target consortium blockchain, providing all users with a decentralized identity software development kit or digital identity executable file to determine each user's digital identity ID on the target consortium blockchain. Then, it authenticates newly connected IoT devices and symmetrically encrypts the device data of authenticated IoT devices to obtain corresponding ciphertext. This ciphertext is stored in IPFS to obtain a corresponding hash value. A policy ciphertext, determined through encryption based on the hash value, access policy, and the corresponding data decryption key, is stored on the target consortium blockchain. Based on the target user's digital identity ID and access request, the policy ciphertext is retrieved from the target consortium blockchain. The target user is authenticated based on the access policy, and the authenticated target user decrypts the policy ciphertext to obtain the corresponding hash value and data decryption key. Finally, the target user retrieves the ciphertext from IPFS using the hash value and decrypts it using the data decryption key to obtain the device data. As can be seen, this application generates trusted digital identities for IoT devices through distributed digital identity and access control policies, and performs rights confirmation and transfer, thereby realizing trusted digital identity management and trusted access control for devices. Furthermore, it achieves decentralized data storage through blockchain and IPFS, allowing data to be sharded and stored on multiple nodes in the IPFS network, ensuring data storage security and solving the problems of trusted access, secure data storage, and secure access for IoT devices. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0041] Figure 1 This is a flowchart of a trusted data sharing method for the Internet of Things disclosed in this application;

[0042] Figure 2 This is a schematic diagram of the structure of an Internet of Things trusted data sharing system disclosed in this application;

[0043] Figure 3 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] Traditional blockchain data storage often stores metadata in plaintext / ciphertext format on IPFS. Decryption of encrypted storage requires the transmission of the data owner's private key, making it vulnerable to cyberattacks and data leaks. Furthermore, trusted data sharing in the Internet of Things (IoT) involves processes such as device data collection, storage, transmission, and processing. Inventors often address specific problems in specific scenarios, making it difficult to develop replicable and scalable solutions. The authenticity and reliability of devices must also be verified before trusted data sharing. To address these technical issues, this application discloses a trusted data sharing method for the Internet of Things (IoT), which solves the problems of trusted access for IoT devices, secure IoT data storage, and secure access.

[0046] See Figure 1 As shown, this embodiment of the invention discloses a trusted data sharing method for the Internet of Things, including:

[0047] Step S11: Build the target consortium blockchain and provide all users with a decentralized identity software development kit or digital identity executable file to determine the digital identity ID of each user in the target consortium blockchain.

[0048] In this embodiment, firstly, a trusted IoT consortium blockchain is built based on actual business needs. A distributed digital identity generation and verification toolkit (DID SDK, Decentralized Identity Software Development Kit) / digital identity executable file is provided to all users, granting each user and IoT device a unique, autonomous, and trusted on-chain digital identity ID (Identity document), with the public and private keys stored locally. Specifically, users independently obtain their digital identity ID and public / private keys by installing the DID SDK / digital identity executable file. By installing and running the DID SDK / digital identity executable file on a smart device, the user obtains the device identity ID and machine public / private keys, which are then stored and securely protected. Users logging into the system for the first time undergo real-name authentication, and the authenticated user's identity ID and public key are written into the trusted IoT consortium blockchain. Simultaneously, the decentralized identity software development kit or digital identity executable file is installed and run on the IoT device to obtain the IoT device's device ID, target public key, and target private key, which are then stored in the target consortium blockchain.

[0049] Step S12: Authenticate the IoT device that is connected for the first time, and symmetrically encrypt the device data of the authenticated IoT device to obtain the corresponding data ciphertext. Store the data ciphertext in IPFS to obtain the corresponding hash value. Store the policy ciphertext determined by encryption processing based on the hash value, access policy and the data decryption key corresponding to the data ciphertext in the target consortium blockchain.

[0050] In this embodiment, authentication management is performed on newly connected IoT devices. The authenticated device ID, basic information, and data generated by the device are written into the IoT Trusted Consortium Chain. The device data metadata is stored on IPFS using symmetric encryption, and the access policy, the hash value returned by IPFS, and the data decryption key are encrypted and stored in the IoT Trusted Consortium Chain. When authenticating a newly connected IoT device, the target plaintext is encrypted by the IoT device, the encrypted plaintext is obtained, and the encrypted plaintext is decrypted using the target public key in the target consortium chain to determine the decrypted plaintext. The authentication of the IoT device is completed based on whether the decrypted plaintext matches the target plaintext. The IoT device's device name is used to determine if it belongs to the target enterprise, and information verification of the IoT device is completed based on the corresponding judgment result. The authentication of the newly connected IoT device is completed through the authentication and information verification. In layman's terms, IoT devices undergo dual verification upon initial system access. First, identity verification is performed by the user / IoT device encrypting plaintext and decrypting it using the corresponding public key in the consortium blockchain. The decrypted content is then compared to the original plaintext to verify identity. Next, an authenticated user verifies the device's ownership by checking its name and other information. After successful dual authentication, device information such as device ID, device name, company affiliation, authentication status, and access time are written into the trusted IoT consortium blockchain. Only devices that have passed authentication can access the system for data transmission.

[0051] After device access, device data is stored in the IoT Trusted Consortium Chain using symmetric encryption. To achieve fast and efficient data storage, metadata is encrypted and stored on IPFS. After storage, a hash value is returned, which can be used to find the corresponding metadata. The data owner encrypts the hash value returned by IPFS, the decryption key of the encrypted data, and the access control policy to form a policy ciphertext, which is then stored on the IoT Trusted Consortium Chain. If the access policy is updated, the policy ciphertext is decrypted to determine the new policy ciphertext using the new access policy, the decryption key of the re-encrypted encrypted data, and the corresponding hash value. This new policy ciphertext is then uploaded to the target consortium chain. The re-encrypted encrypted data is the encrypted data obtained by decrypting the policy ciphertext and then re-encrypting it. The target smart contract on the target consortium chain compares the new policy ciphertext with the previous policy ciphertext to complete the corresponding data replacement. In other words, the on-chain evidence storage smart contract achieves data replacement by comparing the uploaded data digest and stores historical information in a historical information database. Traditional blockchains are not designed for large-scale data storage. Therefore, by integrating blockchain and IPFS, actual data is encrypted and stored on IPFS, while the corresponding access policies are stored in encrypted hashes on the blockchain, providing a secure, reliable, and decentralized data storage solution. Furthermore, by employing "IoT technology + blockchain technology," IoT devices are given a genuine and trustworthy on-chain identity. IoT devices can automatically upload dynamic product information to the blockchain via IoT chips, reducing the cost of obtaining dynamic traceability information while achieving secure data collection from the device side to the blockchain, providing secure and reliable data.

[0052] Step S13: Obtain the policy ciphertext from the target consortium blockchain according to the digital identity ID corresponding to the target user and the access request; authenticate the target user based on the access policy; and use the authenticated target user to decrypt the policy ciphertext to obtain the corresponding hash value and the data decryption key.

[0053] In this embodiment, when a data user requests access to data, the user's identity is first verified by matching their digital identity ID with the identity information in the IoT trusted consortium blockchain. After successful authentication, the corresponding policy ciphertext on the blockchain is obtained and decrypted. The user's attributes are compared to see if they meet the access control policy in the policy ciphertext. If they do, the policy ciphertext can be decrypted; otherwise, it cannot. Users who meet the access control policy obtain the IPFS hash value and decryption key of the data ciphertext. Specifically, the digital identity ID corresponding to the target user is matched with the identity information in the target consortium blockchain. Based on the matching result, it is determined whether the target user's identity meets the preset authentication conditions. If not, obtaining the policy ciphertext is prohibited. If yes, the policy ciphertext is obtained from the target consortium blockchain according to the access request, and the target user's attributes are compared with the access policy to determine whether the target user has passed authentication. If authentication is successful, the policy ciphertext is decrypted; if authentication fails, decryption is prohibited. Finally, the corresponding hash value and decryption key are obtained.

[0054] Step S14: The target user obtains the encrypted data from IPFS using the hash value, and decrypts the encrypted data using the data decryption key to obtain the device data.

[0055] In this embodiment, the corresponding encrypted data is downloaded from IPFS using the hash value and decrypted using the decryption key to obtain the accessed data. Data consistency and integrity are verified through data hash comparison to ensure no data loss. Thus, when data access is needed, the data user initiates an access request. The blockchain smart contract verifies whether the user's attributes comply with the access policy. Upon successful verification, the hash value of the data is obtained via the blockchain, the encrypted data block is retrieved from the IPFS network, and the metadata is obtained after decryption, achieving fine-grained data sharing and user privacy protection.

[0056] In summary, when sharing trusted IoT data, this application first establishes a target consortium blockchain, providing all users with a decentralized identity software development kit or digital identity executable file to determine the digital identity ID of each user on the target consortium blockchain. Then, it authenticates newly connected IoT devices and symmetrically encrypts the device data of the authenticated IoT devices to obtain corresponding ciphertext. This ciphertext is stored in IPFS to obtain a corresponding hash value. A policy ciphertext, determined through encryption based on the hash value, access policy, and the corresponding data decryption key, is stored in the target consortium blockchain. Based on the target user's digital identity ID and access request, the policy ciphertext is retrieved from the target consortium blockchain. The target user is authenticated based on the access policy, and the authenticated target user decrypts the policy ciphertext to obtain the corresponding hash value and the data decryption key. Finally, the target user retrieves the ciphertext from IPFS using the hash value and decrypts it using the data decryption key to obtain the device data. As can be seen, this application generates trusted digital identities for IoT devices through distributed digital identity and access control policies, and performs rights confirmation and transfer, thereby realizing trusted digital identity management and trusted access control for devices. Furthermore, it achieves decentralized data storage through blockchain and IPFS, allowing data to be sharded and stored on multiple nodes in the IPFS network, ensuring data storage security and solving the problems of trusted access, secure data storage, and secure access for IoT devices.

[0057] This application discloses a specific method for trusted data sharing in the Internet of Things (IoT). In general, firstly, a trusted IoT consortium blockchain is built based on actual business needs; a distributed digital identity generation and verification toolkit (DID SDK / digital identity executable file) is provided to all users, assigning each user and IoT device a unique, autonomous, and trusted on-chain digital identity ID, with public and private keys stored locally; then, authentication management is performed on newly connected IoT devices, and the authenticated device ID, basic information, and data generated by the device are written into the trusted IoT consortium blockchain; wherein, the device data metadata is stored on IPFS using symmetric encryption, and the access policy, the hash value returned by IPFS, and the data decryption key are encrypted and stored in the trusted IoT consortium blockchain.

[0058] Finally, when a data user requests access to data, their identity is first verified by matching their digital identity ID with the identity information in the IoT Trusted Consortium Chain. After successful authentication, the corresponding policy ciphertext is retrieved from the chain and decrypted. The user's attributes are then compared to the access control policy in the policy ciphertext. If they meet the policy requirements, the policy ciphertext can be decrypted; otherwise, it cannot. Users who meet the access control policy requirements obtain the IPFS hash value and decryption key of the data ciphertext. The corresponding data ciphertext is then downloaded from IPFS and decrypted using the decryption key to obtain the accessed data. Finally, data consistency and integrity are verified through data hash comparison.

[0059] Therefore, this application generates trusted digital identities for IoT devices through distributed digital identity and access control policies, enabling the confirmation and transfer of rights, and achieving trusted digital identity management and trusted access control for devices. Simultaneously, blockchain and IPFS enable decentralized data storage. Data can be fragmented and stored in the IPFS network, distributed across multiple nodes. Each data block has a unique hash value as its identifier. The hash value or metadata of the data can then be stored on the blockchain, forming a data identifier. The blockchain records information such as the data's storage location and access permissions. Furthermore, access policies are set by the data owner and bound to encrypted data, attributes, and user keys, while also supporting flexible updates to access policies, thereby achieving fine-grained secure data access.

[0060] See Figure 2 As shown, this embodiment of the invention discloses an Internet of Things (IoT) trusted data sharing system, comprising:

[0061] The digital identity ID determination module 11 is used to build a target consortium blockchain and provide all users with a decentralized identity software development kit or a digital identity executable file to determine the digital identity ID of each user in the target consortium blockchain.

[0062] The policy ciphertext storage module 12 is used to authenticate IoT devices that are connected for the first time, and to symmetrically encrypt the device data of the authenticated IoT devices to obtain the corresponding data ciphertext. The data ciphertext is stored in IPFS to obtain the corresponding hash value. The policy ciphertext determined by encryption processing based on the hash value, access policy and the data decryption key corresponding to the data ciphertext is stored in the target consortium blockchain.

[0063] The policy ciphertext decryption module 13 is used to obtain the policy ciphertext from the target consortium blockchain according to the digital identity ID corresponding to the target user and the access request, authenticate the target user based on the access policy, and use the authenticated target user to decrypt the policy ciphertext to obtain the corresponding hash value and the data decryption key.

[0064] The device data acquisition module 14 is used to obtain the encrypted data from the IPFS by the target user using the hash value, and to decrypt the encrypted data using the data decryption key to obtain the device data.

[0065] In summary, when sharing trusted IoT data, this application first establishes a target consortium blockchain, providing all users with a decentralized identity software development kit or digital identity executable file to determine the digital identity ID of each user on the target consortium blockchain. Then, it authenticates newly connected IoT devices and symmetrically encrypts the device data of the authenticated IoT devices to obtain corresponding ciphertext. This ciphertext is stored in IPFS to obtain a corresponding hash value. A policy ciphertext, determined through encryption based on the hash value, access policy, and the corresponding data decryption key, is stored in the target consortium blockchain. Based on the target user's digital identity ID and access request, the policy ciphertext is retrieved from the target consortium blockchain. The target user is authenticated based on the access policy, and the authenticated target user decrypts the policy ciphertext to obtain the corresponding hash value and the data decryption key. Finally, the target user retrieves the ciphertext from IPFS using the hash value and decrypts it using the data decryption key to obtain the device data. As can be seen, this application generates trusted digital identities for IoT devices through distributed digital identity and access control policies, and performs rights confirmation and transfer, thereby realizing trusted digital identity management and trusted access control for devices. Furthermore, it achieves decentralized data storage through blockchain and IPFS, allowing data to be sharded and stored on multiple nodes in the IPFS network, ensuring data storage security and solving the problems of trusted access, secure data storage, and secure access for IoT devices.

[0066] In some specific embodiments, the system may further include:

[0067] The real-name authentication module is used to perform real-name authentication on the user if the user is logging in for the first time, and to provide the user who has passed the real-name authentication with a decentralized identity software development kit or a digital identity executable file to determine the user's digital identity ID in the target consortium chain, and to write the digital identity ID into the target consortium chain.

[0068] In some specific embodiments, the system may further include:

[0069] The storage module is used to install the decentralized identity software development kit or digital identity executable file onto the IoT device for operation, so as to obtain the device ID, target public key and target private key of the IoT device, and store the device ID, the target public key and the target private key in the target consortium blockchain.

[0070] In some specific embodiments, the policy ciphertext storage module 12 may specifically include:

[0071] The plaintext decryption unit is used to encrypt target plaintext through the IoT device, obtain the encrypted plaintext, decrypt the encrypted plaintext using the target public key in the target consortium blockchain, and determine the decrypted plaintext.

[0072] An authentication unit is used to authenticate the IoT device based on whether the decrypted plaintext is consistent with the target plaintext.

[0073] An information verification unit is used to determine whether the IoT device is a target enterprise device based on the device name of the IoT device, so as to complete the information verification of the IoT device based on the corresponding judgment result.

[0074] The IoT device authentication unit is used to authenticate the IoT device that is accessing the network for the first time through the identity verification and the information verification.

[0075] In some specific embodiments, the system can also be used to write the device ID, device name, enterprise to which the authenticated IoT device belongs, authentication status, and access time into the target consortium blockchain.

[0076] In some specific embodiments, the system can also be used to decrypt the policy ciphertext if the access policy is updated, so as to determine the new policy ciphertext through the new access policy, the data decryption key of the re-encrypted data ciphertext, and the hash value corresponding to the re-encrypted data ciphertext, and upload the policy ciphertext to the target consortium blockchain; the re-encrypted data ciphertext is the data ciphertext that is re-encrypted after decrypting the policy ciphertext; the target smart contract on the target consortium blockchain compares the differences between the new policy ciphertext and the policy ciphertext before the update to complete the corresponding data replacement.

[0077] In some specific embodiments, the policy ciphertext decryption module 13 can be used to match the digital identity ID corresponding to the target user with the identity information in the target consortium blockchain, and determine whether the identity of the target user meets the preset authentication conditions based on the corresponding matching result; if not, then the acquisition of the policy ciphertext is prohibited; if yes, then the policy ciphertext is acquired from the target consortium blockchain according to the access request, and the user attributes of the target user are compared with the access policy, so as to determine whether the target user has passed the authentication based on the corresponding comparison result; if the authentication is passed, then the policy ciphertext is decrypted; if the authentication is not passed, then the decryption of the policy ciphertext is prohibited.

[0078] Furthermore, embodiments of this application also disclose an electronic device, Figure 3 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0079] Figure 3 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the IoT trusted data sharing method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0080] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0081] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, etc. The resources stored thereon can include an operating system 221, computer programs 222, etc., and the storage method can be temporary storage or permanent storage.

[0082] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the Internet of Things trusted data sharing method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0083] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed Internet of Things trusted data sharing method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0084] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0085] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0086] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0087] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0088] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A trusted data sharing method for the Internet of Things, characterized in that, include: Establish a target consortium blockchain and provide all users with a decentralized identity software development kit or digital identity executable file to determine the digital identity ID of each user in the target consortium blockchain; The newly connected IoT devices are authenticated, and the device data of the authenticated IoT devices are symmetrically encrypted to obtain the corresponding ciphertext. The ciphertext is stored in IPFS to obtain the corresponding hash value. The policy ciphertext, determined by encryption processing based on the hash value, access policy, and the data decryption key corresponding to the ciphertext, is stored in the target consortium blockchain. The policy ciphertext is obtained from the target consortium blockchain based on the digital identity ID corresponding to the target user and the access request. The target user is authenticated based on the access policy. The authenticated target user is used to decrypt the policy ciphertext to obtain the corresponding hash value and the data decryption key. The target user obtains the encrypted data from IPFS using the hash value, and decrypts the encrypted data using the data decryption key to obtain the device data. The step of obtaining the policy ciphertext from the target consortium blockchain based on the digital identity ID corresponding to the target user and the access request, authenticating the target user based on the access policy, and decrypting the policy ciphertext using the authenticated target user includes: The digital identity ID corresponding to the target user is matched with the identity information in the target consortium blockchain, and the identity of the target user is determined according to the corresponding matching result to determine whether the identity of the target user meets the preset identity verification conditions. If not, then obtaining the encrypted policy text is prohibited; If so, the policy ciphertext is obtained from the target consortium blockchain according to the access request, and the user attributes of the target user are compared with the access policy, so as to determine whether the target user has passed the authentication based on the corresponding comparison result; If the authentication is successful, the policy ciphertext is decrypted. If the authentication fails, decryption of the policy ciphertext is prohibited.

2. The Internet of Things trusted data sharing method according to claim 1, characterized in that, Also includes: If the user is logging in for the first time, real-name authentication is performed on the user. A decentralized identity software development kit or digital identity executable file is provided to the user who has passed the real-name authentication to determine the user's digital identity ID in the target consortium chain, and the digital identity ID is written into the target consortium chain.

3. The Internet of Things trusted data sharing method according to claim 1, characterized in that, Also includes: The decentralized identity software development kit or digital identity executable file is installed on the IoT device and run to obtain the device ID, target public key, and target private key of the IoT device, and the device ID, the target public key, and the target private key are stored in the target consortium blockchain.

4. The Internet of Things trusted data sharing method according to claim 3, characterized in that, The authentication of newly connected IoT devices includes: The target plaintext is encrypted using the IoT device to obtain the encrypted plaintext. The encrypted plaintext is then decrypted using the target public key in the target consortium blockchain to determine the decrypted plaintext. The authentication of the IoT device is completed based on the determination of whether the decrypted plaintext is consistent with the target plaintext. Based on the device name of the IoT device, determine whether the IoT device belongs to the target enterprise, so as to complete the information verification of the IoT device based on the corresponding judgment result; The authentication of the IoT device for the first time is completed through the identity verification and information verification.

5. The Internet of Things trusted data sharing method according to claim 1, characterized in that, After authenticating the newly connected IoT device, the process also includes: The device ID, device name, company, authentication status, and access time of the authenticated IoT device are written into the target consortium blockchain.

6. The Internet of Things trusted data sharing method according to claim 1, characterized in that, Also includes: If the access policy is updated, the policy ciphertext is decrypted so that the new policy ciphertext can be determined by the new access policy, the data decryption key of the re-encrypted data ciphertext, and the hash value corresponding to the re-encrypted data ciphertext, and the policy ciphertext is uploaded to the target consortium blockchain; the re-encrypted data ciphertext is the data ciphertext that is re-encrypted after decrypting the policy ciphertext. The new strategy ciphertext is compared with the previous strategy ciphertext by the target smart contract on the target consortium blockchain to complete the corresponding data replacement.

7. A trusted data sharing system for the Internet of Things, characterized in that, include: The digital identity ID determination module is used to build the target consortium blockchain and provide all users with a decentralized identity software development kit or digital identity executable file to determine the digital identity ID of each user in the target consortium blockchain. The policy ciphertext storage module is used to authenticate IoT devices that are connected for the first time, and to symmetrically encrypt the device data of the authenticated IoT devices to obtain the corresponding data ciphertext. The data ciphertext is stored in IPFS to obtain the corresponding hash value. The policy ciphertext, determined by encryption processing based on the hash value, access policy and the data decryption key corresponding to the data ciphertext, is stored in the target consortium blockchain. The policy ciphertext decryption module is used to obtain the policy ciphertext from the target consortium blockchain according to the digital identity ID corresponding to the target user and the access request, authenticate the target user based on the access policy, and use the authenticated target user to decrypt the policy ciphertext to obtain the corresponding hash value and the data decryption key. The device data acquisition module is used to obtain the encrypted data from the IPFS by the target user using the hash value, and to decrypt the encrypted data using the data decryption key to obtain the device data; The policy ciphertext decryption module is used to match the digital identity ID corresponding to the target user with the identity information in the target consortium blockchain, and determine whether the identity of the target user meets the preset identity verification conditions based on the corresponding matching result. If not, obtaining the policy ciphertext is prohibited; if yes, the policy ciphertext is obtained from the target consortium blockchain according to the access request, and the user attributes of the target user are compared with the access policy to determine whether the target user has passed authentication based on the comparison result; if the authentication is passed, the policy ciphertext is decrypted; if the authentication is not passed, the decryption of the policy ciphertext is prohibited.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the Internet of Things trusted data sharing method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, Used to store a computer program, which, when executed by a processor, implements the Internet of Things trusted data sharing method as described in any one of claims 1 to 6.

Images