A blockchain-based power data security access control method and system

Abstract

The present invention belongs to the technical field of blockchain, and provides a method and system for secure access control of electric power data based on blockchain. The technical solution is to receive an access request from a data access requester, and when the identity authentication of the data access requester is passed, the power consumption data is bound to the data owner; the data owner determines the mining node based on the power consumption data, and processes the power consumption data based on the determined mining node and uploads it to the blockchain; the data owner constructs an access control strategy, encrypts the data based on the access control strategy to obtain data ciphertext; determines whether the attribute set of the data access requester complies with the access strategy, and if so, the data owner generates a decryption key and transmits it to the data access requester; the data access requester uses the decryption key to decrypt the data to obtain plaintext data. The decryption request that does not meet the attribute requirements can be effectively intercepted, thereby significantly optimizing the system performance while ensuring data security.

Description

Technical Field

[0001] The present invention belongs to the technical field of blockchain, and in particular relates to a blockchain-based power data security access control method and system. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] As a key component of modern social infrastructure, the security of smart grid affects the national economy and social order. With the development of science and technology, smart grid integrates a wide range of Internet of Things technologies, realizes the large-scale generation and efficient processing of data, and requires smart grid to have efficient network security measures to prevent data from being tampered, leaked or abused, and achieve data protection. However, the existing security system has certain limitations in dealing with the security challenges in the process of smart grid data sharing, and it is difficult to adapt to the actual needs of smart grid development.

[0004] The process of multi-party collaboration in data sharing in smart grids requires strict data security, which requires the power system to effectively manage data access rights to avoid the risk of unauthorized access and data leakage. In addition, the internal structure of the power system is complex, including multiple roles such as managers and ordinary users, as well as a unified superior department, which significantly increases the complexity of management rights and data access control. Existing solutions are difficult to dynamically adapt to real-time changes in roles and permissions, which is not conducive to the stability and reliability of the system and affects the safe and efficient operation of smart grids. Summary of the invention

[0005] In order to solve at least one of the technical problems existing in the above-mentioned background technology, the present invention provides a blockchain-based power data security access control method and system, which aims to comprehensively improve the system security while overcoming the shortcomings of the traditional security architecture.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] The first aspect of the present invention provides a blockchain-based power data security access control method, comprising the following steps:

[0008] Receiving an access request from a data access requester, the data owner verifies the identity of the data access requester;

[0009] When the data access requester passes the identity authentication, the electricity consumption data is bound to the data owner;

[0010] The data owner determines the mining node based on the electricity consumption data, processes the electricity consumption data based on the determined mining node, and then uploads it to the blockchain; during the data transmission process, differential privacy technology is integrated in the smart contract layer, and noise is generated based on the distribution of each type of data using the Laplace mechanism, and then noise is added to the parameter weights and biases of each layer in the noise generation model using a weighted average method;

[0011] The data owner constructs an access control policy and encrypts the data based on the access control policy to obtain the data ciphertext; determines whether the attribute set of the data access requester complies with the access policy. If so, the data owner generates a decryption key and transmits it to the data access requester;

[0012] The data access requester uses the decryption key to decrypt the data and obtain the plaintext data.

[0013] Furthermore, when the data owner verifies the identity of the data access requester, the data owner's key management center generates a pair of public and private keys for each registered user, and constructs a Bloom filter for each user group to verify the user's identity through the Bloom filter.

[0014] Furthermore, when binding electricity consumption data to data owners, multiple anonymous identifiers are created by users. Bind its power consumption data Specifically, in each time slot, the user randomly divides the power consumption data, and merges the divided data with the anonymous identifier to obtain the information to be published and publishes it in the group to which it belongs. The information to be published includes the power consumption data. , anonymous identification and , Indicates power data , Timestamp t and anonymous identification Combined in order to form a unified record, and the information is transmitted through the user's private key Encryption is performed.

[0015] Furthermore, the mining node determination process includes selecting the mining node based on the average power consumption value, wherein the mining node is selected by summing up all the collected power consumption data and then evenly distributing the sum to each user.

[0016] Furthermore, the data owner constructs an access control policy including the data owner using the public parameters provided by the key management center K , based on sharing requirements, build access control strategies consisting of user attributes and logical words .

[0017] Furthermore, before determining whether the attribute set of the data access requester complies with the access policy, the data owner also evaluates whether the data accessor has access rights based on the condition set, including:

[0018] When a data access requester initiates an access request, the policy execution point smart contract forwards the access request to the attribute authority. After the attribute authority smart contract collects the attribute information related to the data access requester, the policy execution point smart contract constructs an attribute-based access request and submits the attribute-based access request to the policy decision point smart contract. The policy decision point smart contract makes a decision on whether to grant access rights based on the comprehensive information and feeds back the decision result to the data access requester.

[0019] Furthermore, based on the selected mining node, the electricity consumption data is hashed through the Merkle tree structure, and the processing results obtained are the root hash value, timestamp, hash value of the previous block, anonymous identifier and average electricity consumption value. The obtained processing results are integrated and recorded in the block header of the new block.

[0020] Furthermore, the constructed attribute-based access request is a four-tuple AAR consisting of subject attribute, environment attribute, time attribute and level attribute.<S,E,T,L> , where S is the subject attribute, E=<physical location, network location>, T specifies the time limit, A security level relationship between the subject and the object is established.

[0021] Furthermore, the method further includes monitoring the status of the digital certificate by the smart contract, the digital certificate follows the X.509 standard format, extracting the core content of the certificate, and processing the core content using a hash algorithm embedded in the certificate to obtain a first summary;

[0022] Extract the digest signature from the certificate and decrypt the signature using the public key provided by the root certificate to obtain a second digest;

[0023] Compare the first summary and the second summary. If they are consistent, the validity period of the certificate is recorded in the blockchain ledger when the certificate is first added to the blockchain. If they are inconsistent, the certificate is marked as expired.

[0024] A second aspect of the present invention provides a blockchain-based power data security access control system, comprising a data access requester, a data owner, and a blockchain;

[0025] The data owner is configured to: receive access requests from data access requesters and verify the identity of the data access requesters; when the identity authentication of the data access requesters is passed, the electricity consumption data is bound to the data owner; the data owner determines the mining node based on the electricity consumption data, processes the electricity consumption data based on the determined mining node, and uploads it to the blockchain; during the data transmission process, differential privacy technology is integrated in the smart contract layer, and noise is generated based on the distribution of each type of data using the Laplace mechanism, and then noise is added to the parameter weights and biases of each layer in the noise generation model by weighted averaging; the data owner constructs an access control policy and encrypts the data based on the access control policy to obtain the data ciphertext; it determines whether the attribute set of the data access requester meets the access policy. If so, the data owner generates a decryption key and transmits it to the data access requester;

[0026] The data access requester is configured to: decrypt the data using the decryption key to obtain the plaintext data.

[0027] Compared with the prior art, the present invention has the following beneficial effects:

[0028] 1. The present invention introduces an access control mechanism that integrates blockchain auditing and CP-ABE key authentication technology. This mechanism can effectively intercept decryption requests that do not meet attribute requirements, thereby significantly optimizing system performance while ensuring data security.

[0029] 2. The present invention implements an efficient cross-domain access control strategy, which evaluates policies and attributes through smart contracts, strictly limits access rights to sensitive data, ensures that only qualified users can access sensitive data, and effectively ensures data security and compliance.

[0030] 3. In the smart grid, the present invention adopts differential privacy technology as a key means to protect the privacy of user electricity consumption data. This technology introduces random noise into the data to prevent data leakage and re-identification, thereby ensuring the privacy and security of user data.

[0031] 4. In order to effectively deal with the processing speed and capacity challenges brought about by the surge in power system transaction volume, the present invention introduces side chain technology, which can not only maintain the stable operation of the main chain, but also divert transaction loads to the side chain.

[0032] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0034] Figure 1 This is a flow chart of a blockchain-based power data security access control method provided by an embodiment of the present invention;

[0035] Figure 2 It is a block chain structure diagram provided by an embodiment of the present invention;

[0036] Figure 3 It is a smart contract graph introduced with differential privacy provided by an embodiment of the present invention;

[0037] Figure 4 It is a flowchart of the blockchain authorization mechanism provided by an embodiment of the present invention;

[0038] Figure 5 is a cross-domain access flow chart provided by an embodiment of the present invention;

[0039] Figure 6 It is the generated data without adding the differential privacy algorithm provided by the embodiment of the present invention;

[0040] Figure 7 is generated data based on the improved differential privacy algorithm provided by an embodiment of the present invention;

[0041] Figure 8 It is the performance of the user electricity usage behavior analysis provided by the embodiment of the present invention, without differential privacy, traditional differential privacy, and improved differential privacy algorithms. DETAILED DESCRIPTION

[0042] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0043] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0044] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0045] like Figure 1As shown, this embodiment provides a blockchain-based power data security access control method, comprising the following steps:

[0046] Step 1: Receive the access request from the data access requester, and the data owner verifies the identity of the data access requester;

[0047] In this embodiment, the data access requester may be a user, such as a resident living in an area covered by a smart grid, or a power company;

[0048] If the data access requester is an electricity user, the data owner verifies the identity of the electricity user based on the electricity user's account (ID), password (PW) and digital certificate (Cert) to ensure the uniqueness and validity of the submitted information, thereby ensuring the accuracy of identity identification.

[0049] If the data access requester is Power Company A, Power Company A provides its identity credentials, Power Company B verifies these credentials, and confirms the identity of Power Company A.

[0050] Using the information submitted by the data access requester, the user's unique identity is established on the blockchain, including data upload and permission management, which are strictly associated with the data access requester's identity attributes, thereby ensuring the integrity of the data access requester's operations and achieving the immutability and traceability of the operation history. In addition, the system administrator is responsible for supervising the validity period of the user's digital certificate, and the smart contract automatically records any expired or invalid certificates in the blockchain through the built-in timeliness verification mechanism to enhance the security and compliance of the system.

[0051] In this embodiment, when the data owner verifies the identity of the data access requester, the key management center of the data owner generates a pair of public keys and private keys for each registered user, and constructs a Bloom filter for each user group, and verifies the identity of the user through the Bloom filter;

[0052] During the initialization phase, users need to submit their identity (ID) to the Key Management Center (KMC) to complete the registration process.

[0053] Subsequently, KMC generates the system master key ( MK ), and based on the RSA encryption algorithm, a pair of unique public keys is generated for each registered user ( PK ) and the private key ( SK ), the public key is used as the user's anonymity, and a Bloom filter (BF) is created for each user group by collecting the anonymity.

[0054] KMC then integrated Bloom filters to achieve efficient identity authentication and ensure the legitimacy of user IDs.

[0055] In this embodiment, verifying the identity of the user through the Bloom filter specifically includes:

[0056] Bloom filters use a Bit array and A hash function is used to efficiently verify the hash values ​​of all anonymous identifiers in the user group. After the verification is completed, KMC will use the index value in the Bloom filter The mapping value of is set to 1, and the updated Bloom filter is distributed to all users in the group.

[0057] Step 2: After the data access requester passes the identity authentication, the data owner pre-processes the requested electricity consumption data;

[0058] In this embodiment, when the data access requester is an electric power user, preprocessing the requested data includes:

[0059] Conduct multi-dimensional analysis on the collected electricity consumption data, covering key factors such as electricity consumption period, geographical location, and user category. Based on the above key factors, effectively quantify the specific contribution of each feature to the data pattern and change trend, extract the valuable information contained in the data, identify outliers or error sources in the experimental data, and improve data quality;

[0060] When the data access requester is power company A, power company B pre-processes the requested data to ensure that the data meets the query requirements.

[0061] In this embodiment, the electricity consumption data is generated by users creating multiple anonymous identifiers. Bind its power consumption data , enhancing data security.

[0062] In each time slot (which divides time into fixed-length intervals for a specific purpose), users randomly split their electricity usage data, merge the split data with anonymous identifiers, and then securely publish it within their group.

[0063] The information released includes electricity consumption data , anonymous identification and .in, Indicates power data , Timestamp t and anonymous identification Combined in order to form a unified record, and the information is transmitted through the user's private key Encryption is performed.

[0064] Step 3: The data owner determines the mining node based on the electricity consumption data, processes the electricity consumption data based on the determined mining node, and uploads it to the blockchain;

[0065] In this embodiment, after the mining node is selected, the mining node uses the Merkle tree hash algorithm to efficiently process the electricity consumption data, and then records the processed data on the main blockchain; then, the node broadcasts the hashed electricity consumption data to all users in the group for authentication.

[0066] In this embodiment, the mining node is selected based on the average power consumption value, wherein the mining node is selected by summing up all the collected power consumption data and then evenly distributing the sum to each user;

[0067] The selection of mining nodes is based on the deviation of their electricity consumption data from this mean to ensure the consistency and synchronization of data in the blockchain network. When the electricity consumption data of multiple nodes fluctuate closely around the mean, these nodes are eligible to be designated as mining nodes.

[0068] like Figure 2 The structure of the blockchain is shown below. Specifically, the mining node first hashes the data and then , timestamp ( ), the hash value of the previous block , anonymous identification The information such as average power consumption value is integrated and recorded in the header of the new block.

[0069] After completing the processing of the selected node, the process will recursively expand to other nodes until all nodes are covered.

[0070] In order to effectively manage large amounts of transaction data and meet cross-chain interaction needs, side chain technology was introduced to divert and process large amounts of transaction data. As a supplement to the main chain architecture, this technology not only maintains independent transaction rules and consensus mechanisms, but also significantly enhances the scalability and interoperability of the system.

[0071] In this embodiment, during the data transmission process, the smart contract automatically intervenes, the data owner introduces random noise, and differential privacy technology is applied to protect data privacy;

[0072] In the distributed ledger architecture of blockchain technology, the design and implementation of user privacy protection mechanisms are particularly important. Figure 3 As shown, in this embodiment, differential privacy technology is integrated at the smart contract layer to enhance user privacy security. Specifically, the smart contract automatically introduces random noise when uploading data, which not only achieves privacy protection of sensitive information, but also maintains the integrity of the statistical characteristics of the data set.

[0073] In terms of noise generation, the traditional method is to use the Laplace mechanism to generate noise. The processing method of the mathematical model used to generate noise in the differential privacy technology integrated in the smart contract layer is to use the mean of the model parameters As expected, the variance of the model parameters As a scale parameter, the noise is generated using the Laplace mechanism Added to the model parameters, the calculation formula is:

[0074] (1),

[0075] In the formula, represents the model parameters after adding Laplace noise, represents the model parameters, represents the scale parameter of the noise;

[0076] Since the introduction of noise into the model parameters will have a certain impact on its classification accuracy, this embodiment proposes an optimized differential privacy algorithm to process the model parameters, with the aim of improving its classification efficiency while ensuring that the model effectively resists attacks. Specifically, the clustering technology is used to first obtain the approximate distribution characteristics of the data, and then divide the data into n Then, the distribution of each type of data is counted, where n In the data of k The amount of class data is N k , the mean is λ k , standard deviation is β k , weight is μ k , the calculation formula is shown in formula (2)-formula (4):

[0077] (2),

[0078] (3),

[0079] (4),

[0080] In the formula, For users' electricity consumption data, For the k In the data of j The electricity consumption data of users with data points, For the k In the data of j The number of data points, For the i A dataset of users.

[0081] According to the distribution of data, the weight of each layer parameter in the model is w ( i ) and the offset b ( i ) are added with noise. Based on the distribution of each type of data, the Laplace mechanism is used to generate noise, and then the weighted average method is used to add noise to the model parameters. The calculation formula is shown in formula (5)-formula (6):

[0082] (5),

[0083] (6),

[0084] in, Indicates the model i The parameter weights of the layer, is the first i The parameter weights of the layer, For expectations, Indicates j The weight of the class data, is the scale parameter of differential privacy, For the i The bias of the layer adds the result of differential privacy, For the model i The offset of the layer.

[0085] Step 4: The data owner constructs an access control policy and encrypts the data based on the access control policy to obtain the data ciphertext;

[0086] In the CP-ABE encryption process, the data owner uses the public parameters provided by the key management center. K , based on sharing requirements, build access control strategies composed of user attributes and logical words . Then, using the access control policy The parameters are used to perform encryption operations and generate encrypted data ciphertext , and upload it to the storage server. At the same time, the access policy Stored in the blockchain network.

[0087] Step 5: The data owner evaluates whether the data accessor has access rights based on the condition set;

[0088] The cross-domain authorization process includes two steps: permission filtering and permission granting.

[0089] In this process, domain B acts as the delegating party and grants access rights to domain A users:

[0090] First, a comprehensive evaluation is performed based on the condition set C={Data, Times, Path, L_truth} to ensure that the user request not only satisfies the legitimate access rights but also avoids potential permission conflicts.

[0091] Subsequently, the qualified request enters the permission granting stage. In this stage, the corresponding permission database is accessed through the addressing address generated by the ID query based on domain B, and the obtained permission information is fed back to the domain A user as a result. The specific process is as follows: Figure 4 shown.

[0092] Implement cross-domain access control policies to ensure that only authorized users can access data through the Policy Enforcement Point Contract (PEP), Attribute Authority (AA), Policy Decision Point Contract (PDP), and Policy Administration Point Contract (PAP) components.

[0093] In permission management, ensuring the consistency of cross-domain access control policies, role definitions, and permission rules is the core, so data isolation measures must be implemented to protect the security of cross-domain data sharing and access. At the same time, corresponding protection strategies should be customized and implemented based on data characteristics to maintain the confidentiality and compliance of personal privacy and sensitive electricity information.

[0094] like Figure 4 As shown in the figure, the cross-domain access control part of the system covers the key components of Policy Enforcement Point (PEP), Attribute Authority (AA), Policy Decision Point (PDP) and Policy Administration Point (PAP), which together support an efficient and secure cross-domain access control mechanism.

[0095] When a user node initiates an access request, the core function of the cross-domain node is to store the request and generate a raw access request (NAR) for subsequent processing by the PEP. As an intermediary for information transmission, the PEP is responsible for forwarding the request to the AA to collect attribute information related to the user. After obtaining this information, the PEP constructs an attribute-based access request (AAR) and submits it to the PDP contract for policy evaluation.

[0096] In addition, PEP also requests policy information from PAP, and PDP makes a decision on whether to grant access rights based on this comprehensive information, and promptly feeds back the decision result to the requester.

[0097] AAR is a four-tuple consisting of subject attribute (S), environment attribute (E), time attribute (T) and level attribute (L).<S,E,T,L> , where E = <physical location (PL), network location (NL)>, T specifies the time limit, A security level relationship between the subject and the object is established. AAR combines subject attributes, environmental attributes, time attributes and level attributes to provide a flexible representation method for access requests. Legal authorization requires that the subject is legal, the request time is appropriate, the environment is compliant, and the subject's access level is at least the level required by the object, so as to ensure the effectiveness of permission control and the subject meets security requirements and compliance standards. Access will be granted.

[0098] like Figure 5 As shown in the figure, the Policy Execution Point Smart Contract (PEP_SC) receives and processes the NAR from the delegate of Domain A, and interacts with AA to obtain attribute information. Subsequently, PEP_SC submits an AAR to the Policy Decision Point Smart Contract (PDP_SC). PDP_SC conducts a comprehensive evaluation of the AAR after combining the policy information provided by the Policy Management Point Contract (PAP_SC), and makes corresponding authorization decisions accordingly. During the authorization process, in order to ensure data security and avoid permission conflicts, PEP_SC will initially filter the resource information of Domain A and the authorization information of the users of Domain B through the Permission Filter Smart Contract (Permission_Filter_SC). After that, the Permission Delegated Smart Contract (Permission_Delegated_SC) will be responsible for processing the permission delegation request and feeding back the authorization result to PEP_SC. Finally, the users of Domain A obtain the corresponding access rights based on the permission information fed back by PEP_SC.

[0099] Permission filtering realizes the transmission process of filtering permissions by comprehensively evaluating four parameters: Data (valid time range), Times (number of transmissions), Path (transmission path), and L_truth (trust evaluation index). This process not only comprehensively considers the legitimacy of the client and the regulatory requirements of the access control matrix, but also sets strict trust evaluation standards to ensure that only when the subject meets the conditions can the corresponding permissions be obtained. In addition, the algorithm also integrates identity decryption and permission merging, thereby improving the effectiveness and flexibility of permission management and achieving precise matching and dynamic adjustment of permission control.

[0100] In this embodiment, on the basis of ensuring data security and cross-domain collaboration, the smart contract monitors the status of the digital certificate, verifies the integrity of the certificate through the X.509 format, records the validity period, triggers an early warning when it expires, and ensures that the certificate is updated.

[0101] Smart contracts are used to monitor the abnormal status of digital certificates. Digital certificates follow the X.509 standard format. First, the core content C of the certificate is extracted. After that, the content C is processed using the hash algorithm embedded in the certificate to obtain the summary H. In addition, the summary signature is extracted from the certificate, and the signature is decrypted using the public key provided by the root certificate to obtain the summary H'. By comparing the summary H with H', the integrity and credibility of the digital certificate are verified. If the certificate is complete and has not been tampered with, the system will record its validity period information to the blockchain ledger when the certificate is first added to the blockchain. Once the certificate expires, the system will mark the user status as expired, and trigger a certificate abnormality warning when the user performs an operation, prompting the user to update their digital certificate to maintain a valid status.

[0102] In this embodiment, the authority management module adopts two models: system level and interface level to achieve separate supervision of the contract calls and smart contract interface access rights of the roles in the power network blockchain.

[0103] The system-level model is responsible for preventing roles from exceeding their authority, and the interface-level model is responsible for refining the permission control of operations such as information configuration and transactions. This module not only supports users to query electricity consumption information and purchase electricity resources, but also performs access control through the anomaly detection module, allowing multiple accounts to be mapped to a single role, ensuring that behaviors are traceable and activities on the blockchain are controllable. In addition, the power company's dispatching and billing module is responsible for measuring and managing electricity costs. After the billing cycle ends, it summarizes user electricity consumption data and provides real-time feedback to users to encourage them to optimize their electricity consumption patterns and thus improve cost-effectiveness.

[0104] Dynamic pricing at different times can be expressed as , , ..., , the billing center can calculate the electricity cost according to the following formula ,in,

[0105] = + +...+ ,

[0106] In the formula , , ..., Represents the electricity consumption data in different time slots recorded in the blockchain. Blockchain technology ensures the integrity of the data, which is conducive to accurate billing of electricity costs that is transparent and fair.

[0107] Step 6: Determine whether the attribute set of the data access requester complies with the access policy. If so, the data owner generates a decryption key and transmits it to the data access requester.

[0108] When any Attribute-Based Encryption (ABE) decryption request does not meet the established specifications, blockchain technology will be used as an audit tool to effectively intercept and block such requests;

[0109] Data access requesters based on access policies , submit its attribute credential set S . The attribute authority then uses the master key MK Generate the corresponding decryption key SK , and SK Securely transmitted to the requester to authorize the decryption of encrypted data.

[0110] During data access, when the attribute set submitted by the requester satisfies the established access control policy The encrypted data can be authorized to be decrypted. The data access requester then uses the obtained decryption key to execute the corresponding decryption algorithm on the encrypted data. To obtain the plaintext data. After decryption is completed, the user verifies the integrity of the data by comparing the calculation result (data summary) with the original summary record on the blockchain. If the two are consistent, it confirms that the data remains intact during transmission and storage without any form of tampering; if they are inconsistent, the exception handling mechanism is triggered, including further verification steps, sending alerts to system administrators, and recording detailed log information.

[0111] Step 7: The data access requester uses the decryption key to decrypt the data and obtain the plaintext data;

[0112] The data owner uses the public parameters provided by the key management center to build an access control policy and encrypt the data.

[0113] Experimental verification

[0114] The REDD dataset (Reference Energy Disaggregation DataSet) and the UK-DALE dataset (UK Domestic Appliance-Level Electricity) are used to conduct an in-depth analysis of household electricity consumption. The dataset contains electricity usage information of multiple households over a certain period of time, including high-frequency current / voltage waveform data, low-frequency power data, electricity usage time, and electricity consumption, providing a solid data foundation for in-depth research on electricity usage behavior patterns and differential privacy technology.

[0115] By comparing and analyzing the performance of non-differential privacy, traditional differential privacy and improved differential privacy algorithms in user electricity consumption behavior analysis, the experimental results show that the improved differential privacy algorithm has significant advantages in protecting electricity consumption data and maintaining data classification accuracy.

[0116] Experimental results analysis:

[0117] During the data transmission process, the parameter model may be at risk of being attacked. The generative adversarial network can use the parameter model to reconstruct user data, posing a serious threat to user privacy and security.

[0118] Therefore, this paper proposes an improved differential privacy algorithm, which enhances the data protection capability by implementing effective perturbation processing on its parameters before model transmission. In order to systematically evaluate the effectiveness of the improved algorithm in resisting generative adversarial network attacks and verify its superiority in maintaining model classification capabilities, this experiment was designed and implemented.

[0119] Under the premise of assuming that no malicious nodes intervene in the training process, this experiment simulates the attack launched by the attacker on the model using the generative adversarial network (GANs), aiming to evaluate the model's defense ability against such attacks after the introduction of the improved differential privacy algorithm. Specifically, the attacker attempts to reconstruct the user's electricity consumption data through GANs to verify the effectiveness of the improved differential privacy algorithm. By comparing and analyzing the classification results of the model before and after the introduction of the differential privacy algorithm with the real data, this experiment deeply explores the specific impact of the differential privacy algorithm on the classification performance of the model. The experimental results are shown in the figure. Figure 6 and Figure 7 shown. Figure 6 The comparison between real data and GANs generated data when the differential privacy algorithm is not applied is shown. It can be seen that the data generated by GANs and real data have certain similarities in the range of data values ​​and time series relationship. Figure 7 It shows that after applying the improved differential privacy algorithm, the generated data has significant differences in value range and time relationship from the actual data. In summary, the experiment of the present invention shows that the introduction of differential privacy algorithm can significantly enhance the model's defense ability against GANs reconstruction of user electricity consumption data.

[0120] For the analysis of user electricity consumption behavior, this experiment compares and analyzes the performance of non-differential privacy, traditional differential privacy, and improved differential privacy algorithms. Figure 8 As shown in the figure. The horizontal axis represents the number of the edge computing node, and the vertical axis represents the classification accuracy of the model on the test set of the edge node. Figure 8 It can be seen that compared with the traditional differential privacy algorithm, the improved differential privacy algorithm proposed in this invention shows significant advantages in maintaining the accuracy of model classification, and its impact on the model classification ability is much smaller than the former. At the same time, in terms of resisting attacks launched by generative adversarial networks, the improved differential privacy algorithm also shows good protection effects compared with the non-differential privacy algorithm, and has less impact on the model classification ability.

[0121] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A blockchain-based power data security access control method, characterized in that: The steps include: Receiving an access request from a data access requester, the data owner verifies the identity of the data access requester; When the data access requester passes the identity authentication, the electricity consumption data is bound to the data owner; When binding electricity consumption data to data owners, multiple anonymous identities are created by users. Bind its power consumption data Specifically, in each time slot, the user randomly divides the power consumption data, and merges the divided data with the anonymous identifier to obtain the information to be published and publishes it in the group to which it belongs. The information to be published includes the power consumption data. , anonymous identification and , Indicates power data , Timestamp t and anonymous identification Combined in order to form a unified record, and the information to be published is transmitted through the user's private key Encryption is performed; The data owner determines the mining node based on the electricity consumption data, processes the electricity consumption data based on the determined mining node and uploads it to the blockchain; during the data transmission process, differential privacy technology is integrated in the smart contract layer, and noise is generated based on the distribution of each type of data using the Laplace mechanism. Then, noise is added to the parameter weights and biases of each layer in the noise generation model by weighted averaging, including: The data distribution characteristics are obtained through clustering technology, and the data is divided into n Class, statistics the distribution of each class of data, where n In the data of k The amount of class data is N k , the mean is λ k , the standard deviation is β k , the weight is μ k , the calculation formula is: ， ， ， In the formula, For users' electricity consumption data, For the k In the data of j The electricity consumption data of users with data points, For the k In the data of j The number of data points, For the i Datasets for each user; According to the distribution of data, the weight of each layer parameter in the model is and offset Noise is added to all the parameters. Based on the distribution of each type of data, the Laplace mechanism is used to generate noise, and then the weighted average method is used to add noise to the model parameters. The calculation formula is: ， ， in, Indicates the model i The parameter weights of the layer, is the first i The parameter weights of the layer, For expectations, Indicates j The weight of the class data, is the scale parameter of differential privacy, For the i The bias of the layer adds the result of differential privacy, For the model i The layer offset, for noise; The data owner constructs an access control policy and encrypts the data based on the access control policy to obtain the data ciphertext; determines whether the attribute set of the data access requester complies with the access policy. If so, the data owner generates a decryption key and transmits it to the data access requester; the data access requester uses the decryption key to decrypt the data to obtain the plaintext data.

2. A blockchain-based power data security access control method as claimed in claim 1, characterized in that: When the data owner verifies the identity of the data access requester, the data owner's key management center generates a pair of public and private keys for each registered user, and builds a Bloom filter for each user group to verify the user's identity through the Bloom filter.

3. A blockchain-based power data security access control method as claimed in claim 1, characterized in that: The process of determining the mining node includes selecting the mining node based on the average power consumption value, wherein the mining node is selected by summing up all the collected power consumption data and then evenly distributing the sum to each user.

4. A blockchain-based power data security access control method as claimed in claim 1, characterized in that: The data owner constructs an access control policy, which includes the data owner using the public parameters provided by the key management center. K , based on sharing requirements, build access control strategies consisting of user attributes and logical words .

5. The method for secure access control of electric power data based on blockchain according to claim 1, characterized in that: Before determining whether the attribute set of the data access requester complies with the access policy, the data owner also evaluates whether the data accessor has access rights based on the condition set, including: When a data access requester initiates an access request, the policy execution point smart contract forwards the access request to the attribute authority. After the attribute authority smart contract collects the attribute information related to the data access requester, the policy execution point smart contract constructs an attribute-based access request and submits the attribute-based access request to the policy decision point smart contract. The policy decision point smart contract makes a decision on whether to grant access rights based on the comprehensive information and feeds back the decision result to the data access requester.

6. A blockchain-based power data security access control method as claimed in claim 1, characterized in that: Based on the selected mining node, the electricity consumption data is hashed through the Merkle tree structure. The processing results are the root hash value, timestamp, hash value of the previous block, anonymous identifier and average electricity consumption value. The processing results are integrated and recorded in the block header of the new block.

7. The method for secure access control of electric power data based on blockchain according to claim 1, characterized in that: The attribute-based access request constructed is a four-tuple AAR consisting of subject attribute, environment attribute, time attribute and level attribute.<S,E,T,L> , where S is the subject attribute, E = <physical location, network location>, and T specifies the time limit. A security level relationship between the subject and the object is established.

8. The method for secure access control of electric power data based on blockchain according to claim 1, characterized in that: The method further includes monitoring the status of the digital certificate by the smart contract, the digital certificate follows the X.509 standard format, extracting the core content of the certificate, and processing the core content using a hash algorithm embedded in the certificate to obtain a first summary; Extract the digest signature from the certificate and decrypt the signature using the public key provided by the root certificate to obtain a second digest; Compare the first summary and the second summary. If they are consistent, the validity period of the certificate is recorded in the blockchain ledger when the certificate is first added to the blockchain. If they are inconsistent, the certificate is marked as expired.

9. A blockchain-based power data security access control system, characterized in that: The method according to any one of claims 1 to 8, comprising a data access requester, a data owner and a blockchain; The data owner is configured to: receive an access request from a data access requester and verify the identity of the data access requester; When the data access requester passes the identity authentication, the electricity consumption data is bound to the data owner; The data owner determines the mining node based on the electricity consumption data, processes the electricity consumption data based on the determined mining node, and uploads it to the blockchain; During data transmission, differential privacy technology is integrated in the smart contract layer. Based on the distribution of each type of data, noise is generated using the Laplace mechanism. Then, noise is added to the parameter weights and biases of each layer in the noise generation model by weighted averaging. The data owner constructs an access control policy and encrypts the data based on the access control policy to obtain the data ciphertext. It determines whether the attribute set of the data access requester complies with the access policy. If so, the data owner generates a decryption key and transmits it to the data access requester. The data access requester is configured to: decrypt the data using the decryption key to obtain the plaintext data.

Images