A computing power screening method for access control in industrial cloud environments

Abstract

The present invention discloses a computing power screening method for access control in an industrial cloud environment, which relates to the field of industrial Internet security. The method comprises: a computing power screening module completes an initialization operation according to a system setting; the computing power screening module receives a computing power screening request including computing power parameters initiated by an initiator AS of the access request, generates a puzzle PuzzleAO according to the parameters, and responds to the AS; a time limit for receiving an answer to a response from the AS is set according to parameters PGTimeNow and STimeNow of the entity PuzzleAO to which the problem is accessed and accessed; the computing power screening module verifies the timeliness and integrity of PuzzleAS and responds to the AS with a verification result CheckResultPuzzle. The computing power screening method mentioned in the present invention is flexible and safe, so that the industrial cloud can effectively and quickly respond to the access request of the access subject, and effectively filter out access problems of low computing power and low sincerity access subjects.

Description

Technical Field

[0001] The present invention relates to the field of industrial Internet security, and in particular to a computing power screening method for access control in an industrial cloud environment. Background Art

[0002] With the rapid development of emerging information science and technologies such as mobile Internet, Internet of Things, cloud computing and big data, the existing industrial development model is gradually changing from the traditional manual management and operation model to an intelligent industrial manufacturing model that integrates innovative development with emerging information science and technologies.

[0003] At present, the industrial Internet model combined with cloud computing technology is the key development and research target and field of the industry and academia, and the industrial Internet cloud service model based on "cloud integration" is the hottest topic in current research and development. Compared with the traditional industrial Internet cloud service model based on "cloud separation", the industrial Internet cloud service model based on "cloud integration" can not only ensure the real-time and accuracy of the industrial manufacturing decision-making and control process, but also can perceive the characteristics and status of the production entities in the industrial manufacturing process vertically and horizontally, so that resource users can transparently and efficiently use the computing resources, network resources, storage resources, user resources and data resources of the industrial cloud and terminals, and realize a more flexible, networked and intelligent industrial manufacturing process.

[0004] As one of the key technologies in the field of information security, access control technology has undergone decades of research and development. Its emergence enables resources and services in complex network environments such as industrial clouds to be used by legitimate entities, and ensures that only legitimate authorized entities can access the environment. Traditional access control methods include the discretionary access control model (DAC) and the mandatory access control model (MAC), the role-based access control model (RBAC), the attribute-based access control model (ABAC), and the usage access control model (UCON).

[0005] The computing power screening method for access control in industrial cloud environments faces the challenges of multi-tenant environments, dynamic changes in computing power resources, and complex business scenarios and access requirements. Most of the current access control methods used in industrial cloud environments cannot dynamically, flexibly, reliably, and continuously control the access of access subjects, and cannot effectively filter the access of low-computing power and low-sincerity access subjects.

[0006] Therefore, there is an urgent need for a computing power screening method for access control in industrial cloud environments to solve the above problems. Summary of the invention

[0007] To solve the above problems, the present application provides a computing power screening method for access control in an industrial cloud environment, comprising the following steps:

[0008] S1. The computing power screening module completes the initialization operation according to the system settings;

[0009] S2. The computing power screening module receives the computing power screening request including computing power parameters initiated by the initiator AS of the access request, generates a puzzle PuzzleAO according to the parameters, and responds to the AS;

[0010] S3. Set the time limit for receiving the AS response and answer according to the parameters PGTimeNow and STimeNow of the entity PuzzleAO that is accessed and the question is connected;

[0011] If AS responds to the computing power screening module with the answer PuzzleAS within the response time limit, jump to S4;

[0012] If the AS does not respond to the computing power screening module with the answer PuzzleAS within the response time limit, and the response time limit has not expired, continue to wait for the AS response;

[0013] Otherwise, respond to the AS to terminate the reception of the answer;

[0014] S4. The computing power screening module verifies the timeliness and integrity of PuzzleAS and responds to the AS with the verification result CheckResultPuzzle.

[0015] Preferably, the parameters of the puzzle PuzzleAO generated according to the parameters in S2 include parameters IPAS and MACAS;

[0016] The process of generating the parameters of PuzzleAO according to the parameters involves the computing power screening algorithm AAFS-CP;

[0017] Among them, the computing power screening algorithm AAFS-CP includes initialization method, problem generation method, problem solving method and solution answer verification method.

[0018] Preferably, the specific contents of the initialization method include:

[0019] according to Initialize five sets: private key set PrKCpC, puzzle difficulty set PuzDC, string set StringC, puzzle set PuzC and answer set AnsC;

[0020] Select the difficulty coefficient d and private key PrK from PuzDC and PrKCpC respectively;

[0021] Set the target time TtimeMAX for AS to solve the problem according to d;

[0022] Generate an algorithm using the parameter UsePa and return it to complete the initialization;

[0023] Among them, UsePa Used to describe AAFS-CP and the scope of application of AAFS-CP.

[0024] Preferably, the specific steps of the problem generation method are as follows:

[0025] Select a string str from StringC in UsePa, concatenate str, the system timestamp StartTime at this moment, and the IP address value IPAS and MAC address value MACAS that uniquely identify AS, and perform hash operation to obtain a new string IMStr;

[0026] According to IMStr and str, d, TtimeMAX, StartTime, PrK and Generates the puzzle Puzzle and returns it.

[0027] Preferably, the specific steps of the problem solving method are as follows:

[0028] AS looks for a bit string Ans, which is concatenated with the bit string IMStr in the puzzle to obtain a bit string str2, which satisfies the first d bits of the bit string to be 0 after the hash operation.

[0029] If AS successfully finds Ans, it returns the IP address value IPAS and MAC address value MACAS of AS, Ans and Puzzle together.

[0030] Preferably, the specific steps of the answer verification method are as follows:

[0031] verify The question of whether it is a real generation;

[0032] If it is true, start verifying the validity of the answer Ans, otherwise return false;

[0033] If Ans is invalid, it returns false, otherwise it returns true.

[0034] Preferably, the computing power screening algorithm AAFS-CP is provided with constraints, and the constraints include:

[0035] The valid computing power test answer accepted by AAFS-CP is the one that AS solves within the target time;

[0036] The time and computing power cost of AAFS-CP when constructing and verifying puzzles is set with a target threshold. If the time and computing power spent by AAFS-CP when constructing and verifying puzzles exceeds the target threshold, the efficiency of the Client Puzzle computing power screening module in generating puzzles and verifying the answers obtained by AS when solving puzzles will be reduced, which will lead to the collapse of the entire access control process. If the time and computing power spent by AAFS-CP when constructing and verifying puzzles does not exceed the target threshold, the efficiency of the Client Puzzle computing power screening module in generating puzzles and verifying the answers obtained by AS when solving puzzles will be normal, and the entire access control process will run normally.

[0037] The difficult questions are solved only by the AS’s computing power;

[0038] AAFS-CP adjusts the difficulty of generated questions according to the current situation;

[0039] AS cannot predict the answers to difficult questions;

[0040] AAFS-CP can verify the answers to the puzzles solved by AS without storing relevant information of the puzzles;

[0041] A puzzle generated by AAFS-CP uniquely identifies an AS.

[0042] Preferably, the computing power screening module involves a computing power screening execution contract ASEC(), a puzzle generation contract PuzzleGenc() and a solution verification contract PAnswerVC();

[0043] Among them, the computing power screening execution contract ASEC () is the interface for AS to interact with the blockchain network. ASEC () provides computing power screening services for AS that accesses AO for the first time, so that AS can obtain the qualifications to initiate the initial access request through the computing power screening results obtained by the service;

[0044] The puzzle generation contract PuzzleGenC () is the core of the puzzle generation function in the computing power screening module. It is also the implementation of the puzzle generation method A PuzzleGen () of AAFS-CP. PuzzleGenC () generates the puzzle PuzzleAO with the unique identifier AS according to the parameters IPAS and MACAS input by ASEC ();

[0045] The solution verification contract PAnswerVC() is the core of the function of verifying the solution result obtained by AS when solving the puzzle in the computing power screening module. It is the implementation of the solution verification method PAnswerV() of AAFS-CP. PAnswerVC() verifies the timeliness and completeness of the solution PuzzleAS obtained by AS when solving the puzzle input by ASEC(), and then responds the verification result to AS.

[0046] To summarize, the computing power screening method for access control in an industrial cloud environment of the present invention, compared with traditional technologies, provides a computing power screening algorithm based on Client Puzzle - AAFS-CP, and constrains AAFS-CP to solve the problems that most of the current access control methods applied in industrial cloud environments cannot dynamically, flexibly, reliably and continuously control the access of access subjects, and cannot well filter the access of low computing power and low sincerity access subjects, so that the industrial cloud can effectively and quickly respond to the access requests of access subjects.

[0047] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A flowchart of a computing power screening method for access control in an industrial cloud environment according to the present invention;

[0049] Figure 2 This is an operational framework diagram of a computing power screening method for access control in an industrial cloud environment according to the present invention. DETAILED DESCRIPTION

[0050] The technical solution of the present invention is further described below by means of the accompanying drawings and embodiments. It should be noted that unless otherwise specifically stated, the relative arrangement of components and steps, numerical expressions and numerical values ​​described in these embodiments do not limit the scope of the present application.

[0051] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present application, its application, or uses.

[0052] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered part of the specification.

[0053] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0054] Unless otherwise defined, technical or scientific terms used in the present invention shall have the common meanings understood by one having ordinary skills in the field to which the present invention belongs.

[0055] like Figure 1 and Figure 2 As shown, the present invention provides a computing power screening method for access control in an industrial cloud environment, which is specifically as follows: S1, the computing power screening module completes the initialization operation according to the system setting;

[0056] S2. The computing power screening module receives the computing power screening request including computing power parameters initiated by the initiator AS of the access request, generates a puzzle PuzzleAO according to the parameters, and responds to the AS;

[0057] S3. Set the time limit for receiving the AS response and answer according to the parameters PGTimeNow and STimeNow of the entity PuzzleAO that is accessed and the question is connected;

[0058] If AS responds to the computing power screening module with the answer PuzzleAS within the response time limit, jump to S4;

[0059] If the AS does not respond to the computing power screening module with the answer PuzzleAS within the response time limit, and the response time limit has not expired, continue to wait for the AS response;

[0060] Otherwise, respond to the AS to terminate the reception of the answer;

[0061] S4. The computing power screening module verifies the timeliness and integrity of PuzzleAS and responds to the AS with the verification result CheckResultPuzzle.

[0062] Further, the parameters of PuzzleAO generated according to the parameters include parameters IPAS and MACAS;

[0063] The process of generating the parameters of PuzzleAO according to the parameters involves the computing power screening algorithm AAFS-CP;

[0064] Furthermore, the computing power screening algorithm AAFS-CP is provided with constraints, which include:

[0065] The valid computing power test answer accepted by AAFS-CP is the one that AS solves within the target time;

[0066] The time and computing power cost of AAFS-CP when constructing and verifying puzzles is set with a target threshold. If the time and computing power spent by AAFS-CP when constructing and verifying puzzles exceeds the target threshold, the efficiency of the Client Puzzle computing power screening module in generating puzzles and verifying the answers obtained by AS when solving puzzles will be reduced, which will lead to the collapse of the entire access control process. If the time and computing power spent by AAFS-CP when constructing and verifying puzzles does not exceed the target threshold, the efficiency of the Client Puzzle computing power screening module in generating puzzles and verifying the answers obtained by AS when solving puzzles will be normal, and the entire access control process will run normally.

[0067] The difficult questions are solved only by the AS’s computing power;

[0068] AAFS-CP adjusts the difficulty of generated questions according to the current situation;

[0069] AS cannot predict the answers to difficult questions;

[0070] AAFS-CP can verify the answers to the puzzles solved by AS without storing relevant information of the puzzles;

[0071] A puzzle generated by AAFS-CP uniquely identifies an AS.

[0072] Based on the above six constraints, AAFS-CP is defined as follows:

[0073] Assume that AAFS-CP consists of a six-tuple (ACPSetup (), APuzzleGen (), APuzzleSolve (), APAnswerV ()), where is a one-way hash function and a signature verification function. The computing power screening algorithm AAFS-CP includes an initialization method, a problem generation method, a problem solving method, and a solution answer verification method.

[0074] Furthermore, the specific contents of the initialization method include:

[0075] according to Initialize the five sets of private key set PrKCpC, puzzle difficulty set PuzDC, string set StringC, puzzle set PuzC and answer set AnsC, namely PrKCpC 、PuzDC StringC ,PuzC and AnsC ;

[0076] Select the difficulty coefficient d and private key PrK from PuzDC and PrKCpC respectively;

[0077] According to d, the target time TtimeMAX for AS to solve the problem is set, that is, TtimeMAX MaxTolTime (d);

[0078] Generate the algorithm using the parameter UsePa and return it to complete the initialization, that is, UsePa = (StringC, PrKCpC,PuzC, AnsC, d, TtimeMAX, PrK, ), return UsePa. ;

[0079] Among them, UsePa Used to describe AAFS-CP and the scope of application of AAFS-CP.

[0080] Furthermore, the specific steps of the problem generation method are as follows:

[0081] Select a string str from StringC in UsePa, concatenate str, the system timestamp StartTime at this moment, and the IP address value IPAS and MAC address value MACAS that uniquely identify AS, and perform hash operation to obtain a new string IMStr, that is, str StringC,IMStr Hash (IPAS || MACAS || str || StartTime);

[0082] According to IMStr and str, d, TtimeMAX, StartTime, PrK and Generates a puzzle Puzzle and returns it, i.e. Puzzle PuzzleGen (IMStr, str, d, StartTime, TtimeMAX, ), returnPuzzle, where =SiV (PrK, Hash (IMStr, TtimeMAX, d)).

[0083] Further, the specific steps of the problem solving method are as follows:

[0084] AS looks for a bit string Ans, which is concatenated with the bit string IMStr in the puzzle to obtain a bit string str2, which satisfies the first d bits of the bit string to be 0 after the hash operation.

[0085] If AS successfully finds Ans, it returns the IP address value IPAS and MAC address value MACAS of AS, Ans and Puzzle together, that is, str1 , while{Ans , , if str1 == then return (IPAS, MACAS, Ans, Puzzle)}.

[0086] Further, the specific steps of the answer verification method are as follows:

[0087] verify The question of whether it is a real generation;

[0088] If it is true, start verifying the validity of the answer Ans, otherwise return false;

[0089] If Ans is invalid, it returns false, otherwise it returns true, which is str3 , ,if (Hash ( || || || )== )&&SiV(PrK, Hash ( , , ) == )&&str3 == then return true, else return false.

[0090] AAFS-CP is an algorithm that requires AS to solve a partial hash collision problem. Since the ideal hash function is one-way and AS cannot infer the numerical information before hashing through the hash value, AS can only use exhaustive method to find the hash value that meets the access conditions, that is, solving the puzzle generated by AAFS-CP requires AS to have a certain computing power. In addition, since AO needs to dynamically adjust the difficulty of the puzzle it generates through the Client Puzzle computing power screening module to screen AS that meets the computing power conditions, AAFS-CP not only needs to meet the conditions that AS spends computing resources to solve the puzzle, and the Client Puzzle computing power screening module can easily verify the answer to the puzzle solved by AS, but also needs to meet the conditions that the difficulty of the puzzle can be adjusted according to local conditions to screen AS that meets the computing power conditions.

[0091] Furthermore, the computing power screening module involves the computing power screening execution contract ASEC(), the puzzle generation contract PuzzleGenc() and the solution verification contract PAnswerVC();

[0092] Among them, the computing power screening execution contract ASEC () is the interface for AS to interact with the blockchain network. ASEC () provides computing power screening services for AS that accesses AO for the first time, so that AS can obtain the qualifications to initiate the initial access request through the computing power screening results obtained by the service;

[0093] The algorithm details of the contract ASEC() are as follows:

[0094] enter: IP AS , MAC AS , REI AS / / AS except IP AS and MAC AS Other subject information besides

[0095] Output: CheckResult Puzzle or false;

[0096] Puzzle AO PuzzleGenC ( IP AS , MAC AS );

[0097] AS Respond Puzzle ( Puzzle AO );

[0098] while ( STime Now - PGTime Now STime Now ) and then / / STime Now is the current system time;

[0099] if (( AO ( Respond Answer ( , , Puzzle AS , Ans AS )) == false) andthen;

[0100] Continue;

[0101] endif

[0102] CheckResult Puzzle PAnswerVC ( , , Puzzle AS , Ans AS , REI AS );

[0103] return CheckResult Puzzle ;

[0104] endwhile

[0105] return false;

[0106] The puzzle generation contract PuzzleGenC () is the core of the puzzle generation function in the computing power screening module. It is also the implementation of the puzzle generation method A PuzzleGen () of AAFS-CP. PuzzleGenC () generates the puzzle PuzzleAO with the unique identifier AS according to the parameters IPAS and MACAS input by ASEC ();

[0107] The algorithm details of the contract PuzzleGenC() are as follows:

[0108] enter: IP AS, MAC AS

[0109] Output: Puzzle AO

[0110] str ; Puzzle AO NULL;

[0111] Get the system time when the puzzle was generated PGTime Now ;

[0112] IMStr Hash ( IP AS || MAC AS || str || PGTime Now );

[0113] SiV ( PrK AO , Hash ( IMStr , Ttime MAX , d ));

[0114] Puzzle AO PuzzleGen ( IMStr , str , d , PGTime Now , Ttime MAX , );

[0115] return Puzzle AO ;

[0116] The solution verification contract PAnswerVC() is the core of the function of verifying the solution result obtained by AS when solving the puzzle in the computing power screening module. It is the implementation of the solution verification method PAnswerV() of AAFS-CP. PAnswerVC() verifies the timeliness and completeness of the solution PuzzleAS obtained by AS when solving the puzzle input by ASEC(), and then responds the verification result to AS.

[0117] The algorithm details of the contract PAnswerVC() are as follows:

[0118] enter: , , Puzzle AS , Ans AS , REI AS

[0119] Output: CheckResultPuzzle or false

[0120] Hash ( || || Puzzle AS .str || Puzzle AS .PGTime Now );

[0121] SiV ( PrK AO , Hash ( , Puzzle AS .Ttime MAX , Puzzle AS .d ));

[0122] if ( Puzzle AS . != ) and then

[0123] return false;

[0124] endif

[0125] CheckResult Puzzle , str 3, str 4 NULL;

[0126] str 3 ; str 4 Hash ( || Ans AS );

[0127] if ( str 3 != str 4. left ( Puzzle AS .d )) and then

[0128] return false;

[0129] endif

[0130] CheckCode Puzzle Random CheckCode ();

[0131] Generate checksum timestamp Timestamp CC ;

[0132] SivCode Puzzle SiV ( PrK AO , Hash ( , , REI AS , CheckCode Puzzle ));

[0133] CheckResult Puzzle { CheckCode Puzzle , SivCode Puzzle , Timestamp CC}.

[0134] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.

Claims

1. A computing power screening method for access control in an industrial cloud environment, characterized in that: The following steps are involved: S1. The computing power screening module completes the initialization operation according to the system settings; S2. The computing power screening module receives the computing power screening request including computing power parameters initiated by the initiator AS of the access request, generates a puzzle PuzzleAO according to the parameters, and responds to the AS; S3. According to the parameters of the entity PuzzleAO to which the question is connected and accessed, the PGTimeNow parameter and the STimeNow parameter are used to set the time limit for receiving the AS response and answer. The PGTimeNow parameter is the system time parameter at the moment when the puzzle Puzzle is generated, and the STimeNow parameter indicates the current system time parameter. If AS responds to the computing power screening module with the answer PuzzleAS within the response time limit, jump to S4; If the AS does not respond to the computing power screening module with the answer PuzzleAS within the response time limit, and the response time limit has not expired, continue to wait for the AS response; Otherwise, respond to the AS to terminate the reception of the answer; S4. The computing power screening module verifies the timeliness and integrity of PuzzleAS and responds to the AS with the verification result CheckResultPuzzle; The parameters of PuzzleAO generated according to the parameters in S2 include parameters IPAS and MACAS; The process of generating the parameters of PuzzleAO according to the parameters involves the computing power screening algorithm AAFS-CP; Among them, the computing power screening algorithm AAFS-CP includes an initialization method, a problem generation method, a problem solving method, and a solution answer verification method; The specific contents of the initialization method include: according to Initialize five sets: private key set PrKCpC, puzzle difficulty set PuzDC, string set StringC, puzzle set PuzC and answer set AnsC; Select the difficulty coefficient d and private key PrK from PuzDC and PrKCpC respectively; Set the target time TtimeMAX for AS to solve the problem according to d; Generate an algorithm using the parameter UsePa and return it to complete the initialization; Among them, UsePa Used to describe AAFS-CP and the scope of application of AAFS-CP; The specific steps of the problem generation method are as follows: Select a string str from StringC in UsePa, concatenate str, the system timestamp StartTime at this moment, and the IP address value IPAS and MAC address value MACAS that uniquely identify AS, and perform hash operation to obtain a new string IMStr; According to IMStr and str, d, TtimeMAX, StartTime, PrK and Generate a puzzle Puzzle and return it; The specific steps of the problem solving method are as follows: AS looks for a bit string Ans, which is concatenated with the bit string IMStr in the puzzle to obtain a bit string str2, which satisfies the first d bits of the bit string to be 0 after the hash operation. If AS successfully finds Ans, it returns the IP address value IPAS and MAC address value MACAS of AS, Ans and Puzzle together; The computing power screening algorithm AAFS-CP is set with constraints.

2. According to claim 1, a computing power screening method for access control in an industrial cloud environment is characterized in that: The specific steps of the answer verification method are as follows: verify The question of whether it is a real generation; If it is true, start verifying the validity of the answer Ans, otherwise return false; If Ans is invalid, it returns false, otherwise it returns true.

3. According to claim 1, a computing power screening method for access control in an industrial cloud environment is characterized in that: The constraints include: The valid computing power test answer accepted by AAFS-CP is the one that AS solves within the target time; The time and computing power cost of AAFS-CP when constructing and verifying puzzles is set with a target threshold. If the time and computing power spent by AAFS-CP when constructing and verifying puzzles exceeds the target threshold, the efficiency of the Client Puzzle computing power screening module in generating puzzles and verifying the answers obtained by AS when solving puzzles will be reduced, which will lead to the collapse of the entire access control process. If the time and computing power spent by AAFS-CP when constructing and verifying puzzles does not exceed the target threshold, the efficiency of the Client Puzzle computing power screening module in generating puzzles and verifying the answers obtained by AS when solving puzzles will be normal, and the entire access control process will run normally. The computing power screening algorithm AAFS-CP solves the problem by relying only on the computing power of AS; AAFS-CP adjusts the difficulty of generated questions according to the current situation; AS cannot predict the answers to difficult questions; AAFS-CP can verify the answers to the puzzles solved by AS without storing relevant information of the puzzles; A puzzle generated by AAFS-CP uniquely identifies an AS.

4. According to claim 1, a computing power screening method for access control in an industrial cloud environment is characterized in that: The computing power screening module involves computing power screening execution contracts, problem generation contracts, and solution verification contracts; Among them, the computing power screening execution contract is the interface for AS to interact with the blockchain network. The computing power screening execution contract provides computing power screening services for AS that accesses AO for the first time, so that AS can have the qualifications to initiate the initial access request through the computing power screening results obtained by the service; The puzzle generation contract is the core of the puzzle generation function in the computing power screening module, and it is also the implementation of the puzzle generation method of AAFS-CP. The puzzle generation contract generates the puzzle PuzzleAO with a unique identifier AS according to the parameters IPAS and MACAS input by the computing power screening execution contract; The solution verification contract is the core of the function of verifying the solution result obtained by AS when solving the puzzle in the computing power screening module. It is the implementation of the solution verification method of AAFS-CP. The solution verification contract verifies the timeliness and completeness of the solution PuzzleAS obtained when the AS solves the puzzle input by the computing power screening execution contract, and then responds the verification result to AS.

Images