Power data access control method, system and equipment based on alliance chain

Abstract

The invention discloses a power data access control method, system and equipment based on an alliance chain, and particularly relates to the technical field of data access control, and the technical key points are as follows: the method comprises the following steps: a proxy server encrypts a power data set to obtain a first encrypted ciphertext, and sends the first encrypted ciphertext to a storage server for storage, sending the storage record to an alliance chain for storage; the user sends an authentication registration request to the authentication server, and the authentication server stores user registration information carried by the user and sends an authentication token containing an authentication valid date to the user in response to the authentication registration request; a user sends a data access request to a proxy server, and the proxy server responds to the data access request to verify an authentication valid date of an authentication token of the user and triggers matching smart contract access strategy verification based on user attribute information. And after the verification is passed, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

Description

Technical Field

[0001] The present invention relates to the technical field of data access control, and in particular to a power data access control method, system and device based on a consortium chain. Background Art

[0002] With the digital transformation of the global power industry and the widespread application of smart grid technology, the amount of data generated and transmitted in the power system has exploded. Power data covers the entire life cycle from power generation, transmission, distribution to user terminals, including the operating status of power equipment, energy consumption data, fault information, real-time monitoring data, etc. These data are not only an important basis for optimizing the operation and management decisions of the power system, but also an important part of user privacy and business secrets. Therefore, how to securely store and access power data has become a key issue in the current power grid construction.

[0003] Traditional power data storage usually relies on a trusted central node. Although this centralized data storage method facilitates unified management and maintenance, it also brings many challenges and security issues. For example, even if the stored data is maliciously tampered with by an attacker, the malicious behavior is difficult to detect. In order to deal with these problems, blockchain has gradually become a potential solution for power data management due to its decentralized, tamper-proof and transparent characteristics. Blockchain is a chain data structure maintained by distributed network nodes. The nodes generate blocks of data in chronological order and combine the blocks in a sequentially connected manner. Blockchain uses cryptographic algorithms (such as hash algorithms and digital signatures) to effectively ensure that data cannot be tampered with, forged and traceable.

[0004] The existing blockchain-based power data encryption storage solution uses blockchain to store data in a distributed manner and uses a distributed node consensus algorithm to update data, thus realizing a decentralized data storage. However, the existing solution still has shortcomings. Specifically, in order to ensure data security, data usually needs to be encrypted before storage, but traditional encryption algorithms hinder the search of ciphertext data. To make matters worse, keyword retrieval of data on the blockchain is inefficient, which will seriously hinder the actual deployment and application of the solution. In addition, the existing solution lacks fine-grained access control. When actually storing power data, it usually needs to be graded and classified. The higher the grade, the higher the degree of data privacy, and the higher the user requirements for data access. How to design fine-grained access control in the process of power data access is an urgent problem to be solved.

[0005] Therefore, the present invention aims to provide a power data access control method, system and device based on alliance chain to solve the above-mentioned related problems. Summary of the invention

[0006] The technical problem to be solved by the present invention is how to achieve fine-grained access control while ensuring efficient retrieval of encrypted power data. The purpose is to provide a power data access control method, system and device based on a consortium chain. By constructing a power data encryption storage mode that combines on-chain and off-chain based on a consortium chain, the power data is encrypted and stored in a storage server to ensure the security of the power data, and the data storage records are stored on the consortium chain to ensure the data is tamper-proof and traceable. At the same time, the present invention also provides an encryption storage method that supports keyword retrieval based on Bloom filters and symmetric encryption technology, which achieves efficient data retrieval while ensuring secure data storage, thereby improving the practicality of the system. At the same time, fine-grained access control based on user attributes is implemented based on smart contracts to meet access requirements in data grading and classification scenarios.

[0007] The present invention is achieved through the following technical solutions:

[0008] A power data access control method based on alliance chain, the method comprising:

[0009] The authentication server generates system public parameters based on security parameters, and generates signature keys and verification keys;

[0010] The proxy server encrypts the power data set to obtain a first encrypted ciphertext, sends the first encrypted ciphertext to the storage server for storage, and sends the storage record to the alliance chain for storage;

[0011] The user sends an authentication registration request to the authentication server, the authentication server stores the user registration information carried by the user, and responds to the authentication registration request by sending an authentication token containing the authentication validity date to the user;

[0012] The user sends a data access request to the proxy server. The proxy server responds to the data access request by verifying the authentication validity date of the user's authentication token and triggering the matching smart contract access policy verification based on the user's attribute information. After the verification is passed, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

[0013] Furthermore, the authentication server generates system public parameters based on the security parameters, and generates a signature key and a verification key, specifically:

[0014] The authentication server generates system public parameters based on the security factor l, where the system public parameters are specifically {p,P,G,G T ,e,Enc,Dec,F,H,h,Insert,Lookup}, where G represents an additive cyclic group with a prime order of p and a generator of P. T represents a multiplicative cyclic group of order p, e:G×G→G TIt is represented as a bilinear map, Enc represents the symmetric encryption algorithm, Dec represents the decryption algorithm corresponding to the symmetric encryption algorithm, F:{0,1} l ×{0,1} * →{0,1} l represents a pseudo-random function, H:{0,1} * →G, h:{0,1} * →{0,1} l Both represent hash functions. Insert means inserting a data item x into the Bloom filter BF, and Lookup means querying whether the data item x is included in BF.

[0015] The authentication server generates a signing key and verification key

[0016] Further, the proxy server encrypts the power data set to obtain a first encrypted ciphertext, sends the first encrypted ciphertext to the storage server for storage, and sends the storage record to the alliance chain for storage, wherein the power data set includes at least one power data to be encrypted, and the power data is composed of an identifier set and a keyword set, specifically:

[0017] The proxy server randomly generates a first key, encrypts the power data set using the first key to obtain a first encrypted ciphertext, and initializes a first list and a first Bloom filter;

[0018] The proxy server generates a first subkey and a second subkey based on each keyword in the keyword set in combination with the first key, and initializes a first counter;

[0019] The proxy server generates a first pseudo-random tag using the first subkey and the first counter, encrypts each identifier in the identifier set using the second subkey to generate an identifier ciphertext, and updates the first counter to generate a second counter;

[0020] The proxy server adds the first pseudo-random tag and the identifier ciphertext to the first list, and inserts the first pseudo-random tag into the first Bloom filter to update the first list and the first Bloom filter to obtain a second list and a second Bloom filter;

[0021] The proxy server generates a key dictionary for querying the identifier ciphertext using the second list, and sends the key dictionary and the first encrypted ciphertext to the storage server for storage;

[0022] The storage server receives the key dictionary and the first encrypted ciphertext for storage, and sends the storage record to the alliance chain for storage through the smart contract access policy.

[0023] Furthermore, the user sends an authentication registration request to the authentication server, and the authentication server stores the user registration information carried by the user, specifically:

[0024] The user randomly selects a user identity and a user password, and generates a user key and a user credential based on the user identity and the user password respectively;

[0025] The user sends the user registration information including the user identity, user key, user credentials and user attribute information to the authentication server for storage.

[0026] Furthermore, in response to the authentication registration request, an authentication token including the authentication validity date is sent to the user, specifically:

[0027] The user generates a first blinded password using a first random number, and sends an authentication registration request including the user identity and the first blinded password to the authentication server;

[0028] After receiving the authentication registration request, the authentication server uses the user key corresponding to the user identity to process the first blinded password to obtain a signature, and uses the signature key in combination with the user identity, user attribute information and a preset authentication validity date to generate an authentication token;

[0029] The authentication server encrypts the user credentials and the authentication token using a symmetric encryption algorithm to obtain a second encrypted ciphertext, and sends an authentication response message including the signature and the second encrypted ciphertext to the user;

[0030] After receiving the authentication response information, the user uses the user credentials to decrypt the second encrypted ciphertext to obtain an authentication token including the authentication validity date.

[0031] Furthermore, the user sends a data access request to the proxy server. The proxy server responds to the data access request by verifying the authentication validity date of the user's authentication token and triggering the matching smart contract access policy verification based on the user's attribute information. After the verification is passed, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access, specifically:

[0032] The user sends a data access request containing the user identity, authentication token and user attribute information to the proxy server;

[0033] After receiving the data access request, the proxy server will verify the authentication validity date of the user's authentication token, and trigger the matching smart contract access policy verification based on the user's attribute information. After both verifications are passed, the first subkey and the second subkey will be sent to the storage server;

[0034] The storage server initializes the second counter to the first counter, calculates the first pseudo-random label based on the first subkey and the first counter, obtains the identifier ciphertext corresponding to the first pseudo-random label in the key dictionary, decrypts the identifier ciphertext using the second subkey to obtain the identifier set, and then sends the first encrypted ciphertext to the proxy server;

[0035] The proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

[0036] The present invention also provides a power data access control system based on a consortium chain, characterized in that the system is used in any one of the above-mentioned power data access control methods based on a consortium chain, and the system comprises:

[0037] The first module is used for the authentication server to generate system public parameters based on security parameters, and to generate a signature key and a verification key;

[0038] The second module is used for the proxy server to encrypt the power data set to obtain a first encrypted ciphertext, and send the first encrypted ciphertext to the storage server for storage, and send the storage record to the alliance chain for storage;

[0039] The third module is used for the user to send an authentication registration request to the authentication server, the authentication server stores the user registration information carried by the user, and sends an authentication token containing the authentication validity date to the user in response to the authentication registration request;

[0040] The fourth module is used for the user to send a data access request to the proxy server. The proxy server responds to the data access request by verifying the authentication validity date of the user's authentication token and triggering the matching smart contract access policy verification based on the user's attribute information. After the verification is passed, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

[0041] The present invention also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the above-mentioned methods when executing the computer program.

[0042] The present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any one of the methods described above are implemented.

[0043] The present invention also provides a computer program product comprising instructions, and when the instructions are executed by a computer device cluster, the computer device cluster executes any of the above methods.

[0044] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0045] In the present invention, by constructing an on-chain and off-chain combined power data encryption storage mode based on the alliance chain, the power data is encrypted and stored in the storage server to ensure the security of the power data, and the data storage records are stored on the alliance chain to ensure the data is tamper-proof and traceable; at the same time, the present invention also provides an encryption storage method that supports keyword retrieval based on Bloom filters and symmetric encryption technology, which not only ensures the secure storage of data, but also realizes efficient data retrieval and improves the practicality of the system; at the same time, fine-grained access control based on user attributes is realized based on smart contracts to meet the access requirements in data classification scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without creative work. In the drawings:

[0047] Figure 1 This is a schematic diagram of power data access control based on alliance chain in this embodiment;

[0048] Figure 2 This is a method flow diagram of a power data access control method based on a consortium chain in this embodiment;

[0049] Figure 3 Schematic diagram of system modules of a power data access control system based on alliance chain in this embodiment;

[0050] Figure 4 It is a structural schematic diagram of a computer device in this embodiment. DETAILED DESCRIPTION

[0051] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0052] In the present disclosure, unless otherwise specified, the use of the terms "first", "second", etc. to describe various elements is not intended to limit the positional relationship, timing relationship, or importance relationship of these elements, and such terms are only used to distinguish one element from another element. In some examples, the first element and the second element may refer to the same instance of the element, and in some cases, based on the description of the context, they may also refer to different instances.

[0053] The terms used in the description of various examples in this disclosure are only for the purpose of describing specific examples and are not intended to be limiting. Unless the context clearly indicates otherwise, if the number of elements is not specifically limited, the element can be one or more. In addition, the term "and / or" used in this disclosure covers any one of the listed items and all possible combinations.

[0054] Example 1

[0055] See also Figure 1 In this embodiment, the power data access control method provided is used for the proxy server Storage Server Authentication Server and users In the constructed system architecture; see Figure 2 The present embodiment provides a power data access control method based on a consortium chain, the method comprising:

[0056] S1: The authentication server generates system public parameters based on security parameters, and generates signature keys and verification keys, specifically:

[0057] The authentication server generates system public parameters based on the security factor l, where the system public parameters are specifically {p,P,G,G T ,e,Enc,Dec,F,H,h,Insert,Lookup}, where G represents an additive cyclic group with a prime order of p and a generator of P. T represents a multiplicative cyclic group of order p, e:G×G→G T It is represented as a bilinear map, Enc represents the symmetric encryption algorithm, Dec represents the decryption algorithm corresponding to the symmetric encryption algorithm, F:{0,1} l ×{0,1} * →{0,1} l represents a pseudo-random function, H:{0,1} * →G, h:{0,1} * →{0,1} lBoth represent hash functions. Insert means inserting a data item x into the Bloom filter BF, and Lookup means querying whether the data item x is included in BF. The authentication server generates a signature key. and verification key

[0058] S2: The proxy server sends the power data set DB = {id i ,W i} i∈[d] The first encrypted ciphertext C is obtained by encryption, and the first encrypted ciphertext C is sent to the storage server for storage, and the storage record is sent to the alliance chain for storage, wherein the power data set DB includes at least one power data to be encrypted, and the power data is represented by the identifier set id i ∈{0,1} * and keyword set W i ∈{0,1} * The composition is as follows:

[0059] S201: The proxy server randomly generates a first key K∈{0,1} l , encrypt the power data set DB using the first key K to obtain a first encrypted ciphertext C, and initialize the first list L and the first Bloom filter BF;

[0060] S202: The proxy server performs a query based on each keyword in the keyword set. Combined with the first key K to generate the first subkey K 1 =F(K,w||1) and the second subkey K 2 =F(K,w||2), and initialize the first counter c=0;

[0061] S203: The proxy server uses the first subkey K 1 and the first counter c to generate a first pseudo-random tag rl=F(K 1 ,c), using the second subkey K 2 Encrypted identifier set id i Each identifier id in generates an identifier ciphertext eid=Enc(K 2 ,id), and add 1 to the first counter to update it, generating a second counter c=1;

[0062] It should be noted that, in this embodiment, the identifier set includes multiple identifiers, and the keyword set includes multiple keywords. For each keyword and identifier, the above steps S202-S203 are looped to generate corresponding pseudo-random labels and identifier ciphertexts.

[0063] S204: The proxy server adds the first pseudo-random tag rl and the identifier ciphertext eid to the first list L, and executes Insert(rl,BF) to insert the first pseudo-random tag rl into the first Bloom filter BF, so as to update the first list L and the first Bloom filter BF, and obtain the second list L and the second Bloom filter BF;

[0064] It should be noted that, in this embodiment, the first pseudo-random tags rl of all keywords and identifiers and the identifier ciphertext eid are added to the first list L to generate the second list L; all the first pseudo-random tags rl are inserted into the first Bloom filter BF to generate the second Bloom filter BF.

[0065] S205: The proxy server generates a key dictionary γ for querying the identifier ciphertext eid using the second list L, and sends the key dictionary γ and the first encrypted ciphertext C to the storage server for storage;

[0066] S206: The storage server receives the key dictionary γ and the first encrypted ciphertext C for storage, and stores the storage record (ID DB ,h(γ),h(BF),h(C)) are sent to the alliance chain for storage through the smart contract access strategy;

[0067] S3: The user sends an authentication registration request to the authentication server. The authentication server stores the user registration information carried by the user and responds to the authentication registration request by sending an authentication token containing the authentication validity date to the user. Specifically:

[0068] User randomly selects a user ID and user password Based on user identity and user password Generate user keys separately and user credentials ;

[0069] User will contain the user identity User key k, user credential cred and user attribute information {att j} j∈[n] User registration information Sent to the authentication server for storage, where user attribute information {att j} j∈[n] Represents n attributes of a user, such as gender and position;

[0070] The user uses the first random number Generate the first blinded password And send a message containing the user's identity to the authentication server and the first blinding command Certification registration request

[0071] After receiving the authentication registration request req, the authentication server uses the user identity The corresponding user key k is the first blinded password Process and get signature And use the signing key Combined with user identity User attribute information {att j} j∈[n] Generate an authentication token with the preset authentication validity date ext

[0072] It should be noted that, in this embodiment, the validity period of the authentication is determined according to the actual situation, and can be 24 hours, 48 ​​hours or other time and date that meets the requirements, which will not be elaborated here.

[0073] The authentication server uses a symmetric encryption algorithm to encrypt the user credential cred and the authentication token tkn to obtain a second encrypted ciphertext etkn=Enc(cred,tkn||{att j} j∈[n] ||ext), and will contain the signature σ * and the authentication response information res = (σ * ,etkn) sent to the user;

[0074] After receiving the authentication response information res, the user uses the user credential cred to decrypt the second encrypted ciphertext etkn to obtain the authentication token tkn including the authentication validity date;

[0075] It should be noted that, in this embodiment, the user receives the authentication response information res=(σ * ,etkn), calculate the user credentials Then use the user credential cred to decrypt the second encrypted ciphertext etkn to obtain the authentication token tkn and user attribute information {att j} j∈[n] and certification validity date ext.

[0076] S4: The user sends a data access request to the proxy server. The proxy server responds to the data access request by verifying the authentication validity date of the user's authentication token and triggering the matching smart contract access policy verification based on the user's attribute information. After the verification is passed, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access. Specifically:

[0077] If the user sends a data access request containing the user identity, authentication token and user attribute information to the proxy server

[0078] After receiving the data access request req′, the proxy server will verify the authentication validity date ext of the user's authentication token tkn, and based on the user attribute information {att j} j∈[n] Trigger the matching smart contract access policy verification. After both verifications pass, the first subkey K 1 =F(K,w||1) and the second subkey K 2 =F(K,w||2) is sent to the storage server;

[0079] It should be noted that, in this embodiment, the proxy server verifies the equation Whether it is established, to achieve the purpose of verifying the authentication validity date ext of the token tkn; at the same time, the smart contract verifies {att j} j∈[n] ∈AT req Is it true to verify whether it passes the smart contract access policy verification; after both verifications pass, calculate the first subkey K 1 =F(K,w||1) and the second subkey K 2 =F(K,w||2), and the first subkey K 1 and the second subkey K 2 Sent to the storage server for keyword ciphertext retrieval.

[0080] The storage server initializes the second counter c=1 to the first counter c=0, and based on the first subkey K 1 and the first counter c=0 to calculate the first pseudo-random tag rl=F(K 1 ,c), obtain the identifier ciphertext eid corresponding to the first pseudo-random label rl in the key dictionary γ, and use the second subkey K 2 Decrypt the identifier ciphertext eid to obtain the identifier id=Dec(K 2 ,eid), and then send the first encrypted ciphertext C to the proxy server;

[0081] The proxy server decrypts the first encrypted ciphertext C and sends the decrypted power data set to the user for data access.

[0082] It should be noted that, in this embodiment, the proxy server also uses a smart contract to record the access (ID u ,ID DB ,time,h(tkn||{att j} j∈[n]||ext),h(C L ),h(K 1 ||K 2 )) and sent to the alliance chain for on-chain storage, where time represents the current time.

[0083] Specifically, in this embodiment, by constructing an on-chain and off-chain combined power data encryption storage mode based on the alliance chain, the power data is encrypted and stored in the storage server to ensure the security of the power data, and the data storage records are stored on the alliance chain to ensure the data is tamper-proof and traceable; at the same time, the present invention also provides an encryption storage method that supports keyword retrieval based on Bloom filters and symmetric encryption technology, which not only ensures the secure storage of data, but also realizes efficient data retrieval and improves the practicality of the system; at the same time, fine-grained access control based on user attributes is realized based on smart contracts to meet the access requirements in data classification scenarios.

[0084] Example 2

[0085] See also Figure 3 As shown, the present invention also provides a power data access control system based on a consortium chain, characterized in that the system is used in any one of the above-mentioned power data access control methods based on a consortium chain, and the system includes:

[0086] The first module 100 is used for the authentication server to generate system public parameters based on security parameters, and to generate a signature key and a verification key;

[0087] The second module 200 is used for the proxy server to encrypt the power data set to obtain a first encrypted ciphertext, and send the first encrypted ciphertext to the storage server for storage, and send the storage record to the alliance chain for storage;

[0088] The third module 300 is used for the user to send an authentication registration request to the authentication server, the authentication server stores the user registration information carried by the user, and sends an authentication token containing the authentication validity date to the user in response to the authentication registration request;

[0089] The fourth module 400 is used for the user to send a data access request to the proxy server. The proxy server responds to the data access request by verifying the authentication validity date of the user's authentication token and triggering the matching smart contract access policy verification based on the user attribute information. After the verification is passed, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

[0090] It should be noted that the modules in the system of Example 2 correspond to the steps in the method of Example 1. The steps in the method of Example 1 have been described in detail in Example 1. In this Example 2, the contents of the modules in the system will not be described in detail.

[0091] Example 3

[0092] See also Figure 4 As shown, this embodiment further provides a computer device, including a memory 1005 and a processor 1001, wherein the memory 1005 stores a computer program, and the processor 1001 implements the steps of any one of the above methods when executing the computer program.

[0093] It should be noted that the processor 1001 is used to execute the steps in the above method embodiments according to the instructions in the program code. Alternatively, the processor 1001 implements the functions of each module / unit in the above system / device embodiments when executing the computer program.

[0094] Specifically, in this embodiment, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 1005, and are executed by the processor 1001 to complete the present application. One or more modules / units may be a series of computer program instruction segments that can complete specific functions, and the instruction segments are used to describe the execution process of the computer program in the terminal device.

[0095] The terminal device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The terminal device may include, but is not limited to, a processor 1001 and a memory 1005. Those skilled in the art will appreciate that this does not constitute a limitation on the terminal device, and may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the terminal device may also include an input / output device 1003, a network access device 1002, a bus 1006, etc.

[0096] The processor 1001 may be a central processing unit (CPU), or other general-purpose processors 1001, digital signal processors 1001 (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor 1001 may be a microprocessor or any conventional processor, etc.

[0097] The memory 1005 may be an internal storage unit of the terminal device, such as a hard disk or memory of the terminal device. The memory 1005 may also be an external storage device 1004 of the terminal device, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the terminal device. Further, the memory 1005 may also include both the internal storage unit of the terminal device and the external storage device 1004. The memory 1005 is used to store computer programs and other programs and data required by the terminal device. The memory 1005 may also be used to temporarily store data that has been output or is to be output.

[0098] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, systems and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0099] Example 4

[0100] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the above methods are implemented.

[0101] Among them, the computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, system or device, or any combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk. Random Access Memory (RAM), Read-Only Memory (ROM), Erasable Programmable Read Only Memory (EPROM), registers, hard disks, optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above, or any other form of computer-readable storage medium known in the art.

[0102] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application-specific integrated circuit (ASIC). In an embodiment of the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system, or device.

[0103] Example 5

[0104] The present invention also provides a computer program product comprising instructions, and when the instructions are executed by a computer device cluster, the computer device cluster executes the method described in the above embodiment 1.

[0105] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A power data access control method based on alliance chain, characterized in that: Methods include: The authentication server generates system public parameters based on security parameters, and generates signature keys and verification keys; The proxy server encrypts the power data set to obtain a first encrypted ciphertext, sends the first encrypted ciphertext to the storage server for storage, and sends the storage record to the alliance chain for storage; The user sends an authentication registration request to the authentication server, the authentication server stores the user registration information carried by the user, and responds to the authentication registration request by sending an authentication token containing the authentication validity date to the user; The user sends a data access request to the proxy server. The proxy server responds to the data access request by verifying the authentication validity date of the user's authentication token and triggering the matching smart contract access policy verification based on the user's attribute information. After the verification is passed, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

2. According to claim 1, a power data access control method based on alliance chain is characterized in that: The authentication server generates system public parameters based on security parameters, and generates signature keys and verification keys, specifically: The authentication server generates system public parameters based on the security factor l, where the system public parameters are specifically {p,P,G,G T ,e,Enc,Dec,F,H,h,Insert,Lookup}, where G represents an additive cyclic group with a prime order of p and a generator of P. T represents a multiplicative cyclic group of order p, e:G×G→G T It is represented as a bilinear map, Enc represents the symmetric encryption algorithm, Dec represents the decryption algorithm corresponding to the symmetric encryption algorithm, F:{0,1} l ×{0,1} * →{0,1} l represents a pseudo-random function, H:{0,1} * →G, h:{0,1} * →{0,1} l Both represent hash functions. Insert means inserting a data item x into the Bloom filter BF, and Lookup means querying whether the data item x is included in BF. The authentication server generates a signing key and verification key 3. According to claim 1, a power data access control method based on alliance chain is characterized in that: The proxy server encrypts the power data set to obtain a first encrypted ciphertext, sends the first encrypted ciphertext to the storage server for storage, and sends the storage record to the alliance chain for storage, wherein the power data set includes at least one power data to be encrypted, and the power data is composed of an identifier set and a keyword set, specifically: The proxy server randomly generates a first key, encrypts the power data set using the first key to obtain a first encrypted ciphertext, and initializes a first list and a first Bloom filter; The proxy server generates a first subkey and a second subkey based on each keyword in the keyword set in combination with the first key, and initializes a first counter; The proxy server generates a first pseudo-random tag using the first subkey and the first counter, encrypts each identifier in the identifier set using the second subkey to generate an identifier ciphertext, and updates the first counter to generate a second counter; The proxy server adds the first pseudo-random tag and the identifier ciphertext to the first list, and inserts the first pseudo-random tag into the first Bloom filter to update the first list and the first Bloom filter to obtain a second list and a second Bloom filter; The proxy server generates a key dictionary for querying the identifier ciphertext using the second list, and sends the key dictionary and the first encrypted ciphertext to the storage server for storage; The storage server receives the key dictionary and the first encrypted ciphertext for storage, and sends the storage record to the alliance chain for storage through the smart contract access policy.

4. The power data access control method based on alliance chain according to claim 3 is characterized in that: The user sends an authentication registration request to the authentication server, and the authentication server stores the user registration information carried by the user, specifically: The user randomly selects a user identity and a user password, and generates a user key and a user credential based on the user identity and the user password respectively; The user sends the user registration information including the user identity, user key, user credentials and user attribute information to the authentication server for storage.

5. According to claim 4, a power data access control method based on alliance chain is characterized in that: In response to the authentication registration request, an authentication token containing the authentication validity date is sent to the user, specifically: The user generates a first blinded password using a first random number, and sends an authentication registration request including the user identity and the first blinded password to the authentication server; After receiving the authentication registration request, the authentication server uses the user key corresponding to the user identity to process the first blinded password to obtain a signature, and uses the signature key in combination with the user identity, user attribute information and a preset authentication validity date to generate an authentication token; The authentication server encrypts the user credentials and the authentication token using a symmetric encryption algorithm to obtain a second encrypted ciphertext, and sends an authentication response message including the signature and the second encrypted ciphertext to the user; After receiving the authentication response information, the user uses the user credentials to decrypt the second encrypted ciphertext to obtain an authentication token including the authentication validity date.

6. The power data access control method based on alliance chain according to claim 4 is characterized in that: The user sends a data access request to the proxy server. The proxy server responds to the data access request by verifying the authentication validity date of the user's authentication token and triggering the matching smart contract access policy verification based on the user's attribute information. After the verification is passed, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access. Specifically: The user sends a data access request containing the user identity, authentication token and user attribute information to the proxy server; After receiving the data access request, the proxy server will verify the authentication validity date of the user's authentication token, and trigger the matching smart contract access policy verification based on the user's attribute information. After both verifications are passed, the first subkey and the second subkey will be sent to the storage server; The storage server initializes the second counter to the first counter, calculates the first pseudo-random label based on the first subkey and the first counter, obtains the identifier ciphertext corresponding to the first pseudo-random label in the key dictionary, decrypts the identifier ciphertext using the second subkey to obtain the identifier set, and then sends the first encrypted ciphertext to the proxy server; The proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

7. A power data access control system based on alliance chain, characterized in that: The system is used in a power data access control method based on a consortium chain as described in any one of claims 1 to 6, and the system includes: The first module is used for the authentication server to generate system public parameters based on security parameters, and to generate a signature key and a verification key; The second module is used for the proxy server to encrypt the power data set to obtain a first encrypted ciphertext, and send the first encrypted ciphertext to the storage server for storage, and send the storage record to the alliance chain for storage; The third module is used for the user to send an authentication registration request to the authentication server, the authentication server stores the user registration information carried by the user, and sends an authentication token containing the authentication validity date to the user in response to the authentication registration request; The fourth module is used for the user to send a data access request to the proxy server. The proxy server responds to the data access request by verifying the authentication validity date of the user's authentication token and triggering the matching smart contract access policy verification based on the user's attribute information. After the verification is passed, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising instructions, characterized in that When the instructions are executed by a computer device cluster, the computer device cluster executes the method according to any one of claims 1 to 6.

Images