A power data access control method, system and device based on a consortium chain

Abstract

The application discloses a power data access control method, system and device based on a consortium chain, and particularly relates to the technical field of data access control, and the technical points are as follows: the method comprises the following steps: an agent server encrypts a power data set to obtain a first encrypted ciphertext, and sends the first encrypted ciphertext to a storage server for storage, and sends a storage record to a consortium chain for storage; a user sends an authentication registration request to an authentication server, the authentication server stores user registration information carried by the user, and sends an authentication token containing an authentication valid date to the user in response to the authentication registration request; the user sends a data access request to the agent server, the agent server responds to the data access request to verify the authentication valid date of the authentication token of the user, and triggers a matching intelligent contract access strategy verification based on user attribute information, and after verification, the agent server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data access control, and particularly relates to a power data access control method, system and device based on a consortium chain. BACKGROUND

[0002] With the digital transformation of the global power industry and the widespread application of smart grid technology, the amount of data generated and transmitted in the power system is growing explosively. Power data covers the whole life cycle from power generation, transmission, distribution to user terminals, including the running status of power equipment, energy consumption data, fault information, real-time monitoring data, etc. These data are not only important basis for the optimized operation and management decision of the power system, but also an important part of user privacy and business secrets. Therefore, how to securely store and access power data has become a key problem in current power grid construction.

[0003] Traditional power data storage usually relies on a trusted central node. Although this centralized data storage method is convenient for unified management and maintenance, it also brings many challenges and security problems. For example, even if the stored data is maliciously tampered with by attackers, the malicious behavior is difficult to detect. In order to deal with these problems, blockchain, with its characteristics of decentralization, tamper resistance and transparency, has gradually become a potential solution for power data management. Blockchain is a chain-like data structure maintained by distributed network nodes. Nodes generate blocks of data in chronological order and combine blocks in a sequential manner. Blockchain uses cryptographic algorithms such as hash algorithms and digital signatures to effectively ensure data tamper resistance, forgery resistance and traceability.

[0004] Existing blockchain-based power data encryption storage schemes use blockchain to distribute data storage and use distributed node consensus algorithms to update data, achieving a decentralized data storage. However, the existing scheme still has deficiencies. Specifically, in order to ensure data security, data usually needs to be encrypted before storage, but traditional encryption algorithms will hinder the search of ciphertext data. Worse, keyword retrieval on blockchain data is inefficient, which will seriously hinder the actual deployment and application of the scheme. In addition, the existing scheme lacks fine-grained access control. Power data usually needs to be classified when actually stored, and the higher the level, the higher the data privacy, and the higher the requirement for data access users. How to design fine-grained access control in the process of power data access is a problem to be solved.

[0005] Therefore, the present application aims to provide a power data access control method, system and device based on a consortium chain to solve the above-mentioned related problems. SUMMARY

[0006] The technical problem to be solved by the present application is how to realize fine-grained access control while ensuring efficient retrieval of ciphertext power data, and the purpose is to provide a power data access control method, system and device based on a consortium chain, by constructing a power data encryption storage mode based on a consortium chain combining on-chain and off-chain, the power data is stored in the storage server after encryption to ensure the security of the power data, and the data storage record is stored on the consortium chain to ensure the data unforgeability and traceability; Meanwhile, the present application also provides an encryption storage method supporting keyword retrieval based on Bloom filter and symmetric encryption technology, which realizes efficient data retrieval while ensuring data security storage, and improves the practicability of the system; At the same time, based on the smart contract, the fine-grained access control based on user attributes is realized, which meets the access demand in the data classification scene.

[0007] The present application is realized by the following technical solutions:

[0008] A power data access control method based on a consortium chain, the method comprising:

[0009] The authentication server generates system public parameters based on security parameters, and generates a signature key and a verification key;

[0010] The proxy server encrypts the power data set to obtain a first encrypted ciphertext, and sends the first encrypted ciphertext to the storage server for storage, and sends the storage record to the consortium chain for storage;

[0011] The user sends an authentication registration request to the authentication server, the authentication server stores the user registration information carried by the user, and sends an authentication token containing an authentication validity date to the user in response to the authentication registration request;

[0012] The user sends a data access request to the proxy server, the proxy server responds to the data access request to verify the authentication validity date of the authentication token of the user, and triggers the matching smart contract access strategy verification based on the user attribute information, and after the verification, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

[0013] Further, the authentication server generates system public parameters based on security parameters, and generates a signature key and a verification key, specifically:

[0014] The authentication server generates system public parameters based on the security coefficient l, wherein the system public parameters are specifically {p, P, G, G T , e, Enc, Dec, F, H, h, Insert, Lookup}, wherein G represents an additive cyclic group with a prime number p and a generator P, G T represents a multiplicative cyclic group with p, e: G x G→ G Tdenotes a bilinear map, Enc denotes a symmetric encryption algorithm, Dec denotes a decryption algorithm corresponding to the symmetric encryption algorithm, F:{0,1} l ×{0,1} * →{0,1} l denotes a pseudo-random function, H:{0,1} * →G, h:{0,1} * →{0,1} l all denote hash functions, Insert denotes inserting a data item x into a Bloom filter BF, and Lookup denotes querying whether the data item x is contained in BF;

[0015] The authentication server generates a signature key and a verification key

[0016] Further, the proxy server encrypts the power data set to obtain first encrypted ciphertext, and sends the first encrypted ciphertext to the storage server for storage, and sends the storage record to the alliance chain for storage, wherein the power data set includes at least one piece of power data to be encrypted, and the power data is composed of an identifier set and a keyword set, specifically:

[0017] The proxy server randomly generates a first key, encrypts the power data set by using the first key to obtain first encrypted ciphertext, and initializes a first list and a first Bloom filter;

[0018] The proxy server generates a first sub-key and a second sub-key based on each keyword in the keyword set in combination with the first key, and initializes a first counter;

[0019] The proxy server generates a first pseudo-random label by using the first sub-key and the first counter, encrypts each identifier in the identifier set by using the second sub-key to generate an identifier ciphertext, and updates the first counter to generate a second counter;

[0020] The proxy server adds the first pseudo-random label and the identifier ciphertext to the first list, and inserts the first pseudo-random label into the first Bloom filter, to update the first list and the first Bloom filter, to obtain a second list and a second Bloom filter;

[0021] The proxy server generates a key dictionary for querying the identifier ciphertext by using the second list, and sends the key dictionary and the first encrypted ciphertext to the storage server for storage;

[0022] The storage server receives the key dictionary and the first encrypted ciphertext for storage, and sends the storage record to the alliance chain for storage through an intelligent contract access strategy.

[0023] Further, the user sends an authentication registration request to the authentication server, and the authentication server stores user registration information carried by the user, specifically:

[0024] The user randomly selects a user identity and a user password, and generates a user key and a user credential based on the user identity and the user password, respectively;

[0025] The user sends user registration information including the user identity, the user key, the user credential, and user attribute information to the authentication server for storage.

[0026] Further, an authentication token including an authentication validity date is sent to the user in response to the authentication registration request, specifically:

[0027] The user generates a first blinded password using a first random number and sends an authentication registration request including the user identity and the first blinded password to the authentication server;

[0028] After receiving the authentication registration request, the authentication server processes the first blinded password using the user key corresponding to the user identity to obtain a signature, and generates an authentication token using the signature key in combination with the user identity, the user attribute information, and a preset authentication validity date;

[0029] The authentication server encrypts the user credential and the authentication token using a symmetric encryption algorithm to obtain a second encrypted ciphertext, and sends authentication response information including the signature and the second encrypted ciphertext to the user;

[0030] After receiving the authentication response information, the user decrypts the second encrypted ciphertext using the user credential to obtain an authentication token including an authentication validity date.

[0031] Further, the user sends a data access request to the proxy server, and the proxy server verifies the authentication validity date of the authentication token of the user in response to the data access request, and triggers a matching smart contract access strategy verification based on the user attribute information. After the verification is passed, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access, specifically:

[0032] The user sends a data access request including the user identity, the authentication token, and the user attribute information to the proxy server;

[0033] After receiving the data access request, the proxy server verifies the authentication validity date of the authentication token of the user, and triggers a matching smart contract access strategy verification based on the user attribute information. After both verifications are passed, the proxy server sends the first sub-key and the second sub-key to the storage server;

[0034] The storage server initializes the second counter to the first counter, calculates a first pseudo-random tag based on the first subkey and the first counter, obtains the identifier ciphertext corresponding to the first pseudo-random tag from the key dictionary, decrypts the identifier ciphertext using the second subkey to obtain an identifier set, and then sends the first encrypted ciphertext to the proxy server;

[0035] The proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

[0036] The present invention also provides a power data access control system based on a consortium chain, characterized in that the system is used in any one of the above-mentioned power data access control methods based on a consortium chain, and the system includes:

[0037] The first module is used for the authentication server to generate system public parameters based on security parameters, and generate a signature key and a verification key;

[0038] The second module is used for the proxy server to encrypt the power data set to obtain a first encrypted ciphertext, send the first encrypted ciphertext to the storage server for storage, and send the stored record to the alliance chain for storage;

[0039] The third module is used for the user to send an authentication registration request to the authentication server, the authentication server stores the user registration information carried by the user, and sends an authentication token containing the authentication validity date to the user in response to the authentication registration request;

[0040] The fourth module is used for the user to send a data access request to the proxy server. The proxy server will verify the authentication validity date of the user's authentication token in response to the data access request, and trigger the matching smart contract access policy verification based on the user's attribute information. After the verification is passed, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

[0041] The present invention also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the above-mentioned methods when executing the computer program.

[0042] The present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any one of the methods described above are implemented.

[0043] The present invention also provides a computer program product comprising instructions, which, when executed by a computer device cluster, enables the computer device cluster to perform any of the above methods.

[0044] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0045] In the present application, by constructing a power data encryption storage mode based on a combination of on-chain and off-chain of alliance chain, the power data is stored in the storage server after encryption to ensure the security of the power data, and the data storage record is stored on the alliance chain to ensure the data unforgeability and traceability. Meanwhile, the present application also provides an encryption storage method supporting keyword retrieval based on Bloom filter and symmetric encryption technology, which realizes efficient data retrieval while ensuring safe data storage, and improves the practicability of the system. Meanwhile, based on the smart contract, fine-grained access control based on user attributes is realized, which meets the access requirements in the data classification scenario. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments, and it should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor. In the drawings:

[0047] Figure 1 It is a power data access control diagram based on an alliance chain in the present embodiment;

[0048] Figure 2 It is a method flow diagram of a power data access control method based on an alliance chain in the present embodiment;

[0049] Figure 3 It is a system module diagram of a power data access control system based on an alliance chain in the present embodiment;

[0050] Figure 4 It is a structure diagram of a computer device in the present embodiment. DETAILED DESCRIPTION

[0051] The exemplary embodiments of the present disclosure are described below in conjunction with the drawings, which include various details of the embodiments of the present disclosure to help understanding, and should be considered only as exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present disclosure. Also, in order to be clear and concise, the description below omits the description of well-known functions and structures.

[0052] In the present disclosure, the terms "first", "second", etc. used in the description of various examples are not intended to limit the positional relationship, timing relationship or importance relationship of the elements, and such terms are only used to distinguish one element from another. In some examples, the first element and the second element can refer to the same instance of the element, and in some cases, based on the context of the description, they can also refer to different instances.

[0053] The terms used in the description of various examples in the present disclosure are only for the purpose of describing the specific examples and are not intended to be limiting. Unless the context clearly indicates otherwise, if the number of elements is not specifically limited, the element can be one or more. In addition, the term "and / or" used in the present disclosure encompasses any one of the listed items and all possible combinations.

[0054] Embodiment 1

[0055] Referring to Figure 1 In the present embodiment, the power data access control method provided is used for a proxy server Storage server Authentication server And the user In the constructed system architecture; see Figure 2 In the present embodiment, a power data access control method based on a consortium chain is provided, and the method comprises the following steps:

[0056] S1: The authentication server generates system public parameters based on security parameters, and generates a signature key and a verification key, specifically:

[0057] The authentication server generates system public parameters based on a security coefficient l, wherein the system public parameters are specifically {p, P, G, G T , e, Enc, Dec, F, H, h, Insert, Lookup}, wherein G represents an additive cyclic group with a prime number p as the order and P as the generator, G T represents a multiplicative cyclic group with p as the order, e: G x G -> G T represents a bilinear mapping, Enc represents a symmetric encryption algorithm, Dec represents the decryption algorithm corresponding to the symmetric encryption algorithm, F: {0, 1} l x {0, 1} * -> {0, 1} l represents a pseudo-random function, H: {0, 1} * -> G, h: {0, 1} * -> {0, 1} lall represent hash functions, Insert represents inserting a data item x into the Bloom filter BF, and Lookup represents querying whether the data item x is contained in BF; the authentication server generates a signature key and a verification key

[0058] S2: the proxy server inserts the power dataset DB={id i ,W i} i∈[d] into the first list L and the first Bloom filter BF, and obtains a second list L and a second Bloom filter BF; the first encryption ciphertext C is sent to the storage server for storage, and the storage record is sent to the alliance chain for storage; wherein the power dataset DB includes at least one piece of power data to be encrypted, and the power data is composed of an identifier set id i ∈{0,1} * and a keyword set W i ∈{0,1} * , specifically:

[0059] S201: the proxy server randomly generates a first key K∈{0,1} l , encrypts the power dataset DB using the first key K to obtain a first encryption ciphertext C, and initializes a first list L and a first Bloom filter BF;

[0060] S202: the proxy server generates a first sub-key K1=F(K,w||1) and a second sub-key K2=F(K,w||2) based on each keyword w in the keyword set W in combination with the first key K, and initializes a first counter c=0;

[0061] S203: the proxy server generates a first pseudo-random label rl=F(K1,c) using the first sub-key K1 and the first counter c, generates an identifier ciphertext eid=Enc(K2,id) using the second sub-key K2 for each identifier id in the identifier set id i , and updates the first counter by 1 to generate a second counter c=1;

[0062] It should be noted that in the embodiment, the identifier set includes multiple identifiers, and the keyword set includes multiple keywords. For each keyword and identifier, the above steps S202-S203 are cycled to generate corresponding pseudo-random labels and identifier ciphertexts.

[0063] S204: the proxy server adds the first pseudo-random label rl and the identifier ciphertext eid to the first list L, and executes Insert(rl,BF) to insert the first pseudo-random label rl into the first Bloom filter BF, to update the first list L and the first Bloom filter BF, and obtain a second list L and a second Bloom filter BF;

[0064] It should be noted that in the present embodiment, the first pseudo-random label rl and the identifier ciphertext eid of all keywords and identifiers are added to the first list L to generate the second list L; all first pseudo-random labels rl are inserted into the first Bloom filter BF to generate the second Bloom filter BF.

[0065] S205: The proxy server generates a key dictionary γ for querying the identifier ciphertext eid using the second list L, and sends the key dictionary γ and the first encrypted ciphertext C to the storage server for storage;

[0066] S206: The storage server receives and stores the key dictionary γ and the first encrypted ciphertext C, and sends the storage record (ID DB , h(γ), h(BF), h(C)) to the alliance chain through the smart contract access strategy for storage;

[0067] S3: The user sends an authentication registration request to the authentication server, and the authentication server stores the user registration information carried by the user and sends an authentication token containing an authentication validity date to the user in response to the authentication registration request, specifically:

[0068] The user randomly selects a user identity identifier and a user password , and generates a user key and a user credential based on the user identity identifier and the user password , respectively;

[0069] The user sends the user registration information containing the user identity identifier , the user key k, the user credential cred, and the user attribute information {att j} j∈[n] to the authentication server for storage, wherein the user attribute information {att j} j∈[n] represents n attributes of the user, such as gender and position.

[0070] The user generates a first blinded password using a first random number and sends an authentication registration request containing the user identity identifier and the first blinded password

[0071] After receiving the authentication registration request req, the authentication server uses the user identity identifier corresponding user key k to generate a second blinded password The processing is performed to obtain a signature And the signature key is used In combination with the user identity User attribute information {att j} j∈[n] And a preset authentication validity date ext to generate an authentication token

[0072] It should be noted that in the present embodiment, the authentication validity date is determined according to actual conditions, and can be 24h, 48h or other time dates that meet the requirements, which will not be described in detail here.

[0073] The authentication server encrypts the user credential cred and the authentication token tkn using a symmetric encryption algorithm to obtain a second encrypted ciphertext etkn = Enc(cred, tkn || {att j} j∈[n] || ext), and sends authentication response information res = (σ * , etkn) containing the signature σ * And the second encrypted ciphertext etkn to the user.

[0074] After receiving the authentication response information res, the user decrypts the second encrypted ciphertext etkn using the user credential cred to obtain the authentication token tkn containing the authentication validity date.

[0075] It should be noted that in the present embodiment, after receiving the authentication response information res = (σ * , etkn), the user calculates the user credential And decrypts the second encrypted ciphertext etkn using the user credential cred to obtain the authentication token tkn, the user attribute information {att j} j∈[n] And the authentication validity date ext.

[0076] S4: The user sends a data access request to the proxy server, and the proxy server responds to the data access request to verify the authentication validity date of the authentication token of the user, and triggers the matching smart contract access strategy verification based on the user attribute information, and after verification, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access. Specifically:

[0077] If the user sends a data access request containing the user identity, the authentication token and the user attribute information to the proxy server

[0078] The proxy server receives the data access request req' and verifies the authentication expiration date ext of the authentication token tkn of the user, and verifies the user attribute information {att j} j∈[n] The matching smart contract access strategy verification is triggered, and the first sub-key K1=F(K, w||1) and the second sub-key K2=F(K, w||2) are sent to the storage server after the two verifications are passed;

[0079] It should be noted that in this embodiment, the proxy server verifies the authentication expiration date ext of the token tkn by verifying whether the equation is established, to achieve the purpose of verifying the authentication expiration date ext of the token tkn; at the same time, the smart contract verifies whether the user attribute information {att j} j∈[n] ∈ AT req is established, to achieve whether to pass the matching smart contract access strategy verification; after the two verifications are passed, the first sub-key K1=F(K, w||1) and the second sub-key K2=F(K, w||2) are calculated, and the first sub-key K1 and the second sub-key K2 are sent to the storage server for keyword ciphertext retrieval.

[0080] The storage server initializes the second counter c=1 as the first counter c=0, and calculates the first pseudo-random label rl=F(K1, c) based on the first sub-key K1 and the first counter c=0, obtains the identifier ciphertext eid corresponding to the first pseudo-random label rl in the key dictionary γ, and decrypts the identifier ciphertext eid using the second sub-key K2 to obtain the identifier id=Dec(K2, eid), and then sends the first encrypted ciphertext C to the proxy server;

[0081] The proxy server decrypts the first encrypted ciphertext C, and sends the decrypted power data set to the user for data access.

[0082] It should be noted that in this embodiment, the proxy server also sends the access record (ID u ,ID DB ,time, h(tkn||{att j} j∈[n] ||ext), h(C L ), h(K1||K2)) to the alliance chain for on-chain storage, where time represents the current time.

[0083] Specifically, in the embodiment, by constructing a power data encryption storage mode based on a combination of on-chain and off-chain of a consortium chain, the power data is stored in a storage server after being encrypted to ensure the security of the power data, and the data storage record is stored on the consortium chain to ensure the data non-tamperability and traceability. Meanwhile, the application also provides an encryption storage method supporting keyword retrieval based on a Bloom filter and symmetric encryption technology, which realizes efficient data retrieval while ensuring safe data storage, and improves the practicability of the system. Meanwhile, the application realizes fine-grained access control based on user attributes based on a smart contract, and meets the access requirements in the data classification scenario.

[0084] Embodiment 2

[0085] Referring to Figure 3 The application also provides a power data access control system based on a consortium chain, and the system is characterized in that the system is used in the power data access control method based on a consortium chain described in any one of the above, and the system comprises:

[0086] A first module 100 is configured to generate system public parameters based on security parameters by an authentication server, and generate a signature key and a verification key.

[0087] A second module 200 is configured to encrypt a power data set by a proxy server to obtain a first encrypted ciphertext, and send the first encrypted ciphertext to a storage server for storage, and send a storage record to a consortium chain for storage.

[0088] A third module 300 is configured to send an authentication registration request to the authentication server by a user, store user registration information carried by the user by the authentication server, and send an authentication token containing an authentication valid date to the user in response to the authentication registration request.

[0089] A fourth module 400 is configured to send a data access request to the proxy server by the user, verify the authentication valid date of the authentication token of the user by the proxy server in response to the data access request, trigger a matching smart contract access strategy verification based on user attribute information, and decrypt the first encrypted ciphertext by the proxy server after the verification is passed, and send the decrypted power data set to the user for data access.

[0090] It should be noted that the modules in the system of embodiment 2 correspond to the steps in the method of embodiment 1, and the steps in the method of embodiment 1 have been described in detail in embodiment 1, and the content of the modules in the system will not be described in detail in embodiment 2.

[0091] Embodiment 3

[0092] Referring to Figure 4As shown, the embodiment further provides a computer device including a memory 1005 and a processor 1001, the memory 1005 stores a computer program, and the processor 1001 implements the steps of the method of any one of the above embodiments when executing the computer program.

[0093] It should be noted that the processor 1001 is configured to execute the steps of the above method embodiments according to the instructions in the program code. Alternatively, the processor 1001 implements the functions of each module / unit in the above system / device embodiments when executing the computer program.

[0094] Specifically, in the embodiment, the computer program can be divided into one or more modules / units, and the one or more modules / units are stored in the memory 1005 and executed by the processor 1001 to complete the present application. The one or more modules / units can be a series of computer program instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the terminal device.

[0095] The terminal device can be a desktop computer, a notebook, a palm computer, a cloud server and the like. The terminal device can include, but is not limited to, the processor 1001, the memory 1005. Those skilled in the art can understand that it does not limit the terminal device, and can include more or less components than the illustration, or combine certain components, or different components, for example, the terminal device can also include an input / output device 1003, a network access device 1002, a bus 1006 and the like.

[0096] The processor 1001 can be a central processing unit (CPU), and can also be other general-purpose processors 1001, digital signal processors (DSP) 1001, application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor 1001 can be a microprocessor or the processor can also be any conventional processor.

[0097] The memory 1005 can be an internal storage unit of the terminal device, for example, a hard disk or a memory of the terminal device. The memory 1005 can also be an external storage device 1004 of the terminal device, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the terminal device. Further, the memory 1005 can also include both the internal storage unit and the external storage device 1004 of the terminal device. The memory 1005 is used to store computer programs and other programs and data required by the terminal device. The memory 1005 can also be used to temporarily store data that has been output or will be output.

[0098] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described system, system and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0099] Embodiment 4

[0100] The embodiment provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the method in any one of the above embodiments.

[0101] The computer readable storage medium may, for example, be but is not limited to an electronic, magnetic, optical, electromagnetic, infrared or semiconductor system, system or device, or any combination of the above. More specific examples (non-exhaustive list) of the computer readable storage medium include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a register, a hard disk, an optical fiber, a compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above, or any other form of computer readable storage medium known in the art.

[0102] An example storage medium is coupled to the processor such that the processor can read information from, and can write information to, the storage medium. Of course, the storage medium can be a part of the processor. Consistent with embodiments of the application, a computer readable storage medium can be any tangible medium that can retain, or store, program code for use by or in connection with an instruction execution system, apparatus, or device.

[0103] Embodiment 5

[0104] The application also provides a computer program product containing instructions which, when executed by a cluster of computer devices, cause the cluster of computer devices to perform the method of embodiment 1 described above.

[0105] The above detailed description merely describes specific implementations, which are not intended to limit the scope of the application. Various modifications, equivalents and alternatives to those aspects described herein can be made in accordance with the disclosure. The above detailed description is exemplary only and not intended to limit the application. The disclosure described herein will provide examples to those of ordinary skill in the art to which the application pertains, which are intended to be encompassed by claims directed to the features and combinations of features herein disclosed. Numerous specific details are described in this disclosure to provide a thorough understanding of the application. However, in certain instances, well-known methods, procedures, components, and circuits have not been described in detail since it would be well understood that one of ordinary skill in the art would be able to practice the application without the need for such specific information.

Claims

1. A power data access control method based on alliance chain, characterized in that: Methods include: Authentication server based on security factor Generate system common parameters, where the system common parameters are specifically { },in, Indicates that the order is a prime number , the generator is The additive cyclic group of Indicates the order The multiplicative cyclic group of Represented as a bilinear map, Represents a symmetric encryption algorithm, Indicates the decryption algorithm corresponding to the symmetric encryption algorithm, represents a pseudorandom function, 、 Both represent hash functions, Indicates that a data item Insert Bloom filter middle, Represents a query data item Is it included in Inside; the authentication server generates the signing key and verification key ; The proxy server randomly generates a first key, encrypts a power data set using the first key to obtain a first encrypted ciphertext, and initializes a first list and a first Bloom filter, wherein the power data set includes at least one power data to be encrypted, and the power data consists of an identifier set and a keyword set; The proxy server generates a first subkey and a second subkey based on each keyword in the keyword set in combination with the first key, and initializes a first counter; The proxy server generates a first pseudo-random tag using the first subkey and the first counter, encrypts each identifier in the identifier set using the second subkey to generate an identifier ciphertext, and updates the first counter to generate a second counter. The proxy server adds the first pseudo-random tag and the ciphertext of the identifier to the first list, and inserts the first pseudo-random tag into the first Bloom filter to update the first list and the first Bloom filter to obtain a second list and a second Bloom filter; The proxy server generates a key dictionary for querying the identifier ciphertext using the second list, and sends the key dictionary and the first encrypted ciphertext to the storage server for storage; The storage server receives the key dictionary and the first encrypted ciphertext for storage, and sends the storage record to the consortium chain for storage through the smart contract access policy; The user sends an authentication registration request to the authentication server. The authentication server stores the user registration information carried by the user and responds to the authentication registration request by sending an authentication token containing the authentication validity date to the user. The user sends a data access request to the proxy server. The proxy server responds to the data access request by verifying the authentication validity date of the user's authentication token and triggering the matching smart contract access policy verification based on the user's attribute information. After the verification is passed, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

2. The power data access control method based on alliance chain according to claim 1 is characterized in that: The user sends an authentication registration request to the authentication server, and the authentication server stores the user registration information carried by the user, specifically: The user randomly selects a user identity and a user password, and generates a user key and a user credential based on the user identity and the user password respectively; The user sends the user registration information including user identity, user key, user credentials and user attribute information to the authentication server for storage.

3. The power data access control method based on alliance chain according to claim 2 is characterized in that: In response to the authentication registration request, an authentication token containing the authentication validity date is sent to the user, specifically: The user generates a first blinded password using a first random number, and sends an authentication registration request including the user identity and the first blinded password to the authentication server; After receiving the authentication registration request, the authentication server uses the user key corresponding to the user identity to process the first blinded password to obtain a signature, and uses the signature key in combination with the user identity, user attribute information and the preset authentication validity date to generate an authentication token; The authentication server encrypts the user credentials and the authentication token using a symmetric encryption algorithm to obtain a second encrypted ciphertext, and sends an authentication response message including the signature and the second encrypted ciphertext to the user; After receiving the authentication response information, the user uses the user credentials to decrypt the second encrypted ciphertext to obtain an authentication token including the authentication validity date.

4. The power data access control method based on alliance chain according to claim 3 is characterized in that: The user sends a data access request to the proxy server. The proxy server responds to the data access request by verifying the authentication validity date of the user's authentication token and triggering the matching smart contract access policy verification based on the user's attribute information. After the verification is passed, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access. Specifically: The user sends a data access request containing user identity, authentication token and user attribute information to the proxy server; After receiving the data access request, the proxy server will verify the authentication validity date of the user's authentication token and trigger the matching smart contract access policy verification based on the user's attribute information. After both verifications are passed, the first subkey and the second subkey will be sent to the storage server; The storage server initializes the second counter to the first counter, calculates a first pseudo-random tag based on the first subkey and the first counter, obtains the identifier ciphertext corresponding to the first pseudo-random tag from the key dictionary, decrypts the identifier ciphertext using the second subkey to obtain an identifier set, and then sends the first encrypted ciphertext to the proxy server; The proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

5. A power data access control system based on alliance chain, characterized in that: The system is used in a power data access control method based on a consortium chain as described in any one of claims 1 to 4, and the system includes: The first module is used for the authentication server to generate system public parameters based on security parameters, and generate a signature key and a verification key; The second module is used for the proxy server to encrypt the power data set to obtain a first encrypted ciphertext, send the first encrypted ciphertext to the storage server for storage, and send the stored record to the alliance chain for storage; The third module is used for the user to send an authentication registration request to the authentication server, the authentication server stores the user registration information carried by the user, and sends an authentication token containing the authentication validity date to the user in response to the authentication registration request; The fourth module is used for the user to send a data access request to the proxy server. The proxy server will verify the authentication validity date of the user's authentication token in response to the data access request, and trigger the matching smart contract access policy verification based on the user's attribute information. After the verification is passed, the proxy server decrypts the first encrypted ciphertext and sends the decrypted power data set to the user for data access.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

8. A computer program product comprising instructions, characterized in that When the instructions are executed by a computer device cluster, the computer device cluster is caused to perform the method according to any one of claims 1 to 4.

Images