Fine-grained access control method and system for data networking scene

Abstract

The embodiment of the invention provides a fine-grained access control method and system for a data networking scene. Relates to the technical field of computers. The method comprises the following steps: receiving a key request of a first terminal, and returning a first key to the first terminal; the first terminal encrypts the target data based on the second key to obtain encrypted data; the first terminal encrypts the second key based on the first key and a preset attribute access strategy to obtain an encryption key, and associatively stores the encrypted data and the encryption key into a digital object warehouse; receiving an access request of a second terminal, determining attribute information of the second terminal, generating a decryption key according to the attribute information, and returning the decryption key to the second terminal; the second terminal obtains the encrypted data and the encryption key, decrypts the encryption key based on the decryption key, and obtains a second key when the attribute information meets a preset attribute access strategy; and the second terminal decrypts the encrypted data based on the second key to access the target data. According to the invention, the security of data access can be improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of digital networking, and in particular relates to a fine-grained access control method and system for digital networking scenarios. Background Art

[0002] Digital Object (DO) is a data abstraction of resource entities. Users can store their own data as digital objects in the digital object warehouse. Other users can obtain the corresponding data in the digital object warehouse for access. However, data access needs to be controlled, for example, specific data can only be accessed by specific users.

[0003] Currently, mapping can be performed based on data attributes and user attributes. When the user attributes correspond to the attributes of the current data, the user can access the data, making access more convenient.

[0004] However, the current solution only determines whether a user can access data by matching attributes, which results in low data security. Summary of the invention

[0005] The present invention aims to provide a fine-grained access control method, system, device, electronic device and readable storage medium for digital networking scenarios, at least to solve the problem that the prior art focuses on determining whether a user can access data only by attributes, resulting in low data security.

[0006] In order to solve the above-mentioned technical problems, the present invention is achieved as follows: In a first aspect, an embodiment of the present invention provides a fine-grained access control method for a data networking scenario, which is applied to a server, wherein the server communicates with a first terminal and a second terminal; the method comprises: receiving a key request sent by the first terminal, and returning a first key corresponding to the key request to the first terminal; the first terminal is used to encrypt target data based on a locally generated second key to obtain encrypted data; the first terminal is also used to encrypt the second key based on the first key and a preset attribute access policy to obtain an encrypted key, and associate the encrypted data with the encryption key and store them in a digital object repository; receiving an access request from the second terminal for the encrypted data, and determining attribute information of the second terminal according to the access request; A decryption key is generated according to the attribute information, and the decryption key is returned to the second terminal; the second terminal is used to obtain the encrypted data and the encryption key in the digital object repository, decrypt the encryption key based on the decryption key, and obtain the second key when the attribute information satisfies the preset attribute access policy; the second terminal is also used to decrypt the encrypted data based on the second key to access the target data.

[0007] In a second aspect, an embodiment of the present invention further provides a fine-grained access control method for a digital networking scenario, which is applied to a first terminal, the first terminal communicates with a server and a second terminal; the method includes: Sending a key request to the server, and receiving a first key returned by the server; Encrypting the target data based on the second key generated locally to obtain encrypted data; Based on the first key and the preset attribute access policy, encrypting the second key to obtain an encrypted key; The encrypted data and the encryption key are associated and stored in a digital object repository.

[0008] In a third aspect, an embodiment of the present invention further provides a fine-grained access control method for a digital networking scenario, which is applied to a second terminal, and the second terminal communicates with a server and a first terminal; the method includes: Based on the encrypted data to be accessed, generating an access request for the encrypted data; Sending the access request to the server, and receiving a decryption key returned by the server; the decryption key is generated according to the attribute information of the second terminal; Acquire the encrypted data and the encryption key in the digital object repository, decrypt the encryption key based on the decryption key, and obtain a second key when the attribute information satisfies a preset attribute access policy; The encrypted data is decrypted based on the second key to access the target data.

[0009] In a fourth aspect, an embodiment of the present invention further provides a fine-grained access control system for a digital networking scenario, the system comprising: a server, a first terminal and a second terminal; The server is configured to receive a key request sent by the first terminal, and return a first key corresponding to the key request to the first terminal; The first terminal is used to encrypt the target data based on the second key generated locally to obtain encrypted data; The first terminal is configured to encrypt the second key based on the first key and a preset attribute access policy to obtain an encryption key, and associate the encrypted data with the encryption key and store them in a digital object repository; The server is configured to receive an access request from the second terminal to the encrypted data, and determine attribute information of the second terminal according to the access request; The server is configured to generate a decryption key according to the attribute information and return the decryption key to the second terminal; The second terminal is used to obtain the encrypted data and the encryption key in the digital object repository, decrypt the encryption key based on the decryption key, and obtain the second key when the attribute information satisfies the preset attribute access policy; The second terminal is used to decrypt the encrypted data based on the second key to access the target data.

[0010] In a fifth aspect, an embodiment of the present invention further provides a fine-grained access control device for a digital networking scenario, which is applied to a server, and the server communicates with a first terminal and a second terminal; the device includes: a data encryption module, configured to receive a key request sent by the first terminal, and return a first key corresponding to the key request to the first terminal; the first terminal is configured to encrypt target data based on a locally generated second key to obtain encrypted data; the first terminal is further configured to encrypt the second key based on the first key and a preset attribute access policy to obtain an encryption key, and associate the encrypted data with the encryption key and store them in a digital object repository; an access response module, configured to receive an access request from the second terminal for the encrypted data, and determine attribute information of the second terminal according to the access request; A data decryption module is used to generate a decryption key according to the attribute information and return the decryption key to the second terminal; the second terminal is used to obtain the encrypted data and the encryption key in the digital object repository, decrypt the encryption key based on the decryption key, and obtain the second key when the attribute information satisfies the preset attribute access policy; the second terminal is also used to decrypt the encrypted data based on the second key to access the target data.

[0011] In the sixth aspect, an embodiment of the present invention further provides an electronic device, which includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first, second and third aspects.

[0012] In a seventh aspect, an embodiment of the present invention further provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first, second and third aspects are implemented.

[0013] In an embodiment of the present invention, by receiving a key request sent by a first terminal, a first key is returned to the first terminal; the first terminal is used to encrypt the target data based on the second key generated locally to obtain encrypted data; the first terminal encrypts the second key based on the first key and the preset attribute access policy to obtain the encryption key, and associates the encrypted data and the encryption key and stores them in a digital object warehouse; an access request from a second terminal is received, the attribute information of the second terminal is determined, a decryption key is generated based on the attribute information and returned to the second terminal; the second terminal obtains the encrypted data and the encryption key, decrypts the encryption key based on the decryption key, and obtains the second key when the attribute information meets the preset attribute access policy, thereby accessing the target data. On the one hand, the target data is encrypted, and the second key used to access the target data is encrypted through the attribute access policy, thereby improving the security of the data; on the other hand, when accessing the data, the attribute information of the second terminal needs to be verified, and only when the attribute information meets the attribute access policy can the second key be decrypted to access the target data, thereby further improving the security of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a flowchart of the steps of a fine-grained access control method for a digital networking scenario provided by an embodiment of the present invention; Figure 2 is a schematic diagram of a digital object identification system and a digital object warehouse system provided by an embodiment of the present invention; Figure 3 is a schematic diagram of a process of data encryption performed by a first terminal provided by an embodiment of the present invention; Figure 4 is a schematic diagram of a process of data decryption performed by a second terminal provided by an embodiment of the present invention; Figure 5 It is a flowchart of another fine-grained access control method for a data networking scenario provided by an embodiment of the present invention; Figure 6 is a schematic diagram of the interaction of encryption and decryption provided by an embodiment of the present invention; Figure 7 It is a flowchart of another fine-grained access control method for a data networking scenario provided by an embodiment of the present invention; Figure 8 It is a flowchart of another fine-grained access control method for a data networking scenario provided by an embodiment of the present invention; Fig. 9 It is a block diagram of a fine-grained access control system for a digital networking scenario provided by an embodiment of the present invention; Fig.10 It is a block diagram of a fine-grained access control device for a digital networking scenario provided by an embodiment of the present invention; Fig.11It is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0015] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0016] The terms "first", "second", etc. in the specification and claims of the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0017] It should be noted that Digital Object Architecture (DOA) is a software architecture that uses digital objects as the center to solve the interoperability between information terminal resources in an open environment. Digital objects are essentially data abstractions of resource entities. In the Internet environment, digital objects are mainly generated in information terminals and are transformed from data that already exist in the information terminals, such as libraries, tables, documents, and pictures.

[0018] With the continuous development of digital economy and intelligent applications, the demand for data interconnection and interoperability has become more urgent, and digital networking technology represented by digital object architecture has emerged. Digital networking technology draws on the design concept of the Internet and adopts the idea of ​​software definition. Through a data-centric open software architecture and standardized interoperability protocols, various heterogeneous data platforms and systems are connected, thus forming a "virtual / data" network on the "physical / machine" Internet, namely the data Internet (digital networking). In the application scenario of digital networking, data can be easily transferred from one data platform / system to another data platform / system, so higher requirements are put forward for data security.

[0019] Figure 1 is a flowchart of a fine-grained access control method for a data networking scenario provided by an embodiment of the present invention, such as Figure 1 As shown, it is applied to a server, and the server communicates with a first terminal and a second terminal; the method may include: Step 101, receiving a key request sent by the first terminal, and returning a first key corresponding to the key request to the first terminal; the first terminal is used to encrypt target data based on a locally generated second key to obtain encrypted data; the first terminal is also used to encrypt the second key based on the first key and a preset attribute access policy to obtain an encrypted key, and the encrypted data and the encryption key are associated and stored in a digital object repository.

[0020] In the disclosed embodiments, a digital object identification system (Identifier / Resolution System), a digital object registration system (Registry System) and a digital object repository system (Repository System) may be included in the digital network. The digital object repository system is mainly responsible for the entity encapsulation, storage, access and destruction of digital objects, the digital object registration system is mainly responsible for the metadata registration, publication, modification and deletion of digital objects, and the digital object identification system is mainly responsible for the identification creation, resolution, modification and destruction of digital objects. The digital object identification system includes multiple nodes at multiple levels. The server in the present invention may be a server for constituting a digital object identification system. Each server may correspond to one or more nodes. A node may refer to software deployed in a server, and a node may also be referred to as an authorization agency. The digital object repository of the present invention may be a digital object repository in a digital object repository system.

[0021] Figure 2 Schematic diagram of a digital object identification system and a digital object warehouse system provided by an embodiment of the present disclosure; the digital object identification system 21 includes a root node 211, a primary node 212, a primary node 213, a secondary node 214, a secondary node 215, and a secondary node 216. The digital object warehouse system 22 includes a digital object warehouse 221, a digital object warehouse 222, and a digital object warehouse 223. In addition, the first terminal 23 and the second terminal 24 are included, and the first terminal 23 and the second terminal 242 can interact with the digital object identification system 21 and the digital object warehouse system 22 respectively. Figure 2 The number and connection relationship of the nodes and digital object warehouse in the figure are only for illustration. According to actual needs, the architecture of the digital object identification system and the digital object warehouse system may be different.

[0022] The first terminal may be a terminal corresponding to the data owner. A business system may be running in the first terminal. The business system refers to the purpose of the current terminal. For example, the first terminal may be a terminal of a scientific research institute, and the business system therein may be a scientific research management system; the first terminal may be a terminal of a bank, and the business system therein may be a financial management system.

[0023] The first terminal needs to encrypt the data in its business system, and the first terminal can generate a second key for encrypting the data locally. In addition, the key used to encrypt the second key, i.e., the first key, can be requested from the server (i.e., the node). The first terminal can generate different key requests according to the type of data to be encrypted or the confidentiality level. After receiving the key request, the server returns the corresponding first key to the first terminal according to the specific key request. The server can store different first keys, and can then determine the corresponding first key according to the indication of the key request.

[0024] The first terminal encrypts the target data based on the second key to obtain encrypted data, wherein the target data may be any data to be encrypted in the first terminal. In addition, the first terminal also encrypts the second key based on the first key and a preset attribute access policy. The attribute access policy may be an attribute range, and the attribute may be a role, authority, geographic location, and other attributes. Based on the preset attribute access policy and the first key, the second key is jointly encrypted to obtain an encryption key. The encrypted data and the encryption key are stored in a digital object warehouse in association with each other, and the first terminal may encapsulate the encrypted data and the encryption key and other related information, and then publish them as digital objects to the digital object warehouse system, and then store them in an associated manner in the digital object warehouse.

[0025] It is understandable that the encrypted data may flow between multiple digital object repositories in the digital object repository system.

[0026] Figure 3 is a schematic diagram of a process of data encryption performed by a first terminal provided in an embodiment of the present disclosure; Figure 3 It includes a digital object identification system 31, a digital object warehouse system 32, and a first terminal 33; S1, the first terminal 33 obtains the first key returned by the primary node 311 in the digital object identification system 31; S2, the first terminal 33 encrypts the target data based on the second key; S3, the first terminal 33 encrypts the second key based on the first key and the preset attribute access policy; S4, the first terminal 33 associates the encryption key and the encrypted data and stores them in the digital object warehouse 321 in the digital object warehouse system 32.

[0027] Step 102: Receive an access request from the second terminal for the encrypted data, and determine attribute information of the second terminal according to the access request.

[0028] In the disclosed embodiment, the second terminal is a data accessor. Similar to the first terminal, a business system may also be running in the second terminal. The second terminal may determine the encrypted data to be accessed through the digital object retrieval service provided by the digital network. For example, corresponding to each encrypted data, the digital object identification system may generate a unique identifier for the encrypted data, and the identifier of the encrypted data to be accessed may be retrieved through the digital object retrieval service. In addition, the encrypted data may also be retrieved by its features, such as the type of encrypted data, confidentiality level, data size, etc., and there is no specific limitation on how to determine the encrypted data to be accessed.

[0029] The second terminal can generate an access request based on the encrypted data to be accessed, and then send the access request to the server to request the server to return a decryption key, which is used to decrypt the encryption key to obtain the second key. After receiving the access request, the server determines the attribute information of the second terminal corresponding to the access request, wherein the attribute information of the second terminal can be similar to the attribute access policy, such as attribute information such as role and authority. It can be understood that the attribute information of the second terminal can be an attribute set, including multiple attributes.

[0030] Step 103: Generate a decryption key based on the attribute information, and return the decryption key to the second terminal; the second terminal is used to obtain the encrypted data and the encryption key in the digital object repository, decrypt the encryption key based on the decryption key, and obtain the second key when the attribute information meets the preset attribute access policy; the second terminal is also used to decrypt the encrypted data based on the second key to access the target data.

[0031] In the disclosed embodiment, the server node generates a decryption key according to the attribute information, which can be generated by a ciphertext-policy attribute-based encryption algorithm (CP-ABE), such as a bilinear-map-based CP-ABE algorithm, a lattice-based CP-ABE algorithm, a tree access structure-based CP-ABE algorithm, and the like.

[0032] When an encryption algorithm based on ciphertext policy attributes is used, the KeyGen basic algorithm may be included. The attribute information may be used as input, and the KeyGen algorithm may output a decryption key.

[0033] The second terminal can obtain encrypted data, encryption keys, and other associated stored data in the digital object repository. The second terminal uses the decryption key to decrypt the encryption key to obtain the second key. The second key is the key used by the first terminal to encrypt the target data. Therefore, the second terminal can decrypt the ciphertext of the encrypted data based on the second key to obtain the plaintext, and then access the target data. It should be noted that the second key can only be decrypted when the attribute information meets the preset attribute access policy. For example, the attribute information of the second terminal is within the attribute range of the attribute access policy. For example, the attribute information of the second terminal is "Role: Supervisor" and the attribute access policy is "Role: Manager, Role: Supervisor", then the attribute information of the second terminal is within the attribute range of the attribute access policy.

[0034] Figure 4 is a schematic diagram of a process of data decryption performed by a second terminal provided by an embodiment of the present disclosure; Figure 4 In it, a digital object identification system 41, a digital object warehouse system 42, and a second terminal 43 are included; A1, the second terminal 43 obtains the decryption key returned by the primary node 411 in the digital object identification system 41; A2, the second terminal 43 obtains the encrypted data and the encryption key in the digital object warehouse 421 of the digital object warehouse system 42; A3, the second terminal 43 decrypts the encryption key based on the decryption key to obtain the second key; A4, the second terminal 43 decrypts the encrypted data based on the second key to obtain the target data.

[0035] In summary, in an embodiment of the present invention, by receiving a key request sent by a first terminal, a first key is returned to the first terminal; the first terminal is used to encrypt the target data based on the second key generated locally to obtain encrypted data; the first terminal encrypts the second key based on the first key and the preset attribute access policy to obtain an encryption key, and associates the encrypted data and the encryption key and stores them in a digital object warehouse; receives an access request from a second terminal, determines the attribute information of the second terminal, generates a decryption key based on the attribute information and returns it to the second terminal; the second terminal obtains the encrypted data and the encryption key, decrypts the encryption key based on the decryption key, and obtains the second key when the attribute information meets the preset attribute access policy to access the target data. On the one hand, the target data is encrypted, and the second key used to access the target data is encrypted through the attribute access policy, which improves the security of the data; on the other hand, when accessing the data, it is necessary to verify the attribute information of the second terminal, and only when the attribute information meets the attribute access policy can the second key be decrypted to access the target data, which further improves the security of the data.

[0036] Figure 5 It is a flowchart of the steps of another fine-grained access control method for a digital networking scenario provided by an embodiment of the present invention. Figure 5 include: Step 501, receiving a key request sent by the first terminal, and returning a first key corresponding to the key request to the first terminal; the first terminal is used to encrypt target data based on a locally generated second key to obtain encrypted data; the first terminal is also used to encrypt the second key based on the first key and a preset attribute access policy to obtain an encryption key, and the encrypted data and the encryption key are associated and stored in a digital object repository; Step 502, receiving an access request from the second terminal for the encrypted data, and determining attribute information of the second terminal according to the access request; Step 503: Generate a decryption key based on the attribute information, and return the decryption key to the second terminal; the second terminal is used to obtain the encrypted data and the encryption key in the digital object repository, decrypt the encryption key based on the decryption key, and obtain the second key when the attribute information meets the preset attribute access policy; the second terminal is also used to decrypt the encrypted data based on the second key to access the target data.

[0037] For details of the above steps 501-503, please refer to Figure 1 The contents of the embodiments will not be repeated here.

[0038] Optionally, step 501: receiving a key request sent by the first terminal, and returning a first key corresponding to the key request to the first terminal may include sub-steps 5011-5013: Sub-step 5011, receiving a key request sent by the first terminal, and determining a target encryption level carried in the key request; the target encryption level corresponds to the target data; Sub-step 5012, according to the target encryption level, in the mapping relationship between encryption level and encryption parameter, determining the target encryption parameter corresponding to the target encryption level; Sub-step 5013: Generate a first key according to the target encryption parameters and a preset algorithm, and return the first key to the first terminal.

[0039] In the disclosed embodiment, the first terminal may determine the target encryption level of the target data that currently needs to be encrypted. The target encryption level may be information associated with the target data or may be defined by the user (data owner) of the first terminal. The second keys corresponding to target data of different encryption levels may use different first keys. A key request is generated according to the target encryption level of the current target data and sent to the node of the server.

[0040] The server receives the key request sent by the first terminal, determines the target encryption level carried in the key request, stores multiple encryption parameters corresponding to the node, and determines the target encryption parameter corresponding to the target encryption level according to the mapping relationship between the encryption level and the encryption parameter.

[0041] Generate a first key according to the target encryption parameter and the preset algorithm. The encryption parameters may be different depending on the preset algorithm. The preset algorithm may be an encryption algorithm based on the ciphertext policy attribute described above. When an encryption algorithm based on the ciphertext policy attribute is adopted, including the setup basic encryption algorithm, the target encryption parameter may be an implicit security parameter λ of the setup algorithm, and the first terminal may input the implicit security parameter λ into the setup algorithm, and the algorithm outputs a first key (which may be referred to as a system public parameter or a system public key). It is understandable that when the implicit security parameter λ is input into the setup algorithm, the algorithm outputs a first key (system public key PK) and a master private key (MK) corresponding to the first key. It is understandable that if the setup encryption algorithm is used to generate the first key, a decryption key may be generated by the KeyGen algorithm in step 503, specifically, the master private key and attribute information generated simultaneously with the first key are input into the KeyGen algorithm, and then a decryption key may be generated.

[0042] By implementing the embodiments of the present disclosure, the corresponding target encryption parameters can be determined according to the target encryption level of the target data to be encrypted, and the first key can be generated according to the target encryption parameters and the preset algorithm. The corresponding first key can be flexibly generated according to the importance of the actual target data, thereby achieving different encryptions for the second keys of different target data, which can improve the flexibility and accuracy of data encryption.

[0043] Optionally, at least one node is run in the server, and each node corresponds to at least one encryption parameter; the step of receiving the key request sent by the first terminal and returning the first key corresponding to the key request to the first terminal includes: receiving a key request sent by the first terminal, and determining a target encryption level carried in the key request; According to the target encryption level, determine, among the encryption parameters corresponding to the at least one node, a target encryption parameter corresponding to the target encryption level, and determine a target node where the target encryption parameter is located; According to the target encryption parameters and the preset algorithm, a first key is generated through the target node, and the first key and the target node information are returned to the first terminal; the first terminal is used to associate the target node information with the encrypted data and store them in the digital object warehouse.

[0044] In the disclosed embodiment, there are multiple nodes in the digital object identification system, which are provided by a server, and each server corresponds to at least one node, that is, at least one node is running in the server. Each node has its own corresponding encryption parameters, and the encryption parameters of different nodes may be different.

[0045] Determine the target encryption level carried in the key request, determine the target encryption parameter corresponding to the target encryption level in the encryption parameters corresponding to at least one node, and after determining the target encryption parameter, determine the node where the target encryption parameter is located as the target node.

[0046] The target node then generates a first key according to the target encryption parameter and the preset algorithm. The target node can return the first key and the target node information to the first terminal, and the first terminal is used to associate the target node information with the encrypted data and store it in the digital object warehouse. The target node information can be used to indicate the location of the target node in the digital object identification system, and the target node information can be a node identification.

[0047] For example, refer to Figure 2 The root node 211 may be identified as 11, as well as a first-level node 212 identified as 11.01 and a first-level node 213 identified as 11.02, a second-level node 214 identified as 11.01.001, a second-level node 215 identified as 11.01.002, and a second-level node 216 identified as 11.01.003.

[0048] In the implementation of the embodiment of the present disclosure, by determining the target encryption level carried in the key request, according to the target encryption level, in the encryption parameters corresponding to at least one node, the corresponding target encryption parameter is determined, and the target node where the target encryption parameter is located is determined; according to the target encryption parameter and the preset algorithm, a first key is generated through the target node, and the first key and target node information are returned to the first terminal. The target node for interaction can be determined for different first terminal devices, and the first terminal can be encrypting assisted based on the target node, which can disperse the pressure of communication interaction to each server or each node, thereby improving the overall data encryption efficiency.

[0049] Optionally, the access request carries the target node information and identity information of the second terminal; The step of determining the attribute information of the second terminal according to the access request includes: searching, according to the identity information, for attribute information corresponding to the second terminal; The step of generating a decryption key according to the attribute information and returning the decryption key to the second terminal includes: Determine the target node corresponding to the encrypted data according to the target node information; A decryption key is generated through the target node according to the attribute information, and the decryption key is returned to the second terminal.

[0050] In the disclosed embodiment, since the target node information and the encrypted data are associated and stored in the digital object warehouse, the second terminal can also obtain the target node information corresponding to the encrypted data when performing data retrieval, and carry the target node information in the generated access request. In addition, the access request also needs to carry identity information, which can be the identifier of the second terminal in the digital network or the identifier of the current user of the second terminal in the digital network.

[0051] When the second terminal obtains the target node information, it can directly send the access request to the target node of the server; it can also send it to any node in the digital object identification system, and then the node can forward the access request until the target node obtains the access request.

[0052] In addition, the target node may search for attribute information corresponding to the identity information in the database according to the identity information. It is understandable that when the identity information does not have corresponding attribute information, the corresponding decryption key will not be generated, or an erroneous decryption key may be generated. When the corresponding attribute information is found, the decryption key is generated by the target node according to the attribute information, and the decryption key is returned to the second terminal.

[0053] In implementing the embodiments of the present disclosure, the target node information carried in the access request is used to determine the target node corresponding to the encrypted data, and the decryption key is generated through this target node, so that the encryption and decryption of the second key are based on the same node, avoiding problems such as data errors that may be caused by encryption and decryption by different nodes, and improving the accuracy of data access.

[0054] Figure 6 is a schematic diagram of the interaction of encryption and decryption provided by an embodiment of the present disclosure; Figure 6 The system includes a cloud server 601 (running a digital object repository system), a node 602, a first terminal 603, and a second terminal 604. The node 602 sends a first key to the first terminal 603, and the first terminal 603 completes data encryption based on the second key and stores the encrypted data in the cloud server 601. The node 602 sends a decryption key to the second terminal 604, and the second terminal 604 obtains the encrypted data.

[0055] Figure 7 It is a flowchart of another fine-grained access control method for a digital networking scenario provided by an embodiment of the present disclosure; it is applied to a first terminal, and the first terminal communicates with a server and a second terminal; the method includes: Step 701, sending a key request to the server, and receiving a first key returned by the server; Step 702, encrypting the target data based on the second key generated locally to obtain encrypted data; Step 703: Based on the first key and the preset attribute access policy, encrypt the second key to obtain an encrypted key; Step 704: Store the encrypted data and the encryption key in association with each other in a digital object repository.

[0056] For details of the above steps 701-704, please refer to Figure 1 The corresponding embodiments will not be described in detail here.

[0057] Figure 8 It is a flowchart of another fine-grained access control method for a digital networking scenario provided by an embodiment of the present disclosure; it is applied to a second terminal, and the second terminal communicates with a server and a first terminal; the method includes: Step 801, based on the encrypted data to be accessed, generating an access request for the encrypted data; Step 802: sending the access request to the server, and receiving a decryption key returned by the server; the decryption key is generated according to the attribute information of the second terminal; Step 803, obtaining the encrypted data and the encryption key in the digital object repository, decrypting the encryption key based on the decryption key, and obtaining a second key when the attribute information satisfies a preset attribute access policy; Step 804: decrypt the encrypted data based on the second key to access the target data.

[0058] For details of steps 801-804, please refer to Figure 1 The corresponding embodiments will not be described in detail here.

[0059] Fig. 9 is a block diagram of a fine-grained access control system for a digital networking scenario provided by an embodiment of the present disclosure, such as Fig. 9 As shown, the system 900 includes: a server 901, a first terminal 902 and a second terminal 903; The server 901 is configured to receive a key request sent by the first terminal, and return a first key corresponding to the key request to the first terminal; The first terminal, 902, is used to encrypt the target data based on the second key generated locally to obtain encrypted data; The first terminal 902 is used to encrypt the second key to obtain an encryption key based on the first key and a preset attribute access policy, and associate the encrypted data with the encryption key and store them in a digital object repository; The server 901 is configured to receive an access request from the second terminal to the encrypted data, and determine attribute information of the second terminal according to the access request; The server 901 is used to generate a decryption key according to the attribute information and return the decryption key to the second terminal; The second terminal 903 is used to obtain the encrypted data and the encryption key in the digital object repository, decrypt the encryption key based on the decryption key, and obtain the second key when the attribute information satisfies the preset attribute access policy; The second terminal 903 is used to decrypt the encrypted data based on the second key to access the target data.

[0060] Fig.10 1 is a block diagram of a fine-grained access control device 1000 for a digital networking scenario provided by an embodiment of the present invention, which is applied to a server, and the server communicates with a first terminal and a second terminal; the device includes: The data encryption module 1001 is used to receive a key request sent by the first terminal, and return a first key corresponding to the key request to the first terminal; the first terminal is used to encrypt the target data based on a second key generated locally to obtain encrypted data; the first terminal is also used to encrypt the second key based on the first key and a preset attribute access policy to obtain an encryption key, and associate the encrypted data with the encryption key and store them in a digital object repository; An access response module 1002 is configured to receive an access request from the second terminal for the encrypted data, and determine attribute information of the second terminal according to the access request; The data decryption module 1003 is used to generate a decryption key according to the attribute information and return the decryption key to the second terminal; the second terminal is used to obtain the encrypted data and the encryption key in the digital object repository, decrypt the encryption key based on the decryption key, and obtain the second key when the attribute information meets the preset attribute access policy; the second terminal is also used to decrypt the encrypted data based on the second key to access the target data.

[0061] Optional, data encryption module, including: A first level submodule, configured to receive a key request sent by the first terminal, and determine a target encryption level carried in the key request; the target encryption level corresponds to the target data; A first parameter submodule, configured to determine, according to the target encryption level, a target encryption parameter corresponding to the target encryption level in a mapping relationship between encryption levels and encryption parameters; The first generating submodule is used to generate a first key according to the target encryption parameter and a preset algorithm, and return the first key to the first terminal.

[0062] Optionally, at least one node is running in the server, and each node corresponds to at least one encryption parameter; the data encryption module includes: A second level submodule, configured to receive a key request sent by the first terminal, and determine a target encryption level carried in the key request; A second parameter submodule, configured to determine, according to the target encryption level, a target encryption parameter corresponding to the target encryption level among the encryption parameters corresponding to the at least one node, and determine a target node where the target encryption parameter is located; The second generation submodule is used to generate a first key through the target node according to the target encryption parameters and a preset algorithm, and return the first key and target node information to the first terminal; the first terminal is used to associate the target node information with the encrypted data and store them in the digital object warehouse.

[0063] Optionally, the access request carries the target node information and identity information of the second terminal; Access response modules, including: An attribute search submodule, used to search for attribute information corresponding to the second terminal according to the identity information; Data decryption module, including: A target node submodule, used to determine the target node corresponding to the encrypted data according to the target node information; The third generating submodule is used to generate a decryption key through the target node according to the attribute information, and return the second key to the decryption terminal.

[0064] In summary, in an embodiment of the present invention, by receiving a key request sent by a first terminal, a first key is returned to the first terminal; the first terminal is used to encrypt the target data based on the second key generated locally to obtain encrypted data; the first terminal encrypts the second key based on the first key and the preset attribute access policy to obtain an encryption key, and associates the encrypted data and the encryption key and stores them in a digital object warehouse; receives an access request from a second terminal, determines the attribute information of the second terminal, generates a decryption key based on the attribute information and returns it to the second terminal; the second terminal obtains the encrypted data and the encryption key, decrypts the encryption key based on the decryption key, and obtains the second key when the attribute information meets the preset attribute access policy to access the target data. On the one hand, the target data is encrypted, and the second key used to access the target data is encrypted through the attribute access policy, which improves the security of the data; on the other hand, when accessing the data, it is necessary to verify the attribute information of the second terminal, and only when the attribute information meets the attribute access policy can the second key be decrypted to access the target data, which further improves the security of the data.

[0065] The fine-grained access control device for the digital networking scenario in the embodiment of the present invention can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc. The non-mobile electronic device can be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present invention.

[0066] The fine-grained access control device for the digital networking scenario in the embodiment of the present invention may be a device having an operation terminal. The operation terminal may be an Android operation terminal, an iOS operation terminal, or other possible operation terminals, which are not specifically limited in the embodiment of the present invention.

[0067] The fine-grained access control device for digital networking scenarios provided by the embodiment of the present invention can achieve Figure 1 In order to avoid repetition, the various processes implemented by the fine-grained access control device for the digital networking scenario in the method embodiment will not be described here.

[0068] Optionally, an embodiment of the present invention further provides an electronic device, including a processor, a memory, and a program or instruction stored in the memory and executable on the processor. When the program or instruction is executed by the processor, each process of the above-mentioned fine-grained access control method embodiment for the Internet of Things scenario is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0069] It should be noted that the electronic devices in the embodiments of the present invention include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0070] Fig.11 A schematic diagram of the hardware structure of an electronic device 1100 for implementing an embodiment of the present invention.

[0071] The electronic device 1100 includes but is not limited to: a radio frequency unit 1101, a network module 1102, an audio output unit 1103, an input unit 1104, a sensor 1105, a display unit 1106, an initiating user input unit 1107, an interface unit 1108, a memory 1109, and a processor 1110 and other components.

[0072] Those skilled in the art will appreciate that the electronic device 1100 may also include a power source (such as a battery) for supplying power to various components, and the power source may be logically connected to the processor 1110 via a power management terminal, thereby implementing functions such as managing charging, discharging, and power consumption management through the power management terminal. Figure 7 The electronic device structure shown in the figure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be described in detail here.

[0073] The processor 1110 is configured to receive a key request sent by the first terminal, and return a first key corresponding to the key request to the first terminal; the first terminal is configured to encrypt the target data based on a locally generated second key to obtain encrypted data; the first terminal is further configured to encrypt the second key based on the first key and a preset attribute access policy to obtain an encrypted key, and associate the encrypted data with the encryption key and store them in a digital object repository; receiving an access request from the second terminal for the encrypted data, and determining attribute information of the second terminal according to the access request; A decryption key is generated according to the attribute information, and the decryption key is returned to the second terminal; the second terminal is used to obtain the encrypted data and the encryption key in the digital object repository, decrypt the encryption key based on the decryption key, and obtain the second key when the attribute information satisfies the preset attribute access policy; the second terminal is also used to decrypt the encrypted data based on the second key to access the target data.

[0074] Optionally, the processor 1110 is configured to: receiving a key request sent by the first terminal, and determining a target encryption level carried in the key request; the target encryption level corresponds to the target data; According to the target encryption level, in a mapping relationship between encryption levels and encryption parameters, determining a target encryption parameter corresponding to the target encryption level; A first key is generated according to the target encryption parameter and a preset algorithm, and the first key is returned to the first terminal.

[0075] At least one node is running in the server, and each node corresponds to at least one encryption parameter; optionally, the processor 1110 is used to: receiving a key request sent by the first terminal, and determining a target encryption level carried in the key request; According to the target encryption level, determine, among the encryption parameters corresponding to the at least one node, a target encryption parameter corresponding to the target encryption level, and determine a target node where the target encryption parameter is located; According to the target encryption parameters and the preset algorithm, a first key is generated through the target node, and the first key and the target node information are returned to the first terminal; the first terminal is used to associate the target node information with the encrypted data and store them in the digital object warehouse.

[0076] The access request carries the target node information and the identity information of the second terminal; Optionally, the processor 1110 is configured to: searching, according to the identity information, for attribute information corresponding to the second terminal; The step of generating a decryption key according to the attribute information and returning the decryption key to the second terminal includes: Determine the target node corresponding to the encrypted data according to the target node information; A decryption key is generated through the target node according to the attribute information, and the decryption key is returned to the second terminal.

[0077] It should be understood that in the embodiment of the present invention, the input unit 1104 may include a graphics processor (GPU) 11041 and a microphone 11042, and the graphics processor 11041 processes the image data of the static picture or video obtained by the image capture device (such as a camera) in the video capture mode or the image capture mode. The display unit 1106 may include a display panel 11061, and the display panel 11061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The initiating user input unit 1107 includes at least one of a touch panel 11071 and other input devices 11072. The touch panel 11071 is also called a touch screen. The touch panel 11071 may include two parts: a touch detection device and a touch controller. Other input devices 11072 may include, but are not limited to, a physical keyboard, function keys (such as a volume control key, a switch key, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0078] The memory 1109 can be used to store software programs and various data. The memory 1109 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operation terminal, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory 1109 may include a volatile memory or a non-volatile memory, or the memory 1109 may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM). The memory 1109 in the embodiment of the present invention includes but is not limited to these and any other suitable types of memory.

[0079] The processor 1110 may include one or more processing units; optionally, the processor 1110 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to operating the terminal, initiating a user interface and an application program, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor 1110.

[0080] An embodiment of the present invention also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the above-mentioned fine-grained access control method embodiment for digital networking scenarios are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0081] The processor is a processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0082] An embodiment of the present invention further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned fine-grained access control method embodiment for digital networking scenarios, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0083] It should be understood that the chip mentioned in the embodiment of the present invention may also be called a terminal-level chip, a terminal chip, a chip terminal or an on-chip terminal chip, etc.

[0084] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0085] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

Claims

1. A fine-grained access control method for a data networking scenario, characterized in that: Applied to a server, the server communicates with a first terminal and a second terminal; the method comprises: receiving a key request sent by the first terminal, and returning a first key corresponding to the key request to the first terminal; the first terminal is used to encrypt target data based on a locally generated second key to obtain encrypted data; the first terminal is also used to encrypt the second key based on the first key and a preset attribute access policy to obtain an encrypted key, and associate the encrypted data with the encryption key and store them in a digital object repository; receiving an access request from the second terminal for the encrypted data, and determining attribute information of the second terminal according to the access request; A decryption key is generated according to the attribute information, and the decryption key is returned to the second terminal; the second terminal is used to obtain the encrypted data and the encryption key in the digital object repository, decrypt the encryption key based on the decryption key, and obtain the second key when the attribute information satisfies the preset attribute access policy; the second terminal is also used to decrypt the encrypted data based on the second key to access the target data.

2. The method according to claim 1, characterized in that The step of receiving the key request sent by the first terminal and returning the first key corresponding to the key request to the first terminal includes: receiving a key request sent by the first terminal, and determining a target encryption level carried in the key request; the target encryption level corresponds to the target data; According to the target encryption level, in a mapping relationship between encryption levels and encryption parameters, determining a target encryption parameter corresponding to the target encryption level; A first key is generated according to the target encryption parameter and a preset algorithm, and the first key is returned to the first terminal.

3. The method according to claim 1, characterized in that At least one node is running in the server, and each node corresponds to at least one encryption parameter; the step of receiving the key request sent by the first terminal and returning the first key corresponding to the key request to the first terminal includes: receiving a key request sent by the first terminal, and determining a target encryption level carried in the key request; According to the target encryption level, determine, among the encryption parameters corresponding to the at least one node, a target encryption parameter corresponding to the target encryption level, and determine a target node where the target encryption parameter is located; According to the target encryption parameters and the preset algorithm, a first key is generated through the target node, and the first key and the target node information are returned to the first terminal; the first terminal is used to associate the target node information with the encrypted data and store them in the digital object warehouse.

4. The method according to claim 3, characterized in that The access request carries the target node information and the identity information of the second terminal; and the step of determining the attribute information of the second terminal according to the access request includes: searching, according to the identity information, for attribute information corresponding to the second terminal; The step of generating a decryption key according to the attribute information and returning the decryption key to the second terminal includes: Determine the target node corresponding to the encrypted data according to the target node information; A decryption key is generated through the target node according to the attribute information, and the decryption key is returned to the second terminal.

5. A fine-grained access control method for a data networking scenario, characterized in that: Applied to a first terminal, the first terminal communicates with a server and a second terminal; the method includes: Sending a key request to the server, and receiving a first key returned by the server; Encrypting the target data based on the second key generated locally to obtain encrypted data; Based on the first key and the preset attribute access policy, encrypting the second key to obtain an encrypted key; The encrypted data and the encryption key are associated and stored in a digital object repository.

6. A fine-grained access control method for a data networking scenario, characterized in that: Applied to a second terminal, the second terminal communicates with a server and a first terminal; the method includes: Based on the encrypted data to be accessed, generating an access request for the encrypted data; Sending the access request to the server, and receiving a decryption key returned by the server; the decryption key is generated according to the attribute information of the second terminal; Acquire the encrypted data and the encryption key in the digital object repository, decrypt the encryption key based on the decryption key, and obtain a second key when the attribute information satisfies a preset attribute access policy; The encrypted data is decrypted based on the second key to access the target data.

7. A fine-grained access control system for digital networking scenarios, characterized in that: The system comprises: a server, a first terminal and a second terminal; The server is configured to receive a key request sent by the first terminal, and return a first key corresponding to the key request to the first terminal; The first terminal is used to encrypt the target data based on the second key generated locally to obtain encrypted data; The first terminal is configured to encrypt the second key based on the first key and a preset attribute access policy to obtain an encryption key, and associate the encrypted data with the encryption key and store them in a digital object repository; The server is configured to receive an access request from the second terminal to the encrypted data, and determine attribute information of the second terminal according to the access request; The server is configured to generate a decryption key according to the attribute information and return the decryption key to the second terminal; The second terminal is used to obtain the encrypted data and the encryption key in the digital object repository, decrypt the encryption key based on the decryption key, and obtain the second key when the attribute information satisfies the preset attribute access policy; The second terminal is used to decrypt the encrypted data based on the second key to access the target data.

8. A fine-grained access control device for a digital networking scenario, characterized in that: Applied to a server, the server communicates with a first terminal and a second terminal; the device comprises: a data encryption module, configured to receive a key request sent by the first terminal, and return a first key corresponding to the key request to the first terminal; the first terminal is configured to encrypt target data based on a locally generated second key to obtain encrypted data; the first terminal is further configured to encrypt the second key based on the first key and a preset attribute access policy to obtain an encryption key, and associate the encrypted data with the encryption key and store them in a digital object repository; an access response module, configured to receive an access request from the second terminal for the encrypted data, and determine attribute information of the second terminal according to the access request; A data decryption module is used to generate a decryption key according to the attribute information and return the decryption key to the second terminal; the second terminal is used to obtain the encrypted data and the encryption key in the digital object repository, decrypt the encryption key based on the decryption key, and obtain the second key when the attribute information satisfies the preset attribute access policy; the second terminal is also used to decrypt the encrypted data based on the second key to access the target data.

9. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein when the program or instruction is executed by the processor, the steps of the fine-grained access control method for a digital networking scenario as described in any one of claims 1 to 6 are implemented.

10. A readable storage medium, characterized in that: The readable storage medium stores programs or instructions, and when the programs or instructions are executed by the processor, the steps of the fine-grained access control method for the Internet of Things scenario as described in any one of claims 1 to 6 are implemented.

Images