Data system and dynamic access control method based on historical access records

Abstract

The invention discloses a data system and a dynamic access control method based on historical access records, belongs to the technical field of network security, and aims to solve the technical problem of how to combine a rule-based access control mechanism and a mandatory access control mechanism to enhance the flexibility of mandatory access control. Comprising an access control module, a dynamic permission change module, an authentication and authorization module and a data storage module, the access control module is used for controlling access control of a user to a data file based on a BLP model, and the dynamic permission change module is used for performing permission change on the user based on a historical access record and a predetermined rule. The authentication and authorization module is used for carrying out identity authentication on a user based on an authentication request submitted by the user, and the data storage module is used for storing basic information of the user, a security level tag of the user, a data file and a security level tag of the data file through a block chain, and is used for providing data transaction by calling an intelligent contract.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, in particular to a data system and a dynamic access control method based on historical access records. Background Art

[0002] The existing common access control mechanisms mainly include DAC (discretionary access control), role-BAC (role-based access control), rule-BAC (rule-based access control) and MAC (mandatory access control). In discretionary access control, file access rules are determined by the file owner. The advantage is that it is more flexible and easy to maintain, but it also has problems such as difficulty in overall management and security dependence on the file owner; in role-based access control, file access permissions are aggregated into roles and assigned to corresponding users. The advantage is that it is easy to manage permissions in a unified manner, but there are also problems such as inflexible role-user mapping; in rule-based access control, file access rules are determined by the information of both parties. The advantage is that it is suitable for complex scenarios, but there are also problems such as conflicts between rules and complex management; in mandatory access control, file access rules are determined based on the security level labels of both users and files. The advantage is that it can maximize the security of files, but there are also problems such as inflexible permissions and difficult to adjust and change security policies.

[0003] How to combine the rule-based access control mechanism and the mandatory access control mechanism and enhance the flexibility of mandatory access control is a technical problem that needs to be solved. Summary of the invention

[0004] The technical task of the present invention is to address the above shortcomings and provide a data system and a dynamic access control method based on historical access records to solve the technical problem of how to combine the rule-based access control mechanism and the mandatory access control mechanism to enhance the flexibility of mandatory access control.

[0005] In a first aspect, the present invention provides a data system, including an access control module, a dynamic permission change module, an authentication and authorization module, and a data storage module;

[0006] The access control module is used to control the user's access to data files based on the BLP model, add security level labels to all users and data files through the BLP model, and control the user's access rights to data files in a read-up and write-down manner, wherein the read-up and write-down manner is understood as: the user can only view the data files with a security level equal to or lower than the user's own security level, and can only add new content to the data files with a security level equal to or lower than the user's own security level;

[0007] The dynamic permission change module is used to obtain the historical access records of the user accessing the data file within a predetermined time period through a scheduled task, and change the user's permissions based on the historical access records and predetermined rules, wherein the historical access records include the security level of the data file accessed by the user and the corresponding access times;

[0008] The authentication and authorization module cooperates with a designated third party to authenticate the user based on the authentication request submitted by the user, allowing the authenticated user to perform data operations, and to temporarily authorize the user to access the high-security level data file based on the user's authentication request;

[0009] The data storage module is used to store the user's basic information, the user's security level label, the data file and the security level label of the data file through the blockchain, and is used to provide data transactions by calling smart contracts. The data transaction supports users with access rights to access and query data stored in the blockchain, wherein the data in the data file and the data fragments are encrypted and stored on each storage node.

[0010] Preferably, the dynamic permission change module is used to perform the following steps to change the user's permission based on historical access records and predetermined rules:

[0011] For a data file that is higher than the user's security level, if the user has accessed the data file a predetermined number of times, the rule is triggered to change the user's security level to the security level of the accessed data file, and the user obtains a high security level through the change;

[0012] For the high security level obtained by the user through the change, if the user does not access the data file corresponding to the high security level within the predetermined time or the number of accesses to the data file is less than the predetermined number, the rule is triggered to reduce the user's security level to the user's original security level.

[0013] Preferably, the authentication and authorization module is used to authenticate and authorize the user through a decentralized identity system, and the authentication request includes a user identifier DID and a verifiable credential VC;

[0014] The user ID DID is an identifier created by the user in the blockchain. The user ID DID is stored in the decentralized identity system in the form of a key, and the corresponding value is a document, which is used for user identity authentication;

[0015] Verifiable credentials VC are credentials that users apply for from a designated third party;

[0016] Based on the authentication request submitted by the user, the authentication and authorization module is used to verify the DID database based on the user identifier DID, and to verify the designated third party based on the credentials. After the DID database and the third party are verified, the user passes the identity authentication.

[0017] When a user needs to access a data file with a higher security level, the user submits an authentication request. Based on the user identifier DID, verifiable credentials VC and user needs in the authentication request, the authentication and authorization module is used to authenticate the user and temporarily authorize the user to access the data file with the corresponding security level based on the needs.

[0018] Preferably, the data storage module is used to perform the following:

[0019] Data preprocessing: preprocess the data to be stored, convert the data into a predetermined format through preprocessing, and divide the preprocessed data into multiple data slices;

[0020] Data encryption: Each data shard is encrypted with an encryption key, and a unique hash value is generated based on the encryption key and the data shard. The hash value serves as a unique identifier for data transactions on the blockchain and is used to verify the integrity and authenticity of the data.

[0021] Copy and distribute shards: copy each data shard and distribute the copied data shards to each storage node. The number of copies of the data shard and the storage location of the data shard are set by the data owner;

[0022] Access and query data: By calling the methods of smart contracts, users with access rights are supported to access and view data stored in the blockchain;

[0023] User rights maintenance: The user's access rights to data files are maintained through an access control list, which includes the user's security level, the security level of the data file, and the data files to which each user has access rights.

[0024] In a second aspect, a dynamic access control method based on historical access records of the present invention is applied to a data system as described in any one of the first aspects, comprising the following steps:

[0025] Authentication and authorization: Authentication of users based on authentication requests submitted by users, allowing authenticated users to perform data operations, and temporarily authorizing users to access high-security data files based on authentication requests;

[0026] Data storage: The blockchain stores the user's basic information, the user's security level label, the data file, and the security level label of the data file, and is used to provide data transactions by calling smart contracts. Data transactions support users with access rights to access and query data stored in the blockchain. The data in the data file and the data fragments are encrypted and stored on each storage node.

[0027] User access control: Control user access to data files based on the BLP model. Add security level tags to all users and data files through the BLP model, and control user access rights to data files in a read-up and write-down manner. The read-up and write-down manner means that users can only view data files with a security level equal to or lower than their own security level, and can only add new content to data files with a security level equal to or lower than their own security level.

[0028] Dynamic permission change: Obtain historical access records of users accessing data files within a predetermined time period through a scheduled task, and change user permissions based on the historical access records and predetermined rules. The historical access records include the security level of the data files accessed by the user and the corresponding number of accesses.

[0029] Preferably, changing the user's permissions based on historical access records and predetermined rules includes the following steps:

[0030] For a data file that is higher than the user's security level, if the user has accessed the data file a predetermined number of times, the rule is triggered to change the user's security level to the security level of the accessed data file, and the user obtains a high security level through the change;

[0031] For the high security level obtained by the user through the change, if the user does not access the data file corresponding to the high security level within the predetermined time or the number of accesses to the data file is less than the predetermined number, the rule is triggered to reduce the user's security level to the user's original security level.

[0032] Preferably, during authentication and authorization, the user is authenticated and authorized through a decentralized identity system, and the authentication request includes a user identifier DID and a verifiable credential VC;

[0033] The user ID DID is an identifier created by the user in the blockchain. The user ID DID is stored in the decentralized identity system in the form of a key, and the corresponding value is a document, which is used for user identity authentication;

[0034] Verifiable credentials VC are credentials that users apply for from a designated third party;

[0035] Based on the authentication request submitted by the user, the DID database is verified based on the user identifier DID, and the designated third party is verified based on the credentials. After the DID database and the third party are verified, the user passes the identity authentication.

[0036] When a user needs to access a data file with a higher security level, the user submits an authentication request. Based on the user identifier DID, verifiable credentials VC and user needs in the authentication request, the user is authenticated and the user is temporarily authorized to access the data file with the corresponding security level based on the needs.

[0037] As a preferred embodiment, when storing data, the following operations are performed to store data files and provide data transactions:

[0038] Data preprocessing: preprocess the data to be stored, convert the data into a predetermined format through preprocessing, and divide the preprocessed data into multiple data slices;

[0039] Data encryption: Each data shard is encrypted with an encryption key, and a unique hash value is generated based on the encryption key and the data shard. The hash value serves as a unique identifier for data transactions on the blockchain and is used to verify the integrity and authenticity of the data.

[0040] Copy and distribute shards: copy each data shard and distribute the copied data shards to each storage node. The number of copies of the data shard and the storage location of the data shard are set by the data owner;

[0041] Access and query data: By calling the methods of smart contracts, users with access rights are supported to access and view data stored in the blockchain;

[0042] User rights maintenance: The user's access rights to data files are maintained through the access control list, which includes the user's security level, the security level of the data file, and the data files to which each user has access rights.

[0043] The data system and the dynamic access control method based on historical access records of the present invention have the following advantages:

[0044] 1. Using the BLP model in mandatory access control, users can only read file data at a level lower than their own and create files at a level higher than their own. By using the write-up and read-down method, data confidentiality and security are guaranteed to the greatest extent.

[0045] 2. Use a decentralized identity system for authentication to confirm the identity of the user when applying to read high-level file data, to ensure that no one impersonates the user to apply to read high-level file data, causing file data leakage;

[0046] 3. Dynamic access control is performed based on historical access records to ensure that users do not need to frequently authenticate when they need to frequently access high-level files under special circumstances. This increases the flexibility of the access control model while ensuring security. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] The present invention is further described below in conjunction with the accompanying drawings.

[0049] Figure 1 is a structural block diagram of the data system of Example 1;

[0050] Figure 2 This is a flowchart of the user process in the data system of Example 1;

[0051] Figure 3 This is a flowchart of the data system security level change process in Example 1. DETAILED DESCRIPTION

[0052] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments are not intended to limit the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments may be combined with each other.

[0053] The embodiments of the present invention provide a data system and a dynamic access control method based on historical access records, which are used to solve the technical problem of how to combine a rule-based access control mechanism and a mandatory access control mechanism and enhance the flexibility of mandatory access control.

[0054] Embodiment 1:

[0055] The present invention provides a data system, comprising an access control module, a dynamic authority change module, an authentication and authorization module and a data storage module.

[0056] The access control module is used to control user access to data files based on the BLP model. Security level labels are added to all users and data files through the BLP model, and user access rights to data files are controlled in a read-up and write-down manner. The read-up and write-down manner is understood as: users can only view data files with a security level equal to or lower than their own security level, and can only add new content to data files with a security level equal to or lower than their own security level.

[0057] In this embodiment, the access control module uses the BLP model in the mandatory access control to complete the user's access control to the data file. The BLP model adds security level labels to all users and files, and divides the security level into five levels: public, restricted, secret, confidential, and highly confidential. In the BLP model, users can only add content to files with a security level equal to or higher than their own security level. Similarly, users can only view files with a security level equal to or lower than their own security level.

[0058] Through the "up-down, down-read" security policy, the BLP model can ensure that under normal circumstances, high-security file information will not flow to low-security information, thereby protecting the confidentiality of the file. At the same time, the BLP model also defines the system, system state, transition rules between states, and a set of security features. These rules and features constrain the system state and state transitions to ensure that if the initial state of the system is secure, then after a series of rule operations, the system remains in a secure state. Through the use of the BLP model, the system can ensure that only subjects with the corresponding security level can access objects of the corresponding level, thereby effectively preventing unauthorized access and data leakage.

[0059] The dynamic permission change module is used to obtain the historical access records of users accessing data files within a predetermined time period through a scheduled task, and change the user's permissions based on the historical access records and predetermined rules, where the historical access records include the security level of the data files accessed by the user and the corresponding number of accesses.

[0060] As a specific implementation, the dynamic permission change module is used to perform the following to change the user's permissions based on historical access records and predetermined rules:

[0061] (1) For a data file that is higher than the user's security level, if the user has accessed the data file a predetermined number of times, the rule is triggered to change the user's security level to the security level of the accessed data file, and the user obtains a higher security level through the change;

[0062] (2) For a high security level obtained by a user through a change, if the user does not access a data file corresponding to the high security level within a predetermined time or the number of accesses to the data file is less than a predetermined number, a rule is triggered to reduce the user's security level to the user's original security level.

[0063] In this embodiment, the dynamic permission change module automatically changes the user's security level by setting a series of rules and combining the user's historical access records in the past period of time. In the dynamic permission change module, the module will set a timer task to count the security level and corresponding access times of the user's access to the file within a certain period of time, so as to determine whether the corresponding rule is triggered, and change the permissions of the user who triggered the rule.

[0064] For files with a security level lower than or equal to the user's security level, the user can read the file data. For files with a security level higher than the user's security level, when the user accesses the high-level file a certain number of times within a certain period of time, the rules set in the module are triggered. The dynamic permission change module will automatically change the user's security level to a corresponding higher level. Similarly, if the user does not continue to access high-level files for a period of time or does not access high-level files a certain number of times, the rules set in the module are triggered, and the dynamic permission change module will automatically reduce the user's security level back to the user's original security level.

[0065] By setting the number of times a user's security level must be changed to access a high-level file and the duration of the permission change, the system can determine the flexibility of user permissions and the security of data files. The system can also set other permission change rules in the dynamic permission change module to control the user's security level in the system.

[0066] The authentication and authorization module works with a designated third party to authenticate users based on authentication requests submitted by users, allowing authenticated users to perform data operations, and temporarily authorizing users to access high-security data files based on their authentication requests.

[0067] As a specific implementation, the authentication and authorization module is used to authenticate and authorize users through a decentralized identity system. The authentication request includes a user identifier DID and a verifiable credential VC. The user identifier DID is an identifier created by the user in the blockchain. The user identifier DID is stored in the decentralized identity system in the form of a key, and the corresponding value is a document used for user identity authentication; the verifiable credential VC is the credential that the user applies for from a designated third party.

[0068] Based on the authentication request submitted by the user, the authentication and authorization module is used to verify the DID database based on the user identifier DID, and to verify the designated third party based on the credentials. After the DID database and the third party are verified, the user passes the identity authentication.

[0069] When a user needs to access a data file with a higher security level, the user submits an authentication request. Based on the user identifier DID, verifiable credentials VC and user needs in the authentication request, the authentication and authorization module is used to authenticate the user and temporarily authorize the user to access the data file with the corresponding security level based on the needs.

[0070] In this embodiment, the authentication and authorization module uses a decentralized identity system (DID) to authenticate and authorize users. First, the user needs to create a DID on the blockchain as the user's unique identifier. DID is a new type of identifier. The DID identifier is stored in the DID database in the form of a key, and the corresponding value is a DID document, which is used to authenticate the user's identity. Secondly, the user needs to obtain verifiable credentials (VC) from different issuers (such as certificate issuers, such as universities, public security agencies and other authoritative institutions). These credentials can be digital certificates, identity certificates, etc. As the holder, the user will save the credentials issued by these authoritative institutions. Finally, when the user needs to authenticate, the user can selectively disclose the relevant credentials and prove the validity of these credentials to the credential verifier (IV) through smart contracts or other verification mechanisms. In the whole process, the authentication and authorization module will use the verifiable credentials (VC) to verify the credential verifier (IV), and use the DID identifier to verify the DID database. The two are combined to complete the authentication of the user's identity.

[0071] After the user passes the authentication, the authentication and authorization module allows the user to log in to the system to operate the data. When the user needs to view and operate files with a security level higher than his own due to special circumstances, the user can initiate an authentication request to the authentication center again. After confirming the user's identity and needs, the authentication center temporarily authorizes the user to access the corresponding high-level files.

[0072] The data storage module is used to store the user's basic information, the user's security level label, data files and the security level label of the data file through the blockchain, and is used to provide data transactions by calling smart contracts. Data transactions support users with access rights to access and query data stored in the blockchain, where the data in the data file and the data fragments are encrypted and stored on each storage node.

[0073] As a specific implementation, the data storage module is used to perform five steps: data preprocessing, data encryption, replication and distribution, data access and query, and user authority maintenance.

[0074] Data preprocessing: Preprocess the data to be stored, convert the data into a predetermined format through preprocessing, and divide the preprocessed data into multiple data shards.

[0075] As a specific implementation, before storing the data, the data storage module will perform some preprocessing on the data, including converting the data into an appropriate format (such as JSON, binary, etc.) for effective storage and query in the blockchain. The data storage module will then divide the data into smaller fragments, breaking the data into manageable blocks and distributing them on multiple nodes for storage.

[0076] Data encryption: Each data shard is encrypted with an encryption key, and a unique hash value is generated based on the encryption key and the data shard. The hash value serves as a unique identifier for data transactions on the blockchain and is used to verify the integrity and authenticity of the data.

[0077] As a specific implementation, the data storage module will encrypt each data shard to ensure the security and privacy of the data during transmission and storage. The content owner can fully control the encryption process to ensure that only authorized users can access and view the data. At the same time, the data storage module will generate a unique hash based on the sharded data or encryption key. This hash value will serve as the unique identifier of the transaction on the blockchain to verify the integrity and authenticity of the data.

[0078] Replicate shards and distribute: Copy each data shard and distribute the replicated data shards to each storage node. The number of copies of the data shard and the storage location of the data shard are set by the data owner.

[0079] As a specific implementation, the data storage module replicates each shard and distributes the replicated shards to geographically dispersed storage nodes to ensure sufficient redundant copies to ensure data availability and performance and prevent performance degradation and data loss. The content owner decides the number of copies of each shard and where these shards are located. During this process, the content owner should establish a threshold for the minimum number of copies that need to be maintained to ensure that no data is lost.

[0080] Access and query data: By calling the methods of smart contracts, users with access rights are supported to access and view data stored in the blockchain.

[0081] As a specific implementation, by calling the methods of smart contracts, data stored in the blockchain can be accessed and queried. Smart contracts are automated codes executed on the blockchain that can define the storage and access rules of data to ensure data consistency and security.

[0082] User rights maintenance: The user's access rights to data files are maintained through the access control list, which includes the user's security level, the security level of the data file, and the data files to which each user has access rights.

[0083] The data storage module of this embodiment can save user information and security level labels, and maintain access control lists to ensure that only authorized users can access corresponding data. By using blockchain, the data storage module stores data in a decentralized manner, ensuring high security, high reliability, non-tamperability and high efficiency of the data.

[0084] The operation process of this embodiment based on the data system is as follows:

[0085] Step 1: The user uses DID to authenticate and log into the system. At this time, the user can only read file data with a security level lower than or equal to his own security level;

[0086] Step 2: When a user needs to read high-level file data under special circumstances, he or she can apply to the authentication center. After the authentication center confirms that the user has passed the identity authentication, it will authorize the user to access the corresponding file. After obtaining authorization, the user can read the corresponding high-level file data that needs to be read;

[0087] Step 3: If a user frequently reads high-level file data for a certain number of times within a certain period of time, and the rules set in the dynamic permission change module are met, the user's security level will be automatically temporarily changed to a high level. At this time, the user can read file data with the same security level or lower than his own;

[0088] Step 4: If the user does not read high-level file data for a certain number of times within a certain period of time and no longer meets the rules set in the dynamic permission change module, the user's security level will automatically be reduced to the user's original level.

[0089] Embodiment 2:

[0090] The present invention provides a dynamic access control method based on historical access records, which is implemented based on the data system disclosed in Example 1 and includes four steps: authentication and authorization, data storage, user access control, and dynamic permission change.

[0091] Step S100 Authentication and Authorization: Authentication is performed on the user based on the authentication request submitted by the user, and the authenticated user is allowed to perform data operations, and is used to temporarily authorize the user to access high-security-level data files based on the user's authentication request.

[0092] In this embodiment, the user is authenticated and authorized through a decentralized identity system. The authentication request includes a user identifier DID and a verifiable credential VC. The user identifier DID is an identifier created by the user in the blockchain. The user identifier DID is stored in the decentralized identity system in the form of a key, and the corresponding value is a document, which is used for user identity authentication; the verifiable credential VC is the credential that the user applies for from a designated third party.

[0093] During authentication and authorization, based on the authentication request submitted by the user, the user's DID is used to verify with the DID database, and based on the credentials, the user is verified with the designated third party. After both the DID database and the third party are verified, the user passes the identity authentication.

[0094] When a user needs to access a data file with a higher security level, the user submits an authentication request. Based on the user identifier DID, verifiable credentials VC and user needs in the authentication request, the authentication and authorization module is used to authenticate the user and temporarily authorize the user to access the data file with the corresponding security level based on the needs.

[0095] In this embodiment, a decentralized identity system (DID) is used to authenticate and authorize users. First, the user needs to create a DID on the blockchain as the user's unique identifier. DID is a new type of identifier. The DID identifier is stored in the DID database in the form of a key, and the corresponding value is a DID document, which is used to authenticate the user's identity. Secondly, the user needs to obtain verifiable credentials (VC) from different issuers (such as certificate issuers, such as universities, public security agencies and other authoritative institutions). These credentials can be digital certificates, identity certificates, etc. As the holder, the user will save the credentials issued by these authoritative institutions. Finally, when the user needs to be authenticated, the user can selectively disclose the relevant credentials and prove the validity of these credentials to the credential verifier (IV) through smart contracts or other verification mechanisms. In the whole process, the authentication and authorization module will use the verifiable credentials (VC) to verify the credential verifier (IV), and use the DID identifier to verify the DID database. The two are combined to complete the authentication of the user's identity.

[0096] After the user passes the authentication, the user is allowed to log in to the system to operate the data. If the user needs to view and operate files with a security level higher than his own due to special circumstances, the user can initiate an authentication request to the authentication center again. After confirming the user's identity and needs, the authentication center will temporarily authorize the user to access the corresponding high-level files.

[0097] Step S200 Data storage: The basic information of the user, the user's security level label, the data file and the security level label of the data file are stored through the blockchain, and is used to provide data transactions by calling smart contracts. The data transaction supports users with access rights to access and query the data stored in the blockchain, wherein the data in the data file and the data fragments are encrypted and stored on each storage node.

[0098] The specific implementation of data storage includes five steps: data preprocessing, data encryption, shard replication and distribution, data access and query, and user authority maintenance.

[0099] Data preprocessing: Preprocess the data to be stored, convert the data into a predetermined format through preprocessing, and divide the preprocessed data into multiple data shards.

[0100] As a specific implementation, before storing the data, some preprocessing is performed on the data, including converting the data into an appropriate format (such as JSON, binary, etc.) for effective storage and query in the blockchain. Then the data storage module will also divide the data into smaller fragments, breaking the data into manageable blocks and distributing them on multiple nodes for storage.

[0101] Data encryption: Each data shard is encrypted with an encryption key, and a unique hash value is generated based on the encryption key and the data shard. The hash value serves as a unique identifier for data transactions on the blockchain and is used to verify the integrity and authenticity of the data.

[0102] As a specific implementation, each data shard is encrypted to ensure the security and privacy of the data during transmission and storage. The content owner has full control over the encryption process to ensure that only authorized users can access and view the data. At the same time, a unique hash is generated based on the sharded data or encryption key. This hash value will serve as the unique identifier of the transaction on the blockchain to verify the integrity and authenticity of the data.

[0103] Replicate shards and distribute: Copy each data shard and distribute the replicated data shards to each storage node. The number of copies of the data shard and the storage location of the data shard are set by the data owner.

[0104] As a specific implementation, replicate each data shard and distribute the replicated shards to geographically dispersed storage nodes to ensure sufficient redundant copies, thereby ensuring data availability and performance and preventing performance degradation and data loss. It is up to the content owner to decide the number of copies of each shard and where these shards are located. During this process, the content owner should establish a threshold for the minimum number of copies that need to be maintained to ensure that no data is lost.

[0105] Access and query data: By calling the methods of smart contracts, users with access rights are supported to access and view data stored in the blockchain.

[0106] As a specific implementation, by calling the methods of smart contracts, data stored in the blockchain can be accessed and queried. Smart contracts are automated codes executed on the blockchain that can define the storage and access rules of data to ensure data consistency and security.

[0107] User rights maintenance: The user's access rights to data files are maintained through the access control list, which includes the user's security level, the security level of the data file, and the data files to which each user has access rights.

[0108] The method of this embodiment can save user information and security level labels, and maintain access control lists to ensure that only authorized users can access corresponding data. By using blockchain, the data storage module stores data in a decentralized manner, ensuring high security, high reliability, non-tamperability and high efficiency of the data.

[0109] Step S300 user access control: control user access to data files based on the BLP model, add security level labels to all users and data files through the BLP model, and control user access rights to data files in a read-up and write-down manner, wherein the read-up and write-down manner is understood as: users can only view data files with a security level equal to or lower than their own security level, and can only add new content to data files with a security level equal to or lower than their own security level.

[0110] In this embodiment, the BLP model in the mandatory access control is used to complete the user's access control to the data file. The BLP model adds security level labels to all users and files, and divides the security level into five levels: public, restricted, secret, confidential, and highly confidential. In the BLP model, users can only add content to files with a security level equal to or higher than their own security level. Similarly, users can only view files with a security level equal to or lower than their own security level.

[0111] Through the "up-down, down-read" security policy, the BLP model can ensure that under normal circumstances, high-security file information will not flow to low-security information, thereby protecting the confidentiality of the file. At the same time, the BLP model also defines the system, system state, transition rules between states, and a set of security features. These rules and features constrain the system state and state transitions to ensure that if the initial state of the system is secure, then after a series of rule operations, the system remains in a secure state. Through the use of the BLP model, the system can ensure that only subjects with the corresponding security level can access objects of the corresponding level, thereby effectively preventing unauthorized access and data leakage.

[0112] Step S400 Dynamic permission change: Obtain historical access records of users accessing data files within a predetermined time period through a scheduled task, and change the user's permissions based on the historical access records and predetermined rules, wherein the historical access records include the security level of the data files accessed by the user and the corresponding number of accesses.

[0113] As a specific implementation, the user's permissions are changed based on historical access records and predetermined rules, including the following operations:

[0114] (1) For a data file that is higher than the user's security level, if the user has accessed the data file a predetermined number of times, the rule is triggered to change the user's security level to the security level of the accessed data file, and the user obtains a higher security level through the change;

[0115] (2) For a high security level obtained by a user through a change, if the user does not access a data file corresponding to the high security level within a predetermined time or the number of accesses to the data file is less than a predetermined number, a rule is triggered to reduce the user's security level to the user's original security level.

[0116] In this embodiment, a series of rules are set to automatically change the user's security level in combination with the user's historical access records over the past period of time. In the specific implementation process, a scheduled task is set to count the security level of the user's access to the file and the corresponding number of accesses within a certain period of time, so as to determine whether the corresponding rule is triggered and change the permissions of the user who triggered the rule.

[0117] For files that are lower than or equal to the user's security level, the user can read the file data. For files that are higher than the user's security level, when the user accesses the high-level file a certain number of times within a certain period of time, the set rules are triggered. This embodiment changes the user's security level to a corresponding higher level. Similarly, if the user does not continue to access the high-level file for a period of time or does not access the high-level file a certain number of times, the set rules are triggered and the user's security level is automatically reduced to the user's original security level.

[0118] By setting the number of times that access to high-level files requires a user security level change and the duration of the permission change, you can determine the flexibility of user permissions and the security of data files. You can also set other permission change rules to control the user's security level in the system.

[0119] The method of this embodiment combines the mandatory access control mechanism and the rule-based access control mechanism, and can dynamically change the user's security level according to the number of times the user reads a high-security level file within a certain period of time. In this way, while ensuring the security of data to the greatest extent, the flexibility of user access control is increased, so that when users frequently need to read file data higher than their own security level, they do not need to frequently authenticate to the authentication center.

[0120] The use of a decentralized identity system to authenticate user identities can ensure user privacy, reduce fraud and identity theft, and does not rely on a single central server or authority. It can significantly reduce the risk of single point failures and network attacks, thereby enhancing data security and protection.

[0121] The use of blockchain to store data has the advantages of high security, high reliability, decentralization, high transparency, immutability and high efficiency, and can ensure the security and reliability of data to the greatest extent.

[0122] The present invention has been shown and described in detail above through the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art can know that the means in the above different embodiments can be combined to obtain more embodiments of the present invention, and these embodiments are also within the protection scope of the present invention.

Claims

1. A data system, characterized in that: It includes access control module, dynamic permission change module, authentication and authorization module and data storage module; The access control module is used to control the user's access to data files based on the BLP model, add security level labels to all users and data files through the BLP model, and control the user's access rights to data files in a read-up and write-down manner, wherein the read-up and write-down manner is understood as: the user can only view the data files with a security level equal to or lower than the user's own security level, and can only add new content to the data files with a security level equal to or lower than the user's own security level; The dynamic permission change module is used to obtain the historical access records of the user accessing the data file within a predetermined time period through a scheduled task, and change the user's permissions based on the historical access records and predetermined rules, wherein the historical access records include the security level of the data file accessed by the user and the corresponding access times; The authentication and authorization module cooperates with a designated third party to authenticate the user based on the authentication request submitted by the user, allowing the authenticated user to perform data operations, and to temporarily authorize the user to access the high-security level data file based on the user's authentication request; The data storage module is used to store the user's basic information, the user's security level label, the data file and the security level label of the data file through the blockchain, and is used to provide data transactions by calling smart contracts. The data transaction supports users with access rights to access and query data stored in the blockchain, wherein the data in the data file and the data fragments are encrypted and stored on each storage node.

2. The data system according to claim 1, characterized in that: The dynamic permission change module is used to perform the following operations to change the user's permissions based on historical access records and pre-defined rules: For a data file that is higher than the user's security level, if the user has accessed the data file a predetermined number of times, the rule is triggered to change the user's security level to the security level of the accessed data file, and the user obtains a high security level through the change; For the high security level obtained by the user through the change, if the user does not access the data file corresponding to the high security level within the predetermined time or the number of accesses to the data file is less than the predetermined number, the rule is triggered to reduce the user's security level to the user's original security level.

3. The data system according to claim 1, characterized in that: The authentication and authorization module is used to authenticate and authorize users through a decentralized identity system. The authentication request includes the user identifier DID and the verifiable credential VC; The user ID DID is an identifier created by the user in the blockchain. The user ID DID is stored in the decentralized identity system in the form of a key, and the corresponding value is a document, which is used for user identity authentication; Verifiable credentials VC are credentials that users apply for from a designated third party; Based on the authentication request submitted by the user, the authentication and authorization module is used to verify the DID database based on the user identifier DID, and to verify the designated third party based on the credentials. After the DID database and the third party are verified, the user passes the identity authentication. When a user needs to access a data file with a higher security level, the user submits an authentication request. Based on the user identifier DID, verifiable credentials VC and user needs in the authentication request, the authentication and authorization module is used to authenticate the user and temporarily authorize the user to access the data file with the corresponding security level based on the needs.

4. The data system according to claim 1, characterized in that: The data storage module is used to perform the following: Data preprocessing: preprocess the data to be stored, convert the data into a predetermined format through preprocessing, and divide the preprocessed data into multiple data slices; Data encryption: Each data shard is encrypted with an encryption key, and a unique hash value is generated based on the encryption key and the data shard. The hash value serves as a unique identifier for data transactions on the blockchain and is used to verify the integrity and authenticity of the data. Copy and distribute shards: copy each data shard and distribute the copied data shards to each storage node. The number of copies of the data shard and the storage location of the data shard are set by the data owner; Access and query data: By calling the methods of smart contracts, users with access rights are supported to access and view data stored in the blockchain; User rights maintenance: The user's access rights to data files are maintained through an access control list, which includes the user's security level, the security level of the data file, and the data files to which each user has access rights.

5. A dynamic access control method based on historical access records, characterized in that: A data system according to any one of claims 1 to 4, comprising the following steps: Authentication and authorization: Authentication of users based on authentication requests submitted by users, allowing authenticated users to perform data operations, and temporarily authorizing users to access high-security data files based on authentication requests; Data storage: The blockchain stores the user's basic information, the user's security level label, the data file, and the security level label of the data file, and is used to provide data transactions by calling smart contracts. Data transactions support users with access rights to access and query data stored in the blockchain. The data in the data file and the data fragments are encrypted and stored on each storage node. User access control: Control user access to data files based on the BLP model. Add security level tags to all users and data files through the BLP model, and control user access rights to data files in a read-up and write-down manner. The read-up and write-down manner means that users can only view data files with a security level equal to or lower than their own security level, and can only add new content to data files with a security level equal to or lower than their own security level. Dynamic permission change: Obtain historical access records of users accessing data files within a predetermined time period through a scheduled task, and change user permissions based on the historical access records and predetermined rules. The historical access records include the security level of the data files accessed by the user and the corresponding number of accesses.

6. The dynamic access control method based on historical access records according to claim 5 is characterized in that: Changing user permissions based on historical access records and pre-defined rules includes the following steps: For a data file that is higher than the user's security level, if the user has accessed the data file a predetermined number of times, the rule is triggered to change the user's security level to the security level of the accessed data file, and the user obtains a high security level through the change; For the high security level obtained by the user through the change, if the user does not access the data file corresponding to the high security level within the predetermined time or the number of accesses to the data file is less than the predetermined number, the rule is triggered to reduce the user's security level to the user's original security level.

7. The dynamic access control method based on historical access records according to claim 5 is characterized in that: During authentication and authorization, the user is authenticated and authorized through a decentralized identity system, and the authentication request includes the user identifier DID and the verifiable credential VC; The user ID DID is an identifier created by the user in the blockchain. The user ID DID is stored in the decentralized identity system in the form of a key, and the corresponding value is a document, which is used for user identity authentication; Verifiable credentials VC are credentials that users apply for from a designated third party; Based on the authentication request submitted by the user, the DID database is verified based on the user identifier DID, and the designated third party is verified based on the credentials. After the DID database and the third party are verified, the user passes the identity authentication. When a user needs to access a data file with a higher security level, the user submits an authentication request. Based on the user identifier DID, verifiable credentials VC and user needs in the authentication request, the user is authenticated and the user is temporarily authorized to access the data file with the corresponding security level based on the needs.

8. The dynamic access control method based on historical access records according to claim 5 is characterized in that: When storing data, perform the following operations to store data files and provide data transactions: Data preprocessing: preprocess the data to be stored, convert the data into a predetermined format through preprocessing, and divide the preprocessed data into multiple data slices; Data encryption: Each data shard is encrypted with an encryption key, and a unique hash value is generated based on the encryption key and the data shard. The hash value serves as a unique identifier for data transactions on the blockchain and is used to verify the integrity and authenticity of the data. Copy and distribute shards: copy each data shard and distribute the copied data shards to each storage node. The number of copies of the data shard and the storage location of the data shard are set by the data owner; Access and query data: By calling the methods of smart contracts, users with access rights are supported to access and view data stored in the blockchain; User rights maintenance: The user's access rights to data files are maintained through an access control list, which includes the user's security level, the security level of the data file, and the data files to which each user has access rights.

Images