Block chain-based operation management system
By designing a blockchain -based operation management system, the traditional network security model cannot effectively guarantee the problem of network access security, realize high security and intelligent management control, and ensure data privacy security and network availability.
Patent Information
- Application Number
- CN202411270644.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-11
- Publication Date
- 2025-01-28
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Traditional network security models cannot effectively ensure the security of network access at this stage, especially when facing new cyber attack methods such as internal threats and forged identity attacks.
Design a blockchain -based operating management system. Through identity management model design, cross -chain management and access control, analysis and optimization management, data collection storage and early warning notification processing and other technical means to achieve high security and intelligent management control.
The unified identity identity of the blockchain technology is generated to ensure the privacy security of data, automatically increase the cross -chain network node, ensure network availability, realize security analysis and decision -making on user access behavior, and improve network access security.
Smart Images
Figure CN119382922A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of blockchain, and in particular to an operation management system based on blockchain. Background Art
[0002] With the development of new generation information technologies such as the Internet, cloud computing and big data, network structures have become increasingly complex. Traditional network security models mainly focus on identity management and access control at the network boundary, and their defense means mainly rely on intercepting attacks outside the trusted internal network. The traditional network security model divides the network into untrusted areas, network boundary isolation areas and trusted areas (intranet). Important resources such as application servers and data centers are deployed in the intranet for protection; the network boundary isolation area is mainly composed of security devices such as firewalls, gateways and intrusion detection systems. Mobile phones, desktops or laptops in the untrusted area need to pass strict detection and monitoring in the network boundary isolation area before they can remotely access resources in the intranet. With the emergence of new network attack methods such as internal threat attacks and forged identity attacks, the explosive growth of network scale, the flattening of networks and the blurring of network boundaries, the traditional network security model can no longer guarantee the security of network access at this stage. Therefore, it is necessary to design a blockchain-based operation management system with high security and intelligent management and control. Summary of the invention
[0003] The purpose of the present invention is to provide a blockchain-based operation management system to solve the problems raised in the above-mentioned background technology.
[0004] In order to solve the above technical problems, the present invention provides the following technical solutions: a blockchain-based operation management method, comprising: Design and build the identity management model for the operation management system; Conduct cross-chain management and access control on the operation management system; Conduct analysis and optimization management of the operation management system; Carry out data collection, storage and early warning notification processing for the operation management system; The design and construction of the identity management model for operating the management system includes: An identity management model is designed and constructed for the operation management system. The model is divided into four layers: identity management system layer, slave blockchain layer, cross-chain communication layer and main blockchain layer.
[0005] According to the above technical solution, the cross-chain management and access control of the operation management system includes: Use cross-chain network components to achieve cross-chain communication, where the cross-chain network is located between the main chain and the slave chain, and is composed of a set number of nodes. The nodes in the cross-chain network are controlled not to participate in the consensus of any chain, and are only responsible for converting communication protocols, transmitting data, and ensuring the atomicity and consistency of cross-chain transactions; The blockchain layer determines whether the user has access rights, and then the access assessment layer calculates the risk value of the user's access. If the risk value exceeds the set threshold, the access request will be denied even if the user has access rights. The resource layer publishes various resources for resource owners in the zero-trust network. Resource owners need to publish the attributes of the resources in the corresponding policy information contract in advance, and publish the access policy required for the resources in the policy management contract.
[0006] According to the above technical solution, the analysis and optimization management of the operation management system includes: The attribute information of the management access subject, object and access environment of the operation management system is managed through the policy information contract, and its function structure includes obtaining the attribute information of the subject getSAttr(), obtaining the attribute information of the object getOAttr() and obtaining the attribute information of the current access environment getEAttr().
[0007] According to the above technical solution, the analysis and optimization management of the operation management system further includes: When a user applies for services or resources from a service or resource provider, he or she needs to first send his or her UID and signInfo to the service or resource provider for identity authentication; Get the user's attributes according to the user's UID, get the attributes of the accessed resource according to the resource ID, and get the attribute information of the current access environment. Then call the getPolicy() function in the policy management contract to get the access policy information of the resource according to the resource ID. Finally, implement the permission decision based on the queried attribute information and the access policy information of the resource.
[0008] According to the above technical solution, the analysis and optimization management of the operation management system includes: Collect access behavior data information in the operation management system and store it in a distributed manner to avoid data loss or tampering; When receiving a user access behavior risk assessment that exceeds the set threshold, the result will be immediately notified to the workstation for early warning so that it can perform corresponding management and protection.
[0009] According to the above technical solution, a blockchain-based operation management system includes: Management control module, used for management and control of operation management system; Analysis and processing module, used for analysis and optimization of the operation management system; The storage warning module is used to perform storage warning control of system data information.
[0010] According to the above technical solution, the management control module includes: Model design module, used to design the identity management model; Cross-chain management module, used for cross-chain management of the operation management system; Access control module, used to perform control analysis of access behavior.
[0011] According to the above technical solution, the analysis and processing module includes: Information composition module, used to control the composition of contract data information; Identity authentication module, used for authenticating user identity information; The analysis and decision module is used to analyze and decide on system access.
[0012] According to the above technical solution, the storage warning module includes: A collection and storage module is used to collect and store access behavior data information; The early warning notification module is used to provide early warning notifications of data information.
[0013] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: the present invention, by providing a management control module, an analysis and processing module and a storage and early warning module, can generate a unified identity for the user and create an on-chain identity credential, and send the transaction results and the hash value of the transaction to the main chain through the cross-chain communication layer for storage, and only users who have passed the alliance chain member authentication can join the slave chain, thereby ensuring the privacy and security of the data in the slave chain; and can automatically increase the number of nodes in the cross-chain network to ensure that the cross-chain network can operate normally even if multiple nodes fail, and at the same time, in order to avoid data leakage in the cross-chain network, the plaintext of the data is not propagated in the cross-chain network, thereby effectively improving the availability of the cross-chain network. BRIEF DESCRIPTION OF THE DRAWINGS
[0014] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 This is a flowchart of a blockchain-based operation management method provided in Embodiment 1 of the present invention; Figure 2 This is a module structure diagram of a blockchain-based operation management system provided in Example 2 of the present invention. DETAILED DESCRIPTION
[0015] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0016] Embodiment 1: Figure 1 This is a flowchart of a blockchain-based operation management method provided in Embodiment 1 of the present invention. This embodiment can be applied to an operation management system. The method can be executed by a blockchain-based operation management system provided in an embodiment of the present invention. The system is composed of multiple software and hardware modules, such as Figure 1 As shown, the method specifically comprises the following steps: S101. Design and construct an identity management model for the operation management system; Exemplarily, in an embodiment of the present invention, an identity management model is designed and constructed for the operation management system, and the model is divided into four layers: identity management system layer, slave blockchain layer, cross-chain communication layer and main blockchain layer; in this step, the identity management system layer is mainly composed of various identity management systems in the zero-trust network. The identity identification structures of different identity management systems are different, and the cross-domain access process is complicated. Therefore, users in various identity management systems are registered in this model for unified identity management; the slave blockchain layer is composed of multiple alliance chains with the same structure. On each slave chain, an agent node is elected to receive and process user requests, generate a unified identity for the user and create an on-chain identity credential, and send the transaction results and the hash value of the transaction to the main chain through the cross-chain communication layer. The data is saved in the chain, and only users who have passed the alliance chain member authentication can join the slave chain, ensuring the privacy and security of the data in the slave chain; the cross-chain communication layer uses the cross-chain network component to support cross-chain communication between the main chain and the slave chain. The cross-chain network is between the main chain and the slave chain. The nodes in the network do not participate in the consensus and are only responsible for converting the communication protocol and transmitting data. At the same time, the hash locking technology is used to maintain the atomicity and consistency of cross-chain transactions; the main blockchain layer is composed of a consortium chain, and the proxy node is elected on the main chain to receive the transaction results and hash values sent by the slave chain through the cross-chain communication layer, and save them. The main chain allows ordinary users to join. Users can query the slave chain transaction information saved in the main chain and initiate a request to verify the transaction to the specified slave chain through the cross-chain communication layer.
[0017] S102. Perform cross-chain management and access control on the operation management system; Exemplarily, in an embodiment of the present invention, a cross-chain network component is used to implement cross-chain communication, wherein the cross-chain network is located between the main chain and the slave chain, and is composed of a set number of nodes. The nodes in the cross-chain network are controlled not to participate in the consensus of any chain, and are only responsible for converting communication protocols, transmitting data, and ensuring the atomicity and consistency of cross-chain transactions; in this step, the cross-chain network is independent of the main chain and the slave chain, and the main chain and the slave chain communicate with the cross-chain network through a gateway. At the same time, in order to maintain the consistency and atomicity of cross-chain transactions, a hash locking method is adopted. When the hash lock passwords of both parties in the cross-chain are entered correctly, the entire cross-chain transaction is considered successful. In order to prevent node failures in the cross-chain network from affecting the operation of the entire system, the number of nodes in the cross-chain network is automatically increased to ensure that the cross-chain network can operate normally even if multiple nodes fail. At the same time, in order to avoid data leakage in the cross-chain network, the plaintext of the data is not propagated in the cross-chain network, which effectively improves the availability of the cross-chain network and ensures the privacy and security of the data.
[0018] The blockchain layer determines whether the user has access rights, and then the access assessment layer calculates the risk value of the user's access. If the risk value exceeds the set threshold, the access request will be denied even if the user has access rights. The resource layer is used to publish various resources for resource owners in the zero-trust network. The resource owner needs to publish the attributes of the resource to the corresponding policy information contract in advance, and publish the access policy required for the resource to the policy management contract. In this step, the access subject layer is all user entities that need to access resources in the zero-trust network. The blockchain layer consists of two parts: the main chain and the slave chain. The risk assessment layer is used to perform continuous risk assessment on each user's access behavior according to the set rules.
[0019] S103, perform analysis and optimization management of the operation management system; Exemplarily, in an embodiment of the present invention, the attribute information of the management access subject, object and access environment of the operation management system is managed through a policy information contract, and its function structure includes structures for obtaining the attribute information of the subject getSAttr(), obtaining the attribute information of the object getOAttr() and obtaining the attribute information of the current access environment getEAttr(); in this step, the getSAttr() function is used to obtain the attribute information of the subject. When accessing resources, the user will carry his own UID. The function first parses the slave chain ID where the user is located according to the user's UID, and then initiates a request to obtain the subject's attributes to the main chain proxy node. The main chain proxy node forwards the request to the corresponding slave chain proxy node through the cross-chain communication layer, obtains the user's attribute information and returns it to the function. The getOAttr() function is used to obtain the attribute information of the object, that is, to obtain the attribute information of the resource. When publishing the resource, the resource owner will store the attribute of the resource and the ID of the resource in the blockchain. The attribute information of the resource can be obtained through the ID of the resource. The getEAttr() function is used to obtain the attribute information of the current access environment of the access subject, mainly by parsing the access request to obtain the environmental context information.
[0020] When a user applies for services or resources from a service or resource provider, he or she needs to first send his or her UID and signInfo to the service or resource provider for identity authentication; The user's attributes are obtained according to the user's UID, the attributes of the accessed resources are obtained according to the resource ID, and the attribute information of the current access environment is obtained. Then the getPolicy() function in the policy management contract is called to obtain the access policy information of the resource according to the resource ID. Finally, the permission decision is made according to the queried attribute information and the access policy information of the resource. In this step, if the attribute information meets the access policy of the resource, the user is allowed to access this time, otherwise the user access is directly denied, and the access decision process is recorded in the form of an event on the blockchain. Other nodes on the blockchain can register to listen to the occurrence of this event. Through this processing, the security and accuracy of access to the operation management system are effectively guaranteed.
[0021] S104, performing data collection, storage and early warning notification processing of the operation management system; Exemplarily, in an embodiment of the present invention, the access behavior data information in the operation management system is collected and distributedly stored to avoid data loss or tampering; When receiving a user access behavior risk assessment that exceeds the set threshold, the result will be immediately notified to the workstation for early warning so that it can perform corresponding management and protection.
[0022] Embodiment 2: Embodiment 2 of the present invention provides an operation management system based on blockchain. Figure 2A schematic diagram of the module structure of a blockchain-based operation management system provided in the second embodiment, as shown in FIG. Figure 2 As shown, the system includes: Management control module, used for management and control of operation management system; Analysis and processing module, used for analysis and optimization of the operation management system; The storage warning module is used to perform storage warning control of system data information.
[0023] In some embodiments of the present invention, the management control module includes: Model design module, used to design the identity management model; Cross-chain management module, used for cross-chain management of the operation management system; Access control module, used to perform control analysis of access behavior.
[0024] In some embodiments of the present invention, the analysis and processing module includes: Information composition module, used to control the composition of contract data information; Identity authentication module, used for authenticating user identity information; The analysis and decision module is used to analyze and decide on system access.
[0025] In some embodiments of the present invention, the storage warning module includes: A collection and storage module is used to collect and store access behavior data information; The early warning notification module is used to provide early warning notifications of data information.
[0026] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.
[0027] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
Claims
1. A blockchain-based operation management method, characterized in that: include: Design and build the identity management model for the operation management system; Conduct cross-chain management and access control on the operation management system; Conduct analysis and optimization management of the operation management system; Carry out data collection, storage and early warning notification processing for the operation management system; The design and construction of the identity management model for operating the management system includes: An identity management model is designed and constructed for the operation management system. The model is divided into four layers: identity management system layer, slave blockchain layer, cross-chain communication layer and main blockchain layer.
2. According to claim 1, a blockchain-based operation management method is characterized in that: The cross-chain management and access control of the operation management system includes: Use cross-chain network components to achieve cross-chain communication, where the cross-chain network is located between the main chain and the slave chain, and is composed of a set number of nodes. The nodes in the cross-chain network are controlled not to participate in the consensus of any chain, and are only responsible for converting communication protocols, transmitting data, and ensuring the atomicity and consistency of cross-chain transactions; The blockchain layer determines whether the user has access rights, and then the access assessment layer calculates the risk value of the user's access. If the risk value exceeds the set threshold, the access request will be denied even if the user has access rights. The resource layer publishes various resources for resource owners in the zero-trust network. Resource owners need to publish the attributes of the resources in the corresponding policy information contract in advance, and publish the access policy required for the resources in the policy management contract.
3. According to the blockchain-based operation management method of claim 1, it is characterized by: The analysis and optimization management of the operation management system includes: The attribute information of the management access subject, object and access environment of the operation management system is managed through the policy information contract, and its function structure includes obtaining the attribute information of the subject getSAttr(), obtaining the attribute information of the object getOAttr() and obtaining the attribute information of the current access environment getEAttr().
4. The operation management method based on blockchain according to claim 1, characterized in that: The analysis and optimization management of the operation management system further includes: When a user applies for services or resources from a service or resource provider, he or she needs to first send his or her UID and signInfo to the service or resource provider for identity authentication; Get the user's attributes according to the user's UID, get the attributes of the accessed resource according to the resource ID, and get the attribute information of the current access environment. Then call the getPolicy() function in the policy management contract to get the access policy information of the resource according to the resource ID. Finally, implement the permission decision based on the queried attribute information and the access policy information of the resource.
5. The operation management method based on blockchain according to claim 1, characterized in that: The analysis and optimization management of the operation management system includes: Collect access behavior data information in the operation management system and store it in a distributed manner to avoid data loss or tampering; When receiving a user access behavior risk assessment that exceeds the set threshold, the result will be immediately notified to the workstation for early warning so that it can perform corresponding management and protection.
6. A blockchain-based operation management system, characterized by: include: Management control module, used for management and control of operation management system; Analysis and processing module, used for analysis and optimization of the operation management system; The storage warning module is used to perform storage warning control of system data information.
7. The blockchain-based operation management system according to claim 6, characterized in that: The management control module includes: Model design module, used to design the identity management model; Cross-chain management module, used for cross-chain management of the operation management system; Access control module, used to perform control analysis of access behavior.
8. The blockchain-based operation management system according to claim 6, characterized in that: The analysis and processing module comprises: Information composition module, used to control the composition of contract data information; Identity authentication module, used for authenticating user identity information; The analysis and decision module is used to analyze and decide on system access.
9. The blockchain-based operation management system according to claim 6, characterized in that: The storage warning module includes: A collection and storage module is used to collect and store access behavior data information; The early warning notification module is used to provide early warning notifications of data information.