Data element access control method, device and equipment and readable storage medium

Abstract

The invention relates to a data element access control method and device, equipment and a readable storage medium. For each block on the block chain, an initial access permission value is allocated to a data element on each block, in response to a received operation request of a user, a permission level of the user is obtained, a dynamic access permission model is constructed, and based on current time and the dynamic access permission model, a dynamic access permission value is obtained. Calculating a dynamic access permission value of the data element on each block, judging whether the dynamic access permission value of the data element on each block meets a preset access condition or not, and if the dynamic access permission value of the data element on the target block meets the preset access condition, allowing the user to access the data element on the target block based on an operation type corresponding to the permission level of the user. And operating the data elements on the target block. Compared with the prior art, according to the embodiment of the invention, the dynamic access permission value is set, hierarchical control can be dynamically carried out on the user, the data security is guaranteed, and the flexibility of permission management is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of blockchain data access technology, and in particular to a data element access control method, device, equipment and readable storage medium. Background Art

[0002] Currently, blockchain technology is developing rapidly and is known as the next generation of "value" Internet, with a wide range of applications. Blockchain is a new application model with computer technology features such as distributed data storage, peer-to-peer transmission, node consensus, and secure encryption. It has the characteristics of decentralization, openness, and data immutability.

[0003] Blockchain user rights management is the core content of the practical application of blockchain technology in the industry field. User rights management is also a key step to ensure system security and operational compliance. Common user rights management methods are as follows:

[0004] 1) Management based on the permission model, which can include role-based access control (RBAC) and attribute-based access control (ABAC). RBAC assigns permissions based on the user's role, for example, administrators can access all functions, while ordinary users can only access limited functions; ABAC assigns permissions based on user attributes and environmental attributes, for example, the user's department, job function or access time.

[0005] 2) Management based on permission allocation, which can specifically include the principle of least privilege and permission hierarchy. For the principle of least privilege approach, users should only have the minimum permissions required to complete their work to avoid security risks caused by excessive permissions; for the permission hierarchy approach, users at different levels have different permission levels to ensure the hierarchical management of permissions.

[0006] In the blockchain field, user rights management mostly adopts the above method. However, the above method is not flexible enough in managing user rights and has low security. Summary of the invention

[0007] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a data element access control method, apparatus, device and readable storage medium.

[0008] In a first aspect, an embodiment of the present disclosure provides a data element access control method, the method comprising:

[0009] For each block on the blockchain, assign an initial access permission value to the data elements on each block;

[0010] In response to receiving an operation request from a user, obtaining an authority level of the user;

[0011] Constructing a dynamic access permission model, and calculating the dynamic access permission value of the data element on each block through the dynamic access permission model based on the current time and the initial access permission value;

[0012] Determining whether the dynamic access permission value of the data element on each block meets the preset access condition;

[0013] If the dynamic access permission value of the data element on the target block meets the preset access condition, the user is allowed to operate the data element on the target block based on the operation type corresponding to the user's permission level.

[0014] In some embodiments, determining whether the dynamic access permission value of the data element on each block satisfies a preset access condition includes:

[0015] Determine whether the dynamic access permission value of the data element on each block is within the permission value range corresponding to the permission level of the user; and / or

[0016] Determine whether the dynamic access permission value of the data element on each block is greater than the maximum value of the permission value range corresponding to the permission level of the user;

[0017] If the dynamic access permission value of the data element on the target block is within the permission value range corresponding to the user's permission level, or the dynamic access permission value of the data element on the target block is greater than the maximum value of the permission value range corresponding to the user's permission level, then it is determined that the dynamic access permission value of the data element on the target block meets the preset access condition.

[0018] In some embodiments, the method further comprises:

[0019] If the dynamic access permission value of the data element on the target block does not meet the preset access condition, the user is prohibited from operating the data element on the target block.

[0020] In some embodiments, the dynamic access permission model is:

[0021]

[0022] Wherein, y represents the dynamic access right value, α represents the preset first adjustment factor, β represents the preset second adjustment factor, t represents the current time, f represents the initial access right value, γ represents the preset third adjustment factor, β′ represents the preset fourth adjustment factor, N represents the number of pre-configured items, represents the preset fifth adjustment factor, n! represents the factorial operation of n, and ω represents the preset sixth adjustment factor.

[0023] In some embodiments, after constructing the dynamic access permission model, the method further includes:

[0024] Optimizing the dynamic access permission model to generate a target dynamic access permission model;

[0025] The step of calculating the dynamic access permission value of the data element on each block by using a dynamic access permission model based on the current time and the initial access permission value includes:

[0026] Based on the current time and the initial access permission value, the target dynamic access permission value of the data element on each block is calculated by the target dynamic access permission model.

[0027] In some embodiments, the target dynamic access permission model is:

[0028]

[0029] Wherein, y′ is the target dynamic access right value, α represents the preset first adjustment factor, β represents the preset second adjustment factor, t represents the current time, f represents the initial access right value, γ represents the preset third adjustment factor, β′ represents the preset fourth adjustment factor, and N represents the number of pre-configured items. represents the preset fifth adjustment factor, n! represents the factorial operation of n, ω represents the preset sixth adjustment factor, δ represents the preset first target adjustment factor, λ represents the preset second target adjustment factor, μ represents the preset third target adjustment factor, v represents the preset fourth target adjustment factor, and g(t) is the influence function of the current time t on the target dynamic access right value, which is used to characterize the influence of time on the access right.

[0030] In some embodiments, the influence function g(t) of the current time t on the target dynamic access permission value is expressed as:

[0031] g(t)=λ′·t·(1-t)+sin(πt)+μ′·t 3 +v′·cos(πt)+η·t 1 / 2 +θ·t·sin(2πt)

[0032] Wherein, λ′ represents the first adjustment factor of time influence, μ′ represents the second adjustment factor of time influence, v′ represents the third adjustment factor of time influence, η represents the fourth adjustment factor of time influence, and θ represents the fifth adjustment factor of time influence.

[0033] In a second aspect, an embodiment of the present disclosure provides a data element access control device, the device comprising:

[0034] An allocation module, configured to allocate an initial access permission value to a data element on each block on the blockchain;

[0035] An acquisition module, configured to acquire the permission level of the user in response to receiving an operation request from the user;

[0036] A calculation module, used to construct a dynamic access permission model, and calculate the dynamic access permission value of the data element on each block through the dynamic access permission model based on the current time and the initial access permission value;

[0037] A judgment module, used to judge whether the dynamic access permission value of the data element on each block meets the preset access condition;

[0038] The control module is used to allow the user to operate the data elements on the target block based on the operation type corresponding to the user's permission level if the dynamic access permission value of the data elements on the target block meets the preset access condition.

[0039] In a third aspect, an embodiment of the present disclosure provides an electronic device, including:

[0040] Memory;

[0041] Processor; and

[0042] Computer programs;

[0043] The computer program is stored in the memory and is configured to be executed by the processor to implement the method as described in the first aspect.

[0044] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the method as described in the first aspect.

[0045] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, which includes a computer program or instructions, and when the computer program or instructions are executed by a processor, the method described in the first aspect is implemented.

[0046] The data element access control method, device, equipment and readable storage medium provided by the embodiments of the present disclosure assign an initial access permission value to the data element on each block of the blockchain, obtain the permission level of the user in response to receiving an operation request from the user, construct a dynamic access permission model, and calculate the dynamic access permission value of the data element on each block through the dynamic access permission model based on the current time and the initial access permission value, and judge whether the dynamic access permission value of the data element on each block meets the preset access condition. If the dynamic access permission value of the data element on the target block meets the preset access condition, the user is allowed to operate the data element on the target block based on the operation type corresponding to the permission level of the user. Compared with the prior art, the embodiments of the present disclosure can dynamically control users in a hierarchical manner by setting dynamic access permission values ​​for the data elements on each block, thereby ensuring data security and improving the flexibility of permission management. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0049] Figure 1 A flow chart of a data element access control method provided by an embodiment of the present disclosure;

[0050] Figure 2 A flow chart of a data element access control method provided by another embodiment of the present disclosure;

[0051] Figure 3 A schematic diagram of the structure of a data element access control device provided in an embodiment of the present disclosure;

[0052] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0053] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0054] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0055] Currently, blockchain technology is developing rapidly and is known as the next generation of "value" Internet, with a wide range of applications. Blockchain is a new application model with computer technology features such as distributed data storage, peer-to-peer transmission, node consensus, and secure encryption. It has the characteristics of decentralization, openness, and data immutability.

[0056] Blockchain user rights management is the core content of the practical application of blockchain technology in the industry field. User rights management is also a key step to ensure system security and operational compliance. Common user rights management methods are as follows:

[0057] 1) Management based on the permission model, which can include role-based access control (RBAC) and attribute-based access control (ABAC). RBAC assigns permissions based on the user's role, for example, administrators can access all functions, while ordinary users can only access limited functions; ABAC assigns permissions based on user attributes and environmental attributes, for example, the user's department, job function or access time.

[0058] 2) Management based on permission allocation, which can specifically include the principle of least privilege and permission hierarchy. For the principle of least privilege approach, users should only have the minimum permissions required to complete their work to avoid security risks caused by excessive permissions; for the permission hierarchy approach, users at different levels have different permission levels to ensure the hierarchical management of permissions.

[0059] In the blockchain field, user rights management mostly adopts the above method. However, the above method is not flexible enough in managing user rights and has low security.

[0060] To address this problem, the present disclosure provides a data element access control method, which is described below in conjunction with a specific embodiment.

[0061] Figure 1A flow chart of a data element access control method provided in an embodiment of the present disclosure. The executor of the method is an electronic device, which may be a smart phone, a tablet computer, or a laptop computer; it may also be a fixed device such as a personal computer or a server, wherein the server may be a single server or a server cluster, and the server cluster may be a distributed cluster or a centralized cluster. The method may be applied to scenarios where access control is performed on data elements, and may improve the flexibility of user authority management with high security. It is understandable that the data element access control method provided in an embodiment of the present disclosure may also be applied in other scenarios.

[0062] Below Figure 1 The data element access control method shown in the figure is introduced, and the specific steps of the method are as follows:

[0063] S101. For each block on the blockchain, assign an initial access permission value to the data elements on each block.

[0064] In this step, for each block on the blockchain, the electronic device assigns an initial access permission value to the data elements on each block. Optionally, the data elements on each block may be data elements in the Yangtze River Basin, or other types of data elements, without specific limitation. Specifically, the initial access permission value may be assigned to the data elements on each block according to the security level of the data elements on each block. The higher the security level, the smaller the initial access permission value assigned.

[0065] S102: In response to receiving an operation request from a user, obtaining an authority level of the user.

[0066] In this step, the user sends an operation request to the electronic device, and the electronic device obtains the user's permission level in response to receiving the user's operation request. Optionally, the permission levels of different users can be divided into three levels or five levels, without specific limitation. Each permission level corresponds to a permission value range, and each permission level also corresponds to the type of data operation that the user can take.

[0067] S103. Construct a dynamic access permission model, and calculate the dynamic access permission value of the data element on each block through the dynamic access permission model based on the current time and the initial access permission value.

[0068] In this step, the electronic device constructs a dynamic access permission model. After constructing the dynamic access permission model, the electronic device calculates the dynamic access permission value of the data element on each block according to the current time and the initial access permission value through the dynamic access permission model.

[0069] In some embodiments, the dynamic access permission model is:

[0070]

[0071] Wherein, y represents the dynamic access permission value, α represents the preset first adjustment factor, β represents the preset second adjustment factor, t represents the current time, f represents the initial access permission value, γ represents the preset third adjustment factor, β′ represents the preset fourth adjustment factor, and n represents the number of pre-configured items. represents the preset fifth adjustment factor, n! represents the factorial operation of n, and ω represents the preset sixth adjustment factor.

[0072] S104: Determine whether the dynamic access permission value of the data element on each block meets the preset access condition.

[0073] In this step, after calculating the dynamic access permission value of the data element on each block, the electronic device determines whether the dynamic access permission value of the data element on each block meets the preset access condition.

[0074] In some embodiments, before determining whether the dynamic access permission value of the data element on each block meets the preset access condition, the method further includes: normalizing the dynamic access permission value so that the dynamic access permission value falls within a preset permission value range.

[0075] Optionally, the user's permission level is divided into three levels without specific limitation. The permission value range corresponding to the first level is [0, 2], and the corresponding data operation type is reading only; the permission value range corresponding to the second level is (2, 4], and the corresponding data operation type is reading and downloading; the permission value range corresponding to the third level is (4, 6], and the corresponding data operation type is reading, downloading and modifying. Optionally, the preset permission value range is the union of the permission value ranges corresponding to each permission level, for example [0, 2] ∪ (2, 4] ∪ (4, 6] = [0, 6], then the preset permission value range is [0, 6], without specific limitation.

[0076] S105. If the dynamic access permission value of the data element on the target block meets the preset access condition, the user is allowed to operate the data element on the target block based on the operation type corresponding to the user's permission level.

[0077] In this step, if the dynamic access permission value of the data element on the target block meets the preset access condition, the electronic device allows the user to operate the data element on the target block based on the operation type corresponding to the user's permission level.

[0078] The disclosed embodiment allocates an initial access permission value to the data elements on each block on the blockchain, obtains the permission level of the user in response to receiving an operation request from the user, constructs a dynamic access permission model, and calculates the dynamic access permission value of the data elements on each block through the dynamic access permission model based on the current time and the initial access permission value, determines whether the dynamic access permission value of the data elements on each block meets the preset access condition, and allows the user to operate the data elements on the target block based on the operation type corresponding to the permission level of the user if the dynamic access permission value of the data elements on the target block meets the preset access condition. Compared with the prior art, the disclosed embodiment can dynamically control users in a hierarchical manner by setting a dynamic access permission value for the data elements on each block, thereby ensuring data security and improving the flexibility of permission management.

[0079] On the basis of the above embodiment, after constructing the dynamic access permission model, the method also includes: optimizing the dynamic access permission model to generate a target dynamic access permission model; calculating the dynamic access permission value of the data element on each block through the dynamic access permission model based on the current time and the initial access permission value, including: calculating the target dynamic access permission value of the data element on each block through the target dynamic access permission model based on the current time and the initial access permission value.

[0080] In this embodiment, after constructing the dynamic access permission model, the electronic device will optimize the dynamic access permission model to generate a target dynamic access permission model, and calculate the target dynamic access permission value of the data element on each block according to the current time and the target dynamic access permission model. Further, the electronic device will determine whether the target dynamic access permission value of the data element on each block meets the preset access condition. If the target dynamic access permission value of the data element on the target block meets the preset access condition, the user is allowed to operate the data element on the target block based on the operation type corresponding to the user's permission level.

[0081] In some embodiments, the target dynamic access permission model is:

[0082]

[0083] Wherein, y′ is the target dynamic access right value, α represents the preset first adjustment factor, β represents the preset second adjustment factor, t represents the current time, f represents the initial access right value, γ represents the preset third adjustment factor, β′ represents the preset fourth adjustment factor, and N represents the number of pre-configured items. represents the preset fifth adjustment factor, n! represents the factorial operation of n, ω represents the preset sixth adjustment factor, δ represents the preset first target adjustment factor, λ represents the preset second target adjustment factor, μ represents the preset third target adjustment factor, v represents the preset fourth target adjustment factor, and g(t) is the influence function of the current time t on the target dynamic access right value, which is used to characterize the influence of time on the access right.

[0084] In some embodiments, the influence function g(t) of the current time t on the target dynamic access permission value is expressed as:

[0085] g(t)=λ′·t·(1-t)+sin(πt)+μ′·t 3 +v′·cos(πt)+η·t 1 / 2 +θ·t·sin(2πt)

[0086] Wherein, λ′ represents the first adjustment factor of time influence, μ′ represents the second adjustment factor of time influence, v′ represents the third adjustment factor of time influence, η represents the fourth adjustment factor of time influence, and θ represents the fifth adjustment factor of time influence. In some optional implementations, the electronic device can fit all the adjustment factors by gradient descent method, so that the calculated dynamic access permission value of the data element on each block fluctuates with time within a certain range, further ensuring data security.

[0087] Compared with the prior art, the disclosed embodiment sets dynamic access permission values ​​for data elements on each block, optimizes the dynamic access permission model, generates a target dynamic access permission model, further calculates the target dynamic access permission value for the data element on each block based on the current time and the initial access permission value through the target dynamic access permission model, sets access conditions, and allows users to operate on the data elements on the target block when the preset access conditions are met. Users can be dynamically controlled in a hierarchical manner, thereby ensuring data security and improving the flexibility of permission management.

[0088] Figure 2 A flow chart of a data element access control method provided by another embodiment of the present disclosure, such as Figure 2 As shown, the method includes the following steps:

[0089] S201. For each block on the blockchain, assign an initial access permission value to the data elements on each block.

[0090] Specifically, the implementation process and principle of S201 and S101 are the same, and will not be repeated here.

[0091] S202: In response to receiving an operation request from a user, obtaining an authority level of the user.

[0092] Specifically, the implementation process and principle of S202 and S102 are the same, and will not be repeated here.

[0093] S203: construct a dynamic access permission model, and calculate the dynamic access permission value of the data element on each block through the dynamic access permission model based on the current time and the initial access permission value.

[0094] Specifically, the implementation process and principle of S203 and S103 are the same, and will not be repeated here.

[0095] S204: Determine whether the dynamic access permission value of the data element on each block is within the permission value range corresponding to the permission level of the user.

[0096] In this step, the electronic device determines whether the dynamic access permission value of the data element on each block is within the permission value range corresponding to the permission level of the user.

[0097] In some embodiments, the user's permission level is divided into three levels. The permission value range corresponding to the first level is [0, 2], and the corresponding data operation type is reading only; the permission value range corresponding to the second level is (2, 4], and the corresponding data operation type is reading and downloading; the permission value range corresponding to the third level is (4, 6], and the corresponding data operation type is reading, downloading and modifying. For example, the user's permission level is the second level, and the permission value range corresponding to the second level is (2, 4], and the dynamic access permission value of the data element on block A is calculated to be 3. At this time, it is determined that the dynamic access permission value of the data element on block A is within the permission value range corresponding to the user's permission level.

[0098] S205. Determine whether the dynamic access permission value of the data element on each block is greater than the maximum value of the permission value range corresponding to the user's permission level.

[0099] In this step, the electronic device determines whether the dynamic access permission value of the data element on each block is greater than the maximum value of the permission value range corresponding to the permission level of the user. For example, the user's permission level is the second level, the permission value range corresponding to the second level is (2, 4], the maximum value of the corresponding permission value range is 4, and the dynamic access permission value of the data element on block B is calculated to be 5. At this time, it is determined that the dynamic access permission value of the data element on block B is greater than the maximum value of the permission value range corresponding to the permission level of the user.

[0100] S206. If the dynamic access permission value of the data element on the target block is within the permission value range corresponding to the permission level of the user, or the dynamic access permission value of the data element on the target block is greater than the maximum value of the permission value range corresponding to the permission level of the user, it is determined that the dynamic access permission value of the data element on the target block meets the preset access condition.

[0101] In this step, if it is determined that the dynamic access permission value of the data element on the target block is within the permission value range corresponding to the permission level of the user, or it is determined that the dynamic access permission value of the data element on the target block is greater than the maximum value of the permission value range corresponding to the permission level of the user, the electronic device determines that the dynamic access permission value of the data element on the target block satisfies the preset access condition.

[0102] In some embodiments, if it is determined that the dynamic access permission value of the data element on the target block is not within the permission value range corresponding to the user's permission level, and the dynamic access permission value of the data element on the target block is not greater than the maximum value of the permission value range corresponding to the user's permission level, the electronic device determines that the dynamic access permission value of the data element on the target block does not meet the preset access condition.

[0103] S207. If the dynamic access permission value of the data element on the target block meets the preset access condition, the user is allowed to operate the data element on the target block based on the operation type corresponding to the user's permission level.

[0104] Specifically, the implementation process and principle of S207 and S105 are the same, and will not be repeated here.

[0105] S208. If the dynamic access permission value of the data element on the target block does not satisfy the preset access condition, the user is prohibited from operating the data element on the target block.

[0106] In this step, if it is determined that the dynamic access permission value of the data element on the target block does not meet the preset access condition, the electronic device prohibits the user from operating the data element on the target block.

[0107] The disclosed embodiment allocates an initial access permission value to the data elements on each block on the blockchain, obtains the permission level of the user in response to receiving an operation request from the user, constructs a dynamic access permission model, and calculates the dynamic access permission value of the data elements on each block through the dynamic access permission model based on the current time and the initial access permission value. Further, it is determined whether the dynamic access permission value of the data elements on each block is within the permission value range corresponding to the permission level of the user; and / or it is determined whether the dynamic access permission value of the data elements on each block is greater than the maximum value of the permission value range corresponding to the permission level of the user. If the dynamic access permission value of the data elements on the target block is within the permission value range corresponding to the permission level of the user, or the dynamic access permission value of the data elements on the target block is greater than the maximum value of the permission value range corresponding to the permission level of the user, it is determined that the dynamic access permission value of the data elements on the target block meets the preset access condition. Furthermore, if the dynamic access permission value of the data element on the target block meets the preset access condition, the user is allowed to operate the data element on the target block based on the operation type corresponding to the user's permission level; if the dynamic access permission value of the data element on the target block does not meet the preset access condition, the user is prohibited from operating the data element on the target block. Through this method, a dynamic access permission value is set for each data element on a block, and an access condition is set. When the preset access condition is met, the user is allowed to operate the data element on the target block, and when the preset access condition is not met, the user is prohibited from operating the data element on the target block. Users can be dynamically controlled in a hierarchical manner, data security is guaranteed, and the flexibility of permission management is improved.

[0108] Figure 3 The structure diagram of the data element access control device provided in the embodiment of the present disclosure. The data element access control device may be the electronic device as described in the above embodiment, or the data element access control device may be a component or assembly in the electronic device. The data element access control device provided in the embodiment of the present disclosure may execute the processing flow provided in the data element access control method embodiment, such as Figure 3As shown, the data element access control device 40 includes: an allocation module 41, an acquisition module 42, a calculation module 43, a judgment module 44, and a control module 45; wherein the allocation module 41 is used to allocate an initial access permission value to the data elements on each block on the blockchain; the acquisition module 42 is used to obtain the user's permission level in response to receiving an operation request from the user; the calculation module 43 is used to construct a dynamic access permission model, and based on the current time and the initial access permission value, calculate the dynamic access permission value of the data element on each block through the dynamic access permission model; the judgment module 44 is used to judge whether the dynamic access permission value of the data element on each block meets the preset access condition; the control module 45 is used to allow the user to operate the data element on the target block based on the operation type corresponding to the user's permission level if the dynamic access permission value of the data element on the target block meets the preset access condition.

[0109] Optionally, when the judgment module 44 judges whether the dynamic access permission value of the data element on each block satisfies the preset access condition, it is specifically used to: judge whether the dynamic access permission value of the data element on each block is within the permission value range corresponding to the user's permission level; and / or judge whether the dynamic access permission value of the data element on each block is greater than the maximum value of the permission value range corresponding to the user's permission level; if the dynamic access permission value of the data element on the target block is within the permission value range corresponding to the user's permission level, or the dynamic access permission value of the data element on the target block is greater than the maximum value of the permission value range corresponding to the user's permission level, it is determined that the dynamic access permission value of the data element on the target block satisfies the preset access condition.

[0110] Optionally, the control module 45 is further configured to prohibit the user from operating the data elements on the target block if the dynamic access permission value of the data elements on the target block does not satisfy the preset access condition.

[0111] Optionally, the dynamic access permission model is:

[0112]

[0113] Wherein, t represents the dynamic access right value, α represents the preset first adjustment factor, β represents the preset second adjustment factor, t represents the current time, f represents the initial access right value, γ represents the preset third adjustment factor, β′ represents the preset fourth adjustment factor, N represents the number of pre-configured items, represents the preset fifth adjustment factor, n! represents the factorial operation of n, and ω represents the preset sixth adjustment factor.

[0114] Optionally, after constructing the dynamic access permission model, the device 40 further includes: an optimization module 46; the optimization module 46 is used to optimize the dynamic access permission model to generate a target dynamic access permission model;

[0115] When the calculation module 43 calculates the dynamic access permission value of the data element on each block through the dynamic access permission model based on the current time and the initial access permission value, it is specifically used to: calculate the target dynamic access permission value of the data element on each block through the target dynamic access permission model based on the current time and the initial access permission value.

[0116] Optionally, the target dynamic access permission model is:

[0117]

[0118] Wherein, y′ is the target dynamic access right value, α represents the preset first adjustment factor, β represents the preset second adjustment factor, t represents the current time, f represents the initial access right value, γ represents the preset third adjustment factor, β′ represents the preset fourth adjustment factor, and N represents the number of pre-configured items. represents the preset fifth adjustment factor, n! represents the factorial operation of n, ω represents the preset sixth adjustment factor, δ represents the preset first target adjustment factor, λ represents the preset second target adjustment factor, μ represents the preset third target adjustment factor, v represents the preset fourth target adjustment factor, and g(t) is the influence function of the current time t on the target dynamic access right value, which is used to characterize the influence of time on the access right.

[0119] Optionally, the influence function g(t) of the current time t on the target dynamic access right value is expressed as:

[0120] g(t)=λ′·t·(1-t)+sin(πt)+μ′·t 3 +v′·cos(πt)+η·t 1 / 2 +θ·t·sin(2πt)

[0121] Wherein, λ′ represents the first adjustment factor of time influence, μ′ represents the second adjustment factor of time influence, v′ represents the third adjustment factor of time influence, η represents the fourth adjustment factor of time influence, and θ represents the fifth adjustment factor of time influence.

[0122] Figure 3 The data element access control device of the illustrated embodiment can be used to execute the technical solution of the above-mentioned method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0123] Figure 4Schematic diagram of the structure of an electronic device in the embodiment of the present disclosure. Figure 4 , which shows a structural schematic diagram of an electronic device 600 suitable for implementing the embodiments of the present disclosure. Figure 4 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0124] like Figure 4 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 to a random access memory (RAM) 603 to implement the data element access control method of the embodiment described in the present disclosure. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0125] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 4 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0126] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart, thereby implementing the data element access control method as described above. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0127] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0128] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0129] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0130] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device:

[0131] For each block on the blockchain, assign an initial access permission value to the data elements on each block;

[0132] In response to receiving an operation request from a user, obtaining an authority level of the user;

[0133] Constructing a dynamic access permission model, and calculating the dynamic access permission value of the data element on each block through the dynamic access permission model based on the current time and the initial access permission value;

[0134] Determining whether the dynamic access permission value of the data element on each block meets the preset access condition;

[0135] If the dynamic access permission value of the data element on the target block meets the preset access condition, the user is allowed to operate the data element on the target block based on the operation type corresponding to the user's permission level.

[0136] Optionally, when the above one or more programs are executed by the electronic device, the electronic device may also execute other steps described in the above embodiments.

[0137] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0138] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0139] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, constitute a limitation on the unit itself.

[0140] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0141] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0142] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0143] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0144] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A data element access control method, characterized in that: The method comprises: For each block on the blockchain, assign an initial access permission value to the data elements on each block; In response to receiving an operation request from a user, obtaining an authority level of the user; Constructing a dynamic access permission model, and calculating the dynamic access permission value of the data element on each block through the dynamic access permission model based on the current time and the initial access permission value; Determining whether the dynamic access permission value of the data element on each block meets the preset access condition; If the dynamic access permission value of the data element on the target block meets the preset access condition, the user is allowed to operate the data element on the target block based on the operation type corresponding to the user's permission level.

2. The method according to claim 1, characterized in that The determining whether the dynamic access permission value of the data element on each block satisfies a preset access condition includes: Determine whether the dynamic access permission value of the data element on each block is within the permission value range corresponding to the permission level of the user; and / or Determine whether the dynamic access permission value of the data element on each block is greater than the maximum value of the permission value range corresponding to the permission level of the user; If the dynamic access permission value of the data element on the target block is within the permission value range corresponding to the user's permission level, or the dynamic access permission value of the data element on the target block is greater than the maximum value of the permission value range corresponding to the user's permission level, then it is determined that the dynamic access permission value of the data element on the target block meets the preset access condition.

3. The method according to claim 1, characterized in that The method further comprises: If the dynamic access permission value of the data element on the target block does not meet the preset access condition, the user is prohibited from operating the data element on the target block.

4. The method according to claim 1, characterized in that: The dynamic access permission model is: Wherein, y represents the dynamic access right value, α represents the preset first adjustment factor, β represents the preset second adjustment factor, t represents the current time, f represents the initial access right value, γ represents the preset third adjustment factor, β′ represents the preset fourth adjustment factor, N represents the number of pre-configured items, represents the preset fifth adjustment factor, n! represents the factorial operation of n, and ω represents the preset sixth adjustment factor.

5. The method according to claim 1, characterized in that After constructing the dynamic access permission model, the method further includes: Optimizing the dynamic access permission model to generate a target dynamic access permission model; The step of calculating the dynamic access permission value of the data element on each block by using a dynamic access permission model based on the current time and the initial access permission value includes: Based on the current time and the initial access permission value, the target dynamic access permission value of the data element on each block is calculated by the target dynamic access permission model.

6. The method according to claim 5, characterized in that The target dynamic access permission model is: Wherein, y′ is the target dynamic access right value, α represents the preset first adjustment factor, β represents the preset second adjustment factor, t represents the current time, f represents the initial access right value, γ represents the preset third adjustment factor, β′ represents the preset fourth adjustment factor, and N represents the number of pre-configured items. represents the preset fifth adjustment factor, n! represents the factorial operation of n, ω represents the preset sixth adjustment factor, δ represents the preset first target adjustment factor, λ represents the preset second target adjustment factor, μ represents the preset third target adjustment factor, v represents the preset fourth target adjustment factor, and g(t) is the influence function of the current time t on the target dynamic access right value, which is used to characterize the influence of time on the access right.

7. The method according to claim 6, characterized in that The influence function g(t) of the current time t on the target dynamic access right value is expressed as: g(t)=λ′·t·(1-t)+sin(πt)+μ′·t 3 +v′·cos(πt)+η·t 1 / 2 +θ·t·sin(2πt) Wherein, λ′ represents the first adjustment factor of time influence, μ′ represents the second adjustment factor of time influence, v′ represents the third adjustment factor of time influence, η represents the fourth adjustment factor of time influence, and θ represents the fifth adjustment factor of time influence.

8. A data element access control device, characterized in that: The device comprises: An allocation module, configured to allocate an initial access permission value to a data element on each block on the blockchain; An acquisition module, configured to acquire the permission level of the user in response to receiving an operation request from the user; A calculation module, used to construct a dynamic access permission model, and calculate the dynamic access permission value of the data element on each block through the dynamic access permission model based on the current time and the initial access permission value; A judgment module, used to judge whether the dynamic access permission value of the data element on each block meets the preset access condition; The control module is used to allow the user to operate the data elements on the target block based on the operation type corresponding to the user's permission level if the dynamic access permission value of the data elements on the target block meets the preset access condition.

9. An electronic device, characterized in that: include: Memory; processor; as well as Computer programs; The computer program is stored in the memory and is configured to be executed by the processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images