Data element access control method, device, equipment and readable storage medium

Abstract

The present disclosure relates to a data element access control method, device, equipment and readable storage medium. By assigning an initial access permission value to each data element on each block on a block chain, in response to receiving an operation request of a user, obtaining a permission level of the user, constructing a dynamic access permission model, and based on the current time and the dynamic access permission model, calculating a dynamic access permission value of each data element on each block, judging whether the dynamic access permission value of each data element on each block meets a preset access condition, if the dynamic access permission value of the data element on the target block meets the preset access condition, the user is allowed to operate the data element on the target block based on the operation type corresponding to the permission level of the user. Compared with the prior art, the present disclosure sets a dynamic access permission value, which can dynamically control the user, ensures data security and improves the flexibility of permission management.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of blockchain data access, and particularly relates to a data element access control method and device, equipment and a readable storage medium. BACKGROUND

[0002] The current blockchain technology is developing rapidly and is called the next generation of "value" Internet, and has a wide range of applications. The blockchain is a new application mode with computer technology features such as distributed data storage, peer-to-peer transmission, node consensus, and secure encryption, and has characteristics such as decentralization, openness, and data tamper resistance.

[0003] User permission management of the blockchain is the core content of the practical application of the blockchain technology in the industry field, and user permission management is also a key step to ensure system security and operation compliance. Common user permission management methods are as follows:

[0004] 1) Management based on permission models, which can specifically include role-based access control (RBAC) and attribute-based access control (ABAC). RBAC assigns permissions according to the roles of users, for example, an administrator can access all functions, while a normal user can only access limited functions; ABAC assigns permissions according to user attributes and environmental attributes, for example, the user's department, job function, or access time.

[0005] 2) Management based on permission allocation, which can specifically include the principle of least privilege and permission layering. For the principle of least privilege method, a user should only have the minimum permissions required to complete their work, avoiding security risks caused by excessive permissions; for the permission layering method, users at different levels have different permission levels to ensure step-by-step management of permissions.

[0006] In the field of blockchain, user permission management mostly uses the above methods, but the above methods are not flexible enough in managing user permissions, and the security is not high. SUMMARY

[0007] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a data element access control method, device, equipment and readable storage medium.

[0008] In a first aspect, the embodiments of the present disclosure provide a data element access control method, which comprises:

[0009] For each block on the blockchain, an initial access permission value is assigned to a data element on the block;

[0010] In response to receiving an operation request of a user, the permission level of the user is obtained;

[0011] construct a dynamic access permission model, and calculate a dynamic access permission value of the data element on each block by the dynamic access permission model based on a current time and the initial access permission value;

[0012] determine whether the dynamic access permission value of the data element on each block satisfies a preset access condition;

[0013] if the dynamic access permission value of the data element on the target block satisfies the preset access condition, allow the user to operate the data element on the target block based on an operation type corresponding to the permission level of the user.

[0014] In some embodiments, the determining whether the dynamic access permission value of the data element on each block satisfies the preset access condition comprises:

[0015] determining whether the dynamic access permission value of the data element on each block is within a permission value range corresponding to the permission level of the user; and / or

[0016] determining whether the dynamic access permission value of the data element on each block is greater than a maximum value of the permission value range corresponding to the permission level of the user;

[0017] if the dynamic access permission value of the data element on the target block is within the permission value range corresponding to the permission level of the user, or the dynamic access permission value of the data element on the target block is greater than the maximum value of the permission value range corresponding to the permission level of the user, it is determined that the dynamic access permission value of the data element on the target block satisfies the preset access condition.

[0018] In some embodiments, the method further comprises:

[0019] if the dynamic access permission value of the data element on the target block does not satisfy the preset access condition, the user is prohibited from operating the data element on the target block.

[0020] In some embodiments, the dynamic access permission model is:

[0021]

[0022] wherein y represents the dynamic access permission value, a represents a preset first adjustment factor, b represents a preset second adjustment factor, t represents the current time, f represents the initial access permission value, g represents a preset third adjustment factor, b' represents a preset fourth adjustment factor, N represents a preconfigured number of terms, represents a preset fifth adjustment factor, n! represents a factorial operation of n, and w represents a preset sixth adjustment factor.

[0023] In some embodiments, after the dynamic access permission model is constructed, the method further comprises:

[0024] optimizing the dynamic access permission model to generate a target dynamic access permission model;

[0025] calculating, based on the current time and the initial access permission value, a dynamic access permission value of the data element on each block by the dynamic access permission model, comprising:

[0026] calculating, based on the current time and the initial access permission value, a target dynamic access permission value of the data element on each block by the target dynamic access permission model.

[0027] In some embodiments, the target dynamic access permission model is:

[0028]

[0029] wherein y' is the target dynamic access permission value, a represents a preset first adjustment factor, β represents a preset second adjustment factor, t represents the current time, f represents the initial access permission value, γ represents a preset third adjustment factor, β' represents a preset fourth adjustment factor, N represents a preconfigured number of terms, a preset fifth adjustment factor, n! represents the factorial operation of n, ω represents a preset sixth adjustment factor, δ represents a preset first target adjustment factor, λ represents a preset second target adjustment factor, μ represents a preset third target adjustment factor, v represents a preset fourth target adjustment factor, and g(t) is an influence function of the current time t on the target dynamic access permission value, used to represent the influence of time on access permission.

[0030] In some embodiments, the influence function g(t) of the current time t on the target dynamic access permission value is represented as:

[0031] g(t) = λ'·t·(1-t) + sin(πt) + μ'·t 3 + v'·cos(πt) + η·t 1 / 2 + θ·t·sin(2πt)

[0032] wherein λ' represents a first adjustment factor of time influence, μ' represents a second adjustment factor of time influence, v' represents a third adjustment factor of time influence, η represents a fourth adjustment factor of time influence, and θ represents a fifth adjustment factor of time influence.

[0033] In a second aspect, the embodiments of the present disclosure provide a data element access control device, which comprises:

[0034] an assigning module configured to assign an initial access permission value to a data element on each block on the blockchain for each block on the blockchain;

[0035] an obtaining module configured to obtain a permission level of a user in response to receiving an operation request of the user;

[0036] a calculating module configured to construct a dynamic access permission model and calculate a dynamic access permission value of the data element on each block based on the current time and the initial access permission value through the dynamic access permission model;

[0037] a judging module configured to judge whether the dynamic access permission value of the data element on each block meets a preset access condition;

[0038] a control module configured to allow the user to operate the data element on the target block based on an operation type corresponding to the permission level of the user if the dynamic access permission value of the data element on the target block meets the preset access condition.

[0039] In a third aspect, an electronic device is provided, and the electronic device comprises:

[0040] a memory;

[0041] a processor; and

[0042] a computer program;

[0043] The computer program is stored in the memory and is configured to be executed by the processor to implement the method according to the first aspect.

[0044] In a fourth aspect, a computer-readable storage medium is provided, and the computer-readable storage medium stores a computer program. The computer program is executed by a processor to implement the method according to the first aspect.

[0045] In a fifth aspect, a computer program product is provided, and the computer program product comprises a computer program or instructions. The computer program or instructions are executed by a processor to implement the method according to the first aspect.

[0046] The data element access control method, device, equipment and readable storage medium provided by the embodiment of the present disclosure, for each block on the block chain, the initial access permission value is allocated to the data element on each block, in response to receiving the operation request of the user, the permission level of the user is obtained, the dynamic access permission model is constructed, and the dynamic access permission value of the data element on each block is calculated based on the current time and the initial access permission value through the dynamic access permission model, it is judged whether the dynamic access permission value of the data element on each block meets the preset access condition, if the dynamic access permission value of the data element on the target block meets the preset access condition, the user is allowed to operate the data element on the target block based on the operation type corresponding to the permission level of the user. Compared with the prior art, the embodiment of the present disclosure sets the dynamic access permission value for the data element on each block, which can dynamically control the user, ensures the data security, and improves the flexibility of permission management. BRIEF DESCRIPTION OF DRAWINGS

[0047] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present disclosure and, together with the specification, serve to explain the principles of the present disclosure.

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0049] Figure 1 The data element access control method flowchart provided by the embodiment of the present disclosure;

[0050] Figure 2 The data element access control method flowchart provided by another embodiment of the present disclosure;

[0051] Figure 3 The structural schematic diagram of the data element access control device provided by the embodiment of the present disclosure;

[0052] Figure 4 The structural schematic diagram of the electronic equipment provided by the embodiment of the present disclosure. DETAILED DESCRIPTION

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0054] Many specific details are set forth in the following description in order to provide a thorough understanding of the present disclosure. However, the present disclosure can be practiced according to other embodiments that do not require some of the specific details described below. It is understood that the present disclosure is well suited to implement embodiments like those described below, but the description is not intended to limit the scope of the present disclosure.

[0055] The current blockchain technology is developing rapidly and is called the next generation "value" Internet, and has a wide range of applications. The blockchain is a new application mode with computer technology features such as distributed data storage, point-to-point transmission, node consensus, and secure encryption, and has characteristics such as decentralization, openness, and data tamper resistance.

[0056] User permission management of the blockchain is the core content of the practical application of the blockchain technology in the industry field, and user permission management is also a key step to ensure system security and operation compliance. Common user permission management methods are as follows:

[0057] 1) Management based on permission model, which can specifically include role-based access control (RBAC) and attribute-based access control (ABAC). RBAC is to assign permissions according to the roles of users, for example, administrators can access all functions, while ordinary users can only access limited functions; ABAC is to assign permissions according to user attributes and environmental attributes, for example, user department, work function or access time.

[0058] 2) Management based on permission allocation, which can specifically include the principle of least privilege and permission layering. For the principle of least privilege method, users should only have the minimum permissions required to complete their work, avoiding security risks caused by excessive permissions; for the permission layering method, users at different levels have different permission levels to ensure step-by-step management of permissions.

[0059] In the field of blockchain, user permission management mostly uses the above methods, but the above methods are not flexible enough in managing user permissions, and the security is not high.

[0060] To solve this problem, the embodiments of the present disclosure provide a data element access control method, which will be introduced below in combination with specific embodiments.

[0061] Figure 1A data element access control method flowchart is provided for the embodiments of the present disclosure. The execution subject of the method is an electronic device, which can be a smartphone, a tablet computer, a notebook computer, or a fixed device such as a personal computer or a server. The server can be a single server or a server cluster, which can be a distributed cluster or a centralized cluster. The method can be applied to a scenario of access control of data elements, and can improve the flexibility of user permission management and the security. It can be understood that the data element access control method provided by the embodiments of the present disclosure can also be applied to other scenarios.

[0062] The data element access control method shown in the following will be introduced, which includes the following specific steps: Figure 1

[0063] S101, for each block on the block chain, an initial access permission value is assigned to the data element on each block.

[0064] In this step, for each block on the block chain, the electronic device assigns an initial access permission value to the data element on each block. Optionally, the data element on each block can be a data element of the Yangtze River Basin, or other types of data elements, which are not limited. Specifically, the initial access permission value can be assigned to the data element on each block according to the security level of the data element on each block. The higher the security level, the smaller the initial access permission value.

[0065] S102, in response to receiving the operation request of the user, the permission level of the user is obtained.

[0066] In this step, the user will send an operation request to the electronic device, and the electronic device will obtain the permission level of the user in response to receiving the operation request of the user. Optionally, the permission level of different users can be divided into three levels, or five levels, which are not limited. Each permission level corresponds to a permission value range, and each permission level also corresponds to the type of data operation that the user can take.

[0067] S103, a dynamic access permission model is constructed, and based on the current time and the initial access permission value, the dynamic access permission value of the data element on each block is calculated through the dynamic access permission model.

[0068] In this step, the electronic device will construct a dynamic access permission model. After the dynamic access permission model is constructed, the electronic device will calculate the dynamic access permission value of the data element on each block according to the current time, the initial access permission value, and the dynamic access permission model.

[0069] ​In some embodiments, the dynamic access permission model is:

[0070]

[0071] wherein y represents the dynamic access permission value, a represents a preset first adjustment factor, b represents a preset second adjustment factor, t represents the current time, f represents an initial access permission value, g represents a preset third adjustment factor, b' represents a preset fourth adjustment factor, and n represents a preconfigured number of terms, represents a preset fifth adjustment factor, n! represents a factorial operation of n, and w represents a preset sixth adjustment factor.

[0072] S104, determining whether the dynamic access permission value of the data element on each block satisfies a preset access condition.

[0073] In this step, after calculating the dynamic access permission value of the data element on each block, the electronic device determines whether the dynamic access permission value of the data element on each block satisfies a preset access condition.

[0074] In some embodiments, before determining whether the dynamic access permission value of the data element on each block satisfies a preset access condition, the method further comprises: normalizing the dynamic access permission value so that the dynamic access permission value falls within a preset permission value range.

[0075] Optionally, the permission level of the user is divided into three levels, without specific limitation. The permission value range corresponding to the first level is [0, 2], and the corresponding data operation type is only reading; the permission value range corresponding to the second level is (2, 4], and the corresponding data operation type is reading and downloading; and the permission value range corresponding to the third level is (4, 6], and the corresponding data operation type is reading, downloading and modifying. Optionally, the preset permission value range is the union of the permission value ranges corresponding to the respective permission levels, for example, [0, 2]∪(2, 4]∪(4, 6]=[0, 6], and the preset permission value range is [0, 6], without specific limitation.

[0076] S105, if the dynamic access permission value of the data element on the target block satisfies the preset access condition, allowing the user to operate the data element on the target block based on the operation type corresponding to the permission level of the user.

[0077] In this step, if the dynamic access permission value of the data element on the target block satisfies the preset access condition, the electronic device allows the user to operate the data element on the target block based on the operation type corresponding to the permission level of the user.

[0078] The embodiments of the present disclosure allocate an initial access permission value to a data element on each block on a blockchain, in response to receiving an operation request of a user, acquire a permission level of the user, construct a dynamic access permission model, and calculate a dynamic access permission value of the data element on each block based on a current time and the initial access permission value through the dynamic access permission model, determine whether the dynamic access permission value of the data element on each block meets a preset access condition, and if the dynamic access permission value of the data element on a target block meets the preset access condition, allow the user to operate the data element on the target block based on an operation type corresponding to the permission level of the user. Compared with the prior art, the embodiments of the present disclosure can dynamically control the user by setting a dynamic access permission value for the data element on each block, guarantee data security, and improve the flexibility of permission management.

[0079] On the basis of the above-mentioned embodiments, after the dynamic access permission model is constructed, the method further includes: optimizing the dynamic access permission model to generate a target dynamic access permission model; and calculating the dynamic access permission value of the data element on each block based on the current time and the initial access permission value through the dynamic access permission model includes: calculating a target dynamic access permission value of the data element on each block based on the current time and the initial access permission value through the target dynamic access permission model.

[0080] In the embodiments, after the dynamic access permission model is constructed, the electronic device optimizes the dynamic access permission model to generate a target dynamic access permission model, and calculates a target dynamic access permission value of the data element on each block according to the current time and the target dynamic access permission model. Further, the electronic device determines whether the target dynamic access permission value of the data element on each block meets a preset access condition. Furthermore, if the target dynamic access permission value of the data element on a target block meets the preset access condition, the electronic device allows the user to operate the data element on the target block based on an operation type corresponding to the permission level of the user.

[0081] In some embodiments, the target dynamic access permission model is:

[0082]

[0083] wherein y' is the target dynamic access permission value, a represents a preset first adjustment factor, β represents a preset second adjustment factor, t represents the current time, f represents the initial access permission value, γ represents a preset third adjustment factor, β' represents a preset fourth adjustment factor, and N represents a preconfigured number of terms. denoted by , n! represents the factorial operation of n, ω represents the preset sixth adjustment factor, δ represents the preset first target adjustment factor, λ represents the preset second target adjustment factor, μ represents the preset third target adjustment factor, v represents the preset fourth target adjustment factor, and g(t) is the influence function of the current time t on the target dynamic access permission value, used to characterize the influence of time on access permission.

[0084] In some embodiments, the function g(t) representing the influence of the current time t on the target dynamic access permission value is expressed as:

[0085] g(t)=λ′·t·(1-t)+sin(πt)+μ′·t 3 +v′·cos(πt)+η·t 1 / 2 +θ·t·sin(2πt)

[0086] Where λ′ represents the first adjustment factor for time influence, μ′ represents the second adjustment factor for time influence, v′ represents the third adjustment factor for time influence, η represents the fourth adjustment factor for time influence, and θ represents the fifth adjustment factor for time influence. In some optional implementations, the electronic device can fit all the adjustment factors using the gradient descent method to ensure that the dynamic access permission value of the data elements on each block fluctuates within a certain range over time, further ensuring data security.

[0087] Compared to existing technologies, this disclosure optimizes the dynamic access permission model by setting dynamic access permission values ​​for data elements on each block, generating a target dynamic access permission model. Furthermore, based on the current time and the initial access permission value, the target dynamic access permission model calculates the target dynamic access permission value for each data element on each block, setting access conditions. When the preset access conditions are met, the user is allowed to operate on the data elements on the target block. This allows for dynamic hierarchical control of users, ensuring data security and improving the flexibility of access management.

[0088] Figure 2 A flowchart of a data element access control method provided in another embodiment of this disclosure is shown below. Figure 2 As shown, the method includes the following steps:

[0089] S201. For each block on the blockchain, assign an initial access permission value to the data elements on each block.

[0090] Specifically, the implementation process and principle of S201 and S101 are the same, and will not be repeated here.

[0091] S202. In response to receiving an operation request from a user, obtain the user's permission level.

[0092] Specifically, the implementation process and principle of S202 and S102 are consistent, which will not be repeated here.

[0093] S203, constructing a dynamic access permission model, and calculating the dynamic access permission value of the data element on each block based on the current time and the initial access permission value through the dynamic access permission model.

[0094] Specifically, the implementation process and principle of S203 and S103 are consistent, which will not be repeated here.

[0095] S204, judging whether the dynamic access permission value of the data element on each block is within the permission value range corresponding to the user's permission level.

[0096] In this step, the electronic device will judge whether the dynamic access permission value of the data element on each block is within the permission value range corresponding to the user's permission level.

[0097] In some embodiments, the user's permission level is divided into three levels, the first level corresponds to the permission value range [0, 2], and the corresponding data operation type is only reading; the second level corresponds to the permission value range (2, 4], and the corresponding data operation type is reading and downloading; the third level corresponds to the permission value range (4, 6], and the corresponding data operation type is reading, downloading and modification. For example, the user's permission level is the second level, the second level corresponds to the permission value range (2, 4], and the dynamic access permission value of the data element on block A is calculated as 3, so the dynamic access permission value of the data element on block A is judged to be within the permission value range corresponding to the user's permission level.

[0098] S205, judging whether the dynamic access permission value of the data element on each block is greater than the maximum value of the permission value range corresponding to the user's permission level.

[0099] In this step, the electronic device will judge whether the dynamic access permission value of the data element on each block is greater than the maximum value of the permission value range corresponding to the user's permission level. For example, the user's permission level is the second level, the second level corresponds to the permission value range (2, 4], and the maximum value of the corresponding permission value range is 4, and the dynamic access permission value of the data element on block B is calculated as 5, so the dynamic access permission value of the data element on block B is judged to be greater than the maximum value of the permission value range corresponding to the user's permission level.

[0100] S206, if the dynamic access permission value of the data element on the target block is within the permission value range corresponding to the permission level of the user or the dynamic access permission value of the data element on the target block is greater than the maximum value of the permission value range corresponding to the permission level of the user, it is determined that the dynamic access permission value of the data element on the target block meets the preset access condition.

[0101] In this step, if it is judged that the dynamic access permission value of the data element on the target block is within the permission value range corresponding to the permission level of the user or it is judged that the dynamic access permission value of the data element on the target block is greater than the maximum value of the permission value range corresponding to the permission level of the user, the electronic device determines that the dynamic access permission value of the data element on the target block meets the preset access condition.

[0102] In some embodiments, if it is judged that the dynamic access permission value of the data element on the target block is not within the permission value range corresponding to the permission level of the user and the dynamic access permission value of the data element on the target block is not greater than the maximum value of the permission value range corresponding to the permission level of the user, the electronic device determines that the dynamic access permission value of the data element on the target block does not meet the preset access condition.

[0103] S207, if the dynamic access permission value of the data element on the target block meets the preset access condition, the user is allowed to operate the data element on the target block based on the operation type corresponding to the permission level of the user.

[0104] Specifically, the implementation process and principles of S207 and S105 are the same, and will not be repeated here.

[0105] S208, if the dynamic access permission value of the data element on the target block does not meet the preset access condition, the user is prohibited from operating the data element on the target block.

[0106] In this step, if it is judged that the dynamic access permission value of the data element on the target block does not meet the preset access condition, the electronic device prohibits the user from operating the data element on the target block.

[0107] The embodiment of the present disclosure allocates an initial access permission value to a data element on each block on a block chain, in response to receiving an operation request of a user, acquires a permission level of the user, constructs a dynamic access permission model, and calculates a dynamic access permission value of the data element on each block based on the current time and the initial access permission value through the dynamic access permission model. Further, it is judged whether the dynamic access permission value of the data element on each block is within the permission value range corresponding to the permission level of the user; and / or it is judged whether the dynamic access permission value of the data element on each block is greater than the maximum value of the permission value range corresponding to the permission level of the user, if the dynamic access permission value of the data element on the target block is within the permission value range corresponding to the permission level of the user, or the dynamic access permission value of the data element on the target block is greater than the maximum value of the permission value range corresponding to the permission level of the user, it is determined that the dynamic access permission value of the data element on the target block satisfies the preset access condition. Further, if the dynamic access permission value of the data element on the target block satisfies the preset access condition, the user is allowed to operate the data element on the target block based on the operation type corresponding to the permission level of the user; if the dynamic access permission value of the data element on the target block does not satisfy the preset access condition, the user is prohibited from operating the data element on the target block. Through the method, a dynamic access permission value is set for the data element on each block, an access condition is set, when the preset access condition is satisfied, the user is allowed to operate the data element on the target block, when the preset access condition is not satisfied, the user is prohibited from operating the data element on the target block, the user can be dynamically controlled, the data security is guaranteed, and the flexibility of permission management is improved.

[0108] Figure 3 A structural schematic diagram of a data element access control device provided by the embodiment of the present disclosure. The data element access control device can be an electronic device as described in the above embodiment, or the data element access control device can be a component or assembly in the electronic device. The data element access control device provided by the embodiment of the present disclosure can execute the processing flow provided by the data element access control method embodiment, such as Figure 3As shown, the data element access control apparatus 40 comprises: an allocation module 41, an acquisition module 42, a calculation module 43, a judgment module 44, and a control module 45. The allocation module 41 is configured to allocate an initial access permission value to each data element on each block on the blockchain. The acquisition module 42 is configured to acquire a permission level of a user in response to receiving an operation request of the user. The calculation module 43 is configured to construct a dynamic access permission model and calculate a dynamic access permission value of each data element on each block by the dynamic access permission model based on a current time and the initial access permission value. The judgment module 44 is configured to determine whether the dynamic access permission value of each data element on each block meets a preset access condition. The control module 45 is configured to allow the user to operate the data element on a target block based on an operation type corresponding to the permission level of the user if the dynamic access permission value of the data element on the target block meets the preset access condition.

[0109] Optionally, when the judgment module 44 determines whether the dynamic access permission value of each data element on each block meets the preset access condition, the judgment module 44 is specifically configured to determine whether the dynamic access permission value of each data element on each block is within a permission value range corresponding to the permission level of the user, and / or determine whether the dynamic access permission value of each data element on each block is greater than a maximum value of the permission value range corresponding to the permission level of the user. If the dynamic access permission value of the data element on the target block is within the permission value range corresponding to the permission level of the user, or the dynamic access permission value of the data element on the target block is greater than the maximum value of the permission value range corresponding to the permission level of the user, it is determined that the dynamic access permission value of the data element on the target block meets the preset access condition.

[0110] Optionally, the control module 45 is further configured to prohibit the user from operating the data element on the target block if the dynamic access permission value of the data element on the target block does not meet the preset access condition.

[0111] Optionally, the dynamic access permission model is as follows:

[0112]

[0113] wherein t represents the dynamic access permission value, a represents a preset first adjustment factor, b represents a preset second adjustment factor, t represents the current time, f represents the initial access permission value, g represents a preset third adjustment factor, b' represents a preset fourth adjustment factor, N represents a preconfigured number of terms, b" represents a preset fifth adjustment factor, n! represents a factorial operation of n, and w represents a preset sixth adjustment factor.

[0114] Optionally, after the dynamic access permission model is constructed, the apparatus 40 further comprises an optimization module 46, which is configured to perform optimization processing on the dynamic access permission model to generate a target dynamic access permission model.

[0115] When the computing module 43 calculates the dynamic access permission value of the data element on each block based on the current time and the initial access permission value through the dynamic access permission model, the computing module 43 is specifically configured to calculate the target dynamic access permission value of the data element on each block based on the current time and the initial access permission value through the target dynamic access permission model.

[0116] Optionally, the target dynamic access permission model is:

[0117]

[0118] wherein y' is the target dynamic access permission value, a represents a preset first adjustment factor, β represents a preset second adjustment factor, t represents the current time, f represents the initial access permission value, γ represents a preset third adjustment factor, β' represents a preset fourth adjustment factor, N represents a preconfigured number of terms, a' represents a preset fifth adjustment factor, n! represents the factorial operation of n, ω represents a preset sixth adjustment factor, δ represents a preset first target adjustment factor, λ represents a preset second target adjustment factor, μ represents a preset third target adjustment factor, v represents a preset fourth target adjustment factor, and g(t) is an influence function of the current time t on the target dynamic access permission value, which is used to represent the influence of time on access permission.

[0119] Optionally, the influence function g(t) of the current time t on the target dynamic access permission value is represented as:

[0120] g(t)=λ′·t·(1-t)+sin(πt)+μ′·t 3 +v′·cos(πt)+η·t 1 / 2 +θ·t·sin(2πt)

[0121] wherein λ' represents a first adjustment factor of time influence, μ' represents a second adjustment factor of time influence, v' represents a third adjustment factor of time influence, η represents a fourth adjustment factor of time influence, and θ represents a fifth adjustment factor of time influence.

[0122] Figure 3 The data element access control apparatus of the embodiments can be used to execute the technical solutions of the method embodiments, and has similar implementation principles and technical effects, which will not be described here again.

[0123] Figure 4This is a schematic diagram of the structure of an electronic device according to an embodiment of this disclosure. See below for details. Figure 4 It shows a schematic diagram of a structure suitable for implementing the electronic device 600 in the embodiments of this disclosure. Figure 4 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0124] like Figure 4 As shown, electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processor, etc.) 601, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 602 or a program loaded from storage device 608 into random access memory (RAM) 603 to implement the data element access control method as described in the embodiments of this disclosure. The RAM 603 also stores various programs and data required for the operation of electronic device 600. The processing device 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.

[0125] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 607 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 608 including, for example, magnetic tapes, hard disks, etc.; and communication devices 609. Communication device 609 allows electronic device 600 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 4 An electronic device 600 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0126] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts, thereby implementing the data element access control method as described above. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, it performs the functions defined in the methods of embodiments of this disclosure.

[0127] It should be noted that the computer-readable medium described above can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium, for example, can be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the foregoing. More specific examples of the computer-readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program used by or in connection with an instruction execution system, apparatus or device. In the disclosure, the computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, in which the computer-readable program code is contained. Such a propagated data signal can take any of a variety of forms, including, but not limited to, an electromagnetic signal, an optical signal, or any suitable combination of the foregoing. The computer-readable signal medium can also be any computer-readable medium that is not a storage medium and that can communicate, propagate or transport a program for use by or in connection with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including, but not limited to, wire, cable, RF (radio frequency), etc., or any suitable combination of the foregoing.

[0128] In some embodiments, the client, server, or both can communicate using any current known or future developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include local area networks ("LAN"), wide area networks ("WAN"), the Internet, and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any current known or future developed networks.

[0129] The computer-readable medium described above can be included in the electronic device; or exist separately from the electronic device, and not be assembled into the electronic device.

[0130] The computer-readable medium described above carries one or more programs, when the one or more programs are executed by the electronic device, cause the electronic device to:

[0131] allocating an initial access permission value for a data element on each block on the blockchain;

[0132] in response to receiving an operation request of a user, obtaining a permission level of the user;

[0133] constructing a dynamic access permission model, and calculating a dynamic access permission value of the data element on each block by the dynamic access permission model based on a current time and the initial access permission value;

[0134] determining whether the dynamic access permission value of the data element on each block meets a preset access condition;

[0135] if the dynamic access permission value of the data element on the target block meets the preset access condition, allowing the user to operate the data element on the target block based on an operation type corresponding to the permission level of the user.

[0136] Optionally, when the one or more programs are executed by the electronic device, the electronic device can further execute other steps described in the above embodiments.

[0137] Computer program code for carrying out operations of the present disclosure can be written in one or more programming languages or combinations of languages including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages such as C or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0138] The computer program product of the first aspect can include one or more non-transitory computer-readable media storing instructions that, when executed, cause one or more processors to perform the operations of the method of the first aspect. The computer program product of the first aspect can include a computer-readable medium storing instructions that, when executed, cause one or more processors to perform the operations of the method of the first aspect.

[0139] The units described in the embodiments of the present disclosure can be implemented by software, or by hardware, or by a combination of software and hardware. In some cases, the names of the units do not constitute a limitation on the units themselves.

[0140] The functions described in this document can be implemented in part or in whole using one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include Field-programmable Gate Arrays (FPGAs), Program-specific Integrated Circuits (ASICs), Program-specific Standard Products (ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc.

[0141] In the context of the present disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fiber, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0142] The above description merely illustrates the preferred embodiments of the disclosure and a principle for applying the technologies. It is understood by those skilled in the art that the disclosed scope of the disclosure is not limited to the technical solutions formed by the specific combinations of the technical features described above, and should also cover other technical solutions formed by the combinations of the technical features described above or their equivalent features without departing from the disclosed concept. For example, the technical solutions formed by the mutual replacement of the above-described features and the technical features with similar functions disclosed in the disclosure (but not limited to) can be formed.

[0143] Further, although operations are depicted in a particular, sequential order, this should not be understood as requiring or implying that the operations are performed in the order illustrated or sequentially. In certain circumstances, multitasking and parallel processing can be advantageous. Likewise, although specific implementation details are included for the purpose of providing a thorough disclosure, these should not be construed as limitations on the scope of the disclosure. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable sub-combination.

[0144] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. A data element access control method, characterized by, The method comprises: allocating an initial access permission value for a data element on each block on a blockchain; in response to receiving an operation request of a user, obtaining a permission level of the user; constructing a dynamic access permission model, and calculating a dynamic access permission value of the data element on each block based on a current time and the initial access permission value through the dynamic access permission model; determining whether the dynamic access permission value of the data element on each block meets a preset access condition; if the dynamic access permission value of the data element on a target block meets the preset access condition, allowing the user to operate the data element on the target block based on an operation type corresponding to the permission level of the user; the determination of whether the dynamic access permission value of the data element on each block meets the preset access condition comprises: determining whether the dynamic access permission value of the data element on each block is within a permission value range corresponding to the permission level of the user; and / or determining whether the dynamic access permission value of the data element on each block is greater than a maximum value of the permission value range corresponding to the permission level of the user; if the dynamic access permission value of the data element on the target block is within the permission value range corresponding to the permission level of the user, or the dynamic access permission value of the data element on the target block is greater than the maximum value of the permission value range corresponding to the permission level of the user, it is determined that the dynamic access permission value of the data element on the target block meets the preset access condition; the dynamic access permission model is: wherein, represents a dynamic access permission value, represents a preset first adjustment factor, represents a preset second adjustment factor, represents a current time, represents an initial access permission value, represents a preset third adjustment factor, represents a preset fourth adjustment factor, represents a preconfigured number of items, represents a preset fifth adjustment factor, represents a factorial operation of a preset sixth adjustment factor.

2. The method of claim 1, wherein, the method further comprises: if the dynamic access permission value of the data element on the target block does not meet the preset access condition, the user is prohibited from operating the data element on the target block.

3. The method of claim 1, wherein, after the dynamic access permission model is constructed, the method further comprises: optimizing the dynamic access permission model to generate a target dynamic access permission model; the calculation of the dynamic access permission value of the data element on each block based on the current time and the initial access permission value through the dynamic access permission model comprises: calculating a target dynamic access permission value of the data element on each block based on the current time and the initial access permission value through the target dynamic access permission model.

4. The method of claim 3, wherein, the target dynamic access permission model is: wherein, is a target dynamic access permission value, denotes a preset first adjustment factor, denotes a preset second adjustment factor, denotes a current time, denotes an initial access permission value, denotes a preset third adjustment factor, denotes a preset fourth adjustment factor, denotes a preset number of items, denotes a preset fifth adjustment factor, denotes a factorial operation of denotes a preset sixth adjustment factor, denotes a preset first target adjustment factor, denotes a preset second target adjustment factor, denotes a preset third target adjustment factor, denotes a preset fourth target adjustment factor, is a current time an influence function on the target dynamic access permission value, for characterizing the influence of time on the access permission.

5. The method of claim 4, wherein, the current time influence function on target dynamic access rights values is represented as: wherein a first adjustment factor representing a time influence, a second adjustment factor representing a time influence, a third adjustment factor representing a time influence, a fourth adjustment factor representing a time influence, a fifth adjustment factor representing a time influence.

6. A data element access control apparatus, characterized by comprising: the device comprises: an allocation module configured to allocate an initial access permission value for a data element on each block on a blockchain; an obtaining module configured to obtain a permission level of a user in response to receiving an operation request of the user; a calculation module configured to construct a dynamic access permission model, and calculate a dynamic access permission value of the data element on each block based on a current time and the initial access permission value through the dynamic access permission model; a determination module configured to determine whether the dynamic access permission value of the data element on each block meets a preset access condition; The control module is configured to allow the user to operate the data element on the target block based on an operation type corresponding to the permission level of the user if the dynamic access permission value of the data element on the target block meets the preset access condition. In the step of judging whether the dynamic access permission value of the data element on each block meets the preset access condition, the judging module is specifically configured to: judge whether the dynamic access permission value of the data element on each block is within a permission value range corresponding to the permission level of the user; and / or judge whether the dynamic access permission value of the data element on each block is greater than a maximum value of the permission value range corresponding to the permission level of the user; if the dynamic access permission value of the data element on the target block is within the permission value range corresponding to the permission level of the user, or the dynamic access permission value of the data element on the target block is greater than the maximum value of the permission value range corresponding to the permission level of the user, it is determined that the dynamic access permission value of the data element on the target block meets the preset access condition; the dynamic access permission model is: wherein, represents a dynamic access permission value, represents a preset first adjustment factor, represents a preset second adjustment factor, represents a current time, represents an initial access permission value, represents a preset third adjustment factor, represents a preset fourth adjustment factor, represents a preconfigured number of items, represents a preset fifth adjustment factor, represents a factorial operation of a preset sixth adjustment factor.

7. An electronic device, comprising: comprises: a memory; a processor; and a computer program; wherein the computer program is stored in the memory and configured to be executed by the processor to implement the method of any one of claims 1-5.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1-5.

Images