A forest and grassland Internet of Things access control method and system based on smart contracts and KP-ABE

Abstract

The present invention relates to a forest and grass Internet of Things access control method and system based on smart contracts and KP-ABE, comprising the following steps: S1, blockchain network initialization and smart contract definition; S2, forest and grass Internet of Things gateway data transmission attribute encryption and access request generation; S3, forest and grass cloud platform verifies the data transmission attribute access request of the forest and grass Internet of Things gateway; S4, forest and grass cloud platform decrypts the transmission data and stores it in the data acquisition database; S5, forest and grass Internet of Things gateway operation configuration download attribute access request generation; S6, forest and grass cloud platform verifies the forest and grass Internet of Things gateway operation configuration download attribute access request; S7, forest and grass Internet of Things gateway downloads the forest and grass Internet of Things gateway operation configuration; S8, forest and grass cloud platform security situation awareness and emergency disposal; S9, end the process; the system is used to execute the above control method. The present invention realizes the decentralization, transparency, non-tamperability and traceability of the access control of the forest and grass Internet of Things system.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security technology, and in particular to a forest and grassland Internet of Things access control method and system based on smart contracts and KP-ABE. Background Art

[0002] Compared with the power Internet of Things, the Internet of Vehicles, and the Industrial Internet of Things, the forest and grassland Internet of Things has the industry specificity of "difficult terminal protection, difficult power supply, difficult network communication, difficult system maintenance, and difficult security protection" because the terminals are deployed in an open natural environment. At present, the traditional password-based static identity authentication method, centralized authorization management, and access control list mode have the following defects in the forest and grassland Internet of Things:

[0003] There is a risk of centralization: Traditional access control methods usually rely on centralized servers or management systems to maintain and manage access rights. This increases the risk of single point failure. If the centralized system is attacked or fails, the security of the entire IoT system may be affected.

[0004] Lack of transparency: Traditional access control methods often do not have the transparency characteristics of blockchain. This means that the management of access control rules and permissions may not be transparent enough and susceptible to manipulation or abuse by internal malicious actors.

[0005] Static and inflexible: Traditional access control methods usually require pre-configuration of access rights before system deployment, and once configured, it is difficult to modify and adjust. This makes it difficult for the system to cope with dynamically changing access requirements and environments, and lacks flexibility and adaptability.

[0006] Complex permission management: Traditional access control methods may require setting and managing permissions for each user or user group separately, which increases management complexity and cost. As the scale of the Internet of Things expands and the number of users increases, permission management may become more difficult.

[0007] Internal security challenges: Traditional access control methods may face a variety of internal security challenges, such as poor key management, permission leakage, identity forgery, etc. These problems may lead to unauthorized access and data leakage, posing a threat to the security of forest and grassland IoT systems.

[0008] To sum up, there is an urgent need to provide a forestry and grassland Internet of Things access control method and system that is decentralized, transparent, tamper-proof and traceable, flexible, efficient and dynamically adjustable, and can solve the access control problems of forestry and grassland Internet of Things systems in complex open environments. Summary of the invention

[0009] The purpose of the present invention is to provide a forestry and grassland Internet of Things access control method and system that is decentralized, transparent, tamper-proof and traceable, and flexible, efficient and dynamically adjustable, and can solve the access control problems of forestry and grassland Internet of Things systems in complex open environments.

[0010] The above purpose is achieved through the following technical solution: A forest and grassland IoT access control method based on smart contracts and KP-ABE, comprising the following steps:

[0011] S1, blockchain network initialization and smart contract definition: select the blockchain type and blockchain platform, initialize the blockchain network, complete the access control smart contract definition and chain code installation, as well as the security situation awareness smart contract definition and chain code installation;

[0012] S2, data transmission attribute encryption and access request generation of the forest and grassland IoT gateway: Encrypt the forest and grassland IoT terminal data collected by the forest and grassland IoT gateway to form a ciphertext, and initiate a data transmission attribute access request to the forest and grassland cloud platform;

[0013] S3, the Lincao cloud platform verifies the data transmission attribute access request of the Lincao IoT gateway: the Lincao cloud platform registers the session in the blockchain network, simulates and calculates the subject attributes of the current access session Lincao IoT gateway, and verifies whether the attributes of the Lincao IoT gateway pass the verification. If so, execute step S4, if not, execute step S8;

[0014] S4, the forest and grass cloud platform decrypts the transmitted data and stores it in the data collection database: the forest and grass cloud platform performs the decryption operation. If the decryption is successful, the data transmitted by the forest and grass IoT gateway is stored in the data collection database and step S5 is executed. If the decryption is unsuccessful, step S8 is executed;

[0015] S5, generation of access request for downloading running configuration attributes of forest and grassland IoT gateway: the forest and grassland IoT gateway generates access request for downloading running configuration attributes of forest and grassland IoT gateway in combination with the main attributes of the forest and grassland IoT gateway, and sends the access request for downloading running configuration attributes of forest and grassland IoT gateway to the forest and grassland cloud platform;

[0016] S6, the Lincao cloud platform verifies the access request for downloading the running configuration of the Lincao IoT gateway: the Lincao cloud platform registers the session in the blockchain network, and simulates and calculates the subject attributes of the Lincao IoT gateway of the current access session, and verifies whether the attributes of the Lincao IoT gateway pass the verification in combination with the simulated calculated subject attributes of the Lincao IoT gateway. If so, execute step S7, if not, execute step S8;

[0017] S7, the forest and grass IoT gateway downloads the forest and grass IoT gateway operation configuration: the forest and grass IoT gateway reads the forest and grass IoT periodic operation configuration in the forest and grass cloud platform and downloads and stores it locally to the forest and grass IoT gateway, and executes step S9;

[0018] S8, security situation awareness and emergency disposal of the Lincao cloud platform: The Lincao IoT gateway calls the access control failure session chain strategy of the access control smart contract, records the access control access session failure information to the blockchain network, and determines whether there is a DOS attack. If so, prevent the DOS attack and execute step S9. If not, directly execute step S9;

[0019] S9, end the process.

[0020] The technical solution of the present invention aims to solve the problems of traditional access control technology, such as centralization risk, lack of transparency, staticness and inflexibility, complex permission management, internal security challenges, etc. By defining a dynamic access control smart contract in the blockchain network, attribute-based access control combined with multi-dimensional dynamic attributes is adopted to realize dynamic and sustainable access control between the forest and grassland Internet of Things gateway and the forest and grassland cloud platform, key policy attribute-based encryption is used to realize the secure transmission of collected data, and the access session between the forest and grassland Internet of Things gateway and the forest and grassland cloud platform is stored in the blockchain. While realizing the decentralization, transparency, non-tamperability and traceability of the forest and grassland Internet of Things system, it also realizes flexible, efficient and dynamically adjustable access control, effectively solving the access control problem of the forest and grassland Internet of Things system in a complex open environment.

[0021] A further technical solution is that step S1 includes the following steps:

[0022] S1.1, blockchain network initialization;

[0023] S1.2, access control smart contract definition and chain code installation, where the access control smart contract includes the access session operation strategy and dynamic access control strategy of the Lincao IoT Gateway and Lincao Cloud Platform in the blockchain network;

[0024] S1.3, Security Situation Awareness Smart Contract Definition and Chain Code Installation: The security situation awareness smart contract includes the data exchange operation strategy performed by the Lincao IoT Gateway and the Lincao Cloud Platform in the blockchain network after access control, and the security situation awareness operation strategy performed in the blockchain network after access control or decryption fails;

[0025] S1.4, key policy attribute-based encryption scheme initialization and key generation: Key policy attribute-based encryption generates the system public key and system master key, and calculates the decryption key of the Lincao Cloud Platform client user based on the system master key and user attribute set.

[0026] A further technical solution is that the access session operation strategy includes:

[0027] Data transmission session chain strategy: used to initiate a transaction for the data transmission access session sent by the forest and grassland IoT gateway, and after calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network;

[0028] Running configuration download access session chain strategy: used to initiate a transaction for the running configuration download access session sent by the forest and grassland IoT gateway, and after calculation through the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network;

[0029] Access control failed session on-chain strategy: When access control or decryption of the forest and grassland IoT gateway fails, a transaction is initiated for the access control failed session. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network;

[0030] The dynamic access control strategy includes:

[0031] Forest and Grassland IoT Gateway Subject Attribute Generation Strategy: It is used for the Forest and Grassland IoT Gateway to directly read its own attributes and collect data information;

[0032] The multi-dimensional dynamic attribute generation strategy of the forest and grassland IoT gateway subject: used by the forest and grassland cloud platform to simulate the multi-dimensional dynamic attributes using the physical model and calculate the attribute value of the forest and grassland IoT gateway subject for this access session;

[0033] Forestry and Grassland IoT Gateway Data Transmission Attribute Access Request Generation Strategy: used for the Forestry and Grassland IoT Gateway to generate data transmission attribute access requests;

[0034] The strategy for generating access request for running configuration download attribute of forest and grassland IoT gateway is used for generating access request for running configuration download attribute of forest and grassland IoT gateway;

[0035] Lincao Cloud Platform Key Policy Attribute-Based Encryption Initialization Strategy: used for key policy attribute-based encryption to generate system public keys and system master keys;

[0036] Lincao Cloud Platform Access Control Tree Structure Key Generation Strategy: used to calculate the decryption key of the Lincao Cloud Platform client user based on the system master key and user attribute set;

[0037] Key policy attribute-based encryption strategy for forest and grassland IoT gateway: used for forest and grassland IoT gateway to use system public key, with forest and grassland IoT gateway submission data and data transmission access request attributes as input to generate ciphertext;

[0038] Key policy attribute base data decryption strategy of the forest and grass cloud platform: used by the forest and grass cloud platform to take the ciphertext as input and restore the data submitted by the forest and grass IoT gateway when the predetermined requirements are met;

[0039] The access control verification strategy for downloading the operation configuration of the forest and grass IoT gateway is: the forest and grass cloud platform combines the forest and grass cloud platform client attribute set and the forest and grass IoT gateway operation configuration download attribute access request attribute set to perform access control verification on the forest and grass IoT gateway;

[0040] The data transmission access control verification strategy of the forest and grass IoT gateway is: the forest and grass cloud platform combines the forest and grass cloud platform client attribute set and the forest and grass IoT gateway data transmission attribute access request attribute set to perform access control verification on the forest and grass IoT gateway;

[0041] The data exchange operation strategy includes:

[0042] The download strategy of the operation configuration of the forest and grassland IoT gateway is used by the forest and grassland IoT gateway to obtain the periodic operation configuration of the forest and grassland IoT gateway configured and generated in the forest and grassland cloud platform from the client of the forest and grassland cloud platform;

[0043] Data transmission strategy of forestry and grassland IoT gateway: used by the forestry and grassland IoT gateway to obtain data transmission storage configuration information and execute operations in the forestry and grassland cloud platform from the forestry and grassland cloud platform client;

[0044] The security situation awareness operation strategy includes:

[0045] Security situation awareness strategy: used by the Lincao cloud platform to monitor the Lincao IoT gateways that fail access control or decryption;

[0046] Security threat emergency response strategy: The forestry and grassland cloud platform is used to close access authorization for forestry and grassland IoT gateways that exceed the specified access threshold, and inform the forestry and grassland IoT gateways that have been attacked.

[0047] A further technical solution is that step S2 specifically includes the following steps:

[0048] S2.1, determine whether the forest and grassland IoT gateway is deployed for the first time, if so, execute step S2.2, if not, execute step S2.3;

[0049] S2.2, mobile data collection terminal connects and configures the forest and grassland IoT gateway: Use the mobile data collection terminal to connect the forest and grassland IoT gateway and the forest and grassland cloud platform, download and store the dynamic access control policy of the access control smart contract in the forest and grassland cloud platform, the data exchange operation policy of the security situation awareness smart contract, and the operation configuration of the forest and grassland IoT gateway to the local forest and grassland IoT gateway;

[0050] S2.3, the forestry and grassland IoT gateway periodically generates attribute access requests: the forestry and grassland IoT gateway uses the forestry and grassland IoT gateway subject attribute generation strategy to periodically generate the subject attributes of the forestry and grassland IoT gateway based on the locally stored smart contract strategy and the forestry and grassland IoT gateway operation configuration;

[0051] S2.4, encryption of data collected by the forest and grassland IoT gateway using the key policy attribute-based encryption mechanism: The forest and grassland IoT gateway uses the forest and grassland IoT gateway subject attributes and the forest and grassland cloud platform system public key to call the forest and grassland IoT gateway key policy attribute-based encryption strategy to encrypt the forest and grassland IoT terminal data collected in the forest and grassland IoT gateway to form ciphertext;

[0052] S2.5, the forestry and grassland IoT gateway initiates a data transmission attribute access request to the forestry and grassland cloud platform: the forestry and grassland IoT gateway uses the data transmission attribute access request generation strategy, combines the forestry and grassland IoT gateway subject attributes to generate a forestry and grassland IoT gateway data transmission attribute access request, and sends the forestry and grassland IoT gateway data transmission attribute access session to the forestry and grassland cloud platform.

[0053] A further technical solution is that step S3 specifically includes the following steps:

[0054] S3.1, Lincao Cloud Platform uploads the data transmission session of Lincao IoT Gateway to the blockchain network: Lincao Cloud Platform calls the data transmission session chain strategy, initiates a transaction for the data transmission access session sent by Lincao IoT Gateway, and forms a new block storage into the blockchain network after calculation by the blockchain network consensus algorithm;

[0055] S3.2, the forestry cloud platform calculates the multi-dimensional dynamic attributes of the forestry IoT gateway: the forestry cloud platform calls the multi-dimensional dynamic attribute calculation strategy of the forestry IoT gateway subject, obtains the forestry IoT gateway subject attributes of the last access session stored in the blockchain network as a basis, uses the physical model to simulate the multi-dimensional dynamic attributes, and calculates the forestry IoT gateway subject attribute value of this access session;

[0056] S3.3, the Lincao Cloud Platform performs access control verification on the data transmission of the Lincao Internet of Things Gateway: The Lincao Cloud Platform calls the Lincao Internet of Things Gateway data transmission access control verification strategy, and verifies whether the subject attribute of the Lincao Internet of Things Gateway of the current access request passes the verification in combination with the simulated calculated subject attribute value of the Lincao Internet of Things Gateway. If so, execute step S4; if not, execute step S8.

[0057] A further technical solution is that step S4 specifically includes the following steps:

[0058] S4.1, Lincao Cloud Platform Key Policy Attribute Base Data Decryption: Lincao Cloud Platform calls the Lincao Cloud Platform Key Policy Attribute Base Data Decryption Strategy, uses the key to perform the decryption operation, and the decryption is successful when the attributes in the ciphertext meet the access control tree; if the decryption is unsuccessful, execute step S8;

[0059] S4.2, the data transmitted by the forestry and grassland IoT gateway is stored in the data collection database: the forestry and grassland cloud platform calls the data transmission strategy of the forestry and grassland IoT gateway and stores the data transmitted by the forestry and grassland IoT gateway into the data collection database.

[0060] A further technical solution is that step S6 specifically includes the following steps:

[0061] S6.1, Lincao Cloud Platform uploads the running configuration download session of Lincao IoT Gateway to the blockchain network: Lincao Cloud Platform calls the running configuration download session chain strategy, initiates a transaction for the running configuration download access session sent by Lincao IoT Gateway, and after calculation by the blockchain network consensus algorithm, forms a new block storage into the blockchain network;

[0062] S6.2, the forestry cloud platform calculates the multi-dimensional dynamic attributes of the forestry IoT gateway: the forestry cloud platform calls the forestry IoT gateway subject multi-dimensional dynamic attribute calculation strategy of the access control smart contract, obtains the forestry IoT gateway subject attributes of the last access session stored in the blockchain network, and uses the physical model to simulate the multi-dimensional dynamic attributes to calculate the forestry IoT gateway subject attribute value of this access session;

[0063] S6.3, the Lincao cloud platform performs access control verification on the download access of the Lincao IoT gateway operation configuration: the Lincao cloud platform calls the access control verification strategy for the download access of the Lincao IoT gateway operation configuration, and verifies whether the main attribute of the Lincao IoT gateway of the current access request passes the verification in combination with the main attribute value of the Lincao IoT gateway calculated by simulation. If so, execute step S7; if not, execute step S8;

[0064] A further technical solution is that step S8 specifically includes the following steps:

[0065] S8.1, the access control result session of the forestry and grassland IoT gateway is uploaded to the blockchain network: the forestry and grassland cloud platform calls the access control failure session chain strategy, initiates a transaction for the access control failure session sent by the forestry and grassland IoT gateway, and after calculation by the blockchain network consensus algorithm, forms a new block storage and enters the blockchain network;

[0066] S8.2, the Lincao cloud platform conducts security situation awareness: call the security situation awareness strategy, read the historical access session records in the blockchain network, evaluate the number of accesses to the current client node and the Lincao IoT gateway to determine whether there is a DOS attack, and if the access IP and / or access port exceeds the access upper limit threshold, execute step S8.3;

[0067] S8.3, Lincao Cloud Platform carries out emergency disposal: calls the security threat emergency disposal strategy to urgently close the current access IP and / or access port to prevent DOS attacks.

[0068] To achieve the above-mentioned objectives, the present invention also provides a forestry and grassland Internet of Things access control system based on smart contracts and KP-ABE, which is used to implement any of the above-mentioned forestry and grassland Internet of Things access control methods based on smart contracts and KP-ABE. The forestry and grassland Internet of Things access control system based on smart contracts and KP-ABE is established on a blockchain network, and the dynamic access control of the forestry and grassland Internet of Things gateway to the forestry and grassland cloud platform is realized by calling and executing smart contracts.

[0069] A further technical solution is that the forest and grassland IoT access control system based on smart contracts and KP-ABE includes:

[0070] Blockchain initialization and smart contract definition module: used to initialize the blockchain network according to the application scenario, complete the access control smart contract definition and chain code installation, as well as the security situation awareness smart contract definition and chain code installation, and initialize the system public key, master key and generate the client user private key;

[0071] Data transmission attribute encryption and access request generation module: used to periodically and automatically run the configuration of the forest and grassland IoT gateway, generate the main attributes of the forest and grassland IoT gateway, combine the public key of the forest and grassland cloud platform system, use the forest and grassland IoT gateway key policy attribute-based encryption strategy, encrypt the forest and grassland IoT terminal data collected in the forest and grassland IoT gateway to form ciphertext, and initiate a data transmission attribute access request to the forest and grassland cloud platform;

[0072] Data transmission attribute access request verification module: After the forestry and grassland cloud platform uploads the data transmission session to the chain, it verifies whether the attributes of the forestry and grassland IoT gateway have passed the verification in combination with the main attributes of the forestry and grassland IoT gateway calculated by simulation;

[0073] Transmission data decryption and storage module: It is used for the forestry cloud platform to use the key related to the access structure to decrypt the ciphertext transmitted by the forestry Internet of Things, and store the data transmitted by the successfully decrypted forestry Internet of Things gateway into the data collection database;

[0074] Running configuration download attribute access request generation module: used for the forest and grassland Internet of Things to combine the main attributes of the forest and grassland Internet of Things gateway, use the forest and grassland Internet of Things gateway running configuration download attribute access request generation strategy, generate the forest and grassland Internet of Things gateway running configuration download attribute access request, and send the forest and grassland Internet of Things gateway running configuration download attribute access request to the forest and grassland cloud platform;

[0075] Running configuration download attribute access request verification module: After the Lincao cloud platform uploads the running configuration download access session to the chain, it combines the main attributes of the Lincao IoT gateway calculated by simulation to verify whether the attributes of the Lincao IoT gateway have passed the verification;

[0076] Periodic operation configuration download module: used by the Forestry and Grassland IoT Gateway to read the periodic operation configuration of the Forestry and Grassland IoT in the Forestry and Grassland Cloud Platform and download it to the local storage of the Forestry and Grassland IoT Gateway;

[0077] Security situation awareness and emergency response module: After the forestry and grassland IoT gateway uploads the access control failed session to the chain, it reads the historical access session records in the blockchain network, evaluates the number of accesses to the current client node and the forestry and grassland IoT gateway, determines whether there is a DOS attack, and prevents the DOS attack.

[0078] Compared with the existing technology, the present invention takes advantage of the blockchain technology and attribute-based encryption technology, and combines multi-dimensional dynamic attributes to participate in access control, providing a decentralized, transparent, tamper-proof and traceable, flexible, efficient and dynamically adjustable dynamic access control mechanism for the forest and grassland Internet of Things, with the following advantages:

[0079] (1) Decentralization and distribution: Deployed on the blockchain through smart contracts, the dynamic access control method has decentralized and distributed characteristics. There is no single central point that can control or tamper with access rights, which enhances the security and robustness of the system.

[0080] (2) Transparency and immutability: All smart contract executions and transactions are recorded on the blockchain network, ensuring transparency and immutability, which can effectively prevent malicious actors from modifying access control rules or abusing permissions.

[0081] (3) Dynamicity and flexibility: Smart contracts can automatically execute and adjust access rights according to preset rules and conditions. This enables access control policies to be dynamically adjusted according to the real-time status and needs of the forest and grassland IoT, increasing the flexibility and adaptability of the system.

[0082] (4) Fine-grained access control: KP-ABE allows fine-grained access control based on user attributes and roles. Different access rights can be set for different users or user groups to meet the complex permission requirements in the forest and grassland Internet of Things.

[0083] (5) Simplified permission management: By associating permissions with attributes and roles, KP-ABE simplifies the permission management process. Administrators do not need to set permissions for each user individually, but only need to define attributes and roles, thereby reducing management costs and complexity.

[0084] (6) Enhanced security: KP-ABE uses encryption technology to protect the security of data and combines multi-dimensional dynamic attributes to participate in access control, so that only users with appropriate attributes can decrypt and access data. This helps prevent unauthorized access and data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0086] Figure 1 A flowchart of a forest and grassland Internet of Things access control method based on smart contracts and KP-ABE according to an embodiment of the present invention;

[0087] Figure 2 A flowchart of a blockchain network initialization and smart contract definition process according to an embodiment of the present invention;

[0088] Figure 3 A schematic diagram of the process of encrypting data transmission attributes and generating access control requests for a forest and grassland Internet of Things gateway according to an embodiment of the present invention;

[0089] Figure 4 A schematic diagram of a process for verifying a data transmission attribute access control request of a forestry and grassland Internet of Things gateway by a forestry and grassland cloud platform involved in one embodiment of the present invention;

[0090] Figure 5 A flow chart of a process of downloading attribute access control request for verifying the operation strategy of a forestry and grassland Internet of Things gateway by a forestry and grassland cloud platform involved in one embodiment of the present invention;

[0091] Figure 6 A structural diagram of forest and grassland Internet of Things access control based on smart contracts and KP-ABE involved in one embodiment of the present invention;

[0092] Figure 7 The present invention is a schematic diagram of the execution process of a forest and grassland Internet of Things access control system based on smart contracts and KP-ABE involved in one embodiment of the present invention. DETAILED DESCRIPTION

[0093] The present invention is described in detail below in conjunction with the accompanying drawings. The description in this part is only exemplary and explanatory and should not have any limiting effect on the scope of protection of the present invention. In addition, those skilled in the art can make corresponding combinations of the features in the embodiments and in different embodiments in this document based on the description of this document.

[0094] The embodiments of the present invention are as follows, referring to Figure 1 , a forest and grassland Internet of Things access control method based on smart contracts and KP-ABE, including the following steps:

[0095] S1, blockchain network initialization and smart contract definition: system builders select blockchain type and blockchain platform according to application scenarios, perform blockchain network initialization, carry out organization registration, identity authentication and verification, define alliances for organizations according to actual business and create channels for alliances, issue certificates to the organization's client user nodes, peer nodes, sorting nodes, and identity authentication nodes through certificate authorities, and each organization approves the chain code definition and endorsement policy definition and completes storage on the channel ledger; complete access control smart contract definition and chain code installation, as well as security situation awareness smart contract definition and chain code installation; initialize and generate the forest and grass cloud platform system public key PK, system master key MK, and client user decryption key S;

[0096] like Figure 2 The specific steps of step S1 are as follows:

[0097] S1.1, blockchain network initialization: select the appropriate blockchain type and specific blockchain platform according to the application scenario, carry out organization registration, identity authentication and verification, define the alliance for the organization according to the actual business and create a channel for the alliance, issue certificates to the organization's client user nodes, peer nodes, sorting nodes, and identity authentication nodes through the certificate authority (CA), and each organization approves the chain code definition and endorsement policy definition and completes the storage on the channel ledger;

[0098] For the forest and grassland IoT application scenario, considering that the users are mainly forest and grassland management departments, the data has strong industry attributes and needs to be connected to the Internet for information exchange. It is most appropriate to use a consortium chain, and Hyperledger Fabric is one of the most widely used consortium chain platforms in the world. Therefore, the Fabric blockchain platform is recommended for the method of the present invention.

[0099] For the forestry and grassland Internet of Things system, the forestry and grassland management departments at all levels are organizations, and usually establish organizations and alliances according to administrative levels. For example, the forestry and grassland management departments at the municipal and county levels are organizations, and alliances are established at the provincial level. Channels are built to enable organizations to communicate with each other and maintain a common ledger.

[0100] Each organization registers with the Fabric blockchain network MSP as an organization administrator, and sends requests and obtains services to the Forest and Grassland IoT dynamic access control application system deployed on the Forest and Grassland Cloud Platform through the client user node. Registered field investigators, after passing the MSP identity authentication, use mobile data collection terminals to connect to the Forest and Grassland IoT gateway and the Forest and Grassland Cloud Platform to carry out the initial deployment work.

[0101] S1.2, access control smart contract definition and chain code installation, where the access control smart contract includes the access session operation strategy and dynamic access control strategy performed by the Lincao IoT Gateway and the Lincao Cloud Platform in the blockchain network, and the chain code is installed through the Lincao Cloud Platform client node;

[0102] The access session operation strategy includes:

[0103] Data transmission session on-chain strategy: It is used by the client of the Lincao Cloud Platform to initiate a transaction for the data transmission access session sent by the Lincao IoT gateway. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, so that the access behavior cannot be tampered with and can be traced;

[0104] Running configuration download access session chain strategy: It is used for the Lincao cloud platform client to initiate a transaction with the running configuration download access session sent by the Lincao IoT gateway. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, so that the access behavior cannot be tampered with and can be traced;

[0105] Access control failed session on-chain strategy: When the access control or decryption of the Lincao IoT gateway fails, the Lincao Cloud Platform initiates a transaction for the access control failed session. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, making the access behavior tamper-proof and traceable.

[0106] For the forest and grassland IoT system, the access session storage content varies according to the session type, but the storage method is the same, which is to update the access session information into the blockchain network. For example, the running configuration downloads the access session chain strategy, and the session storage content includes but is not limited to the visitor's username, login time, login location, login IP, and submits a session write request to the blockchain network after the session is completed.

[0107] For the forest and grass IoT system, in the access control attributes, the subject attribute is the data of the forest and grass IoT gateway, the object attribute is the forest and grass cloud platform client attribute, the permission attribute is the operation permission of the forest and grass IoT gateway to the forest and grass cloud platform, and the environment attribute is the environment information when the forest and grass IoT gateway accesses the forest and grass cloud platform. The object attribute is the description information of the forest and grass cloud platform client, such as: client IP, client port number, network protocol. The operations of the permission attribute include read, write, and execute; the environment attribute includes but is not limited to controlling the start time, end time, and initiator of the access session.

[0108] The dynamic access control strategy includes:

[0109] Forestry and Grassland Internet of Things Gateway Subject Attribute Generation Strategy: It is used for the forestry and grassland Internet of Things Gateway to directly read its own attributes and collect data information, such as device name, device type, device MAC, battery power, temperature, humidity, RSSI and other information, and store them in a key-value pair format. The format under one embodiment is as follows: {Device name: Getwey101, device type: Forestry and Grassland Internet of Things Gateway, device MAC: 23:e4:xx:xx:5f:k9, battery power: 2400, temperature: 24, humidity: 80; RSSI: -65};

[0110] The multi-dimensional dynamic attribute generation strategy of the forest and grassland IoT gateway subject: The forest and grassland cloud platform uses the physical model to simulate the multi-dimensional dynamic attributes based on the forest and grassland IoT gateway subject attributes of the previous access session stored in the blockchain network, and calculates the forest and grassland IoT gateway subject attribute values ​​of this access session for later access control verification;

[0111] Among them, multi-dimensional dynamic attributes refer to attribute values ​​that change over time or space, such as battery power, temperature and humidity, and wireless model strength. The physical model is determined by the physical characteristics of multi-dimensional dynamic attributes. For example, the battery power has a physical characteristic that the battery power will decay over time, and temperature and humidity are physical characteristics that wireless devices have consistent temperature and humidity in a common space environment; wireless model strength is a physical characteristic that the wireless signal strength of wireless devices in a fixed wireless signal space remains stable.

[0112] Forestry and Grassland IoT Gateway Data Transmission Attribute Access Request Generation Strategy: used for the Forestry and Grassland IoT Gateway to generate data transmission attribute access requests, including subject attributes, object attributes, authority attributes and environment attributes; the authority attribute is a write operation;

[0113] Forestry and Grassland IoT Gateway Operation Configuration Download Attribute Access Request Generation Strategy: used for the Forestry and Grassland IoT Gateway to generate operation configuration download attribute access request attributes, including subject attributes, object attributes, authority attributes and environment attributes; the authority attribute is a read operation;

[0114] Lincao Cloud Platform Key Policy Attribute-Based Encryption Initialization Strategy: used for the Certificate Authority (CA) Key Policy Attribute-Based Encryption (KP-ABE) to generate the system public key PK and system master key MK;

[0115] Lincao Cloud Platform Access Control Tree Structure Key Generation Strategy: The certificate authority (CA) calculates the decryption key S of the Lincao Cloud Platform client user based on the system master key MK and the user attribute set W';

[0116] Key policy attribute-based encryption strategy for forest and grass IoT gateway: used for the forest and grass IoT gateway to use the system public key PK, submit data D to the forest and grass IoT gateway, and access request attribute W as input to generate ciphertext C;

[0117] Key policy attribute-based data decryption strategy of the forest and grass cloud platform: used by the forest and grass cloud platform to take the ciphertext C as input. If the access request attribute W meets the threshold value requirement of the user attribute set W', the forest and grass IoT gateway submission data D is restored;

[0118] Access control verification strategy for downloading the operation configuration of the forest and grass IoT gateway: used for access control verification of the attribute set of the client of the forest and grass cloud platform being accessed and the attribute set of the access request for downloading the operation configuration of the forest and grass IoT gateway;

[0119] The access control verification strategy for data transmission of the forest and grassland IoT gateway is used to verify the access control of the attribute set of the client of the forest and grassland cloud platform being accessed and the attribute set of the access request for data collection and storage by the forest and grassland IoT gateway.

[0120] S1.3, Security Situation Awareness Smart Contract Definition and Chain Code Installation: The security situation awareness smart contract includes the data exchange operation strategy performed by the Lincao IoT Gateway and the Lincao Cloud Platform in the blockchain network after access control, and the security situation awareness operation strategy performed in the blockchain network after access control or decryption fails, and the chain code is installed through the Lincao Cloud Platform client node;

[0121] The data exchange operation strategy includes:

[0122] The Forestry and Grassland IoT Gateway Operation Configuration Download Strategy is used for the Forestry and Grassland IoT Gateway to obtain the periodic operation configuration of the Forestry and Grassland IoT Gateway configured and generated in the Forestry and Grassland Cloud Platform from the Forestry and Grassland Cloud Platform Client; the periodic operation configuration of the Forestry and Grassland IoT Gateway configured by the Forestry and Grassland Cloud Platform includes but is not limited to the IP address, access port, access time, and access duration of the Forestry and Grassland Cloud Platform Client;

[0123] Data transmission strategy of the Forestry and Grassland IoT Gateway: used by the Forestry and Grassland IoT Gateway to obtain data transmission storage configuration information and perform operations in the Forestry and Grassland Cloud Platform from the Forestry and Grassland Cloud Platform client, including but not limited to the Forestry and Grassland Cloud Platform client database IP address, access port, database name, and database user;

[0124] The security situation awareness operation strategy includes:

[0125] Security situation awareness strategy: used by the Lincao cloud platform to monitor the Lincao IoT gateways that fail access control or decryption;

[0126] Security threat emergency response strategy: The forestry and grassland cloud platform is used to close access authorization for forestry and grassland IoT gateways that exceed the specified access threshold, and inform the forestry and grassland IoT gateway of the information where the attack occurred; when the number of failed accesses to the same forestry and grassland IoT gateway exceeds the specified threshold, the security threat emergency response strategy is triggered.

[0127] S1.4, Key policy attribute-based encryption scheme initialization and key generation: The Lincao cloud platform client calls the Lincao cloud platform key policy attribute-based encryption initialization strategy of the access control smart contract, and the certificate authority (CA) key policy attribute-based encryption (KP-ABE) generates the system public key PK and system master key MK. Call the Lincao cloud platform access control tree structure key generation strategy of the access control smart contract, and the certificate authority (CA) calculates the decryption key S of the Lincao cloud platform client user based on the system master key MK and the user attribute set W'.

[0128] S2, Forestry and Grassland IoT Gateway data transmission attribute encryption and access request generation: The Forestry and Grassland IoT Gateway configures the Forestry and Grassland IoT Gateway through investigators or periodic automatic operation, generates the subject attributes of the Forestry and Grassland IoT Gateway, combines the public key of the Forestry and Grassland Cloud Platform system, uses the Forestry and Grassland IoT Gateway key policy attribute-based encryption strategy, encrypts the Forestry and Grassland IoT terminal data collected in the Forestry and Grassland IoT Gateway to form a ciphertext, and initiates a data transmission attribute access request to the Forestry and Grassland Cloud Platform;

[0129] like Figure 3 , the specific steps of step S2 are as follows:

[0130] S2.1, determine whether the forest and grassland IoT gateway is deployed for the first time, if so, execute step S2.2, if not, execute step S2.3;

[0131] S2.2, mobile data collection terminal connects and configures the forest and grassland IoT gateway: after passing the identity authentication, the field investigators registered through the Fabric blockchain network MSP use the mobile data collection terminal to connect the forest and grassland IoT gateway and the forest and grassland cloud platform, and download and store the dynamic access control policy of the access control smart contract in the forest and grassland cloud platform, the data exchange operation policy of the security situation awareness smart contract, and the operation configuration of the forest and grassland IoT gateway to the local forest and grassland IoT gateway;

[0132] S2.3, the forestry and grassland IoT gateway periodically generates attribute access requests: the forestry and grassland IoT gateway uses the forestry and grassland IoT gateway subject attribute generation strategy to periodically generate the subject attributes of the forestry and grassland IoT gateway based on the locally stored smart contract strategy and the forestry and grassland IoT gateway operation configuration;

[0133] The static attribute generation strategy of the forest and grass IoT gateway is that the forest and grass IoT gateway directly reads its own unchanged attribute information, such as device name, device type, device MAC and other information, and stores them in the form of key-value pairs. For example, {device name: Getwey101, device type: forest and grass IoT gateway, device MAC: 23:e4:xx:xx:5f:k9}.

[0134] S2.4, encryption of data collected by the forest and grassland IoT gateway using the key policy attribute-based encryption mechanism: The forest and grassland IoT gateway uses the forest and grassland IoT gateway subject attributes and the forest and grassland cloud platform system public key to call the forest and grassland IoT gateway key policy attribute-based encryption strategy to encrypt the forest and grassland IoT terminal data collected in the forest and grassland IoT gateway to form ciphertext;

[0135] S2.5, the forestry and grassland IoT gateway initiates a data transmission attribute access request to the forestry and grassland cloud platform: the forestry and grassland IoT gateway uses the data transmission attribute access request generation strategy and combines the forestry and grassland IoT gateway subject attributes to generate a forestry and grassland IoT gateway data transmission attribute access request, and sends the forestry and grassland IoT gateway data transmission attribute access session to the forestry and grassland cloud platform;

[0136] The data transmission access request attributes generated by the forestry and grassland IoT gateway include subject, object attributes, authority attributes and environment attributes; the authority attribute is a write operation, that is, writing the perception data collected by the forestry and grassland IoT gateway into the database of the forestry and grassland cloud platform.

[0137] S3, the Lincao cloud platform verifies the data transmission attribute access request of the Lincao IoT gateway: the Lincao cloud platform registers the session in the blockchain network, simulates and calculates the subject attributes of the current access session Lincao IoT gateway, and verifies whether the attributes of the Lincao IoT gateway pass the verification. If so, execute step S4, if not, execute step S8;

[0138] like Figure 4 , the specific steps of step S3 are as follows:

[0139] S3.1, Lincao Cloud Platform uploads the data transmission session of Lincao IoT Gateway to the blockchain network: Lincao Cloud Platform calls the data transmission session chain strategy, initiates a transaction for the data transmission access session sent by Lincao IoT Gateway, and forms a new block storage into the blockchain network after calculation through the blockchain network consensus algorithm, so as to realize the tamper-proof and traceable access behavior;

[0140] S3.2, the forestry cloud platform calculates the multi-dimensional dynamic attributes of the forestry IoT gateway: the forestry cloud platform calls the multi-dimensional dynamic attribute calculation strategy of the forestry IoT gateway subject, obtains the forestry IoT gateway subject attributes of the last access session stored in the blockchain network as a basis, uses the physical model to simulate the multi-dimensional dynamic attributes, and calculates the forestry IoT gateway subject attribute value of this access session;

[0141] S3.3, the Lincao Cloud Platform performs access control verification on the data transmission of the Lincao Internet of Things Gateway: The Lincao Cloud Platform calls the Lincao Internet of Things Gateway data transmission access control verification strategy, and verifies whether the subject attribute of the Lincao Internet of Things Gateway of the current access request passes the verification in combination with the simulated calculated subject attribute value of the Lincao Internet of Things Gateway. If so, execute step S4; if not, execute step S8.

[0142] For the forest and grass IoT system, the device type, device mac, device power, and registration time of the last access time node are calculated using the time-battery power attenuation model to compare the battery power result with the power in the current registration information of the forest and grass IoT gateway. If it is within the set threshold range, such as ±10% of the calculation result, it is considered to have passed the verification; the device temperature, external humidity, and internal humidity collected by the IoT gateway this time are calculated using the consistency characteristics of the common spatial environmental factors. The fluctuation range of the ambient temperature and humidity of all devices is calculated. If it is within the set threshold range, such as ±10% of the average temperature and humidity, it is considered to have passed the verification; the channel fingerprint and RF fingerprint are constructed based on the network channel using the wireless signal spatial transmission attenuation model. If it is within the set threshold range, such as ±10% of the signal strength, it is considered to have passed the verification. The above-mentioned multi-dimensional dynamic attribute verification can be used alone or in combination.

[0143] S4, the forest and grass cloud platform decrypts the transmitted data and stores it in the data collection database: the forest and grass cloud platform performs the decryption operation. If the decryption is successful, the data transmitted by the forest and grass IoT gateway is stored in the data collection database and step S5 is executed. If the decryption is unsuccessful, step S8 is executed;

[0144] The specific steps of step S4 are as follows:

[0145] S4.1, Lincao Cloud Platform Key Policy Attribute Base Data Decryption: Lincao Cloud Platform calls the Lincao Cloud Platform Key Policy Attribute Base Data Decryption Strategy, uses the key to perform the decryption operation, and the decryption is successful when the attributes in the ciphertext meet the access control tree; if the decryption is unsuccessful, execute step S8;

[0146] S4.2, the data transmitted by the forestry and grassland IoT gateway is stored in the data collection database: the forestry and grassland cloud platform calls the data transmission strategy of the forestry and grassland IoT gateway and stores the data transmitted by the forestry and grassland IoT gateway into the data collection database.

[0147] S5, generation of access request for downloading running configuration attributes of forest and grassland IoT gateway: the forest and grassland IoT gateway generates access request for downloading running configuration attributes of forest and grassland IoT gateway in combination with the main attributes of the forest and grassland IoT gateway, and sends the access request for downloading running configuration attributes of forest and grassland IoT gateway to the forest and grassland cloud platform;

[0148] Specifically, the forestry and grassland IoT gateway uses the forestry and grassland IoT gateway operation configuration download attribute access request generation strategy in the forestry and grassland IoT gateway operation configuration downloaded to the local area, combines the forestry and grassland IoT gateway subject attributes to generate a forestry and grassland IoT gateway operation configuration download attribute access request, and sends a forestry and grassland IoT gateway operation configuration download attribute access session to the forestry and grassland cloud platform.

[0149] For the forestry and grassland Internet of Things gateway, the operation configuration download access request attributes are generated, including subject attributes, object attributes, authority attributes and environment attributes; among them, the authority attribute is a read operation, that is, the forestry and grassland Internet of Things periodic operation configuration information in the forestry and grassland cloud platform database is read and downloaded to the local forestry and grassland Internet of Things gateway, for the periodic operation of the forestry and grassland Internet of Things gateway after the next sleep wake-up.

[0150] S6, the Lincao cloud platform verifies the access request for downloading the running configuration of the Lincao IoT gateway: the Lincao cloud platform registers the session in the blockchain network, and simulates and calculates the subject attributes of the Lincao IoT gateway of the current access session, and verifies whether the attributes of the Lincao IoT gateway pass the verification in combination with the simulated calculated subject attributes of the Lincao IoT gateway. If so, execute step S7, if not, execute step S8;

[0151] like Figure 5 , the specific steps of step S6 are as follows:

[0152] S6.1, Lincao Cloud Platform uploads the running configuration download session of Lincao IoT Gateway to the blockchain network: Lincao Cloud Platform calls the running configuration download session chain strategy, initiates a transaction for the running configuration download access session sent by Lincao IoT Gateway, and forms a new block storage into the blockchain network after calculation through the blockchain network consensus algorithm, so as to realize the tamper-proof and traceable access behavior;

[0153] S6.2, the forestry cloud platform calculates the multi-dimensional dynamic attributes of the forestry IoT gateway: the forestry cloud platform calls the forestry IoT gateway subject multi-dimensional dynamic attribute calculation strategy of the access control smart contract, obtains the forestry IoT gateway subject attributes of the last access session stored in the blockchain network, and uses the physical model to simulate the multi-dimensional dynamic attributes to calculate the forestry IoT gateway subject attribute value of this access session;

[0154] S6.3, the Lincao cloud platform performs access control verification on the download access of the Lincao IoT gateway operation configuration: the Lincao cloud platform calls the access control verification strategy for the download access of the Lincao IoT gateway operation configuration, and verifies whether the main attribute of the Lincao IoT gateway of the current access request passes the verification in combination with the main attribute value of the Lincao IoT gateway calculated by simulation. If so, execute step S7; if not, execute step S8;

[0155] S7, the forest and grass IoT gateway downloads the forest and grass IoT gateway operation configuration: the forest and grass IoT gateway reads the forest and grass IoT periodic operation configuration in the forest and grass cloud platform and downloads and stores it locally to the forest and grass IoT gateway, and executes step S9;

[0156] Specifically, the forestry and grassland IoT gateway uses the forestry and grassland IoT gateway operation configuration download strategy to read and download the forestry and grassland IoT periodic operation configuration information in the forestry and grassland cloud platform database to the local forestry and grassland IoT gateway for periodic operation after the forestry and grassland IoT gateway wakes up from sleep mode next time.

[0157] S8, security situation awareness and emergency disposal of the Lincao cloud platform: The Lincao IoT gateway calls the access control failure session chain strategy of the access control smart contract, records the access control access session failure information to the blockchain network, and determines whether there is a DOS attack. If so, prevent the DOS attack and execute step S9. If not, directly execute step S9;

[0158] The specific steps of step S8 are as follows:

[0159] S8.1, Lincao IoT Gateway access control result session upload to blockchain network: When access control or decryption fails, the Lincao Cloud Platform calls the access control failure session chain strategy, initiates a transaction for the access control failure session sent by the Lincao IoT Gateway, and forms a new block storage into the blockchain network after calculation through the blockchain network consensus algorithm, so as to achieve the tamper-proof and traceable access behavior;

[0160] S8.2, the Lincao cloud platform conducts security situation awareness: call the security situation awareness strategy, read the historical access session records in the blockchain network, evaluate the number of accesses to the current client node and the Lincao IoT gateway to determine whether there is a DOS attack, and if the access IP and / or access port exceeds the access upper limit threshold, execute step S8.3;

[0161] S8.3, Lincao Cloud Platform carries out emergency disposal: calls the security threat emergency disposal strategy to urgently close the current access IP and / or access port to prevent DOS attacks.

[0162] S9, end the process.

[0163] The technical solution of the present invention aims to address the problems of traditional access control technology, such as centralization risk, lack of transparency, staticness and inflexibility, complex permission management, and internal security challenges. By defining a dynamic access control smart contract in the blockchain network, attribute-based access control combined with multi-dimensional dynamic attributes is used to implement dynamic and sustainable access control between the forest and grassland Internet of Things gateway and the forest and grassland cloud platform, key policy attribute-based encryption is used to achieve secure transmission of collected data, and the access sessions between the forest and grassland Internet of Things gateway and the forest and grassland cloud platform are stored in the blockchain through transactions. This achieves decentralization, transparency, non-tamperability and traceability of access control of the forest and grassland Internet of Things system, while also achieving flexible, efficient and dynamically adjustable access control, effectively solving the access control problem of the forest and grassland Internet of Things system in a complex open environment.

[0164] The present invention also provides a forest and grassland Internet of Things access control system based on smart contracts and KP-ABE. The embodiments are as follows, which are used to implement any of the above-mentioned forest and grassland Internet of Things access control methods based on smart contracts and KP-ABE. The forest and grassland Internet of Things access control system based on smart contracts and KP-ABE is established on a blockchain network, and the dynamic access control of the forest and grassland Internet of Things gateway to the forest and grassland cloud platform is realized by calling and executing smart contracts.

[0165] Based on the above embodiment, in another embodiment of the present invention, Figure 6 The forest and grassland IoT access control system based on smart contracts and KP-ABE includes:

[0166] Blockchain initialization and smart contract definition module: used to initialize the blockchain network according to the application scenario, complete the access control smart contract definition and chain code installation, as well as the security situation awareness smart contract definition and chain code installation, and initialize the system public key, master key and generate the client user private key;

[0167] Data transmission attribute encryption and access request generation module: used to periodically and automatically run the configuration of the forest and grassland IoT gateway, generate the main attributes of the forest and grassland IoT gateway, combine the public key of the forest and grassland cloud platform system, use the forest and grassland IoT gateway key policy attribute-based encryption strategy, encrypt the forest and grassland IoT terminal data collected in the forest and grassland IoT gateway to form ciphertext, and initiate a data transmission attribute access request to the forest and grassland cloud platform;

[0168] Data transmission attribute access request verification module: After the forestry and grassland cloud platform uploads the data transmission session to the chain, it verifies whether the attributes of the forestry and grassland IoT gateway have passed the verification in combination with the main attributes of the forestry and grassland IoT gateway calculated by simulation;

[0169] Transmission data decryption and storage module: It is used for the forestry cloud platform to use the key related to the access structure to decrypt the ciphertext transmitted by the forestry Internet of Things, and store the data transmitted by the successfully decrypted forestry Internet of Things gateway into the data collection database;

[0170] Running configuration download attribute access request generation module: used for the forest and grassland Internet of Things to combine the main attributes of the forest and grassland Internet of Things gateway, use the forest and grassland Internet of Things gateway running configuration download attribute access request generation strategy, generate the forest and grassland Internet of Things gateway running configuration download attribute access request, and send the forest and grassland Internet of Things gateway running configuration download attribute access request to the forest and grassland cloud platform;

[0171] Running configuration download attribute access request verification module: After the Lincao cloud platform uploads the running configuration download access session to the chain, it combines the main attributes of the Lincao IoT gateway calculated by simulation to verify whether the attributes of the Lincao IoT gateway have passed the verification;

[0172] Periodic operation configuration download module: used by the Forestry and Grassland IoT Gateway to read the periodic operation configuration of the Forestry and Grassland IoT in the Forestry and Grassland Cloud Platform and download it to the local storage of the Forestry and Grassland IoT Gateway;

[0173] Security situation awareness and emergency response module: After the forestry and grassland IoT gateway uploads the access control failed session to the chain, it reads the historical access session records in the blockchain network, evaluates the number of accesses to the current client node and the forestry and grassland IoT gateway, determines whether there is a DOS attack, and prevents the DOS attack.

[0174] In order to better understand the technical solution of the present invention, the following is an example of the execution process of the forest and grassland Internet of Things access control system based on smart contracts and KP-ABE of the present invention: Figure 7 :

[0175] (1) The system administrator executes the blockchain initialization and smart contract definition module to create a blockchain network and initialize the system key in the Lincao Cloud Platform;

[0176] (2) The forestry and grassland IoT gateway executes the data transmission attribute encryption and access request generation module, and initiates a data transmission attribute access request to the forestry and grassland cloud platform;

[0177] (3) The Lincao Cloud Platform executes the data transmission attribute access request verification module to verify whether the attributes of the Lincao IoT gateway have passed the verification. If it passes, execute step (4); if it fails, execute step (8);

[0178] (4) The forestry and grassland cloud platform executes the transmission data decryption and storage module, and stores the data transmitted by the successfully decrypted forestry and grassland IoT gateway into the data collection database. If the decryption fails, execute step (8);

[0179] (5) The forestry and grassland IoT gateway executes the operation configuration download attribute access request generation module and initiates the operation configuration download attribute access request to the forestry and grassland cloud platform;

[0180] (6) The forestry cloud platform executes the running configuration download attribute access request verification module, and verifies whether the attributes of the forestry IoT gateway pass the verification in combination with the simulated calculated attributes of the forestry IoT gateway. If it passes step (7), it fails step (8).

[0181] (7) The Forestry and Grassland IoT Gateway executes the periodic operation configuration download module, reads the periodic operation configuration of the Forestry and Grassland IoT in the Forestry and Grassland Cloud Platform and updates it to the local storage of the Forestry and Grassland IoT Gateway;

[0182] (8) The Lincao Cloud Platform executes the security situation awareness and emergency response module. After uploading the access control failed session to the chain, it determines whether there is a DOS attack and decides whether to initiate the security threat emergency response strategy;

[0183] (9) End the process.

[0184] For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications should also be considered as the scope of protection of the present invention.

Claims

1. A forest and grassland Internet of Things access control method based on smart contracts and KP-ABE, characterized in that: The steps include: S1, blockchain network initialization and smart contract definition: select the blockchain type and blockchain platform, initialize the blockchain network, complete the access control smart contract definition and chain code installation, as well as the security situation awareness smart contract definition and chain code installation; S2, data transmission attribute encryption and access request generation of the forest and grassland IoT gateway: Encrypt the forest and grassland IoT terminal data collected by the forest and grassland IoT gateway to form a ciphertext, and initiate a data transmission attribute access request to the forest and grassland cloud platform; The step S2 specifically includes the following steps: S2.1, determine whether the forest and grassland IoT gateway is deployed for the first time, if so, execute step S2.2, if not, execute step S2.3; S2.2, mobile data collection terminal connects and configures the forest and grassland IoT gateway: Use the mobile data collection terminal to connect the forest and grassland IoT gateway and the forest and grassland cloud platform, download and store the dynamic access control policy of the access control smart contract in the forest and grassland cloud platform, the data exchange operation policy of the security situation awareness smart contract, and the operation configuration of the forest and grassland IoT gateway to the local forest and grassland IoT gateway; S2.3, the forestry and grassland IoT gateway periodically generates attribute access requests: the forestry and grassland IoT gateway uses the forestry and grassland IoT gateway subject attribute generation strategy to periodically generate the subject attributes of the forestry and grassland IoT gateway based on the locally stored smart contract strategy and the forestry and grassland IoT gateway operation configuration; S2.4, encryption of data collected by the forest and grassland IoT gateway using the key policy attribute-based encryption mechanism: The forest and grassland IoT gateway uses the forest and grassland IoT gateway subject attributes and the forest and grassland cloud platform system public key to call the forest and grassland IoT gateway key policy attribute-based encryption strategy to encrypt the forest and grassland IoT terminal data collected in the forest and grassland IoT gateway to form ciphertext; S2.5, the forestry and grassland IoT gateway initiates a data transmission attribute access request to the forestry and grassland cloud platform: the forestry and grassland IoT gateway uses the data transmission attribute access request generation strategy and combines the forestry and grassland IoT gateway subject attributes to generate a forestry and grassland IoT gateway data transmission attribute access request, and sends the forestry and grassland IoT gateway data transmission attribute access session to the forestry and grassland cloud platform; S3, the Lincao cloud platform verifies the data transmission attribute access request of the Lincao IoT gateway: the Lincao cloud platform registers the session in the blockchain network, simulates and calculates the subject attributes of the current access session Lincao IoT gateway, and verifies whether the attributes of the Lincao IoT gateway pass the verification. If so, execute step S4, if not, execute step S8; S4, the forest and grass cloud platform decrypts the transmitted data and stores it in the data collection database: the forest and grass cloud platform performs the decryption operation. If the decryption is successful, the data transmitted by the forest and grass IoT gateway is stored in the data collection database and step S5 is executed. If the decryption is unsuccessful, step S8 is executed; S5, generation of access request for downloading running configuration attributes of forest and grassland IoT gateway: the forest and grassland IoT gateway generates access request for downloading running configuration attributes of forest and grassland IoT gateway in combination with the main attributes of the forest and grassland IoT gateway, and sends the access request for downloading running configuration attributes of forest and grassland IoT gateway to the forest and grassland cloud platform; S6, the Lincao cloud platform verifies the access request for downloading the running configuration of the Lincao IoT gateway: the Lincao cloud platform registers the session in the blockchain network, and simulates and calculates the subject attributes of the Lincao IoT gateway of the current access session, and verifies whether the attributes of the Lincao IoT gateway pass the verification in combination with the simulated calculated subject attributes of the Lincao IoT gateway. If so, execute step S7, if not, execute step S8; S7, the forest and grass IoT gateway downloads the forest and grass IoT gateway operation configuration: the forest and grass IoT gateway reads the forest and grass IoT periodic operation configuration in the forest and grass cloud platform and downloads and stores it locally to the forest and grass IoT gateway, and executes step S9; S8, security situation awareness and emergency disposal of the Lincao cloud platform: The Lincao IoT gateway calls the access control failure session chain strategy of the access control smart contract, records the access control access session failure information to the blockchain network, and determines whether there is a DOS attack. If so, prevent the DOS attack and execute step S9. If not, directly execute step S9; S9, end the process.

2. According to the method for access control of forest and grassland Internet of Things based on smart contract and KP-ABE in claim 1, it is characterized in that: The step S1 includes the following steps: S1.1, blockchain network initialization; S1.2, access control smart contract definition and chain code installation, where the access control smart contract includes the access session operation strategy and dynamic access control strategy performed by the Lincao IoT Gateway and Lincao Cloud Platform in the blockchain network; S1.3, Security Situation Awareness Smart Contract Definition and Chain Code Installation: The security situation awareness smart contract includes the data exchange operation strategy performed by the Lincao IoT Gateway and the Lincao Cloud Platform in the blockchain network after access control, and the security situation awareness operation strategy performed in the blockchain network after access control or decryption fails; S1.4, key policy attribute-based encryption scheme initialization and key generation: Key policy attribute-based encryption generates the system public key and system master key, and calculates the decryption key of the Lincao Cloud Platform client user based on the system master key and user attribute set.

3. The forest and grassland Internet of Things access control method based on smart contracts and KP-ABE according to claim 2 is characterized in that: The access session operation strategy includes: Data transmission session chain strategy: used to initiate a transaction for the data transmission access session sent by the forest and grassland IoT gateway, and after calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network; Running configuration download access session chain strategy: used to initiate a transaction for the running configuration download access session sent by the forest and grassland IoT gateway, and after calculation through the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network; Access control failed session on-chain strategy: When access control or decryption of the forest and grassland IoT gateway fails, a transaction is initiated for the access control failed session. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network; The dynamic access control strategy includes: Forest and Grassland IoT Gateway Subject Attribute Generation Strategy: It is used for the Forest and Grassland IoT Gateway to directly read its own attributes and collect data information; The multi-dimensional dynamic attribute generation strategy of the forest and grassland IoT gateway subject: used by the forest and grassland cloud platform to simulate the multi-dimensional dynamic attributes using the physical model and calculate the attribute value of the forest and grassland IoT gateway subject for this access session; Forestry and Grassland IoT Gateway Data Transmission Attribute Access Request Generation Strategy: used for the Forestry and Grassland IoT Gateway to generate data transmission attribute access requests; The strategy for generating access request for running configuration download attribute of forest and grassland IoT gateway is used for generating access request for running configuration download attribute of forest and grassland IoT gateway; Lincao Cloud Platform Key Policy Attribute-Based Encryption Initialization Strategy: used for key policy attribute-based encryption to generate system public keys and system master keys; Lincao Cloud Platform Access Control Tree Structure Key Generation Strategy: used to calculate the decryption key of the Lincao Cloud Platform client user based on the system master key and user attribute set; Key policy attribute-based encryption strategy for forest and grassland IoT gateway: used for forest and grassland IoT gateway to use system public key, with forest and grassland IoT gateway submission data and data transmission access request attributes as input to generate ciphertext; Key policy attribute base data decryption strategy of the forest and grass cloud platform: used by the forest and grass cloud platform to take the ciphertext as input and restore the data submitted by the forest and grass IoT gateway when the predetermined requirements are met; Access control verification strategy for downloading the operation configuration of the forest and grass IoT gateway: used by the forest and grass cloud platform to perform access control verification on the forest and grass IoT gateway by combining the forest and grass cloud platform client attribute set and the forest and grass IoT gateway operation configuration download attribute access request attribute set; The access control verification strategy for data transmission of the forest and grassland IoT gateway is used by the forest and grassland cloud platform to verify the access control of the forest and grassland IoT gateway by combining the forest and grassland cloud platform client attribute set and the forest and grassland IoT gateway data transmission attribute access request attribute set; The data exchange operation strategy includes: The Forestry and Grassland IoT Gateway operation configuration download strategy is used by the Forestry and Grassland IoT Gateway to obtain the periodic operation configuration of the Forestry and Grassland IoT Gateway configured and generated in the Forestry and Grassland Cloud Platform from the Forestry and Grassland Cloud Platform client; Data transmission strategy of forestry and grassland IoT gateway: used by the forestry and grassland IoT gateway to obtain data transmission storage configuration information and execute operations in the forestry and grassland cloud platform from the forestry and grassland cloud platform client; The security situation awareness operation strategy includes: Security situation awareness strategy: used by the Lincao cloud platform to monitor the Lincao IoT gateways that fail access control or decryption; Security threat emergency response strategy: The forestry and grassland cloud platform is used to close access authorization for forestry and grassland IoT gateways that exceed the specified access threshold, and inform the forestry and grassland IoT gateways that have been attacked.

4. The forest and grassland Internet of Things access control method based on smart contracts and KP-ABE according to claim 3 is characterized in that: The step S3 specifically includes the following steps: S3.1, Lincao Cloud Platform uploads the data transmission session of Lincao IoT Gateway to the blockchain network: Lincao Cloud Platform calls the data transmission session chain strategy, initiates a transaction for the data transmission access session sent by Lincao IoT Gateway, and forms a new block storage into the blockchain network after calculation by the blockchain network consensus algorithm; S3.2, the forestry cloud platform calculates the multi-dimensional dynamic attributes of the forestry IoT gateway: the forestry cloud platform calls the multi-dimensional dynamic attribute calculation strategy of the forestry IoT gateway subject, obtains the forestry IoT gateway subject attributes of the last access session stored in the blockchain network as a basis, uses the physical model to simulate the multi-dimensional dynamic attributes, and calculates the forestry IoT gateway subject attribute value of this access session; S3.3, the Lincao Cloud Platform performs access control verification on the data transmission of the Lincao Internet of Things Gateway: The Lincao Cloud Platform calls the Lincao Internet of Things Gateway data transmission access control verification strategy, and verifies whether the subject attribute of the Lincao Internet of Things Gateway of the current access request passes the verification in combination with the simulated calculated subject attribute value of the Lincao Internet of Things Gateway. If so, execute step S4; if not, execute step S8.

5. The forest and grassland Internet of Things access control method based on smart contracts and KP-ABE according to claim 3 is characterized in that: The step S4 specifically includes the following steps: S4.1, Lincao Cloud Platform Key Policy Attribute Base Data Decryption: Lincao Cloud Platform calls the Lincao Cloud Platform Key Policy Attribute Base Data Decryption Strategy, uses the key to perform the decryption operation, and the decryption is successful when the attributes in the ciphertext meet the access control tree; if the decryption is unsuccessful, execute step S8; S4.2, the data transmitted by the forestry and grassland IoT gateway is stored in the data collection database: the forestry and grassland cloud platform calls the data transmission strategy of the forestry and grassland IoT gateway and stores the data transmitted by the forestry and grassland IoT gateway into the data collection database.

6. The forest and grassland Internet of Things access control method based on smart contracts and KP-ABE according to claim 5 is characterized in that: The step S6 specifically includes the following steps: S6.1, Lincao Cloud Platform uploads the running configuration download session of Lincao IoT Gateway to the blockchain network: Lincao Cloud Platform calls the running configuration download session chain strategy, initiates a transaction for the running configuration download access session sent by Lincao IoT Gateway, and after calculation by the blockchain network consensus algorithm, forms a new block storage into the blockchain network; S6.2, the forestry cloud platform calculates the multi-dimensional dynamic attributes of the forestry IoT gateway: the forestry cloud platform calls the forestry IoT gateway subject multi-dimensional dynamic attribute calculation strategy of the access control smart contract, obtains the forestry IoT gateway subject attributes of the last access session stored in the blockchain network, and uses the physical model to simulate the multi-dimensional dynamic attributes to calculate the forestry IoT gateway subject attribute value of this access session; S6.3, the Lincao Cloud Platform performs access control verification on the download access of the Lincao Internet of Things Gateway operation configuration: the Lincao Cloud Platform calls the access control verification strategy for the download access of the Lincao Internet of Things Gateway operation configuration, and verifies whether the main attribute value of the Lincao Internet of Things Gateway of the current access request passes the verification in combination with the simulated calculated main attribute value of the Lincao Internet of Things Gateway. If it passes, execute step S7; if not, execute step S8.

7. The forest and grassland Internet of Things access control method based on smart contracts and KP-ABE according to claim 6 is characterized in that: The step S8 specifically includes the following steps: S8.1, the access control result session of the forestry and grassland IoT gateway is uploaded to the blockchain network: the forestry and grassland cloud platform calls the access control failure session chain strategy, initiates a transaction for the access control failure session sent by the forestry and grassland IoT gateway, and after calculation by the blockchain network consensus algorithm, forms a new block storage and enters the blockchain network; S8.2, the Lincao cloud platform conducts security situation awareness: call the security situation awareness strategy, read the historical access session records in the blockchain network, evaluate the number of accesses to the current client node and the Lincao IoT gateway to determine whether there is a DOS attack, and if the access IP and / or access port exceeds the access upper limit threshold, execute step S8.3; S8.3, Lincao Cloud Platform carries out emergency disposal: calls the security threat emergency disposal strategy to urgently close the current access IP and / or access port to prevent DOS attacks.

8. A forest and grassland IoT access control system based on smart contracts and KP-ABE, characterized in that: Used to implement the forest and grassland Internet of Things access control method based on smart contracts and KP-ABE as described in any one of claims 1 to 7, the forest and grassland Internet of Things access control system based on smart contracts and KP-ABE is established on a blockchain network, and the dynamic access control of the forest and grassland Internet of Things gateway to the forest and grassland cloud platform is realized by calling and executing smart contracts.

9. The forest and grassland IoT access control system based on smart contracts and KP-ABE according to claim 8 is characterized in that: The forest and grassland IoT access control system based on smart contracts and KP-ABE includes: Blockchain initialization and smart contract definition module: used to initialize the blockchain network according to the application scenario, complete the access control smart contract definition and chain code installation, as well as the security situation awareness smart contract definition and chain code installation, and initialize the system public key, master key and generate the client user private key; Data transmission attribute encryption and access request generation module: used to periodically and automatically run the configuration of the forest and grassland IoT gateway, generate the main attributes of the forest and grassland IoT gateway, combine the public key of the forest and grassland cloud platform system, use the forest and grassland IoT gateway key policy attribute-based encryption strategy, encrypt the forest and grassland IoT terminal data collected in the forest and grassland IoT gateway to form ciphertext, and initiate a data transmission attribute access request to the forest and grassland cloud platform; Data transmission attribute access request verification module: After the forestry and grassland cloud platform uploads the data transmission session to the chain, it verifies whether the attributes of the forestry and grassland IoT gateway have passed the verification in combination with the main attributes of the forestry and grassland IoT gateway calculated by simulation; Transmission data decryption and storage module: It is used for the forestry cloud platform to use the key related to the access structure to decrypt the ciphertext transmitted by the forestry Internet of Things, and store the data transmitted by the successfully decrypted forestry Internet of Things gateway into the data collection database; Running configuration download attribute access request generation module: used for the forest and grassland Internet of Things to combine the main attributes of the forest and grassland Internet of Things gateway, use the forest and grassland Internet of Things gateway running configuration download attribute access request generation strategy, generate the forest and grassland Internet of Things gateway running configuration download attribute access request, and send the forest and grassland Internet of Things gateway running configuration download attribute access request to the forest and grassland cloud platform; Running configuration download attribute access request verification module: After the Lincao cloud platform uploads the running configuration download access session to the chain, it combines the main attributes of the Lincao IoT gateway calculated by simulation to verify whether the attributes of the Lincao IoT gateway have passed the verification; Periodic operation configuration download module: used by the Forestry and Grassland IoT Gateway to read the periodic operation configuration of the Forestry and Grassland IoT in the Forestry and Grassland Cloud Platform and download it to the local storage of the Forestry and Grassland IoT Gateway; Security situation awareness and emergency response module: After the forestry and grassland IoT gateway uploads the access control failed session to the chain, it reads the historical access session records in the blockchain network, evaluates the number of accesses to the current client node and the forestry and grassland IoT gateway, determines whether there is a DOS attack, and prevents the DOS attack.

Images