Blockchain data sharing security system for edge-cloud collaborative IoT scenarios

Abstract

The present invention provides a blockchain data sharing security system for edge-cloud collaborative Internet of Things scenarios, which belongs to the field of data security technology. The system includes an initial module, a first verification module, a second verification module and a monitoring module. System parameters are generated by obtaining user identity information and broadcasting them to a terminal. The terminal generates encrypted verification information, and uses a cross-domain identity authentication model to compare the system parameters with the encrypted verification information to obtain a first identity authentication result. A second identity authentication is performed on successful users through an inter-domain alliance key, and a monitoring mechanism is started to monitor user behavior in real time, handle exceptions in a timely manner, reduce the complexity of user operations, improve security and privacy protection, enhance the security and reliability of the system, and meet the needs of the Internet of Things and smart cities for efficient identity authentication.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a blockchain data sharing security system for edge-cloud collaborative Internet of Things scenarios. Background Art

[0002] With the rapid development of the Internet of Things and smart cities, the demand for data sharing and identity authentication is increasing. When users authenticate in multiple domains, they face multiple challenges such as security, privacy protection, and real-time. When authenticating between different domains using traditional methods, users need to repeatedly enter information, which increases operational complexity and user burden.

[0003] Therefore, the present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios. Summary of the invention

[0004] The blockchain data sharing security system for the edge-cloud collaborative Internet of Things scenario provided by the present invention generates system parameters by obtaining user identity information and broadcasts it to the terminal. The terminal generates encrypted verification information, and uses a cross-domain identity authentication model to compare the system parameters with the encrypted verification information to obtain a first identity authentication result. The second identity authentication is performed on the successful user through the inter-domain alliance key, and a monitoring mechanism is started to monitor user behavior in real time, handle exceptions in a timely manner, reduce the complexity of user operations, improve security and privacy protection, enhance the security and reliability of the system, and meet the needs of the Internet of Things and smart cities for efficient identity authentication.

[0005] The present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, including:

[0006] Initial module: obtains user identity information, generates system parameters according to the identity information, and broadcasts the system parameters to the terminal, which generates corresponding encrypted verification information;

[0007] The first verification module: constructs a cross-domain identity authentication model according to the edge-cloud collaborative network application scenario framework, and uses the cross-domain identity authentication model to compare the system parameters corresponding to each user with the encrypted verification information to obtain a first identity authentication result;

[0008] The second verification module is used to calculate the inter-domain alliance key between different participating domains, and use the inter-domain alliance key to perform a second identity authentication on the user whose first identity authentication result is successful, to obtain a second identity authentication result;

[0009] Monitoring module: Start the monitoring mechanism to monitor the user's access behavior in real time and monitor the anomalies in the access behavior.

[0010] The present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, the initial module including:

[0011] Parameter generation unit: The user provides identity information through the registration interface, and generates system parameters according to the identity information;

[0012] Broadcast unit: encrypt the system parameters using an encryption algorithm to obtain encrypted system parameters, select a corresponding broadcast protocol from a parameter-protocol table according to the system encryption parameters, and broadcast the encrypted system parameters to relevant terminals using the broadcast protocol;

[0013] Verification information generation unit: The terminal decrypts the received encryption system parameters and generates corresponding encrypted verification information.

[0014] The present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, wherein the first verification module comprises:

[0015] Framework construction unit: determining the identity authentication requirements of the user, analyzing the specific application scenarios of the Internet of Things based on the identity authentication requirements, and constructing a network application scenario framework based on the specific application scenarios;

[0016] Authentication model unit: determines the participating domains based on the network application scenario framework, determines the authentication process between different participating domains based on the cloud device, uses the edge device to process user requests in real time, and integrates the edge device and the cloud device to build a cross-domain identity authentication model;

[0017] The first identity authentication unit: sends the system parameters corresponding to each user and the encrypted authentication information to the edge computing node through a secure channel, and uses the edge computing node to compare and obtain a first identity authentication result.

[0018] The present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, wherein a first identity authentication unit comprises:

[0019] Storage information block: The edge computing node queries the cloud database for storage information corresponding to the user identity information, where the storage information includes storage password information and storage user parameters;

[0020] First comparison block: Perform a first comparison on the encrypted verification information and the corresponding stored password information. If they match, perform a second comparison on the system parameters. If they do not match, return a login failure prompt.

[0021] Second comparison block: Perform a second comparison between the system parameters and the stored user parameters. If they match, execute the next step. If they do not match, return a security warning and trigger security measures.

[0022] The present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, and a second verification module, including:

[0023] Key generation unit: based on the first identity authentication result, the edge device sends a key generation request to the cloud device, and calculates an inter-domain alliance key between participating domains according to the key generation request;

[0024] Second identity authentication unit: Use the alliance key to perform a second identity authentication on the user whose first identity authentication result is successful. The second identity authentication result is fed back to the edge device, and the corresponding operation is performed according to the second identity authentication result.

[0025] The present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, a key generation unit, including:

[0026] ,in, represents the inter-domain alliance key; M represents the additional information that needs to be transmitted; T represents the timestamp; N represents the sequence number of the key; C represents the context information; U represents the user-specific information; represents the i-th hash processing process; represents the i-th hash function; Represents a symmetric key; represents the random number of the jth participating domain; Indicates the number of iterations of the key derivation function; represents the jth participating domain key derivation function; Indicates that the jth domain undergoes n rounds of AES encryption; represents the jth participating domain key; represents the salt value of the jth participating domain; Represents a concatenation operation, combining the key generated by the KDF, the AES encryption result, and the salt value into one input.

[0027] The present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, a monitoring module, including:

[0028] Access log unit: After completing the second identity authentication, the edge device and the cloud should jointly start the monitoring mechanism to record each access behavior of the user, extract the user's behavior characteristics, and form an access log in the edge device;

[0029] Abnormal monitoring unit: stores the access log in a cloud device and performs abnormal monitoring on the access log.

[0030] The present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, an abnormality monitoring unit, including:

[0031] Policy determination block: The cloud device records the hash value of the access log on the blockchain, defines the data sharing policy, and allows authorized users or systems to access the log records on the blockchain;

[0032] Rule setting block: According to historical data combined with data sharing strategies, set access log anomaly monitoring rules to monitor users for anomalies.

[0033] Compared with the prior art, the beneficial effects of the present application are as follows: system parameters are generated by obtaining user identity information and broadcasting them to the terminal, the terminal generates encrypted verification information, and the system parameters are compared with the encrypted verification information using a cross-domain identity authentication model to obtain a first identity authentication result, and a second identity authentication is performed on successful users through an inter-domain alliance key, and a monitoring mechanism is started to monitor user behavior in real time, handle exceptions in a timely manner, reduce the complexity of user operations, improve security and privacy protection, enhance the security and reliability of the system, and meet the needs of the Internet of Things and smart cities for efficient identity authentication.

[0034] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description and the accompanying drawings.

[0035] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0037] Figure 1 It is a structural diagram of the blockchain data sharing security system for the edge-cloud collaborative Internet of Things scenario provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0038] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0039] Embodiment 1:

[0040] The embodiment of the present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, such as Figure 1 As shown, including:

[0041] Initial module: obtains user identity information, generates system parameters according to the identity information, and broadcasts the system parameters to the terminal, which generates corresponding encrypted verification information;

[0042] The first verification module: constructs a cross-domain identity authentication model according to the edge-cloud collaborative network application scenario framework, and uses the cross-domain identity authentication model to compare the system parameters corresponding to each user with the encrypted verification information to obtain a first identity authentication result;

[0043] The second verification module is used to calculate the inter-domain alliance key between different participating domains, and use the inter-domain alliance key to perform a second identity authentication on the user whose first identity authentication result is successful, to obtain a second identity authentication result;

[0044] Monitoring module: Start the monitoring mechanism to monitor the user's access behavior in real time and monitor the anomalies in the access behavior.

[0045] In this embodiment, the identity information is the personal information provided by the user when registering, which is usually used to identify the user, such as user name, email address, telephone number, ID number, etc.

[0046] In this embodiment, system parameters are specific parameters generated based on identity information, which may be used for system configuration or user authority management, such as user authority level, access token, user preference settings, etc. System parameters include user ID, timestamp and random number.

[0047] In this embodiment, the encrypted verification information is verification information generated by the terminal by decrypting the encryption system parameters, which is used to confirm the user identity or authority, for example, the user identity token or security code obtained after decryption, such as "Token12345" or "UserVerified".

[0048] In this embodiment, after submitting identity information through the registration interface, the system generates system parameters based on this information, encrypts the system parameters using an encryption algorithm, selects the corresponding broadcast protocol according to the parameter-protocol table, and broadcasts the encrypted system parameters to relevant terminals. After receiving the encrypted system parameters, the terminals decrypt them and generate corresponding encrypted verification information.

[0049] In this embodiment, the network application scenario framework is a network architecture built based on a specific application scenario, including the design of devices, network protocols, and data flows. For example, in a smart home system, the framework may include communication protocols and data interaction processes between smart bulbs, thermostats, user mobile phones, and cloud servers.

[0050] In this embodiment, the cross-domain identity authentication model is a model for performing identity authentication between multiple participating domains, ensuring that users can be correctly identified in different domains. For example, if a user uses the same identity to operate in smart home and smart city applications, the system can identify the user in these two domains.

[0051] In this embodiment, the first identity authentication result is a preliminary identity authentication result obtained through comparison, indicating whether the user identity is confirmed. For example, if the user identity authentication is successful, "verification passed" is returned, and if it fails, "verification failed" is returned.

[0052] In this embodiment, the comparison process is that the edge computing node queries the cloud database for stored information related to the user identity information, including password information and user parameters, and compares the encrypted verification information with the stored password information. On the other hand, the collected system parameters are compared with the stored user parameters.

[0053] In this embodiment, the user's identity authentication needs are identified and the specific application scenarios of the Internet of Things are analyzed to build a network application scenario framework. The participating domains and authentication processes are determined according to the framework, and the edge devices are used to process user requests in real time to build a cross-domain identity authentication model. The user's system parameters and encrypted verification information are sent to the edge computing node through a secure channel for comparison to obtain the first identity authentication result.

[0054] In this embodiment, the inter-domain alliance key is a key generated based on the trust relationship and identity authentication results between multiple participating domains, and is used to encrypt and protect data transmitted between these domains. For example, the shared key generated between the edge device and the cloud device, such as "ABCD1234EFGH5678", is used for subsequent data encryption and decryption.

[0055] In this embodiment, the second identity authentication is a further identity authentication of the user using the inter-domain alliance key to ensure the user's identity and authority. For example, during the second identity authentication process, the system may require the user to enter a one-time password or use biometrics (such as fingerprint recognition) and transmit the verification result encrypted by the alliance key.

[0056] In this embodiment, after the first identity authentication succeeds, the edge device sends a key generation request to the cloud device, calculates the inter-domain alliance key between the participating domains, uses the alliance key to perform a second identity authentication on the successful user, and feeds back the verification result to the edge device based on the second identity authentication result.

[0057] In this embodiment, the monitoring mechanism is a system or process for real-time monitoring and recording of user access behavior to ensure tracking and analysis of user activities. For example, after the user successfully passes the second identity authentication, the system starts the monitoring mechanism to record each user's login time, accessed resources (such as files, devices), operation type (such as read, modify, delete), etc.

[0058] In this embodiment, access behaviors are various operations and activities performed by users in the system, including login, data access, file upload / download, etc. For example, after a user logs in on an edge device, he accesses a specific application, views a file, uploads a picture, or modifies settings, etc. Each operation is recorded as an access behavior.

[0059] In this embodiment, after completing the second identity authentication, the edge device and the cloud jointly start the monitoring mechanism, record the user's access behavior and extract behavioral features, and generate an access log. The log is stored in the edge device and then uploaded to the cloud for centralized storage and analysis, and the access log is monitored in real time.

[0060] The working principle and beneficial effects of the above technical solution are: by obtaining user identity information to generate system parameters and broadcasting them to the terminal, the terminal generates encrypted verification information, and uses the cross-domain identity authentication model to compare the system parameters with the encrypted verification information to obtain the first identity authentication result, and uses the inter-domain alliance key to perform the second identity authentication on the successful user, and starts the monitoring mechanism to monitor user behavior in real time, handle exceptions in time, reduce the complexity of user operations, improve security and privacy protection, enhance the security and reliability of the system, and meet the needs of the Internet of Things and smart cities for efficient identity authentication.

[0061] Embodiment 2:

[0062] The embodiment of the present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, the initial module including:

[0063] Parameter generation unit: The user provides identity information through the registration interface, and generates system parameters according to the identity information;

[0064] Broadcast unit: encrypt the system parameters using an encryption algorithm to obtain encrypted system parameters, select a corresponding broadcast protocol from a parameter-protocol table according to the system encryption parameters, and broadcast the encrypted system parameters to relevant terminals using the broadcast protocol;

[0065] Verification information generation unit: The terminal decrypts the received encryption system parameters and generates corresponding encrypted verification information.

[0066] In this embodiment, the encrypted system parameters are data obtained by encrypting the system parameters using an encryption algorithm to ensure that the data is not accessed by unauthorized persons during transmission. For example, user permission information encrypted using the AES algorithm, such as "U1234:admin", may become "XyZ12345..." after encryption.

[0067] In this embodiment, the parameter-protocol table is a mapping table that contains the relationship between system parameters and corresponding broadcast protocols. For example, the table may contain entries, such as the broadcast protocol corresponding to the "user authority parameter" is the "UDP protocol" or the "MQTT protocol".

[0068] In this embodiment, the relevant terminal is a device or system that receives the broadcast, usually a user's device or server, such as a smart phone, a tablet computer, an IoT device, a server, etc.

[0069] In this embodiment, the broadcast protocol is a communication protocol used to broadcast encryption system parameters to relevant terminals, such as UDP (User Datagram Protocol), MQTT (Message Queue Telemetry Transport), HTTP (Hypertext Transfer Protocol), etc.

[0070] The working principle and beneficial effects of the above technical solution are: after submitting identity information through the registration interface, the system generates system parameters based on this information, encrypts the system parameters using an encryption algorithm, and selects the corresponding broadcast protocol according to the parameter-protocol table. The encrypted system parameters are broadcast to the relevant terminals. After receiving the encrypted system parameters, the terminals decrypt them and generate corresponding encrypted verification information, completing the preliminary preparations for identity authentication, ensuring the security of user identity information, reducing the risk of data leakage, and improving the compatibility and efficiency of the system.

[0071] Embodiment 3:

[0072] The embodiment of the present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, wherein the first verification module includes:

[0073] Framework construction unit: determining the identity authentication requirements of the user, analyzing the specific application scenarios of the Internet of Things based on the identity authentication requirements, and constructing a network application scenario framework based on the specific application scenarios;

[0074] Authentication model unit: determines the participating domains based on the network application scenario framework, determines the authentication process between different participating domains based on the cloud device, uses the edge device to process user requests in real time, and integrates the edge device and the cloud device to build a cross-domain identity authentication model;

[0075] The first identity authentication unit: sends the system parameters corresponding to each user and the encrypted authentication information to the edge computing node through a secure channel, and uses the edge computing node to compare and obtain a first identity authentication result.

[0076] In this embodiment, the identity authentication requirement is the specific requirement of the user or system for identity authentication, including requirements in terms of security, convenience, etc. For example, the user hopes to authenticate through biometrics (such as fingerprint or facial recognition) and requires a consistent identity authentication experience on different devices.

[0077] In this embodiment, the specific application scenario is a specific IoT application environment involving the interaction of users, devices, and services. For example, in a smart home system, users control smart devices in their homes through mobile phones, or in a smart city, citizens access public services through applications.

[0078] In this embodiment, the participating domain is the scope of various systems or devices involved in the identity authentication process. For example, in a smart home, the participating domain may include the user's mobile phone, smart home devices and cloud services.

[0079] In this embodiment, the cloud device is a device or service running in a cloud computing environment, and is typically used for data storage and processing, such as a cloud server, a database service, a cloud storage service, etc.

[0080] In this embodiment, the authentication process is the specific steps and methods for user identity authentication, including data collection, comparison and confirmation processes. For example, the user sends fingerprint data to the cloud server via a mobile phone, and the cloud server compares the fingerprint data with the stored data to confirm the user's identity.

[0081] In this embodiment, the edge device is a computing device close to the data source (such as a user device) and is responsible for real-time processing and responding to user requests, such as a smart speaker, edge computing gateway, router, etc.

[0082] In this embodiment, the user request is an operation or query request sent by the user to the system, for example, the user requests to unlock the smart door lock at home through a smart phone.

[0083] In this embodiment, the secure channel is an encrypted channel used to protect the data transmission process and ensure the confidentiality and integrity of the data, such as an HTTPS connection, a VPN connection, etc.

[0084] In this embodiment, the edge computing node is a node that performs data processing in an edge computing environment, usually close to a user device, such as an edge computing gateway or an edge server, for processing user requests and data analysis.

[0085] The working principle and beneficial effects of the above technical solution are: by identifying the user's identity authentication needs and analyzing the specific application scenarios of the Internet of Things to build a network application scenario framework, determining the participating domains and authentication processes based on the framework, and using edge devices to process user requests in real time, building a cross-domain identity authentication model, and sending the user's system parameters and encrypted verification information to the edge computing node through a secure channel for comparison, and obtaining the first identity authentication result, which improves the flexibility and efficiency of cross-domain identity authentication and ensures the reliability and timeliness of identity authentication.

[0086] Embodiment 4:

[0087] The embodiment of the present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, wherein the first identity authentication unit includes:

[0088] Storage information block: The edge computing node queries the cloud database for storage information corresponding to the user identity information, where the storage information includes storage password information and storage user parameters;

[0089] First comparison block: Perform a first comparison on the encrypted verification information and the corresponding stored password information. If they match, perform a second comparison on the system parameters. If they do not match, return a login failure prompt.

[0090] Second comparison block: Perform a second comparison between the system parameters and the stored user parameters. If they match, execute the next step. If they do not match, return a security warning and trigger security measures.

[0091] In this embodiment, the stored information is a collection of information related to the user identity, which is stored in a cloud database for identity authentication and user management, such as the user's personal information (such as user name, email address), password, role, permission settings, etc.

[0092] In this embodiment, the stored password information is password information related to the user account, which is usually encrypted or hashed to ensure security. For example, the password set by the user when registering (such as "SecureP@ss123") is stored in the database in hashed form (such as using the SHA-256 algorithm).

[0093] In this embodiment, the stored user parameters are other parameters related to the user identity, which are used for personalized services and authority management, such as the user's role (such as administrator, ordinary user), the last login time, the account status (such as activated, locked), etc.

[0094] In this embodiment, the first comparison is a preliminary comparison of the encrypted verification information provided by the user with the password information stored in the database to confirm the user's identity. For example, the password entered by the user is hashed and then compared with the hashed password stored in the database. If they match, it means that the identity verification is successful.

[0095] In this embodiment, the second comparison is to further compare the user's system parameters with the stored user parameters after the first comparison is successful to confirm the user's permissions and status. For example, the access token (such as JWT) provided by the user is compared with the user roles and permissions stored in the database to confirm whether the user has the right to access specific resources.

[0096] In this embodiment, security measures are measures taken by the system to protect users and data when identity authentication fails or a security incident occurs. For example, if the first comparison fails, the system will lock the user account and require the user to reset the password; if the second comparison fails, the system may record the event and restrict the user's access rights.

[0097] In this embodiment, the security warning is a warning message sent by the system to the user or administrator when a potential security risk or identity authentication failure is detected. For example, the system prompts "There is an abnormal login attempt in your account, please check the account security immediately" or "Authentication failed, your account has been locked, please contact the administrator."

[0098] The working principle and beneficial effects of the above technical solution are as follows: the edge computing node queries the storage information related to the user identity information from the cloud database, including password information and user parameters, and compares the encrypted verification information with the stored password information. On the other hand, the collected system parameters are compared with the stored user parameters, which improves the response speed and reduces the delay. At the same time, it monitors and triggers security measures in real time to effectively prevent potential security threats.

[0099] Embodiment 5:

[0100] The embodiment of the present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, and the second verification module includes:

[0101] Key generation unit: based on the first identity authentication result, the edge device sends a key generation request to the cloud device, and calculates an inter-domain alliance key between participating domains according to the key generation request;

[0102] Second identity authentication unit: Use the alliance key to perform a second identity authentication on the user whose first identity authentication result is successful. The second identity authentication result is fed back to the edge device, and the corresponding operation is performed according to the second identity authentication result.

[0103] In this embodiment, the key generation request is a request sent by the edge device to the cloud device after the first identity authentication is successful, which is used to generate a key for subsequent communications. For example, the request sent by the edge device includes the user identity information and the key type generated by the user-specific information (such as a symmetric key or an asymmetric key), for example: "Request to generate an inter-domain alliance key for user 123".

[0104] In this embodiment, the corresponding operation is performed based on the result of the second identity authentication. The subsequent action taken by the system may be to allow access, perform specific operations, or trigger security measures. For example, if the second identity authentication succeeds, the system allows the user to access specific resources (such as cloud storage) or execute specific commands (such as starting the device). If it fails, the system may lock the account or require the user to re-authenticate.

[0105] The working principle and beneficial effects of the above technical solution are: after the first identity authentication is successful, the edge device sends a key generation request to the cloud device, calculates the inter-domain alliance key between the participating domains, uses the alliance key to perform a second identity authentication on the successful user, and feeds back the verification result to the edge device. Based on the second identity authentication result, the system performs corresponding operations, such as granting access rights or triggering security measures, which improves the security of the system, reduces potential security risks, and optimizes the user experience, making the identity authentication process more efficient and secure.

[0106] Embodiment 6:

[0107] The embodiment of the present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, a key generation unit, including:

[0108] ,in, represents the inter-domain alliance key; M represents the additional information that needs to be transmitted; T represents the timestamp; N represents the sequence number of the key; C represents the context information; U represents the user-specific information; represents the i-th hash processing process; represents the i-th hash function; Represents a symmetric key; represents the random number of the jth participating domain; Indicates the number of iterations of the key derivation function; represents the jth participating domain key derivation function; Indicates that the jth domain undergoes n rounds of AES encryption; represents the jth participating domain key; represents the salt value of the jth participating domain; Represents a concatenation operation, combining the key generated by the KDF, the AES encryption result, and the salt value into one input.

[0109] In this embodiment, user-specific information is information related to a specific user and is used to personalize the authentication and key generation process, such as the user's profile information (such as user name, email), the user's permission settings, the user's historical activity records, etc. This information can be used to generate a user-specific key or token during key generation or authentication.

[0110] In this embodiment, AES encryption is the Advanced Encryption Standard (AES), which is a symmetric encryption algorithm used to encrypt and decrypt data to ensure the confidentiality of the data. For example, the user's sensitive data (such as passwords or personal information) is encrypted using the AES algorithm to generate ciphertext. Assuming that the user's password is "mypassword", after AES encryption, a ciphertext may be generated, such as "3d6f9e8b...", which can only be decrypted by the person holding the key.

[0111] In this embodiment, the salt value is a random data in cryptography, which is usually attached to the password or other sensitive information to increase security and prevent rainbow table attacks. For example, when storing a user's password, the system generates a random salt value (such as "RANDOMSALT123") and combines it with the user's password (such as "mypassword") and performs hash processing to generate a stored hash value. In this way, even if two users have the same password, the stored hash values ​​will be different.

[0112] In this embodiment, the concatenation operation is to combine multiple inputs into a single input for subsequent processing or generating the final key. For example, assuming that the key generated by the key derivation function is "KEY123", the result of AES encryption is "CIPHERTEXT456", and the salt value is "RANDOMSALT123", the concatenation operation may combine them into a new input, such as "KEY123+CIPHERTEXT456+RANDOMSALT123", for generating the final key or further processing.

[0113] The working principle and beneficial effects of the above technical solution are: through the key generation process, multi-level hash processing and key derivation are performed using inter-domain alliance keys, timestamps, user-specific information and context information, and each participating domain uses random numbers and salt values, combined with key derivation functions for iteration, to generate symmetric keys, and uses AES encryption to protect data to ensure the security and uniqueness of the keys, thereby providing the necessary security foundation for subsequent identity authentication, enhancing the security and anti-attack capabilities of the keys, and effectively preventing key leakage and replay attacks.

[0114] Embodiment 7:

[0115] The embodiment of the present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, a monitoring module, including:

[0116] Access log unit: After completing the second identity authentication, the edge device and the cloud should jointly start the monitoring mechanism to record each access behavior of the user, extract the user's behavior characteristics, and form an access log in the edge device;

[0117] Abnormal monitoring unit: stores the access log in a cloud device and performs abnormal monitoring on the access log.

[0118] In this embodiment, the behavioral features are features extracted from the user's access behavior and are used to analyze the user's habits and patterns to help identify normal and abnormal behaviors. For example, the user's behavioral features may include average login frequency, commonly used access time periods, commonly accessed resource types, operation modes, etc. For example, the user usually logs in between 9 and 10 a.m. on weekdays and accesses specific folders.

[0119] In this embodiment, the access log is a detailed log file that records the user's access behavior, including timestamp, user identity, accessed resources, operation type and other information. For example, an access log entry may be as follows: time: 2025-01-24 10:15:30, user: user123, operation: access file / documents / report.pdf, result: success.

[0120] In this embodiment, anomaly monitoring is the analysis of access logs to identify unusual activity patterns or behaviors that may indicate security threats or abnormal user operations. For example, if a user usually accesses the system during the day on weekdays, but downloads a large number of files late at night (such as 2 a.m.), this behavior may be marked as an anomaly, triggering an alert or further identity authentication.

[0121] The working principle and beneficial effects of the above technical solution are: after completing the second identity authentication, the edge device and the cloud jointly start the monitoring mechanism, record the user's access behavior and extract behavioral features, generate an access log, which is stored in the edge device and then uploaded to the cloud for centralized storage and analysis. The access log is monitored in real time, abnormal behavior is identified and corresponding security alarms or measures are triggered, potential security threats and abnormal activities are discovered in a timely manner, and the system's security protection capabilities are improved.

[0122] Embodiment 8:

[0123] The embodiment of the present invention provides a blockchain data sharing security system for edge-cloud collaborative IoT scenarios, an abnormality monitoring unit, including:

[0124] Policy determination block: The cloud device records the hash value of the access log on the blockchain, defines the data sharing policy, and allows authorized users or systems to access the log records on the blockchain;

[0125] Rule setting block: According to historical data combined with data sharing strategies, set access log anomaly monitoring rules to monitor users for anomalies.

[0126] In this embodiment, the hash value is a fixed-length string generated by processing data (such as access logs) through a hash function, and is usually used for data integrity verification and secure storage. For example, assuming that the access log content is "user user123 accessed the file / report.pdf at 10:15:30 on January 24, 2025", a hash value such as "5d41402abc4b2a76b9719d911017c592" may be generated after hash processing. This hash value can be used to verify the integrity of the log content during storage or transmission.

[0127] In this embodiment, the data sharing policy specifies which users or systems can access the data records on the blockchain, as well as the permissions and conditions for access. For example, a data sharing policy may specify that only authenticated administrators and a specific audit team can access the access log records on the blockchain, while ordinary users cannot access them. This can be achieved through role-based access control.

[0128] In this embodiment, historical data is user access behavior data collected in the past, which is used for analysis and formulation of monitoring rules. For example, historical data may include user access logs in the past few months, recording the user's login time, accessed resources, operation type, etc. For example, all access records of user user123 in the past month, including frequently accessed files and time patterns.

[0129] In this embodiment, the anomaly monitoring rules are based on historical data and data sharing policies, and the rules are set to identify abnormal behaviors or activities of users. For example, an anomaly monitoring rule may be "if the user has not accessed the system at night in the past 30 days, but downloads a large number of files at 11 pm, it is marked as abnormal." This rule can be implemented through machine learning algorithms or simple threshold detection.

[0130] The working principle and beneficial effects of the above technical solution are: in the cloud device, the hash value of the access log is recorded on the blockchain to ensure the immutability of the data, define the data sharing strategy, authorize specific users or systems to access the log records on the blockchain, and set abnormal monitoring rules based on historical data and sharing strategies to monitor user behavior in real time and identify potential abnormal activities, thereby improving the security and transparency of the access log, preventing data tampering, promptly identifying and responding to abnormal behaviors, and enhancing the system's security protection capabilities.

[0131] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. The blockchain data sharing security system for edge-cloud collaborative IoT scenarios is characterized by: include: Initial module: obtains user identity information, generates system parameters according to the identity information, and broadcasts the system parameters to the terminal, which generates corresponding encrypted verification information; The first verification module: constructs a cross-domain identity authentication model according to the edge-cloud collaborative network application scenario framework, and uses the cross-domain identity authentication model to compare the system parameters corresponding to each user with the encrypted verification information to obtain a first identity authentication result; The second verification module is used to calculate the inter-domain alliance key between different participating domains, and use the inter-domain alliance key to perform a second identity authentication on the user whose first identity authentication result is successful, to obtain a second identity authentication result; Monitoring module: Start the monitoring mechanism to monitor the user's access behavior in real time and monitor the abnormalities in the access behavior; Wherein, the first verification module includes: A first identity authentication unit: sending the system parameters corresponding to each user and the encrypted authentication information to an edge computing node through a secure channel, and using the edge computing node for comparison to obtain a first identity authentication result; The first identity verification unit comprises: Storage information block: The edge computing node queries the cloud database for storage information corresponding to the user identity information, where the storage information includes storage password information and storage user parameters; First comparison block: Perform a first comparison on the encrypted verification information and the corresponding stored password information. If they match, perform a second comparison on the system parameters. If they do not match, return a login failure prompt. Second comparison block: performs a second comparison between the system parameters and the stored user parameters. If they match, the next step is executed. If they do not match, a security warning is returned and security measures are triggered. The second verification module includes: A key generation unit, comprising: ,in, represents the inter-domain alliance key; M represents the additional information that needs to be transmitted; T represents the timestamp; N represents the sequence number of the key; C represents the context information; U represents the user-specific information; represents the i-th hash processing process; represents the i-th hash function; Represents a symmetric key; represents the random number of the jth participating domain; Indicates the number of iterations of the key derivation function; represents the jth participating domain key derivation function; Indicates that the jth domain undergoes n rounds of AES encryption; represents the jth participating domain key; represents the salt value of the jth participating domain; Represents a concatenation operation, combining the key generated by the KDF, the AES encryption result, and the salt value into one input.

2. The blockchain data sharing security system for edge-cloud collaborative IoT scenarios according to claim 1 is characterized in that: Initial modules, including: Parameter generation unit: The user provides identity information through the registration interface, and generates system parameters according to the identity information; Broadcast unit: encrypt the system parameters using an encryption algorithm to obtain encrypted system parameters, select a corresponding broadcast protocol from a parameter-protocol table according to the encrypted system parameters, and broadcast the encrypted system parameters to relevant terminals using the broadcast protocol; Verification information generation unit: The terminal decrypts the received encryption system parameters and generates corresponding encrypted verification information.

3. The blockchain data sharing security system for edge-cloud collaborative IoT scenarios according to claim 1 is characterized in that: The first verification module includes: Framework construction unit: determining the identity authentication requirements of the user, analyzing the specific application scenarios of the Internet of Things based on the identity authentication requirements, and constructing a network application scenario framework based on the specific application scenarios; Authentication model unit: Determine participating domains based on the network application scenario framework, determine the authentication process between different participating domains based on cloud devices, use edge devices to process user requests in real time, and integrate edge devices and cloud devices to build a cross-domain identity authentication model.

4. The blockchain data sharing security system for edge-cloud collaborative IoT scenarios according to claim 1 is characterized in that: The second verification module includes: Key generation unit: based on the first identity authentication result, the edge device sends a key generation request to the cloud device, and calculates an inter-domain alliance key between participating domains according to the key generation request; Second identity authentication unit: Use the alliance key to perform a second identity authentication on the user whose first identity authentication result is successful. The second identity authentication result is fed back to the edge device, and the corresponding operation is performed according to the second identity authentication result.

5. The blockchain data sharing security system for edge-cloud collaborative IoT scenarios according to claim 1 is characterized in that: Monitoring module, including: Access log unit: After completing the second identity authentication, the edge device and the cloud should jointly start the monitoring mechanism to record each access behavior of the user, extract the user's behavior characteristics, and form an access log in the edge device; Abnormal monitoring unit: stores the access log in a cloud device and performs abnormal monitoring on the access log.

6. The blockchain data sharing security system for edge-cloud collaborative IoT scenarios according to claim 5 is characterized in that: Abnormal monitoring unit, including: Policy determination block: The cloud device records the hash value of the access log on the blockchain, defines the data sharing policy, and allows authorized users or systems to access the log records on the blockchain; Rule setting block: According to historical data combined with data sharing strategies, set access log anomaly monitoring rules to monitor users for anomalies.

Images