Decentralized authority verification method based on alliance chain

Abstract

The invention provides a decentralized permission verification method based on an alliance chain, which comprises the following steps of: establishing a user permission matrix, establishing a role permission matrix, obtaining a single node result matrix by the user permission matrix and the role permission matrix, participating in role and permission verification by each consensus node, establishing a consensus node matrix, and verifying the role and permission by the consensus node matrix. And representing a verification result of each role by each node. According to the method and the system, each organization can participate in user permission verification, and the problem of permission verification permissions is solved.

Description

Technical Field

[0001] The present invention relates to the field of user authority verification, and in particular to a decentralized authority verification method based on an alliance chain. Background Art

[0002] With the digital transformation of enterprises and organizations, single sign-on (SSO) systems have become a widely used identity authentication solution. SSO allows users to access multiple applications or services with a single login, simplifying the user experience and improving efficiency. However, the current SSO system still has many challenges in permission management, especially in complex cross-organizational or cross-platform environments. The following are some typical problems:

[0003] Permission verification is difficult to manage centrally. The traditional permission system is centralized, which means that the security of permission verification is concentrated in one or a few central nodes. If these nodes are attacked or fail, the security and availability of the entire system will be threatened.

[0004] Similarly, in a cross-organizational single sign-on system, if the permission verification function is controlled by a single organization, there is also the risk of single point failure and trust breakdown. In multi-organization collaboration, each organization hopes to have fair participation rights and jointly manage permission verification work.

[0005] Auditing and tracing are difficult. In a cross-organizational permission system, the user's operation logs may be distributed in the systems of multiple organizations. How to conduct unified auditing and compliance supervision is a difficult problem. Once a security incident occurs, how to trace the user's operation history and token usage records across organizations, and how to audit whether the data has been tampered with are important challenges in the cross-organizational permission system. Summary of the invention

[0006] The purpose of the present invention is to provide a decentralized permission verification method based on the alliance chain, which can enable each organization to participate in user permission verification and solve the problem of equal rights in permission verification.

[0007] In order to achieve the above object, the present invention is implemented through the following technical solutions:

[0008] A decentralized permission verification method based on a consortium chain, comprising the steps of:

[0009] Establish a user permission matrix to represent the relationship between users and the roles they have;

[0010] Establish a role permission matrix to represent each role's permissions to all resources in the system;

[0011] A single node result matrix is ​​obtained through the user permission matrix and the role permission matrix, which represents the permissions of a certain user to each resource;

[0012] Each consensus node participates in the verification of roles and permissions, and establishes a consensus node matrix to represent the verification results of each node for each role.

[0013] Furthermore, the user's identity matrix I is expressed as:

[0014]

[0015] The role permission matrix P is expressed as:

[0016]

[0017] The single node result matrix A is expressed as:

[0018] A=I·P;

[0019] The consensus node matrix C is expressed as:

[0020]

[0021] Among them, n, k, and m represent the number of users, roles, and resources respectively, and i nk Indicates whether user n has roles k, p km represents the permissions of role k to resource m, c Nk Represents the authority of node N to role k.

[0022] Furthermore, a threshold consensus mechanism is used to reach consensus, and permission verification is passed only when more than a certain proportion of nodes reach agreement.

[0023] Furthermore, assuming that the consensus threshold is T, at least T nodes must agree to pass the consensus.

[0024] The final permission verification formula is as follows:

[0025]

[0026] Among them, A' is the consensus node matrix, represents element-wise product, (I·P) is the original user permission matrix, that is, the single node result matrix, (C·T) represents the verification result of the consensus node on the role permission, if the consensus is reached, the value of (C·T) is 1, otherwise it is 0.

[0027] The advantages of the present invention are: BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a flowchart of the authority verification of the present invention. DETAILED DESCRIPTION

[0029] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0030] Example 1

[0031] This embodiment proposes a decentralized permission verification method based on the alliance chain. Please refer to Figure 1 , the verification system includes N organizations (nodes). After the user successfully logs in to the system and authenticates, when accessing resources, the system will automatically verify the user's permissions through the smart contract technology on the alliance chain to verify whether the user is eligible to access the expected resources. At the same time, the user's access log is recorded on the distributed ledger of the alliance chain. In a complex system, especially in a cross-organizational environment, users may need to access multiple resources (such as applications, databases, file systems, etc.), and different users may have different permissions (such as read, write, execute), so the following method is used for permission verification.

[0032] Assume that n, k, and m represent the number of users, roles, and resources in the system, respectively. Establish a user permission matrix I to represent the relationship between users and their roles. The dimension of matrix I is n×k:

[0033]

[0034] i nk Indicates whether user n has role k.

[0035] Create a role permission matrix P to represent each role's permissions to all resources in the system. The dimension of the matrix P is k×m:

[0036]

[0037] p km Indicates the permissions of role k on resource m.

[0038] In order to verify a user's permissions to resources, we can multiply the user's role matrix with the role permission matrix to obtain the user's permissions to each resource, and use a single node result matrix A to represent a user's permissions to each resource:

[0039] A=I·P.

[0040] Assume that there are N consensus nodes, and each node will participate in the verification of roles and permissions. The dimension of the consensus node matrix C is N×k, which represents the verification result of each node for each role. The consensus node matrix C is expressed as:

[0041]

[0042] c Nk Indicates the authority of node N to role k. A value of 0 indicates that the node does not agree to have the authority, and a value of 1 indicates that the node agrees to have the authority.

[0043] In order to reach a consensus, a threshold consensus mechanism is adopted, that is, if more than a certain proportion of nodes reach a consensus (such as more than 2 / 3 of the nodes agree), the permission verification is passed. Assuming the consensus threshold is T, then:

[0044]

[0045] That is, at least T nodes must agree to pass the consensus.

[0046] The final permission verification formula is as follows:

[0047]

[0048] Among them, A' is the consensus node matrix, represents element-wise product, (I·P) is the original user permission matrix, that is, the single node result matrix, (C·T) represents the verification result of the consensus node on the role permission, if the consensus is reached, the value of (C·T) is 1, otherwise it is 0.

[0049] Example 2

[0050] When the number of users is 2, the number of roles is 2, the number of resources is 2, and the number of nodes is 3, the identity matrix is:

[0051]

[0052] Indicates that user 1 has role 1 and user 2 has role 2.

[0053] The permission matrix is:

[0054]

[0055] This means that role 1 has permissions for both resource 1 and resource 2, while role 2 has permissions only for resource 2.

[0056] The consensus node matrix is:

[0057]

[0058] Indicates that nodes 1 and 3 agree with user 1's role permissions, but node 2 disagrees with user 2's role permissions.

[0059] The threshold T=2, that is, at least two of the three nodes agree.

[0060] The matrix (C·T) is converted to:

[0061]

[0062] This means that user 1's role permissions have passed consensus verification, but user 2's permissions have not.

[0063] The final consensus node matrix is:

[0064]

[0065] It means that user 1 has permissions to resources 1 and 2 (verified by consensus), and user 2 has no permissions to any resource (not verified by consensus).

[0066] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A decentralized permission verification method based on alliance chain, characterized in that: Includes steps: Establish a user permission matrix to represent the relationship between users and the roles they have; Establish a role permission matrix to represent each role's permissions to all resources in the system; A single node result matrix is ​​obtained through the user permission matrix and the role permission matrix, which represents the permissions of a certain user to each resource; Each consensus node participates in the verification of roles and permissions, and establishes a consensus node matrix to represent the verification results of each node for each role.

2. According to the decentralized permission verification method based on the alliance chain according to claim 1, it is characterized in that: The user's identity matrix I is expressed as: The role permission matrix P is expressed as: The single node result matrix A is expressed as: A=I·P; The consensus node matrix C is expressed as: Among them, n, k, and m represent the number of users, roles, and resources respectively, and i nk Indicates whether user n has roles k, p km represents the permissions of role k to resource m, c Nk Represents the authority of node N to role k.

3. According to the decentralized permission verification method based on the alliance chain according to claim 2, it is characterized in that: The threshold consensus mechanism is used to reach consensus, and the permission verification is passed only when more than a certain proportion of nodes reach consensus.

4. According to the decentralized permission verification method based on the alliance chain of claim 3, it is characterized in that: Assuming the consensus threshold is T, at least T nodes must agree to pass the consensus. The final permission verification formula is as follows: Among them, A' is the consensus node matrix, represents element-wise product, (I·P) is the original user permission matrix, that is, the single node result matrix, (C·T) represents the verification result of the consensus node on the role permission, if the consensus is reached, the value of (C·T) is 1, otherwise it is 0.

Images