Information access method, electronic equipment, storage medium and computer program product

Abstract

The invention discloses an information access method, electronic equipment, a storage medium and a computer program product. The method belongs to the field of civil aviation services, and comprises the following steps: in response to a received information access request, obtaining a search trap door corresponding to the information access request; the search trap door is matched with at least one keyword mark stored in a database, a keyword matching result is obtained, the keyword mark is used for representing a mark obtained by encrypting keywords corresponding to different information in the database through a public key, and the public key corresponds to a private key; in response to the keyword matching result that a target keyword mark matched with the search trap door exists in a database, target information corresponding to the target keyword mark is obtained, and the target information is obtained through public key encryption; and outputting the target information. According to the invention, the technical problem of poor security of information access control in related technologies is solved.

Description

Technical Field

[0001] The present invention relates to the field of civil aviation services, and in particular to an information access method, electronic equipment, storage medium, and computer program product. Background Art

[0002] With the acceleration of the civil aviation informatization process and the surge in information demand in the big data era, enterprises and airports in the civil aviation industry are facing increasingly severe information security challenges. Data integrity, accessibility and privacy protection have become core issues in civil aviation data sharing and interaction. In the wave of informatization and digital transformation of the civil aviation industry, civil aviation information systems are faced with the challenge of ensuring data integrity, user identity trust and access control security while ensuring efficient data sharing.

[0003] Traditional data storage and access control mechanisms have low reliability in data access and verification processes, which can easily expose the personal information of data owners or visitors, resulting in poor security for information access control.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide an information access method, an electronic device, a storage medium, and a computer program product, so as to at least solve the technical problem of poor security of information access control in the related art.

[0006] According to one aspect of an embodiment of the present invention, there is provided an information access method, comprising: in response to receiving an information access request, obtaining a search trapdoor corresponding to the information access request, wherein the search trapdoor is used to represent a trapdoor obtained by encrypting a keyword input by the request object using a private key of the request object, and the request object is used to represent the object sending the information access request; matching the search trapdoor with at least one keyword tag stored in a database to obtain a keyword matching result, wherein the keyword tag is used to represent a tag obtained by encrypting keywords corresponding to different information in the database using a public key, and the public key corresponds to the private key; in response to the keyword matching result being that there is a target keyword tag matching the search trapdoor in the database, obtaining target information corresponding to the target keyword tag, wherein the target information is encrypted by the public key; and outputting the target information.

[0007] Furthermore, the search trap is matched with at least one keyword tag stored in a database to obtain a keyword matching result, including: obtaining a target hash value that matches the at least one keyword tag; performing bilinear mapping processing on the search trap to obtain a bilinear mapping value of the search trap; in response to the bilinear mapping value being the same as the target hash value matched with any one of the keyword tags, determining that the keyword matching result is that the target keyword tag exists; in response to the bilinear mapping value being different from the target hash value matched with at least one keyword tag, determining that the keyword matching result is that the target keyword tag does not exist.

[0008] Furthermore, before obtaining the search trap for the information access request, the method also includes: obtaining a first identity identifier of the request object; matching the first identity identifier with multiple identity identifiers stored in an identity identifier library to obtain an identifier matching result; in response to the identifier matching result being that multiple identity identifiers include the first identity identifier, determining that the identity of the request object is secure, and obtaining a search trap.

[0009] Furthermore, the method also includes: in response to the identification matching result that the first identity identifier does not belong to multiple identity identifiers, obtaining the current matching number of the first identity identifier; in response to the matching number corresponding to the identification matching result reaching a preset threshold, obtaining the access address of the request object based on the information access request; locking the access address according to a preset strategy, and refusing to receive the information access request sent by the access address.

[0010] Furthermore, the method also includes: in response to receiving an identity registration request, obtaining object information of the registration object and a registration address of the registration object, wherein the registration object is used to represent the object that sends the identity registration request, the registration object includes the request object, and the registration address includes the access address; performing a security check on the object information and the registration address to obtain a security check result; in response to the security check result being that the object information and the registration address are secure, generating an identity identifier of the registration object based on the object information and the registration address, wherein the registration address corresponds to the identity identifier; and outputting the identity identifier of the registration object.

[0011] Furthermore, the database includes: a distributed storage module and a blockchain. The method also includes: in response to receiving an information storage request, obtaining splicing information that currently needs to be stored, wherein the splicing information is obtained by splicing encrypted information and information tags corresponding to the encrypted information, the encrypted information includes target information, and the information tags include at least one keyword tag; splitting the splicing information to obtain encrypted information and information tags; storing the encrypted information in the distributed storage module, and storing the information tags in the blockchain.

[0012] Furthermore, the method also includes: in response to receiving the information to be stored, encrypting the information to be stored based on the public key to obtain encrypted information and encryption keywords corresponding to the information to be stored; performing hash calculation on the encryption keyword to obtain a first hash value, and performing bilinear mapping processing on the first hash value to obtain a hash mapping value; performing hash calculation on the hash mapping value to obtain a second hash value, wherein the second hash value includes the target hash value; and constructing an information tag corresponding to the encrypted information based on the second hash value and the value of a preset generator.

[0013] According to another aspect of an embodiment of the present invention, there is also provided an information access device, including: a first acquisition module, used to obtain a search trapdoor corresponding to the information access request in response to receiving an information access request, wherein the search trapdoor is used to represent a trapdoor obtained by encrypting a keyword input by the request object using a private key of the request object, and the request object is used to represent the object sending the information access request; a tag matching module, used to match the search trapdoor with at least one keyword tag stored in a database to obtain a keyword matching result, wherein the keyword tag is used to represent a tag obtained by encrypting keywords corresponding to different information in the database using a public key, and the public key corresponds to the private key; a second acquisition module, used to obtain target information corresponding to the target keyword tag in response to the keyword matching result being a target keyword tag matching the search trapdoor in the database, wherein the target information is encrypted by the public key; and an information output module, used to output the target information.

[0014] According to another aspect of an embodiment of the present invention, there is further provided an electronic device, comprising: a memory storing an executable program; and a processor for running the program, wherein the method in each embodiment of the present invention is executed when the program is running.

[0015] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored executable program, wherein when the executable program is running, the device where the computer-readable storage medium is located is controlled to execute the methods in various embodiments of the present invention.

[0016] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the method in each embodiment of the present invention is implemented.

[0017] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method in each embodiment of the present invention is implemented.

[0018] According to another aspect of the embodiments of the present invention, a computer program is further provided. When the computer program is executed by a processor, the methods in the embodiments of the present invention are implemented.

[0019] In an embodiment of the present invention, a search trap corresponding to an information access request is obtained; the search trap is matched with at least one keyword tag stored in a database to obtain a keyword matching result; target information corresponding to the target keyword tag is obtained; and the target information is output in a manner that the keywords of the information to be obtained are encrypted to generate a search trap, thereby ensuring that even if the search trap is intercepted during network transmission, it cannot be reversely decrypted to obtain the keywords. In addition, keywords associated with the data file are encrypted using the public key of the data accessor to generate a keyword tag. Only when the search trap successfully matches the keyword tag can the target information be obtained, and only the data accessor holding the private key can successfully decrypt the target information, thereby achieving the purpose of ensuring the controllability and security of information access, thereby realizing the technical effect of improving the security of information access control, and further solving the technical problem of poor security of information access control in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0021] Figure 1 is a flow chart of an information access method according to an embodiment of the present invention;

[0022] Figure 2 is a structural diagram of an optional information access control system model according to an embodiment of the present invention;

[0023] Figure 3 is a schematic diagram of an information access device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] According to an embodiment of the present invention, an embodiment of an information access method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0027] Figure 1 is a flow chart of an information access method according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0028] Step S102, in response to receiving the information access request, obtaining a search trapdoor corresponding to the information access request, wherein the search trapdoor is used to represent a trapdoor obtained by encrypting a keyword input by the request object using a private key of the request object, and the request object is used to represent the object sending the information access request.

[0029] The above-mentioned information access request may refer to an application or signal sent by the requesting party to the information access control system (hereinafter referred to as the control system) in order to obtain data files stored in the control system. In the scenario of civil aviation data management, this may mean that the requesting party wants to access encrypted files related to flight, passenger information or operational data.

[0030] The search trap can be an encrypted identifier obtained by encrypting the input keyword using a private key by the requesting object. The search trap is designed to perform efficient search in encrypted data while protecting the privacy of the keyword.

[0031] The above-mentioned request object may be an entity that actively initiates the information access request. For example, the above-mentioned request object may be a staff member, department or any legitimate data accessor within the civil aviation industry, but is not limited thereto.

[0032] The private key can be part of an asymmetric key pair owned by the requesting party, which is opposite to the public key. The private key is highly confidential and is only known by the holder, and is used to generate search traps and decrypt encrypted data files retrieved through the search traps.

[0033] In an optional embodiment, when the smart contract program receives an access request sent by the requesting object, it can obtain the search trap corresponding to the information access request. The generation and use of the search trap ensures the privacy of the keywords. Even if a third party intercepts the trap, they cannot know the specific content of the keywords due to the lack of the private key required for decryption. This provides strong privacy protection for data accessors, especially in a data sharing environment, where users do not need to worry about their search intentions and query content being spied on by unauthorized entities.

[0034] For example, a smart contract program can calculate the search trap based on the following formula:

[0035] T w =H1(W) α .

[0036] Where, T w represents the search trap, H1 represents the hash function, W represents the keyword input by the request object, and α is the private key of the request object. Through the above calculation, the privacy of the keyword can be ensured. Even if there is an attacker who can intercept the trap, the specific keyword corresponding to the trap cannot be determined. Because of the lack of the inverse element of the private key α of the request object, the search trap T cannot be restored. w .

[0037] Step S104, matching the search trap with at least one keyword tag stored in the database to obtain a keyword matching result, wherein the keyword tag is used to represent a tag obtained by encrypting keywords corresponding to different information in the database using a public key, and the public key corresponds to a private key.

[0038] The above keyword tag can be an encrypted identifier obtained by the data owner using the public key of the data accessor to encrypt the keyword associated with the data file during the data upload stage. This tag is designed to reflect the basic information of the keyword, but after encryption, even if it is obtained by a third party, it cannot be decrypted due to the lack of the corresponding private key, thereby protecting the privacy of the keyword. In this embodiment, the keyword tag can be stored on the blockchain as a basis for subsequent search trapdoor matching.

[0039] The above keyword matching result can be the conclusion drawn by the smart contract program after matching the keyword tag stored in the blockchain database when receiving the search trap from the data accessor. The matching process can be based on the characteristics of the asymmetric encryption algorithm, and can determine whether the two correspond to the same keyword by calculating the specific mathematical relationship between the search trap and the keyword tag. The keyword matching results can be divided into two situations: successful matching and failed matching. The result directly determines whether the data accessor can obtain the encrypted data file related to the keyword. A successful match means that the data accessor has the right to access the data related to the keyword, while a failed match will result in the access request being denied.

[0040] The public key can be part of the asymmetric key pair of the data accessor, corresponding to the private key. The public key is made public and used by the data owner when encrypting the data file, ensuring that only the data accessor holding the matching private key can successfully decrypt the file. The use of the public key ensures the security of the data encryption and decryption process, as well as the verification of the identity of the data accessor and the control of permissions.

[0041] In an optional embodiment, the keyword tag is a tag obtained by the data owner using the public key of each data accessor to encrypt the keyword related to the data file held by the data owner. This process ensures that the generation of the keyword tag is bound to the public key of the data accessor, so that in the subsequent search process, it can accurately correspond to the data accessor holding the matching private key, that is, the above-mentioned request object. When the control system receives the information access request sent by the request object and obtains the search trap corresponding to the request, the search trap can be matched with the keyword tag stored in the database using the smart contract program. The above matching process can utilize the characteristics of the asymmetric encryption algorithm, that is, only the entity holding the private key corresponding to the public key used when generating the keyword tag can successfully decrypt and match. The above-mentioned smart contract program can determine whether it matches by calculating the value of the bilinear mapping between the search trap and the keyword tag, thereby obtaining the above-mentioned keyword matching result. The above steps correspond to the private key and the public key, and the search trap is only valid for the request object holding the private key corresponding to the public key, ensuring accurate control of data access, thereby enhancing the security of the control system.

[0042] Step S106, in response to the keyword matching result being that there is a target keyword tag matching the search trap in the database, obtaining target information corresponding to the target keyword tag, wherein the target information is encrypted by a public key.

[0043] The above-mentioned target keywords can be words or phrases used to describe the subject, content or attributes of the encrypted data file. The target keywords can help data visitors quickly locate the data they are interested in. For example, in the field of civil aviation, a data file may contain detailed information about a flight. The target keywords can be flight number, departure date or destination, etc., but are not limited to these. The above-mentioned target keywords can be selected during the encryption stage of the file to characterize the characteristics of the encrypted file. The above-mentioned target information can refer to the data file associated with the above-mentioned keywords uploaded to the control system by the data owner, and the information after encryption processing.

[0044] In an optional embodiment, when the search trap successfully matches the target keyword tag, the smart contract program can trigger the process of retrieving the encrypted data file from the distributed cloud storage server, thereby returning the encrypted data file to the data accessor. Since the target information (i.e., the encrypted data file) is encrypted using the public key of the data accessor when uploading, only the data accessor holding the matching private key can decrypt and access the data. This mechanism ensures that even if the data file is intercepted during transmission or storage, the third party cannot decrypt the data, thereby greatly enhancing the security of the data while protecting the privacy of data stores and accessors.

[0045] Step S108, output target information.

[0046] In an optional embodiment, when the smart contract program confirms that the search trap successfully matches the target keyword tag stored in the blockchain, the smart contract program can retrieve the target information corresponding to the keyword tag from the distributed cloud storage server, that is, the encrypted data file, thereby completing the output of the target information. The above steps can ensure the security of data transmission and the verification of the identity of the visitor, preventing the data from being intercepted or accessed by unauthorized users during the transmission process.

[0047] In an embodiment of the present invention, a search trap corresponding to an information access request is obtained; the search trap is matched with at least one keyword tag stored in a database to obtain a keyword matching result; target information corresponding to the target keyword tag is obtained; and the target information is output in a manner that the keywords of the information to be obtained are encrypted to generate a search trap, thereby ensuring that even if the search trap is intercepted during network transmission, it cannot be reversely decrypted to obtain the keywords. In addition, keywords associated with the data file are encrypted using the public key of the data accessor to generate a keyword tag. Only when the search trap successfully matches the keyword tag can the target information be obtained, and only the data accessor holding the private key can successfully decrypt the target information, thereby achieving the purpose of ensuring the controllability and security of information access, thereby realizing the technical effect of improving the security of information access control, and further solving the technical problem of poor security of information access control in related technologies.

[0048] Furthermore, the search trap is matched with at least one keyword tag stored in a database to obtain a keyword matching result, including: obtaining a target hash value that matches the at least one keyword tag; performing bilinear mapping processing on the search trap to obtain a bilinear mapping value of the search trap; in response to the bilinear mapping value being the same as the target hash value matched with any one of the keyword tags, determining that the keyword matching result is that the target keyword tag exists; in response to the bilinear mapping value being different from the target hash value matched with at least one keyword tag, determining that the keyword matching result is that the target keyword tag does not exist.

[0049] The target hash value can be a fixed-length hash value generated by the keyword after being processed by a hash function, and is used to store the keyword information in an encrypted form in the control system. The characteristics of the hash function ensure that it is difficult to derive the original keyword from the hash value. The use of the target hash value, in addition to providing a lightweight storage method, also effectively protects the privacy of the keyword and ensures the security of the keyword during transmission and storage.

[0050] The above-mentioned bilinear mapping value can be a value generated after performing mathematical operations on the search trap in the keyword matching process, and the above-mentioned mathematical operations utilize the properties of bilinear mapping. In this embodiment, the above-mentioned bilinear mapping value is mainly used to compare with the target hash value to determine whether the search trap matches the keyword tag stored in the database. The use of bilinear mapping not only improves the efficiency of keyword matching, but also ensures the privacy and security of the matching process, because this process does not involve direct comparison of keywords, but is indirectly judged through mathematical operations.

[0051] The above-mentioned target keyword tag can be an encrypted tag containing keywords generated for each data file before the data owner uploads the data. The data owner can select one or more keywords to describe the characteristics of the data file, and then use the public key of the data accessor to encrypt the keywords to generate a target keyword tag. The target keyword tag is stored on the blockchain and associated with the location of the data file in the distributed cloud storage. The generation and storage of the target keyword tag ensures the encryption status of the description information of the data file during the transmission and storage process, and even if it is intercepted, it cannot be directly interpreted, thereby protecting the description information of the data file from being accessed by unauthorized visitors.

[0052] In an optional embodiment, the control system can use the smart contract program to process the above keywords through a hash function, thereby converting the keywords into a target hash value of a fixed length. Since the hash function has a strong unidirectionality, the above process can ensure the irreversibility of the original keyword, that is, the original keyword cannot be reversely derived from the target hash value, thereby protecting the privacy of the keyword and preventing the leakage of sensitive information. Subsequently, the smart contract program can use bilinear mapping to process the search trap, and the bilinear mapping value obtained after processing can be compared with the target hash value in a mathematical sense. If the above bilinear mapping value is the same as the target hash value matched by any keyword tag, it is determined that the target keyword tag exists. If the above bilinear mapping value is different from the target hash value matched by all keyword tags, it is determined that the keyword matching result is that the target keyword tag does not exist. This comparison method does not expose the keyword itself, but verifies the existence of the keyword through mathematical operations, further strengthening the privacy protection of the keyword.

[0053] For example, the target hash value can be calculated as follows:

[0054] t=e(H1(W),h r );

[0055] B=H2(t).

[0056] In the formula, t represents the keyword of the data held by the data owner, e represents the bilinear mapping, h is a preset generator in the cyclic group G1, r represents the random number selected by the data owner, B represents the target hash value, H2 represents the hash function, and the meanings of other symbols in the formula are the same as those in the previous formula and will not be repeated here. The calculation method of the bilinear mapping value of the above search trap can be shown as follows:

[0057] e(T w ,A)=e(H1(W) α ,g r )=e(H1(W),g) α e(g,g)αr =e(H1(W),h r ).

[0058] In the formula, A represents the public key of the data accessor, g is a preset generator in the cyclic group G2, and the interpretations of other symbols in the formula are the same as those in the previous formula and will not be repeated here. w ,A)=B, then it can be determined that the keyword matching result is the existence of the target keyword tag.

[0059] Furthermore, before obtaining the search trap for the information access request, the method also includes: obtaining a first identity identifier of the request object; matching the first identity identifier with multiple identity identifiers stored in an identity identifier library to obtain an identifier matching result; in response to the identifier matching result being that multiple identity identifiers include the first identity identifier, determining that the identity of the request object is secure, and obtaining a search trap.

[0060] The first identity identifier mentioned above may refer to the identity information that the control system requires the requesting party (i.e., data accessor) to provide when attempting to access encrypted data. In this embodiment, the first identity identifier is processed by the smart contract program to generate an irreversible, encrypted unique identification code for subsequent identity authentication processes, which ensures that even if the identification information is intercepted, the true identity of the requesting party cannot be directly interpreted, thereby enhancing the security of the identity information.

[0061] The above-mentioned identity library can be a database that stores all legitimate user identities. It is located on the blockchain and is managed by smart contracts. The multiple identities in the identity library have gone through the registration process and are processed by smart contracts. Each legitimate user has its corresponding encrypted identity stored in the library. Due to the decentralized and tamper-proof characteristics of the blockchain, the identity library can provide a safe and reliable data storage environment, ensuring that the identity information of data accessors will not be tampered with or deleted, and enhancing the overall security and stability of information access.

[0062] The above-mentioned identification matching result may refer to the conclusion obtained by the control system after receiving the first identification of the request object and comparing the first identification with multiple identifications stored in the identification library. The identification matching result is used to determine whether the request object is a legitimate user, thereby deciding whether to allow it to access the encrypted data.

[0063] In an optional embodiment, the control system can use blockchain technology to build an identity library, and the above identity library can store the identities of all registered users. Before the requesting object attempts to access the encrypted data file, the control system can use the smart contract program to verify the legitimacy of the identity of the requesting object. Therefore, the smart contract program can obtain the first identity of the requesting object, and can match the obtained first identity with multiple identity identifiers pre-stored in the identity library to obtain the above identification matching result. If the above identification matching result shows that the first identity is included in the multiple identity identifiers, that is, the identity identifier of the data accessor matches the identity of the legitimate user in the identity library, the smart contract will determine the identity security of the requesting object. This judgment mechanism ensures that only authenticated users can perform subsequent data searches and accesses, enhances the access control capabilities of the control system, and prevents unauthorized access and potential security threats.

[0064] Furthermore, the method also includes: in response to the identification matching result that the first identity identifier does not belong to multiple identity identifiers, obtaining the current matching number of the first identity identifier; in response to the matching number corresponding to the identification matching result reaching a preset threshold, obtaining the access address of the request object based on the information access request; locking the access address according to a preset strategy, and refusing to receive the information access request sent by the access address.

[0065] The above-mentioned number of matches may refer to the total number of identity authentication matching attempts for the first identity identifier of a request object recorded by the smart contract program. In this embodiment, when the smart contract program receives an access request, it checks whether the first identity identifier in the request matches the legal identity identifier stored in the identity identifier library. Each unmatched attempt will be recorded by the smart contract and the number of matches for the first identity identifier will be increased. This mechanism helps to identify and track possible illegal access attempts and monitor abnormal behavior.

[0066] The above-mentioned preset threshold can be a security parameter pre-set in the smart contract program, which is used to determine whether the matching attempt of the current first identity identifier has reached an abnormal level. The setting of the above-mentioned preset threshold is based on the analysis of normal user behavior and potential illegal access behavior, and is usually set at a reasonable value, such as 5 times, 10 times or more. The staff can set it according to actual needs, and there is no limitation here. When the smart contract program detects that the number of matches of the current first identity identifier reaches or exceeds the preset threshold, it is considered that the current access behavior is abnormal and may involve illegal access or attack, so further measures are taken.

[0067] The above preset strategy can be a security measure that the smart contract program can take after detecting an abnormal number of matches. When the number of matches corresponding to the identification matching result reaches or exceeds the preset threshold, the smart contract program can execute the above preset strategy to ensure the security of information access.

[0068] In an optional embodiment, after the first identity of the request object is compared with multiple identity identifiers in the identity library, if the identification matching result is that the first identity identifier does not belong to these legal identifiers, it indicates that the request object may not be registered or its identity identifier has been tampered with, and the smart contract program can further obtain the current number of matches of the first identity identifier, that is, the number of previous attempts to match but failed. The smart contract program can preset a threshold to monitor whether the number of matches of the first identity identifier exceeds the limit. When the number of matches corresponding to the identification matching result reaches or exceeds this preset threshold, it indicates that the current request object has abnormal access behavior, and the smart contract can take immediate action to prevent potential illegal access or attacks. Specifically, the smart contract program can obtain the access address of the request object to accurately identify the source of the abnormal request, which is convenient for subsequent tracking and auditing. Then, the smart contract can lock the access address of the above-mentioned request object according to the pre-set security policy, that is, prohibit the address from sending information access requests within a certain period of time. The above steps can prevent attackers from using the same address to continue to attack, thereby enhancing the dynamic defense capability of the control system.

[0069] Furthermore, the method also includes: in response to receiving an identity registration request, obtaining object information of the registration object and a registration address of the registration object, wherein the registration object is used to represent the object that sends the identity registration request, the registration object includes the request object, and the registration address includes the access address; performing a security check on the object information and the registration address to obtain a security check result; in response to the security check result being that the object information and the registration address are secure, generating an identity identifier of the registration object based on the object information and the registration address, wherein the registration address corresponds to the identity identifier; and outputting the identity identifier of the registration object.

[0070] The above identity registration request can be a formal application initiated by an entity (including but not limited to an individual, department or system user) that wishes to access information to the control system. Through the identity registration request, the control system can obtain the basic information of the new user in order to carry out the subsequent identity verification and registration process.

[0071] The above-mentioned registration object may refer to an entity that issues an identity registration request, that is, a user or department that wishes to obtain access rights to the control system. In this embodiment, the registration object may be a request initiator that needs to access data.

[0072] The above object information can be the detailed personal information submitted by the registered object in the identity registration request, which is used for the control system to identify and verify the identity of the registered object. Object information is the basis for generating a unique identity of the registered object. Through the processing of the smart contract program, the object information can be encrypted and generate an irreversible, unique identification code, ensuring the uniqueness of the registered object in the control system and the security of its identity.

[0073] The above security verification result can be the result obtained after the smart contract program verifies the object information and registration address provided by the registered object.

[0074] In an optional embodiment, when receiving an identity registration request sent by a registered object, the control system can use a smart contract program to obtain detailed information of the registered object, including but not limited to department number, work number, name, gender, ID number, MAC (Media Access Control) address, login IP (Internet Protocol) and other object information, as well as the registered address used by the registered object when initiating the request, such as IP address or device MAC address. The collection of the above information can provide a data basis for subsequent security verification and identity generation. The smart contract program can execute a pre-built security verification algorithm to check the integrity and accuracy of the object information, and whether there are known security risks at the registered address, so as to obtain the above security verification results. For example, the smart contract program can check the format and validity of the registered object's ID number, whether the registered object's MAC address has been tampered with, and whether the IP address used by the registered object is included in the prohibited access list. The above security verification results will directly determine whether the registered object can be successfully registered. If the security verification results show that the object information and registration address are safe, the smart contract program can generate a unique, encrypted identity for the registered object based on this information, and establish a corresponding relationship between the registration address and the identity. The above identity can be stored in the above identity library and become the only identity proof of the registered object in the control system. The generation and output process of the above identity is automated and encrypted, ensuring that the identity information of the registered object is not leaked. At the same time, by corresponding to the registered address of the registered object, the control system can track and manage the data access behavior of each object, thereby providing a basis for subsequent identity verification and security audits.

[0075] Furthermore, the database includes: a distributed storage module and a blockchain. The method also includes: in response to receiving an information storage request, obtaining splicing information that currently needs to be stored, wherein the splicing information is obtained by splicing encrypted information and information tags corresponding to the encrypted information, the encrypted information includes target information, and the information tags include at least one keyword tag; splitting the splicing information to obtain encrypted information and information tags; storing the encrypted information in the distributed storage module, and storing the information tags in the blockchain.

[0076] The above-mentioned distributed storage module may refer to a storage system composed of multiple distributed cloud servers, which is used to store encrypted information in the civil aviation data sharing platform. The distributed storage module can provide high availability, high scalability and high security, and can intelligently store encrypted information on more appropriate servers according to the size, type and access frequency of the data. This mechanism not only improves the efficiency of data storage, but also enhances the disaster recovery capability of the storage system. Even if some servers fail, the storage system can still operate normally to ensure the continuity and availability of data.

[0077] The above-mentioned information storage request may be a formal request issued by the data owner to the control system, aiming to store the data files or information held by the data owner in the control system.

[0078] The above-mentioned splicing information may refer to a data structure composed of encrypted information and information tags uploaded by the data owner. The above-mentioned encrypted information may refer to target information processed by an encryption algorithm. In this embodiment, the target information may be an important data file, information record, etc. in civil aviation services, and the data owner encrypts the target information using an encryption algorithm to generate encrypted information.

[0079] The above-mentioned information tag may be a group of descriptive tags added to the encrypted information, and the information tag may include at least one keyword tag.

[0080] In an optional embodiment, when the control system receives an information storage request sent by the data owner, the smart contract program can respond immediately and obtain the splicing information from the above information storage request. The above splicing information is a data structure spliced ​​by an algorithm from encrypted information and information tags corresponding to the encrypted information, wherein the encrypted information contains target information (such as important data files), and the information tag contains at least one keyword tag for subsequent file retrieval. For example, the above splicing information can be shown as follows:

[0081] K={F * ,(A,B)}.

[0082] In the formula, K represents the splicing information, F *Represents the above encrypted information, (A, B) represents the above information tag, and the interpretation of other symbols in the formula is consistent with the previous formula and will not be repeated here. The smart contract program can then perform the splitting process of the spliced ​​information to separate the encrypted information and the information tag. This process ensures the searchability and storage security of the data. The above encrypted information can be the encrypted target information, which will be stored in the distributed storage module, taking advantage of the distributed cloud storage to improve storage efficiency and disaster recovery capabilities. The above information tag can include metadata such as keyword tags. After being standardized by the smart contract program, it is stored on the blockchain, using the decentralized and tamper-proof characteristics of the blockchain to provide a trusted basis for subsequent data retrieval and access control.

[0083] Furthermore, the method also includes: in response to receiving the information to be stored, encrypting the information to be stored based on the public key to obtain encrypted information and encryption keywords corresponding to the information to be stored; performing hash calculation on the encryption keyword to obtain a first hash value, and performing bilinear mapping processing on the first hash value to obtain a hash mapping value; performing hash calculation on the hash mapping value to obtain a second hash value, wherein the second hash value includes the target hash value; and constructing an information tag corresponding to the encrypted information based on the second hash value and the value of a preset generator.

[0084] The above-mentioned information to be stored may be a data file or information that the data owner is going to upload to the control system. The above-mentioned encrypted keywords may refer to descriptive keywords generated during the encryption process of the information to be stored for subsequent retrieval and access control. When encrypting information, the data owner will add one or more keywords to each piece of information to be stored, and these keywords become encrypted keywords after encryption. There is a logical association between the encrypted keywords and the information to be stored, but after encryption, the specific content of the information cannot be directly inferred from the keywords, which ensures the privacy of the data. The above-mentioned first hash value may be a digital summary generated by hashing the encrypted keywords. The above-mentioned hash mapping value may be a mathematical transformation result obtained by performing a bilinear mapping on the basis of the first hash value. The above-mentioned second hash value may be the result obtained by hashing the hash mapping value again. The above-mentioned preset generator may be an element in a mathematical group, which is usually determined when the encryption algorithm is designed.

[0085] In an optional embodiment, when the control system receives the information to be stored, the smart contract program can encrypt the information to be stored based on the public key published by the data accessor. This process can generate encrypted information and encrypted keywords corresponding to the information to be stored, wherein the encrypted information is the encrypted form of the file or information uploaded by the data owner. For example, the encrypted information can be shown as follows:

[0086]

[0087] In the formula, represents each encrypted file block, n represents the number of encrypted file blocks, and the interpretation of other symbols in the formula is consistent with the above formula, which will not be repeated here. The encrypted keywords are descriptive keywords related to the data content, which are formed after encryption. For example, the above encrypted keywords can be shown as follows:

[0088] W={W1,W2,...,W n}.

[0089] Where W1, W2, ..., W n Represents the keyword tag of each encrypted file block, where the interpretation of other symbols is consistent with the above formula and will not be repeated here. The generation of the above encrypted keywords not only enhances the security of the data, but also provides a basis for subsequent keyword retrieval. Subsequently, the smart contract program can perform a hash calculation on the encrypted keywords to generate a first hash value. The above first hash value is a digital summary of the encrypted keywords, ensuring that even if the keywords themselves are leaked, they cannot be directly associated with the encrypted information, protecting the privacy of the data owner. Then, the smart contract program can perform a bilinear mapping process on the first hash value to obtain a hash mapping value, thereby converting the first hash value into a mathematical group suitable for subsequent encryption operations, providing the possibility of constructing a more secure information tag. After the bilinear mapping process, the smart contract program can perform a hash calculation on the hash mapping value again to obtain a second hash value, wherein the second hash value may include the target hash value. The above steps further increase the difficulty of data cracking, thereby enhancing the security of the data. Based on the target hash value and the preset generator value, the smart contract program can construct an information tag corresponding to the encrypted information. The above information tag is an encrypted keyword index used for subsequent data retrieval. The information tag can be generated through complex operations of bilinear mapping and hash calculation, ensuring that only data accessors holding the correct private key can decrypt the information tag and obtain the corresponding encrypted data file.

[0090] For ease of understanding, Figure 2 is a structural diagram of an optional information access control system model according to an embodiment of the present invention, such as Figure 2As shown in Figure 1, the model includes: data accessor, data owner, key management system, blockchain system, identity authentication system, identity information database, and cloud storage server. Among them, the data accessor is the data requester in the model. The data accessor first completes registration through the identity authentication system to obtain a unique identifier. The data accessor can use his own private key to generate a search trapdoor according to the keywords to be queried. The data owner is the data provider in the model. They encrypt the data files to be stored and generate keyword tags, then upload the encrypted data files to the cloud storage server, and upload the keyword tags to the blockchain system. The key management system is responsible for generating an asymmetric key pair, that is, providing the data accessor with a public and private key, where the private key is used to generate a search trapdoor, and the public key is used by the data owner to encrypt data. The blockchain system is responsible for storing keyword tags and matching keywords through smart contracts in the blockchain system. The identity information database stores the unique identifier generated when the user registers, as well as the identity information related to the user. When the user logs in, the smart contract reads data from the database for identity authentication to ensure the legitimacy of the user's authority and identity. As a platform for distributed storage of encrypted data files, cloud storage servers reduce the storage pressure of blockchain and improve the efficiency of data retrieval and access. Encrypted data files are intelligently distributed to different cloud storage servers according to security levels and access requirements.

[0091] exist Figure 2 In the operation process described in , data accessors and data owners first register through the identity authentication system. After successful registration, their personal information is uploaded to the blockchain system, a unique identifier is generated by the smart contract, and the identity information is stored using the identity information database. The key management system generates a key pair for each registered data accessor, in which the public key is distributed to the smart contract and the private key is held by the data accessor to generate a search trap. The data owner can log in and store data based on the blockchain system. At this time, the smart contract in the blockchain system can verify the identity of the data owner through the identity authentication system. When the verification is passed, the blockchain system can store the file data in the cloud storage server. The data accessor can log in and search based on the blockchain system. At this time, the blockchain system can also verify the identity information of the data accessor through the smart contract and return the access success or failure information to the data accessor. If the data access is successful, the smart contract can return the file data from the cloud storage server, thereby sending data to the data accessor.

[0092] According to an embodiment of the present invention, an embodiment of an information access device is provided. It should be noted that the device can be used to execute the above information access method. The specific implementation and application scenario are the same as those of the above embodiment, and will not be repeated here. Figure 3is a schematic diagram of an information access device according to an embodiment of the present invention. Figure 3 As shown, the device comprises:

[0093] The first acquisition module 302 is used to obtain a search trapdoor corresponding to the information access request in response to receiving the information access request, wherein the search trapdoor is used to represent a trapdoor obtained by encrypting keywords input by the request object using the private key of the request object, and the request object is used to represent the object sending the information access request.

[0094] The tag matching module 304 is used to match the search trap with at least one keyword tag stored in the database to obtain a keyword matching result, wherein the keyword tag is used to represent a tag obtained by encrypting keywords corresponding to different information in the database using a public key, and the public key corresponds to a private key.

[0095] The second acquisition module 306 is used to acquire target information corresponding to the target keyword tag in response to the keyword matching result being that there is a target keyword tag matching the search trap in the database, wherein the target information is obtained by public key encryption.

[0096] The information output module 308 is used to output target information.

[0097] Furthermore, the tag matching module is also used to: obtain a target hash value that matches at least one keyword tag; perform bilinear mapping processing on the search trapdoor to obtain a bilinear mapping value of the search trapdoor; in response to the bilinear mapping value being the same as the target hash value that matches any keyword tag, determine that the keyword matching result is that the target keyword tag exists; in response to the bilinear mapping value being different from the target hash value that matches at least one keyword tag, determine that the keyword matching result is that the target keyword tag does not exist.

[0098] Furthermore, before obtaining the search trap for the information access request, the device also includes: a third acquisition module, used to obtain a first identity identifier of the request object; an identity matching module, used to match the first identity identifier with multiple identity identifiers stored in an identity identifier library to obtain an identifier matching result; a fourth acquisition module, used to determine that the identity of the request object is secure in response to the identifier matching result that multiple identity identifiers include the first identity identifier, and obtain the search trap.

[0099] Furthermore, the device also includes: a fifth acquisition module, used to obtain the current matching number of the first identity identifier in response to the identification matching result that the first identity identifier does not belong to multiple identity identifiers; an address acquisition module, used to obtain the access address of the request object based on the information access request in response to the matching number corresponding to the identification matching result reaching a preset threshold; an address locking module, used to lock the access address according to a preset strategy, and refuse to receive information access requests sent by the access address.

[0100] Furthermore, the device also includes: a fifth acquisition module, used to obtain object information of the registered object and the registered address of the registered object in response to receiving an identity registration request, wherein the registered object is used to represent the object that sends the identity registration request, the registered object includes the request object, and the registered address includes the access address; a security verification module, used to perform security verification on the object information and the registered address to obtain a security verification result; an identification generation module, used to generate an identity identification of the registered object based on the object information and the registered address in response to the security verification result that the object information and the registered address are secure, wherein the registration address corresponds to the identity identification; an identification output module, used to output the identity identification of the registered object.

[0101] Furthermore, the database includes: a distributed storage module and a blockchain, and the device also includes: a sixth acquisition module, used to respond to receiving an information storage request, obtain the splicing information that currently needs to be stored, wherein the splicing information is obtained by splicing the encrypted information and the information tag corresponding to the encrypted information, the encrypted information includes the target information, and the information tag includes at least one keyword tag; an information splitting module, used to split the splicing information to obtain the encrypted information and the information tag; an information storage module, used to store the encrypted information in the distributed storage module, and store the information tag in the blockchain.

[0102] Furthermore, the device also includes: an information encryption module, which is used to encrypt the information to be stored based on the public key in response to receiving the information to be stored, and obtain the encrypted information and encryption keywords corresponding to the information to be stored; a first calculation module, which is used to perform hash calculation on the encryption keyword to obtain a first hash value, and perform bilinear mapping processing on the first hash value to obtain a hash mapping value; a second calculation module, which is used to perform hash calculation on the hash mapping value to obtain a second hash value, wherein the second hash value includes the target hash value; a tag construction module, which is used to construct an information tag corresponding to the encrypted information based on the second hash value and the value of a preset generator.

[0103] An embodiment of the present application further provides an electronic device, comprising: a memory storing an executable program; and a processor for running the program, wherein the program executes the methods in various embodiments of the present invention when running.

[0104] An embodiment of the present application further provides a computer-readable storage medium, which includes a stored executable program, wherein when the executable program is running, the device where the computer-readable storage medium is located is controlled to execute the methods in various embodiments of the present invention.

[0105] An embodiment of the present application further provides a computer program product, including a computer program, which implements the methods in various embodiments of the present invention when executed by a processor.

[0106] An embodiment of the present application further provides a computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium is used to store a computer program, and when the computer program is executed by a processor, the method in each embodiment of the present invention is implemented.

[0107] The embodiments of the present application further provide a computer program, which implements the methods in the above-mentioned embodiments of the present invention when executed by a processor.

[0108] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0109] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0110] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0111] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0112] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0113] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. An information access method, characterized in that: include: In response to receiving an information access request, obtaining a search trapdoor corresponding to the information access request, wherein the search trapdoor is used to represent a trapdoor obtained by encrypting a keyword input by the request object using a private key of the request object, and the request object is used to represent an object sending the information access request; Matching the search trapdoor with at least one keyword tag stored in a database to obtain a keyword matching result, wherein the keyword tag is used to represent a tag obtained by encrypting keywords corresponding to different information in the database using a public key, and the public key corresponds to the private key; In response to the keyword matching result being that there is a target keyword tag in the database that matches the search trapdoor, acquiring target information corresponding to the target keyword tag, wherein the target information is encrypted by the public key; The target information is output.

2. The method according to claim 1, characterized in that Matching the search trapdoor with at least one keyword tag stored in a database to obtain a keyword matching result includes: Obtaining a target hash value that matches the at least one keyword tag; Performing bilinear mapping processing on the search trapdoor to obtain a bilinear mapping value of the search trapdoor; In response to the bilinear mapping value being the same as a target hash value matched with any one of the keyword tags, determining that the keyword matching result is that the target keyword tag exists; In response to the bilinear mapping value being different from the target hash value matched by the at least one keyword tag, it is determined that the keyword matching result is that the target keyword tag does not exist.

3. The method according to claim 1, characterized in that Before obtaining the search trap for the information access request, the method further includes: Obtaining the first identity identifier of the request object; Matching the first identity identifier with multiple identity identifiers stored in an identity identifier library to obtain an identifier matching result; In response to the identification matching result that the multiple identifications include the first identification, it is determined that the identity of the request object is safe, and the search trapdoor is obtained.

4. The method according to claim 3, characterized in that: The method further comprises: In response to the identification matching result being that the first identity identification does not belong to the multiple identity identifications, obtaining a current matching number of the first identity identification; In response to the number of matches corresponding to the identification matching result reaching a preset threshold, obtaining an access address of the requested object based on the information access request; The access address is locked according to a preset strategy, and information access requests sent from the access address are rejected.

5. The method according to claim 3, characterized in that: The method further comprises: In response to receiving the identity registration request, obtaining object information of a registration object and a registration address of the registration object, wherein the registration object is used to represent the object that sends the identity registration request, the registration object includes the request object, and the registration address includes an access address; Performing a security check on the object information and the registered address to obtain a security check result; In response to the security verification result indicating that the object information and the registered address are safe, generating an identity identifier of the registered object based on the object information and the registered address, wherein the registered address corresponds to the identity identifier; Output the identity of the registered object.

6. The method according to any one of claims 1 to 5, characterized in that The database includes: a distributed storage module and a blockchain, and the method further includes: In response to receiving the information storage request, obtaining the splicing information currently required to be stored, wherein the splicing information is obtained by splicing the encrypted information and the information tag corresponding to the encrypted information, the encrypted information includes the target information, and the information tag includes the at least one keyword tag; Splitting the spliced ​​information to obtain the encrypted information and the information mark; The encrypted information is stored in the distributed storage module, and the information mark is stored in the blockchain.

7. The method according to claim 6, characterized in that The method further comprises: In response to receiving the information to be stored, encrypting the information to be stored based on the public key to obtain encrypted information and encryption keywords corresponding to the information to be stored; Performing hash calculation on the encrypted keyword to obtain a first hash value, and performing bilinear mapping processing on the first hash value to obtain a hash mapping value; Performing a hash calculation on the hash mapping value to obtain a second hash value, wherein the second hash value includes a target hash value; Based on the second hash value and the value of the preset generator, an information tag corresponding to the encrypted information is constructed.

8. An electronic device, characterized in that: include: A memory storing an executable program; A processor, configured to run the program, wherein the program executes the method according to any one of claims 1 to 7 when running.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is run, the device where the storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images