Block chain-based security management method and device, equipment and storage medium

Abstract

The invention provides a security management method and device based on a block chain, equipment and a storage medium, and the method comprises the steps: obtaining an access request, carrying out the multi-factor verification of the access request through a verification rule of a smart contract in a block chain network, obtaining a verification result, and when the verification result is represented to pass, carrying out the verification of the access request; the access request is allowed to access the corresponding accessible range, in the process of accessing the accessible range, the trust score is determined through the trust scoring rule of the smart contract, the accessible range is dynamically adjusted according to the trust score, and each access is verified by using the smart contract of the decentralized, tamper-resistant and high-transparency block chain network, so that the access efficiency is improved. And the intelligent contract is utilized to determine the trust score to perform dynamic permission adjustment of the accessible range, so that the transparency of permission change and access is ensured, and the security of the verification process is ensured.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a blockchain-based security management method, device, equipment and storage medium. Background Art

[0002] With the rapid development of 5G networks, 5G private networks have become key infrastructure in scenarios such as enterprises, industries, medical care, and smart cities. 5G private networks provide private network services for different devices and users, supporting key businesses with high reliability and low latency. However, in order to achieve security management today, the network security architecture used is mostly based on border defense and single point trust, which can easily lead to users or devices obtaining excessive permissions after being authenticated, thereby increasing the risk of internal threats. At present, in order to solve the above-mentioned single point trust problem, some design solutions require re-verification of identity for each request, but there are still challenges in terms of transparency of access control, security of the verification process, and permission changes. Summary of the invention

[0003] The embodiments of the present application provide a blockchain-based security management method, device, equipment, and storage medium to solve at least one problem existing in the related technology. The technical solution is as follows: In a first aspect, an embodiment of the present application provides a blockchain-based security management method, including: Get access request; Perform multi-factor verification on the access request through the verification rules of the smart contract in the blockchain network to obtain a verification result; When the verification result characterizes passing, the access request is allowed to access the corresponding accessible scope, and in the process of accessing the accessible scope, the trust score is determined according to the trust scoring rule of the smart contract; The accessible range is dynamically adjusted according to the trust score.

[0004] In one embodiment, the multi-factor verification of the access request is performed according to the verification rules of the smart contract in the blockchain network, and the verification result obtained includes: Verify the user name, password, digital certificate, identity token, biometric information and geographic location of the device corresponding to the access request through the verification rules of the smart contract in the blockchain network to obtain a verification result; Wherein, when the user name, the password, the digital certificate, the identity token, the biometric information and the geographic location are all verified, the verification result indicates a pass.

[0005] In one embodiment, during accessing the accessible scope, determining the trust score by using the trust score rule of the smart contract includes: In the process of accessing the accessible scope, the behavior factor, the device legitimacy factor, the location factor and the network activity factor are analyzed respectively through the trust scoring rule of the smart contract to determine the behavior score, the legitimacy score, the location score and the network activity score; A trust score is obtained by performing weighted calculation based on the behavior score, the legitimacy score, the location score, and the network activity score using corresponding weight parameters.

[0006] In one implementation, dynamically adjusting the accessible range according to the trust score includes: When the trust score is greater than or equal to a first score threshold, maintaining the current accessible scope; When the trust score is greater than a second score threshold and less than a first score threshold, adjusting the accessible scope to non-core resources; When the trust score is less than or equal to a second score threshold, the accessible scope is adjusted to a non-core resource and then reduced, or the accessible scope is adjusted to be empty for isolation.

[0007] In one embodiment, the method further comprises: In the process of accessing the accessible range, determining difference data, synchronizing data using the difference data in the blockchain network through the QUIC protocol, and obtaining synchronization data from the edge server; wherein the blockchain network is deployed based on a 5G private network; When receiving information, determining the priority of the information and processing the information with the highest priority; When the base station of the accessed node is switched or the IP address is changed, the remaining nodes in the blockchain network are notified by real-time broadcast or multicast, and a dynamic domain name is assigned to the node by the dynamic domain name system; When the accessed node switches nodes, the node communication is maintained through connection migration or multipath transmission of the QUIC protocol.

[0008] In one embodiment, the method further comprises: Determining a deployment scenario for the blockchain network; When the deployment scenario is a high-security scenario, the node deployment density of the blockchain network is increased, and an election algorithm and multi-layer identity are used for identity authentication; When the deployment scenario is a low-security scenario, the node deployment density of the blockchain network is reduced, and the CPU scheduling algorithm is used for identity authentication.

[0009] In one embodiment, the method further comprises: Encrypting the adjusted accessible range and the access information of the access request to obtain encrypted log data; The log data is transmitted to the blockchain network for storage.

[0010] In a second aspect, an embodiment of the present application provides a blockchain-based security management device, including: An acquisition module, used to acquire access requests; A verification module, used to perform multi-factor verification on the access request through the verification rules of the smart contract in the blockchain network to obtain a verification result; A determination module, configured to allow the access request to access the corresponding accessible scope when the verification result characterization passes, and determine the trust score according to the trust score rule of the smart contract during the process of accessing the accessible scope; An adjustment module is used to dynamically adjust the accessible range according to the trust score.

[0011] In one embodiment, the blockchain-based security management device further includes a management module, and the management module is used to: In the process of accessing the accessible range, determining difference data, synchronizing data using the difference data in the blockchain network through the QUIC protocol, and obtaining synchronization data from the edge server; wherein the blockchain network is deployed based on a 5G private network; When receiving information, determining the priority of the information and processing the information with the highest priority; When the base station of the accessed node is switched or the IP address is changed, the remaining nodes in the blockchain network are notified by real-time broadcast or multicast, and a dynamic domain name is assigned to the node by the dynamic domain name system; When the accessed node switches nodes, the node communication is maintained through connection migration or multipath transmission of the QUIC protocol.

[0012] In one embodiment, the management module is further used for: Determining a deployment scenario for the blockchain network; When the deployment scenario is a high-security scenario, the node deployment density of the blockchain network is increased, and an election algorithm and multi-layer identity are used for identity authentication; When the deployment scenario is a low-security scenario, the node deployment density of the blockchain network is reduced, and the CPU scheduling algorithm is used for identity authentication.

[0013] In one embodiment, the management module is further used for: Encrypting the adjusted accessible range and the access information of the access request to obtain encrypted log data; The log data is transmitted to the blockchain network for storage.

[0014] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement a method in any one of the above-mentioned embodiments.

[0015] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed, the method in any one of the above-mentioned embodiments is implemented.

[0016] The beneficial effects of the above technical solution include at least: By obtaining access requests and performing multi-factor verification on access requests through the verification rules of smart contracts in the blockchain network, a verification result is obtained. When the verification result characterizes passing, the access request is allowed to access the corresponding accessible scope, and in the process of accessing the accessible scope, the trust score is determined through the trust scoring rules of the smart contract. According to the trust score, the accessible scope is dynamically adjusted. Each access is verified by the smart contract of the blockchain network with decentralization, immutability and high transparency, and the smart contract is used to determine the trust score for dynamic permission adjustment of the accessible scope, so as to ensure the transparency of permission changes and access, as well as the security of the verification process.

[0017] The above summary is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments and features described above, further aspects, embodiments and features of the present application will be readily apparent by reference to the accompanying drawings and the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the multiple drawings represent the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments disclosed in the present application and should not be regarded as limiting the scope of the present application.

[0019] Figure 1 This is a schematic diagram of the steps of a security management method based on blockchain according to an embodiment of the present application; Figure 2 A schematic diagram of the system architecture of an embodiment of the present application; Figure 3 This is a structural block diagram of a blockchain-based security management device according to an embodiment of the present application; Figure 4 This is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0020] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present application. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0021] Reference Figure 1 , showing a flowchart of a blockchain-based security management method according to an embodiment of the present application, the blockchain-based security management method may at least include steps S100-S400: S100: Get access request.

[0022] S200. Perform multi-factor verification on the access request through the verification rules of the smart contract in the blockchain network to obtain a verification result.

[0023] S300: When the verification result characterizes passing, the access request is allowed to access the corresponding accessible scope, and in the process of accessing the accessible scope, the trust score is determined according to the trust score rule of the smart contract.

[0024] S400, dynamically adjust the accessible scope based on the trust score.

[0025] The technical solution of the embodiment of the present application obtains an access request, performs multi-factor verification on the access request through the verification rules of the smart contract in the blockchain network, and obtains a verification result. When the verification result characterizes a pass, the access request is allowed to access the corresponding accessible scope, and in the process of accessing the accessible scope, the trust score is determined through the trust scoring rules of the smart contract, and the accessible scope is dynamically adjusted according to the trust score. Each access is verified by using a smart contract with a decentralized, tamper-proof, and highly transparent blockchain network, and the smart contract is used to determine the trust score to perform dynamic permission adjustment of the accessible scope, thereby ensuring the transparency of permission changes and access, and ensuring the security of the verification process.

[0026] Reference Figure 2, the method of the embodiment of the present application can be implemented through a pre-built system architecture, which includes but is not limited to an access module, a private blockchain network deployed based on a 5G private network (several nodes, smart contract modules (smart contracts for short)), a zero-trust control module (including a dynamic trust scoring module, a permission control module), and an edge module (including edge nodes and edge servers). Among them, the access module is used to connect the user's device to the 5G private network after the verification result representation is passed. The zero-trust control module is the security decision-making core of the entire network, responsible for real-time verification of the identity and behavior of all devices and users, and execution of dynamic permission control policies. The zero-trust gateway deployed in the edge cloud server, as a key component of the zero-trust architecture, is responsible for strict security control of access requests from external devices and users. The zero-trust gateway first verifies the identity of the external visitor through the blockchain network, and then reviews its permissions through a smart contract to determine the accessible scope, and adjusts the access permissions in real time based on the evaluation results of the dynamic trust scoring module to ensure the security of the 5G private network. Therefore, the zero-trust gateway and the zero-trust control module work together to ensure that the entire process from external access to internal management is safe and controllable. As the first line of defense of the network, the zero-trust gateway is responsible for the initial identity authentication and access control of external devices and users to prevent unauthorized access. The zero-trust control module is located inside the network and continuously monitors and manages connected devices and users, dynamically adjusts their permissions, ensures internal security, ensures that external devices or users entering the private network are strictly reviewed, and that all network boundary activities are recorded on the blockchain network.

[0027] In one implementation, users and devices must first register using information such as passwords, user names, and biometric information to generate corresponding digital certificates, identity tokens, etc. User names and passwords are generated and stored using an encrypted hash algorithm to ensure security. Digital certificates are generated based on public key infrastructure (PKI) to provide trusted identity authentication for high-security scenarios. Identity tokens: dynamically generated single-time verification tokens are used to enhance user login security. When registration is successful, users and devices are connected to a private blockchain network based on 5G private network deployment through an access module. Users and devices participate in the operation of the blockchain network as nodes. At the same time, passwords, user names, biometric information, digital certificates, identity tokens, etc. are all recorded in the smart contract of the blockchain network. The smart contract stores trust scoring rules, verification rules, etc., and manages relevant information of users and devices, allocation of access rights (such as accessible scope), log data, etc., to ensure data transparency and immutability.

[0028] In one implementation, when a user and device attempt to access a blockchain network, the user can use their device to initiate an access request, and the zero-trust gateway will obtain the access request and send it to the blockchain network, using the verification rules of the blockchain network's smart contract to perform multi-factor verification to verify the identity. It should be noted that the zero-trust control module does not rely on a single trust point, and each time an access request is obtained, multi-factor verification will be re-performed to ensure security.

[0029] In one implementation, step S200 is specifically: Through the verification rules of the smart contract in the blockchain network, the username, password, digital certificate, identity token, biometric information and geographic location of the device corresponding to the access request are verified to obtain the verification result.

[0030] Specifically, the zero-trust control module uses the verification rules of the smart contract in the blockchain network to verify the user name, password, digital certificate, identity token, biometric information and geographical location of the device corresponding to the access request, and obtain the verification result. Among them, the smart contract will save the behavior information of the user and the device every time, so the commonly used geographical location (such as determined by the IP address) is saved. If the current geographical location is different from the commonly used geographical location, it is an abnormal change, and the user will be prompted to re-verify the above factors except the geographical location. When these factors are verified, the verification result is passed.

[0031] It should be noted that when the user name, password, digital certificate, identity token, biometric information and geographic location are all verified, the verification result indicates that it is passed, and when at least one of the user name, password, digital certificate, identity token, biometric information (such as fingerprint or face) and geographic location is not verified, the verification result indicates that it is not passed. Among them, when the verification is passed, a new block can be generated, the new block is synchronized in the blockchain network, all nodes update data, maintain consistency, and record the access request, verification results, etc. in the blockchain network, and the verification results are fed back to the zero trust gateway to decide whether to allow access.

[0032] In one embodiment, in step S300, the smart contract pre-configures and stores the accessible scope corresponding to each user and device, and performs permission review of the access request based on the accessible scope pre-stored in the smart contract. The pre-stored accessible scope is pre-allocated based on the user role, device type, and sensitivity of network resources. Therefore, when the verification result characterizes passing, the smart contract can determine the accessible scope corresponding to the access request, and allow the access request to access the corresponding accessible scope, so that users and devices can access within the accessible scope.

[0033] It should be noted that the sensitivity of network resources can be divided based on confidentiality, integrity and availability. Confidentiality: Resources that process personal privacy data or corporate confidential information are considered highly sensitive and access rights are strictly controlled. Integrity: If network resources involve critical business processes, they need to be prevented from tampering and limited to strictly reviewed users and devices. Availability: Relatively insensitive data resources or public information can have relatively loose access rights, allowing more users and devices to access.

[0034] In one embodiment, in the process of accessing the accessible scope in step S300, the trust score is determined by the trust score rule of the smart contract, including steps S310-S320: S310. In the process of accessing the accessible scope, the behavior factors, device legitimacy factors, location factors, and network activity factors are analyzed respectively through the trust scoring rules of the smart contract to determine the behavior score, legitimacy score, location score, and network activity score.

[0035] Optionally, during the process of user accessing the accessible scope, the dynamic trust scoring module of the zero trust control module will continuously monitor the relevant information of the user (and the device he uses) in real time, and then use the trust scoring rules of the smart contract to analyze the behavioral factors, device legitimacy factors, location factors and network activity factors in the relevant information, thereby determining the corresponding behavior score, legitimacy score, location score and network activity score.

[0036] For example, the basic scores corresponding to behavioral factors, device legitimacy factors, location factors, and network activity factors under normal circumstances can be set in advance; when behavioral factors such as the analysis of the user's login time and operation frequency do not conform to the user's historical behavior, such as sudden large-scale data requests or logins at unconventional times, it is considered that there are abnormal operations, and the basic score corresponding to the behavioral factor will be reduced, and the smart contract will trigger a risk alert; when location factors such as remote login, uncommon IP addresses, and unauthorized IP addresses are logged in (for example, the user usually operates in China, but suddenly logs in from abroad), the basic score corresponding to the location factor will be reduced; when device legitimacy factors such as the fingerprint information, operating system version, or network interface of the device are different from those stored in the smart contract, indicating that there are problems with legitimacy and consistency, the basic score corresponding to the network activity factor will be reduced; when network activity factors such as sudden large-scale data transmission lead to a sharp increase in data traffic, frequent sensitive resource access requests, and excessive data transmission frequency, the basic score corresponding to the network activity factor will be reduced. It is understandable that when at least one of the corresponding behavior factors, device legitimacy factors, location factors, and network activity factors is determined based on relevant information from real-time monitoring and returns to normal, the lowered basic score will be increased again.

[0037] In some embodiments, if at least one basic score corresponding to the behavioral factor, device legitimacy factor, location factor, and network activity factor decreases, the user's access to core resources (sensitive resources) can be directly restricted, that is, the accessible scope is adjusted to non-core resources, and additional identity authentication is required and an alarm event or re-verification is triggered, waiting for the administrator to intervene and review.

[0038] The degree of reduction and improvement of the basic score is determined based on the degree of deviation / abnormality of behavioral factors, device legitimacy factors, location factors, and network activity factors. The greater the degree of deviation / abnormality, the greater the degree of reduction. For example, for a slight geographic location deviation, such as being in different provinces in China, the basic score will decrease by 10% to 15%; if the device suddenly appears in a highly abnormal geographic location (such as logging in remotely from abroad), the trust score will decrease by 30% to 50%; abnormal data transmission frequency: if the network activity of the device has a frequency fluctuation that does not conform to the historical behavior pattern, for slight fluctuations, the trust score will decrease by 5% to 10%; and for frequent and large fluctuations, the score will decrease by 15% to 20%.

[0039] It should be noted that the zero-trust control module focuses on evaluating the real-time security status of devices and users and managing permissions, while the blockchain network verifies the integrity of data and the legality of transactions; the permission control module of the zero-trust control module regularly synchronizes data with the smart contract of the blockchain network to dynamically adjust device permissions, and each permission adjustment will be automatically executed through the smart contract.

[0040] S320: Perform weighted calculation based on the behavior score, the legitimacy score, the location score, and the network activity score using corresponding weight parameters to obtain a trust score.

[0041] Then, the trust scoring rules of the smart contract also set weight parameters corresponding to different scores in advance based on actual needs. Therefore, the dynamic trust scoring module of the zero trust control module can perform weighted calculations based on the behavior score, legitimacy score, location score and network activity score using the corresponding weight parameters to obtain a comprehensive trust score.

[0042] In one implementation, step S400 includes steps S410-S430: S410: When the trust score is greater than or equal to the first score threshold, maintain the current accessible range.

[0043] Optionally, when the trust score is greater than or equal to the first score threshold, for example, the first score threshold is 80, which is equivalent to a score range of 80-100, representing a high trust level and a safe operating environment, the permission control module of the zero trust control module does not adjust the current accessible scope, and the user can access most resources, including sensitive data such as internal company confidential documents and financial data.

[0044] S420: When the trust score is greater than the second score threshold and less than the first score threshold, adjust the accessible scope to non-core resources.

[0045] Optionally, when the trust score is greater than the second score threshold and less than the first score threshold, for example greater than 49 and less than 80, which is equivalent to a score range of 50-79, equivalent to a medium trust level, the permission control module of the zero trust control module adjusts the accessible scope to non-core resources, prohibits the user's device from accessing non-core resources, and triggers a warning event. The permissions will be restricted and sensitive data cannot be accessed, but general business systems can be accessed.

[0046] S430: When the trust score is less than or equal to the second score threshold, the accessible scope is adjusted to non-core resources to reduce the accessible scope, or the accessible scope is adjusted to empty for isolation.

[0047] Optionally, when the trust score is less than or equal to a second score threshold, equivalent to a score range of 0-49, a low trust level, a serious abnormality or a high-risk operation, the permission control module of the zero trust control module adjusts the accessible scope to non-core resources, and further reduces the accessible scope so that only basic operations can be performed. Alternatively, the permission control module directly adjusts the accessible scope to empty to isolate the user's device, isolate suspicious devices, and ensure security until the security issue is resolved.

[0048] In one implementation, the blockchain-based security management method of the embodiment of the present application may further include steps S510-S540: S510. In the process of accessing the accessible range, determine the difference data, use the difference data to synchronize data in the blockchain network through the QUIC protocol, and obtain the synchronization data from the edge server.

[0049] In the embodiments of the present application, the blockchain network deployed using the 5G private network is different from the existing blockchain network. The deployment of existing blockchains is mostly based on the Internet or local area network environment, while the 5G private network has the characteristics of high bandwidth, low latency and high concurrency. To adapt to these characteristics, the communication protocols and data synchronization mechanisms of the nodes in the blockchain network are optimized, so that the nodes can quickly process and record the data flow in the 5G private network, thereby ensuring the efficient operation of the blockchain system.

[0050] Specifically, in view of the low latency and high concurrency characteristics of 5G private networks, lightweight and efficient communication protocols such as the UDP-based transport protocol (QUIC) are designed to replace traditional TCP, so as to reduce transmission delay and improve throughput, reduce handshake steps, compress message formats, and reduce protocol costs.

[0051] Optionally, in the process of accessing the accessible range, when node data synchronization is required, in order to avoid bandwidth waste caused by full data transmission, the node's own differential data since the last synchronization is determined, and then the differential data is used for data synchronization in the blockchain network through the QUIC protocol; wherein, the node's synchronization data can be stored and shared with the help of the edge computing nodes of the 5G network (referred to as edge nodes for short), so the node can obtain real-time synchronization data of other nodes from the edge server, reducing the core node load.

[0052] In some implementations, shard synchronization can also be achieved. For example, through the high concurrency characteristics of the 5G private network, a number of nodes can be sharded so that the shards can be synchronized during data synchronization, thereby improving the efficiency of large-scale node data synchronization.

[0053] S520: When receiving information, determine the priority of the information and process the information with the highest priority.

[0054] In the embodiment of the present application, the blockchain network is provided with dynamic priority management. When a node receives information, it determines the priority of the current information based on the preset priorities of different types of information in the smart contract, and then prioritizes the information with the highest priority. For example, different types of information such as transaction requests and consensus messages can be preset with corresponding priorities to determine the order of processing.

[0055] S530. When the base station of the accessed node is switched or the IP address is changed, the remaining nodes in the blockchain network are notified through real-time broadcast or multicast, and a dynamic domain name is allocated to the node through the dynamic domain name system.

[0056] The blockchain network of the embodiment of the present application also provides node mobility support. Different from the existing blockchain network in which most nodes are in fixed locations, the devices in the 5G private network have strong mobility. By introducing a node management mechanism that supports dynamic IP addresses, it is ensured that the device can still maintain participation in the blockchain network when switching between different base stations.

[0057] Specifically, when the base station of the accessed node switches or the IP address changes, the remaining nodes in the blockchain network are notified through real-time broadcast or multicast, and a dynamic domain name is assigned to the node through the dynamic domain name system (DDNS), thereby ensuring that the node can still be quickly located by the domain name when the location changes.

[0058] S540. When the accessed node performs node switching, node communication is maintained through connection migration or multipath transmission of the QUIC protocol.

[0059] Optionally, in the blockchain network of the embodiment of the present application, when the accessed node performs node switching, the node communication is maintained by utilizing the session persistence function of the transport layer (such as the connection migration of the QUIC protocol) or multi-path transmission (such as MPTCP), thereby ensuring seamless switching between the new and old nodes, reducing latency, and ensuring uninterrupted communication.

[0060] In an embodiment of the present application, the blockchain network monitors the status of the node in real time through a heartbeat detection mechanism. When the node switches the base station, it automatically updates its position and status in the blockchain network. When the node is offline for a short time and reconnects, it supports the rapid recovery of the data synchronization status that was interrupted last time. After the node is switched, based on Token identity authentication, an encrypted token bound to a dynamic IP address and identity is used for authentication to ensure that the legitimacy of the node can still be quickly verified after it moves. Temporary data of the device (such as a mobile device) is stored in the edge node to ensure that the mobile node can quickly resume normal operation and synchronize data such as unfinished transaction records during the switch.

[0061] In the embodiments of the present application, based on the distributed characteristics of the blockchain network, the access control logic is dispersed to different nodes. Each blockchain node has the ability to independently verify device and user permissions, reducing dependence on centralized systems and enhancing the flexibility and security of the system. Part of the access control logic can also be delegated to edge computing nodes. These nodes can independently process access requests from access devices based on smart contracts on the blockchain network, reducing network delays while improving the efficiency of permission verification.

[0062] Among them, the access control logic is decentralized to the nodes, and the distribution of smart contracts is that each node is deployed with the same smart contract, which is responsible for executing the permission verification of users and devices. These smart contracts include permission allocation, dynamic adjustment of the accessible scope, trust scoring rules and verification rules, which can ensure that each node can independently conduct permission review when receiving an access request; data synchronization mechanism: through the consensus mechanism of the blockchain network, the data of all nodes are synchronized to ensure that the access control logic executed by each node is consistent. This synchronization mechanism allows the system to continue to undertake verification tasks when any node fails, without affecting the security and function of the entire network; local processing of access requests, when a device issues an access request, the system will first perform multi-factor verification at the node closest to the user (such as an edge node) to reduce delays and improve response speed. In this way, the decentralized logic enables the entire system framework to have efficient local processing capabilities and improve overall performance.

[0063] It should be noted that although each node in the blockchain network has the ability to independently verify device and user permissions, the verification capabilities of different nodes may vary, depending on the type of node and the network location. The differences between nodes are mainly reflected in the following aspects: Edge nodes: Usually close to users, responsible for handling preliminary verification of users and devices and management of some access rights. The processing power of edge nodes is relatively weak, and they are mainly used to process low-sensitivity data and quickly respond to user requests. The permission verification capabilities of edge nodes are relatively basic and suitable for processing local, low-complexity requests. Therefore, correspondingly, the role of edge nodes: responsible for local device authentication, permission management, and low-latency response operations. These nodes can cache some smart contract data locally and ensure the accuracy of permission verification by synchronizing with core nodes. The permission verification capabilities of these nodes are relatively limited, mainly targeting non-core system resources.

[0064] Core nodes: Located at the center of the network, they have more powerful computing power and higher permission management capabilities. Core nodes usually handle access requests involving highly sensitive data, such as access to the company's core business. Core nodes are also responsible for cross-node permission verification coordination and management of complex permission adjustment operations. Therefore, correspondingly, the core node role: responsible for managing the high-level permission operations of the entire network and the data flow within the system. The core node can not only verify the identity of the device, but also dynamically adjust the permissions across regions, handle highly complex operation requests, and conduct more stringent security reviews of the system.

[0065] In one implementation, the blockchain-based security management method of the embodiment of the present application may further include steps S610-S630: S610: Determine a deployment scenario for the blockchain network.

[0066] The blockchain network of the embodiment of the present application is based on 5G network slicing technology. According to different network slice segmentation deployment, the deployment density and verification mechanism of blockchain nodes can also be different for different business needs, which can meet personalized needs. For example, deployment scenarios include but are not limited to high-security scenarios (such as industrial Internet) and low-security scenarios (such as ordinary business scenarios such as the Internet of Things). High-security scenarios and low-security scenarios can be set as needed.

[0067] S620. When the deployment scenario is a high-security scenario, increase the node deployment density of the blockchain network, and use the election algorithm and multi-layer identity for identity authentication.

[0068] Optionally, when the deployment scenario is a high-security scenario, the node deployment density can be increased to form a tighter blockchain network, improve fault tolerance and data reliability, for example, based on the number of baseline nodes, the number of nodes can be further increased in the slice area corresponding to the deployment scenario. Then, a stricter election algorithm (such as PBFT) and multi-layer identity authentication are used to improve data consistency and security, increase block size limits, prevent data abuse, and ensure data integrity and non-tamperability. For example, multi-layer identity includes but is not limited to passwords, verification codes, phone numbers, ID numbers, etc., without specific limitation.

[0069] S630: When the deployment scenario is a low-security scenario, reduce the node deployment density of the blockchain network, and use the CPU scheduling algorithm for identity authentication.

[0070] Optionally, when the deployment scenario is a low-security scenario, the node deployment density of the blockchain network can be reduced. For example, based on the number of baseline nodes, the number of nodes can be further reduced in the slice area corresponding to the deployment scenario to reduce deployment and maintenance costs, and some decision-making can be appropriately sacrificed to optimize performance. Then, the CPU scheduling algorithm (such as DPoS) can be used for identity authentication to improve throughput, and the identity authentication requirements can be appropriately relaxed to reduce the network burden, and a more flexible block generation frequency can be used to balance efficiency and security.

[0071] In one implementation, the blockchain-based security management method of the embodiment of the present application may further include steps S710-S720: S710: Encrypt the adjusted accessible range and the access information of the access request to obtain encrypted log data.

[0072] S720: Transmit the log data to the blockchain network for storage.

[0073] Optionally, in the embodiment of the present application, the immutability of the blockchain is utilized to ensure that the relevant data of each node, such as permission changes (adjusted accessible scope), access information of each access request (including device information (such as device status changes), user information, user operations), traffic management, warning events, real-time monitoring and collected data, etc. can be transparently recorded to support subsequent auditing and tracing. Therefore, all relevant data will be encrypted to obtain encrypted log data. Then, the encrypted log data is transmitted to the blockchain network for verification and storage to prevent any unauthorized operations or potential attacks and ensure the security and integrity of the data.

[0074] The embodiment of the present application is based on the blockchain network and zero-trust security framework of the 5G private network, and utilizes the decentralization and immutability of blockchain technology, combined with the zero-trust security framework, to ensure that each access request in the 5G private network is verified, recorded and managed by the smart contract, and to build a distributed and immutable security management mechanism. The device access, user identity authentication, dynamic trust score and permission management of the 5G private network are managed through a private blockchain network to ensure the legitimacy and security of each access request, and to improve the security, transparency and management flexibility of the devices and users in the private network. In addition, the distributed blockchain network avoids the performance bottleneck of centralized permission management and adapts to the high concurrency and multi-device environment of the 5G private network; the blockchain network records all relevant information and supports subsequent security audits and behavior tracing.

[0075] Reference Figure 3 , shows a structural block diagram of a blockchain-based security management device according to an embodiment of the present application, which may include: An acquisition module, used to acquire access requests; The verification module is used to perform multi-factor verification on the access request through the verification rules of the smart contract in the blockchain network to obtain the verification result; A determination module is used to allow the access request to access the corresponding accessible scope when the verification result representation is passed, and in the process of accessing the accessible scope, determine the trust score according to the trust score rule of the smart contract; The adjustment module is used to dynamically adjust the accessible scope according to the trust score.

[0076] In one embodiment, the blockchain-based security management device further includes a management module, and the management module is used to: In the process of accessing the accessible range, differential data is determined, and data is synchronized using the differential data in the blockchain network through the QUIC protocol, and the synchronized data is obtained from the edge server; wherein the blockchain network is deployed based on a 5G private network; When receiving information, determine the priority of the information and process the information with the highest priority; When the base station of the accessed node switches or the IP address changes, the rest of the nodes in the blockchain network are notified through real-time broadcast or multicast, and a dynamic domain name is assigned to the node through the dynamic domain name system; When the accessed node switches nodes, the node communication is maintained through connection migration or multipath transmission of the QUIC protocol.

[0077] In one embodiment, the management module is further configured to: Determine the deployment scenario of the blockchain network; When the deployment scenario is a high-security scenario, increase the node deployment density of the blockchain network and use election algorithms and multi-layer identities for identity authentication; When the deployment scenario is a low-security scenario, reduce the node deployment density of the blockchain network and use the CPU scheduling algorithm for identity authentication.

[0078] In one embodiment, the management module is further configured to: Encrypt the adjusted accessible range and the access information of the access request to obtain encrypted log data; Transmit log data to the blockchain network for storage.

[0079] The functions of each module in each device in the embodiments of the present application can be found in the corresponding description in the above method, and will not be repeated here.

[0080] Reference Figure 4 , shows a structural block diagram of an electronic device according to an embodiment of the present application, the electronic device includes: a memory 310 and a processor 320, the memory 310 stores instructions that can be run on the processor 320, and the processor 320 loads and executes the instructions to implement the blockchain-based security management method in the above embodiment. The number of the memory 310 and the processor 320 can be one or more.

[0081] In one embodiment, the electronic device further includes a communication interface 330 for communicating with external devices and performing data exchange transmission. If the memory 310, the processor 320 and the communication interface 330 are implemented independently, the memory 310, the processor 320 and the communication interface 330 can be interconnected through a bus and complete mutual communication. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0082] Optionally, in a specific implementation, if the memory 310, the processor 320 and the communication interface 330 are integrated on a chip, the memory 310, the processor 320 and the communication interface 330 can communicate with each other through an internal interface.

[0083] An embodiment of the present application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the blockchain-based security management method provided in the above embodiment.

[0084] An embodiment of the present application also provides a chip, which includes a processor for calling and executing instructions stored in the memory from the memory, so that a communication device equipped with the chip executes the method provided by the embodiment of the present application.

[0085] An embodiment of the present application also provides a chip, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the method provided in the embodiment of the application.

[0086] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting the advanced RISC machines (ARM) architecture.

[0087] Further, optionally, the above-mentioned memory may include a read-only memory and a random access memory, and may also include a non-volatile random access memory. The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may include a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may include a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available. For example, static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct rambus RAM (DR RAM).

[0088] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.

[0089] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the described specific features, structures, materials or characteristics may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0090] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0091] Any process or method description in the flow chart or otherwise described herein can be understood to represent a module, fragment or portion of a code including one or more executable instructions for implementing the steps of a specific logical function or process. And the scope of the preferred embodiment of the present application includes other implementations, in which the functions may not be performed in the order shown or discussed, including in a substantially simultaneous manner or in a reverse order according to the functions involved.

[0092] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, which can be embodied in any computer-readable medium for use by an instruction execution system, apparatus or device (such as a computer-based system, a system including a processor or other system that can fetch instructions from an instruction execution system, apparatus or device and execute instructions), or used in conjunction with these instruction execution systems, apparatuses or devices.

[0093] It should be understood that the various parts of the present application can be implemented with hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented with software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the above embodiment method can be completed by instructing the relevant hardware through a program, which can be stored in a computer-readable storage medium, and when the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0094] In addition, each functional unit in each embodiment of the present application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into one module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of a software functional module. If the above-mentioned integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The storage medium can be a read-only memory, a disk or an optical disk, etc.

[0095] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope recorded in the claims.

Claims

1. A security management method based on blockchain, characterized in that: include: Get access request; Perform multi-factor verification on the access request through the verification rules of the smart contract in the blockchain network to obtain a verification result; When the verification result characterizes passing, the access request is allowed to access the corresponding accessible scope, and in the process of accessing the accessible scope, the trust score is determined according to the trust scoring rule of the smart contract; The accessible range is dynamically adjusted according to the trust score.

2. The blockchain-based security management method according to claim 1 is characterized in that: The access request is subjected to multi-factor verification through the verification rules of the smart contract in the blockchain network, and the verification results obtained include: Verify the user name, password, digital certificate, identity token, biometric information and geographic location of the device corresponding to the access request through the verification rules of the smart contract in the blockchain network to obtain a verification result; Wherein, when the user name, the password, the digital certificate, the identity token, the biometric information and the geographic location are all verified, the verification result indicates a pass.

3. The blockchain-based security management method according to claim 1 is characterized in that: In the process of accessing the accessible scope, determining the trust score by the trust score rule of the smart contract includes: In the process of accessing the accessible scope, the behavior factor, the device legitimacy factor, the location factor and the network activity factor are analyzed respectively through the trust scoring rule of the smart contract to determine the behavior score, the legitimacy score, the location score and the network activity score; A trust score is obtained by performing weighted calculation based on the behavior score, the legitimacy score, the location score, and the network activity score using corresponding weight parameters.

4. The blockchain-based security management method according to claim 3 is characterized in that: The dynamically adjusting the accessible range according to the trust score includes: When the trust score is greater than or equal to a first score threshold, maintaining the current accessible scope; When the trust score is greater than a second score threshold and less than a first score threshold, adjusting the accessible scope to non-core resources; When the trust score is less than or equal to a second score threshold, the accessible scope is adjusted to a non-core resource and then reduced, or the accessible scope is adjusted to be empty for isolation.

5. The blockchain-based security management method according to any one of claims 1 to 4, characterized in that: The method further comprises: In the process of accessing the accessible range, determining difference data, synchronizing data using the difference data in the blockchain network through the QUIC protocol, and obtaining synchronization data from the edge server; wherein the blockchain network is deployed based on a 5G private network; When receiving information, determining the priority of the information and processing the information with the highest priority; When the base station of the accessed node is switched or the IP address is changed, the remaining nodes in the blockchain network are notified by real-time broadcast or multicast, and a dynamic domain name is assigned to the node by the dynamic domain name system; When the accessed node switches nodes, the node communication is maintained through connection migration or multipath transmission of the QUIC protocol.

6. The blockchain-based security management method according to claim 5 is characterized in that: The method further comprises: Determining a deployment scenario for the blockchain network; When the deployment scenario is a high-security scenario, the node deployment density of the blockchain network is increased, and an election algorithm and multi-layer identity are used for identity authentication; When the deployment scenario is a low-security scenario, the node deployment density of the blockchain network is reduced, and the CPU scheduling algorithm is used for identity authentication.

7. The blockchain-based security management method according to any one of claims 1 to 4, characterized in that: The method further comprises: Encrypting the adjusted accessible range and the access information of the access request to obtain encrypted log data; The log data is transmitted to the blockchain network for storage.

8. A security management device based on blockchain, characterized in that: include: An acquisition module, used to acquire access requests; A verification module, used to perform multi-factor verification on the access request through the verification rules of the smart contract in the blockchain network to obtain a verification result; A determination module, configured to allow the access request to access the corresponding accessible scope when the verification result characterization passes, and determine the trust score according to the trust score rule of the smart contract during the process of accessing the accessible scope; An adjustment module is used to dynamically adjust the accessible range according to the trust score.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed, the method according to any one of claims 1 to 7 is implemented.

Images