A blockchain-based security management method, device, equipment and storage medium

Abstract

The application provides a blockchain-based security management method, device, equipment and storage medium. The blockchain-based security management method obtains an access request, performs multi-factor verification on the access request through a verification rule of a smart contract in a blockchain network, obtains a verification result, allows the access request to access a corresponding accessible range when the verification result indicates that the access request is passed, and determines a trust score through a trust score rule of the smart contract during the process of accessing the accessible range. The trust score is dynamically adjusted according to the trust score, each access is verified by using the smart contract of the blockchain network which has decentralization, tamper resistance and high transparency, and the trust score is determined by using the smart contract to dynamically adjust the access range, so that the transparency of the permission change and the access is ensured, and the security of the verification process is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication, and in particular to a security management method and device based on a blockchain, an equipment, and a storage medium. BACKGROUND

[0002] With the rapid development of 5G networks, 5G private networks have become key infrastructure in enterprise, industry, medical care, smart city, and other scenarios. A 5G private network provides private network services for different devices and users, and supports high reliability and low latency for key services. However, in order to achieve security management, most network security architectures currently used are based on border defense and single-point trust, which can easily lead to users or devices obtaining excessive permissions after being authenticated, thereby increasing the risk of internal threats. At present, in order to solve the problem of single-point trust, some design schemes re-verify the identity each time a request is made, but there are still challenges in terms of access control transparency, verification process security, and permission changes. SUMMARY

[0003] The embodiments of the present application provide a security management method and device based on a blockchain, an equipment, and a storage medium to solve at least one problem in the related art. The technical solutions are as follows:

[0004] In a first aspect, the embodiments of the present application provide a security management method based on a blockchain, comprising:

[0005] obtaining an access request;

[0006] performing multi-factor authentication on the access request through a verification rule of a smart contract in a blockchain network to obtain a verification result;

[0007] when the verification result indicates that the access request is passed, allowing the access request to access a corresponding accessible range, and determining a trust score through a trust score rule of the smart contract in the process of accessing the accessible range;

[0008] dynamically adjusting the accessible range according to the trust score.

[0009] In an implementation manner, the performing multi-factor authentication on the access request through a verification rule of a smart contract in a blockchain network to obtain a verification result comprises:

[0010] verifying a username, a password, a digital certificate, an identity token, biological information, and a geographical location of a device corresponding to the access request through a verification rule of a smart contract in a blockchain network to obtain a verification result;

[0011] When the username, the password, the digital certificate, the identity token, the biological information, and the geographic location are all verified, the verification result represents passing.

[0012] In an embodiment, the determining a trust score in the process of accessing the accessible range includes:

[0013] In the process of accessing the accessible range, the behavior factor, the device legality factor, the location factor, and the network activity factor are analyzed respectively by the trust score rule of the smart contract to determine a behavior score, a legality score, a location score, and a network activity score.

[0014] According to the behavior score, the legality score, the location score, and the network activity score, a corresponding weight parameter is used for weighted calculation to obtain the trust score.

[0015] In an embodiment, the dynamically adjusting the accessible range according to the trust score includes:

[0016] When the trust score is greater than or equal to a first score threshold, the current accessible range is maintained.

[0017] When the trust score is greater than a second score threshold and less than the first score threshold, the accessible range is adjusted to a non-core resource.

[0018] When the trust score is less than or equal to the second score threshold, the accessible range is adjusted to a non-core resource, and then the accessible range is reduced, or the accessible range is adjusted to empty for isolation.

[0019] In an embodiment, the method further includes:

[0020] In the process of accessing the accessible range, difference data is determined, the difference data is used for data synchronization in a blockchain network based on a 5G private network, and synchronization data is obtained from an edge server; wherein the blockchain network is deployed based on a 5G private network.

[0021] When the information is received, the priority of the information is determined, and the information with the highest priority is processed.

[0022] When the base station of the accessed node is switched or the IP address is changed, the rest of the nodes in the blockchain network are notified through real-time broadcasting or multicasting, and the dynamic domain name system is used to allocate a dynamic domain name for the node.

[0023] When the accessed node performs node switching, the node communication is maintained through connection migration or multi-path transmission of the QUIC protocol.

[0024] In an implementation, the method further comprises:

[0025] determining a deployment scenario of the blockchain network;

[0026] when the deployment scenario is a high-security scenario, increasing a node deployment density of the blockchain network, and performing identity verification by using an election algorithm and a multi-layer identity;

[0027] when the deployment scenario is a low-security scenario, reducing the node deployment density of the blockchain network, and performing identity verification by using a scheduling algorithm of a CPU.

[0028] In an implementation, the method further comprises:

[0029] encrypting the adjusted accessible range and the access information of the access request to obtain encrypted log data;

[0030] transmitting the log data to the blockchain network for storage.

[0031] In a second aspect, an embodiment of the present application provides a security management device based on a blockchain, comprising:

[0032] an acquisition module configured to acquire an access request;

[0033] a verification module configured to perform multi-factor verification on the access request by using a verification rule of a smart contract in a blockchain network, to obtain a verification result;

[0034] a determination module configured to, when the verification result indicates that the access request is allowed to access a corresponding accessible range, determine a trust score by using a trust score rule of the smart contract in a process of accessing the accessible range;

[0035] an adjustment module configured to dynamically adjust the accessible range according to the trust score.

[0036] In an implementation, the security management device based on the blockchain further comprises a management module, which is configured to:

[0037] in the process of accessing the accessible range, determine difference data, perform data synchronization by using the difference data in a blockchain network based on a QUIC protocol, and acquire synchronization data from an edge server; wherein the blockchain network is deployed based on a 5G private network;

[0038] when receiving information, determine a priority of the information, and process information with the highest priority;

[0039] When the base station of the accessed node is switched or the IP address is changed, the rest of the nodes in the blockchain network are notified in real time by broadcasting or multicasting, and the dynamic domain name system is used to assign a dynamic domain name to the node;

[0040] When the accessed node is switched, the node communication is maintained by connection migration or multi-path transmission of the QUIC protocol.

[0041] In an embodiment, the management module is further configured to:

[0042] determine the deployment scenario of the blockchain network;

[0043] when the deployment scenario is a high-security scenario, increase the node deployment density of the blockchain network, and use an election algorithm and multi-layer identity for identity verification;

[0044] when the deployment scenario is a low-security scenario, reduce the node deployment density of the blockchain network, and use a CPU scheduling algorithm for identity verification.

[0045] In an embodiment, the management module is further configured to:

[0046] encrypt the adjusted accessible range and the access information of the access request to obtain encrypted log data;

[0047] transmit the log data to the blockchain network for storage.

[0048] In a third aspect, the embodiments of the present application provide an electronic device, comprising a processor and a memory, the memory storing instructions, the instructions being loaded and executed by the processor to implement the method in any of the embodiments of the above aspects.

[0049] In a fourth aspect, the embodiments of the present application provide a computer readable storage medium, which stores a computer program, and the computer program is executed to implement the method in any of the embodiments of the above aspects.

[0050] The beneficial effects of the above technical solutions at least include:

[0051] By acquiring the access request, the access request is subjected to multi-factor verification through the verification rule of the smart contract in the blockchain network, a verification result is obtained, when the verification result represents passing, the access request is allowed to access the corresponding accessible range, and in the process of accessing the accessible range, the trust score is determined through the trust score rule of the smart contract, the accessible range is dynamically adjusted according to the trust score, each access is verified by the smart contract of the blockchain network which has decentralization, non-tamperability and high transparency, and the dynamic permission adjustment of the accessible range is determined by the trust score of the smart contract, the transparency of the permission change and the access is ensured, and the security of the verification process is ensured.

[0052] The above summary is merely intended to illustrate the present description and is not intended to limit in any way. In addition to the illustrative aspects, embodiments and features described above, further aspects, embodiments and features will be readily apparent to those skilled in the art by reference to the drawings and the following detailed description. BRIEF DESCRIPTION OF DRAWINGS

[0053] In the drawings, like numerals refer to like elements throughout the various drawings. The drawings are not necessarily to scale, the drawings are merely intended to depict some of the embodiments in accordance with the present disclosure and should not be interpreted in any way to limit the scope of the present disclosure.

[0054] Figure 1 A step flow diagram of a blockchain-based security management method according to an embodiment of the present disclosure;

[0055] Figure 2 A schematic diagram of a system architecture according to an embodiment of the present disclosure;

[0056] Figure 3 A block diagram of a blockchain-based security management device according to an embodiment of the present disclosure;

[0057] Figure 4 A block diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0058] In the following, only some exemplary embodiments are described in brief. As those skilled in the art will recognize, the described embodiments can be modified in various different ways without departing from the spirit or scope of the present disclosure. Therefore, the drawings and the description are to be considered as merely illustrative in nature and not restrictive.

[0059] With reference to Figure 1 , a flowchart of a blockchain-based security management method according to an embodiment of the present disclosure is shown, which can at least include steps S100-S400:

[0060] S100, acquire an access request.

[0061] S200, perform multi-factor verification on the access request through a verification rule of a smart contract in a blockchain network to obtain a verification result.

[0062] S300, when the verification result indicates pass, allow the access request to access a corresponding accessible range, and determine a trust score through a trust score rule of the smart contract in the process of accessing the accessible range.

[0063] S400, dynamically adjust the accessible range according to the trust score.

[0064] The technical scheme of the embodiment of the present application acquires an access request, performs multi-factor verification on the access request through a verification rule of a smart contract in a blockchain network to obtain a verification result, when the verification result indicates pass, allows the access request to access a corresponding accessible range, and determines a trust score through a trust score rule of the smart contract in the process of accessing the accessible range, and dynamically adjusts the accessible range according to the trust score. Each access is verified by using the smart contract of the blockchain network which has decentralization, non-tamperability and high transparency, and the dynamic permission adjustment of the accessible range is performed by using the trust score determined by the smart contract, so as to ensure the transparency of the permission change and the access, and the security of the verification process.

[0065] Reference Figure 2The method of the embodiments of the present application can be implemented through a system architecture constructed in advance, which includes but is not limited to an access module, a private blockchain network (several nodes, a smart contract module (referred to as a smart contract)) deployed based on a 5G private network, a zero-trust control module (including a dynamic trust score module and a permission control module), and an edge module (including an edge node and an edge server). The access module is used to verify the result of access, and then connect the device of the user to the 5G private network. The zero-trust control module is the core of the security decision of the whole network, and is responsible for real-time verification of the identity and behavior of all devices and users, and execution of a dynamic permission control strategy. The zero-trust gateway deployed in the edge cloud server is a key component of the zero-trust architecture, and is responsible for the access request of external devices and users, and strict security management and control. The zero-trust gateway first verifies the identity of the external visitor through the blockchain network, and then audits the permission of the external visitor through the smart contract, determines the accessible range, and adjusts the access permission in real time based on the evaluation result of the dynamic trust score module, to ensure the security of the 5G private network. Therefore, the zero-trust gateway and the zero-trust control module work together to ensure the safety and controllability of the whole process from external access to internal management. The zero-trust gateway, as the first line of defense of the network, is responsible for the preliminary identity verification and access control of external devices and users, to prevent unauthorized access. The zero-trust control module, located inside the network, continuously monitors and manages the devices and users that have accessed, dynamically adjusts the permissions of the devices and users, ensures the internal security, ensures that the external devices or users entering the private network are strictly reviewed, and all network boundary activities are recorded on the blockchain network.

[0066] In an embodiment, the user and the device first register by using password, username, biometric information and the like, to generate corresponding digital certificates, identity tokens and the like. The username and the password are generated and stored through an encryption hash algorithm to ensure security. The digital certificate is generated based on a public key infrastructure (PKI) to provide a trusted identity authentication for a high-security scenario. The identity token is a single-time verification token generated dynamically to enhance the security of user login. When the registration is successful, the user and the device access the private blockchain network deployed based on the 5G private network through the access module. The user and the device act as nodes of the blockchain network to participate in the operation of the network. The password, the username, the biometric information, the digital certificate, the identity token and the like are recorded in the smart contract of the blockchain network. The smart contract stores trust score rules, verification rules and the like, and manages the related information of the user and the device, the allocation of access permissions (such as the accessible range), log data and the like, to ensure the transparency and non-tamperability of the data.

[0067] In an embodiment, when the user and the device attempt to access the blockchain network, the user can initiate an access request with the device, the zero-trust gateway obtains the access request and sends it to the blockchain network, and the access request is verified by the verification rules of the smart contract of the blockchain network to verify the identity. It should be noted that the zero-trust control module does not rely on a single trust point, and each time an access request is obtained, multi-factor authentication is performed again to ensure security.

[0068] In an embodiment, step S200 is specifically:

[0069] The username, password, digital certificate, identity token, biometric information, and geographic location of the device corresponding to the access request are verified by the verification rules of the smart contract in the blockchain network to obtain a verification result.

[0070] Specifically, the zero-trust control module uses the verification rules of the smart contract in the blockchain network to verify the username, password, digital certificate, identity token, biometric information, and geographic location of the device corresponding to the access request, respectively, to obtain a verification result. The smart contract stores the behavior information of the user and the device each time, so it stores the commonly used geographic location (determined based on the IP address), and if the current geographic location is different from the commonly used geographic location, it is an abnormal change, prompting the user to re-verify the above-mentioned factors other than the geographic location. When all these factors are verified, the verification result is passed.

[0071] It should be noted that when the username, password, digital certificate, identity token, biometric information, and geographic location are all verified, the verification result is passed, and when at least one of the username, password, digital certificate, identity token, biometric information (such as fingerprint or face), and geographic location is not verified, the verification result is not passed. When the verification is passed, a new block can be generated, the new block is synchronized in the blockchain network, all nodes update the data to maintain consistency, and the access request, verification result, etc. are recorded in the blockchain network, and the verification result is fed back to the zero-trust gateway to determine whether to allow access.

[0072] In an embodiment, in step S300, the smart contract pre-configures and stores the accessible range corresponding to each user and device, and the access request is audited based on the pre-stored accessible range of the smart contract. The pre-stored accessible range is pre-allocated based on the user role, device type, and sensitivity of network resources, so when the verification result is passed, the smart contract can determine the accessible range corresponding to the access request, allow the access request to access the corresponding accessible range, and allow the user and the device to access within the accessible range.

[0073] It should be noted that the sensitivity of network resources can be divided based on confidentiality, integrity and availability. Confidentiality: resources handling personal privacy data or enterprise confidential information are considered highly sensitive, access is strictly controlled. Integrity: if the network resource involves critical business processes, tampering is prevented and limited to strictly reviewed users and devices. Availability: relatively insensitive data resources or public information, access can be relatively relaxed, allowing more users and devices to access.

[0074] In an embodiment, in the process of accessing the accessible range in step S300, the trust score is determined by the trust score rule of the smart contract, including steps S310-S320:

[0075] S310, in the process of accessing the accessible range, the behavior factor, the device legality factor, the location factor and the network activity factor are analyzed respectively by the trust score rule of the smart contract, and the behavior score, the legality score, the location score and the network activity score are determined.

[0076] Optionally, in the process of accessing the accessible range by the user, the dynamic trust score module of the zero trust control module constantly monitors the relevant information of the user (and the device used by the user) in real time, and then analyzes the behavior factor, the device legality factor, the location factor and the network activity factor in the relevant information by using the trust score rule of the smart contract, so as to correspondingly determine the behavior score, the legality score, the location score and the network activity score.

[0077] For example, the basic scores corresponding to the behavior factor, the device legality factor, the location factor and the network activity factor under normal circumstances can be set in advance; when the behavior factor such as the login time and operation frequency of the user does not conform to the historical behavior of the user, such as a sudden large amount of data request or login at an irregular time, it is considered that there is abnormal operation, at this time the basic score corresponding to the behavior factor will be reduced, and the smart contract will trigger a risk alarm; when the location factor such as out-of-town login, rarely used IP address, unauthorized IP address login (for example, the user usually operates in China, but suddenly logs in from abroad), the basic score corresponding to the location factor will be reduced; when the device legality factor such as at least one of the fingerprint information of the device, the operating system version or the network interface is different from that stored in the smart contract, indicating that there is a problem in legality and consistency, the basic score corresponding to the network activity factor will be reduced; when the network activity factor such as sudden large-scale data transmission leading to dramatic increase in data traffic, frequent sensitive resource access request, too high data transmission frequency, etc., the basic score corresponding to the network activity factor will be reduced. It can be understood that when at least one of the corresponding behavior factor, device legality factor, location factor and network activity factor is determined to return to the normal state based on the real-time monitoring of the relevant information, the reduced basic score will be increased again.

[0078] In some embodiments, if at least one of the base scores corresponding to the behavior factor, the device legitimacy factor, the location factor and the network activity factor decreases, the user's access to the core resources (sensitive resources) can be directly restricted, i.e., the accessible range is adjusted to non-core resources, and additional identity verification is required, and an alarm event or re-verification is triggered, waiting for the administrator to intervene in the review.

[0079] Wherein the degree of decrease and increase of the base score is determined based on the degree of deviation / abnormality of the behavior factor, the device legitimacy factor, the location factor and the network activity factor, respectively. The greater the degree of deviation / abnormality, the higher the degree of decrease. For example, for a slight geographical location deviation, such as being in the same country but different provinces, the base score decreases by 10% to 15%; if the device suddenly appears in a highly abnormal geographical location (such as remote login from abroad), the trust score decreases by 30% to 50%; data transmission frequency anomaly: if the network activity of the device shows a frequency fluctuation that does not conform to the historical behavior pattern, for a slight fluctuation, the trust score decreases by 5% to 10%; and for frequent and large fluctuations, the score decreases by 15% to 20%.

[0080] It should be noted that the zero trust control module focuses on the real-time security state of the device and the user for evaluation and permission management, while the blockchain network verifies the integrity of the data and the legality of the transaction; the permission control module of the zero trust control module synchronizes data with the smart contract of the blockchain network regularly to dynamically adjust the device permissions, and each adjustment of the permissions is automatically executed through the smart contract.

[0081] S320, according to the behavior score, the legitimacy score, the location score and the network activity score, the corresponding weight parameters are used for weighted calculation to obtain a trust score.

[0082] Then, the trust score rule of the smart contract also has weight parameters corresponding to different scores preset according to actual needs, so that the dynamic trust score module of the zero trust control module can use the corresponding weight parameters to perform weighted calculation according to the behavior score, the legitimacy score, the location score and the network activity score to obtain a comprehensive trust score.

[0083] In one embodiment, step S400 includes steps S410-S430:

[0084] S410, when the trust score is greater than or equal to a first score threshold, the current accessible range is maintained.

[0085] Optionally, when the trust score is greater than or equal to the first score threshold, for example, the first score threshold is 80, which corresponds to a score range of 80-100, representing a high trust level, the operating environment is safe, and at this time the permission control module of the zero trust control module does not adjust the current accessible range, and the user can access most resources, including company internal confidential files, financial data and other sensitive data.

[0086] S420, when the trust score is greater than the second score threshold and less than the first score threshold, adjust the accessible range to non-core resources.

[0087] Optionally, when the trust score is greater than the second score threshold and less than the first score threshold, for example, greater than 49 and less than 80, which corresponds to a score range of 50-79, which corresponds to a medium trust level, at this time the permission control module of the zero trust control module adjusts the accessible range to non-core resources, prohibits the user's device from accessing non-core resources, and triggers a warning event, the permission will be limited and cannot access sensitive data, but can access general business systems.

[0088] S430, when the trust score is less than or equal to the second score threshold, adjust the accessible range to non-core resources and reduce the accessible range, or adjust the accessible range to empty to isolate.

[0089] Optionally, when the trust score is less than or equal to the second score threshold, which corresponds to a score range of 0-49, a low trust level, a serious anomaly or a high-risk operation, the permission control module of the zero trust control module adjusts the accessible range to non-core resources, further reduces the accessible range, and can only perform basic operations, or the permission control module directly adjusts the accessible range to empty to isolate the user's device, isolate the suspicious device, and ensure safety until the security problem is solved.

[0090] In an embodiment, the blockchain-based security management method of the embodiment of the present application can further include steps S510-S540:

[0091] S510, in the process of accessing the accessible range, determine the difference data, synchronize the data in the blockchain network through the QUIC protocol using the difference data, and obtain the synchronization data from the edge server.

[0092] In the embodiment of the present application, the blockchain network deployed by the 5G private network is different from the existing blockchain network. The deployment of the existing blockchain is mostly based on the Internet or local area network environment, while the 5G private network has the characteristics of high bandwidth, low delay and high concurrency. In order to adapt to these characteristics, the communication protocol and data synchronization mechanism of the nodes in the blockchain network are optimized, so that the nodes can quickly process and record the data flow in the 5G private network, and ensure the efficient operation of the blockchain system.

[0093] Specifically, for the characteristics of low latency and high concurrency of the 5G private network, a lightweight and efficient communication protocol such as a UDP-based transmission protocol (QUIC) is designed to replace the traditional TCP to reduce transmission delay and improve throughput, reduce handshake steps, compress message formats, and reduce protocol costs.

[0094] Optionally, in the process of accessing the accessible range, when data synchronization of the node is required, in order to avoid bandwidth waste caused by full data transmission, the difference data of the node itself since the last synchronization is determined, and then the difference data is used for data synchronization in the blockchain network through the QUIC protocol; wherein the synchronization data of the node can be stored and shared by means of the edge computing node (referred to as edge node) of the 5G network, so that the node can obtain real-time synchronization data of other nodes from the edge server, reducing the load of the core node.

[0095] In some embodiments, sharding synchronization can also be implemented, for example, by using the high concurrency characteristics of the 5G private network, a number of nodes are sharded, so that the data is synchronized when the sharding is synchronized, improving the efficiency of large-scale node data synchronization.

[0096] S520, when receiving the information, determining the priority of the information, and processing the information with the highest priority.

[0097] In the embodiments of the application, the blockchain network is provided with dynamic priority management, when the node receives information, the priority of the current information is determined based on the priority of different types of information preset in the smart contract, and then the information with the highest priority is processed. For example, different types of information such as transaction requests and consensus messages can be respectively preset with corresponding priorities, so as to determine the order of processing.

[0098] S530, when the base station of the accessed node is switched or the IP address is changed, the remaining nodes in the blockchain network are notified through real-time broadcast or multicast, and the dynamic domain name system is used to allocate a dynamic domain name for the node.

[0099] The blockchain network of the embodiments of the application also provides mobility support for the node. Unlike the existing blockchain network in which the nodes are mostly fixed, the devices in the 5G private network have strong mobility. By introducing a node management mechanism that supports dynamic IP addresses, it is ensured that the device can still participate in the blockchain network when switching between different base stations.

[0100] Specifically, when the base station of the accessed node is switched or the IP address is changed, the remaining nodes in the blockchain network are notified through real-time broadcast or multicast, and the dynamic domain name system (DDNS) is used to allocate a dynamic domain name for the node, so that the node can be quickly located through the domain name when the node position changes.

[0101] S540, when the accessed node performs node switching, the node communication is maintained through connection migration or multi-path transmission of the QUIC protocol.

[0102] Optionally, in the blockchain network of the embodiments of the present application, when the accessed node performs node switching, the node communication is maintained through the use of the session maintenance function of the transport layer (such as connection migration of the QUIC protocol) or multi-path transmission (such as MPTCP), ensuring seamless switching between the new and old nodes, reducing the delay, and ensuring uninterrupted communication.

[0103] In the embodiments of the present application, the blockchain network monitors the state of the node in real time through the heartbeat detection mechanism, automatically updates the position and state of the node in the blockchain network when the node switches the base station, supports fast recovery of the last interrupted data synchronization state when the node is offline for a short time, and uses the dynamic IP address and the encrypted token bound to the identity for authentication based on the Token identity authentication after the node switches, ensuring that the node can still be quickly verified for its legality after moving. The temporary data of the storage device (such as a mobile device) in the edge node is stored, ensuring that the mobile node can quickly recover to normal work and synchronize the data such as the unfinished transaction records during the switching period.

[0104] In the embodiments of the present application, based on the distributed characteristics of the blockchain network, the access control logic is dispersed to different nodes, each blockchain node has the ability to independently verify the device and user authority, reduces the dependence on the centralized system, and enhances the flexibility and security of the system; part of the access control logic can also be decentralized to the edge computing nodes, which can independently process the access request of the access device according to the smart contract on the blockchain network, reduce the delay in the network, and improve the efficiency of the authority verification.

[0105] In the embodiments of the present application, the access control logic is dispersed to the nodes, the same smart contract is deployed to each node, which is responsible for performing the authority verification of the user and the device, and the smart contract contains the authority allocation, dynamic adjustment of the accessible range, trust score rules and verification rules, which can ensure that each node can independently perform the authority audit when receiving the access request; the data synchronization mechanism: through the consensus mechanism of the blockchain network, the data of all nodes is kept synchronized, ensuring that the access control logic executed by each node is consistent, and such a synchronization mechanism enables other nodes to continue to undertake the verification task when any node fails, without affecting the security and function of the entire network; the local processing of the access request, when the device issues an access request, the system will first perform multi-factor authentication in the node closest to the user (such as the edge node), reducing the delay and improving the response speed. In this way, the logic dispersion enables the entire system framework to have efficient local processing capability, improving the overall performance.

[0106] It should be noted that although each node of the blockchain network has the ability to independently verify the device and user authority, the verification capabilities of different nodes may differ depending on the type of node and the network location, and the differences between nodes mainly manifest in the following aspects:

[0107] Edge nodes: usually close to users, responsible for handling preliminary verification of users and devices and management of part of access permissions, the processing capability of edge nodes is relatively weak, mainly used for processing low-sensitivity data and responding to user requests quickly, the permission verification capability of edge nodes is relatively basic, suitable for processing local and low-complexity requests. Therefore, correspondingly, the edge node role: responsible for the identity verification of local devices, permission management and low-latency response operations, these nodes can cache part of the smart contract data locally and synchronize with the core nodes to ensure the accuracy of permission verification, the permission verification capability of these nodes is relatively limited, mainly for non-core system resources.

[0108] Core nodes: located in the center of the network, with stronger computing power and higher permission management capability, core nodes usually handle access requests involving high-sensitivity data, such as access involving the core business of a company, core nodes are also responsible for cross-node permission verification coordination and management of complex permission adjustment operations. Therefore, correspondingly, the core node role: responsible for managing high-level permission operations of the entire network and data flow within the system, core nodes not only can verify the identity of devices, but also can dynamically adjust cross-regional permissions, handle high-complexity operation requests, and can perform more stringent security reviews on the system.

[0109] In an implementation, the blockchain-based security management method of the embodiment of the present application can further include steps S610-S630:

[0110] S610, determine the deployment scenario of the blockchain network.

[0111] The blockchain network of the embodiment of the present application is based on 5G network slicing technology, and is deployed according to different network slicing segments. The deployment density and verification mechanism of the blockchain nodes can be different for the needs of different businesses, and can meet individual needs. For example, the deployment scenarios include but are not limited to high-security scenarios (such as industrial internet) and low-security scenarios (such as Internet of Things and other ordinary business scenarios), and the high-security scenarios and low-security scenarios can be set as needed.

[0112] S620, when the deployment scenario is a high-security scenario, increase the node deployment density of the blockchain network, and use an election algorithm and multi-layer identity for identity verification.

[0113] Optionally, when the deployment scenario is a high-security scenario, the node deployment density can be increased to form a tighter blockchain network, improve fault tolerance and data reliability, for example, on the basis of the number of benchmark nodes, the number of nodes in the corresponding slice area of the deployment scenario is further increased. Then, a more stringent election algorithm (such as PBFT) and multi-layer identity authentication are used to improve data consistency and security, increase block size limits, prevent data abuse, and ensure data integrity and non-tamperability. For example, multi-layer identity includes but is not limited to password, verification code, phone number, ID number, etc., without specific limitation.

[0114] S630, when the deployment scenario is a low-security scenario, the node deployment density of the blockchain network is reduced, and the scheduling algorithm of the CPU is used for identity authentication.

[0115] Optionally, when the deployment scenario is a low-security scenario, the node deployment density of the blockchain network can be reduced, for example, on the basis of the number of benchmark nodes, the number of nodes in the corresponding slice area of the deployment scenario is further reduced, the deployment and maintenance cost is reduced, and part of the decision-making is appropriately sacrificed to optimize the performance. Then, the scheduling algorithm of the CPU (such as DPoS) can be used for identity authentication to improve the throughput, appropriately relax the identity authentication requirements, reduce the network burden, and use a more flexible block generation frequency to balance efficiency and security.

[0116] In an embodiment, the security management method based on the blockchain of the application can further include steps S710-S720:

[0117] S710, the adjusted accessible range and the access information of the access request are encrypted to obtain encrypted log data.

[0118] S720, the log data is transmitted to the blockchain network for storage.

[0119] Optionally, in the embodiment of the application, the non-tamperability of the blockchain is used to ensure that the relevant data of each node, such as permission change (adjusted accessible range), access information of each access request (including device information (such as device state change), user information, user operation), traffic management, warning event, real-time monitoring and collection data, etc. can be transparently recorded to support subsequent audit and traceability, so all related data are encrypted to obtain encrypted log data. Then, the encrypted log data is transmitted to the blockchain network for verification and storage to prevent any unauthorized operation or potential attack and ensure the security and integrity of the data.

[0120] The embodiment of the application is based on a blockchain network and a zero-trust security framework of a 5G private network, uses the decentralization and non-tamperability of the blockchain technology, combines the zero-trust security framework, ensures that each access request in the 5G private network is verified, recorded and managed by a smart contract, constructs a distributed and non-tamperable security management mechanism, manages device access, user identity verification, dynamic trust scoring and permission management of the 5G private network through a private blockchain network, ensures the legality and security of each access request, and improves the security, transparency and management flexibility of devices and users in the private network. In addition, the distributed blockchain network avoids the performance bottleneck of centralized permission management and adapts to the high concurrency and multi-device environment of the 5G private network; the blockchain network records all related information and supports subsequent security audit and behavior traceability.

[0121] Reference Figure 3 The structure block diagram of the security management device based on the blockchain is shown, and the device can include:

[0122] The acquisition module is configured to acquire an access request.

[0123] The verification module is configured to perform multi-factor verification on the access request through a verification rule of a smart contract in the blockchain network to obtain a verification result.

[0124] The determination module is configured to allow the access request to access a corresponding accessible range when the verification result indicates that the access request is passed, and determine a trust score through a trust scoring rule of the smart contract during the access to the accessible range.

[0125] The adjustment module is configured to dynamically adjust the accessible range according to the trust score.

[0126] In an embodiment, the security management device based on the blockchain further includes a management module, and the management module is configured to:

[0127] During the access to the accessible range, the management module is configured to determine difference data, synchronize data through the difference data in the blockchain network through a QUIC protocol, and acquire synchronization data from an edge server; and the blockchain network is deployed based on the 5G private network.

[0128] When the information is received, the management module is configured to determine a priority of the information and process information with the highest priority.

[0129] When a base station of the accessed node is switched or an IP address of the accessed node is changed, the management module is configured to notify the remaining nodes in the blockchain network through real-time broadcasting or multicasting, and assign a dynamic domain name to the node through a dynamic domain name system.

[0130] When the accessed node is switched, the management module is configured to maintain node communication through connection migration or multi-path transmission of the QUIC protocol.

[0131] In an implementation, the management module is further configured to:

[0132] determine a deployment scenario of the blockchain network;

[0133] when the deployment scenario is a high-security scenario, increase a node deployment density of the blockchain network, and perform identity verification by using an election algorithm and a multi-layer identity;

[0134] when the deployment scenario is a low-security scenario, reduce the node deployment density of the blockchain network, and perform identity verification by using a CPU scheduling algorithm.

[0135] In an implementation, the management module is further configured to:

[0136] encrypt the adjusted accessible range and the access information of the access request to obtain encrypted log data;

[0137] transmit the log data to the blockchain network for storage.

[0138] The functions of each module in each device in the embodiments of the present application can be referred to the corresponding description in the above method, which will not be repeated here.

[0139] Referring to Figure 4 , a structural block diagram of an electronic device according to an embodiment of the present application is shown, which includes a memory 310 and a processor 320. The memory 310 stores instructions executable on the processor 320, and the processor 320 loads and executes the instructions to implement the blockchain-based security management method in the above embodiments. The number of the memory 310 and the processor 320 can be one or more.

[0140] In an implementation, the electronic device further includes a communication interface 330 for communicating with external devices to perform data interaction transmission. If the memory 310, the processor 320 and the communication interface 330 are independently implemented, the memory 310, the processor 320 and the communication interface 330 can be connected to each other through a bus and complete communication therebetween. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus.

[0141] Optionally, in a specific implementation, if the memory 310, the processor 320 and the communication interface 330 are integrated on a chip, the memory 310, the processor 320 and the communication interface 330 can complete the communication among each other through an internal interface.

[0142] The embodiment of the application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the blockchain-based security management method provided in the above embodiment.

[0143] The embodiment of the application further provides a chip, which comprises a processor, is used for calling and running instructions stored in a memory, and makes a communication device installed with the chip execute the method provided in the embodiment of the application.

[0144] The embodiment of the application further provides a chip, which comprises an input interface, an output interface, a processor and a memory, and the input interface, the output interface, the processor and the memory are connected through an internal connection path. The processor is used for executing code in the memory, and when the code is executed, the processor is used for executing the method provided in the embodiment of the application.

[0145] It should be understood that the processor described above can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc. It should be noted that the processor can be a processor supporting an advanced RISC machine (ARM) architecture.

[0146] Further, the aforementioned memory can include a read-only memory, and a random access memory, and can further include a non-volatile random access memory. The memory can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memory. The non-volatile memory can include a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically EPROM (EEPROM), or a flash memory. The volatile memory can include a random access memory (RAM), which functions as an external cache. Many forms of RAM are available, by way of example and not limitation. For example, a static RAM (SRAM), a dynamic RAM (DRAM), a synchronous DRAM (SDRAM), a double data rate synchronous DRAM (DDR SDRAM), an enhanced SDRAM (ESDRAM), a synchlink DRAM (SLDRAM), and a direct rambus RAM (DR RAM) can be used.

[0147] In the above-described embodiments, all or part of the embodiments can be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to the present disclosure are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable apparatus. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium.

[0148] In the description of the application, the description of the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the application. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in one or more embodiments or examples. In addition, different embodiments or examples described in the specification and the features of different embodiments or examples can be combined and combined by those skilled in the art without contradiction, if necessary.

[0149] In addition, the terms "first", "second" are only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the application, the meaning of "multiple" is two or more, unless otherwise specifically limited.

[0150] Any process or method descriptions in flow charts or described elsewhere herein can be understood as representing code modules, segments, or portions of code that include one or more executable instructions for implementing specific logic functions or other processes. And the various embodiments of the application can include additional or fewer steps or processes in comparison to those shown in the figures.

[0151] The logic and / or steps represented in flow charts or otherwise described herein, for example, can be embodied in computer-readable instructions, which can be used to cause one or more processors to perform the actions indicated in the steps. The computer-readable instructions can be stored on one or more storage media or memory devices associated with the one or more processors.

[0152] It should be understood that parts of the application can be implemented in hardware, software, firmware or a combination thereof. In the above-described embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the above-described embodiment method can be instructed by the relevant hardware through a program, which can be stored in a computer-readable storage medium, and the program includes one or a combination of the steps of the method embodiment when executed.

[0153] In addition, each of the function units in each embodiment of the present application can be integrated in one processing module, or each unit can be physically present separately, or two or more units can be integrated in one module. The integrated module can be realized in the form of hardware or in the form of a software function module. When the integrated module is realized in the form of a software function module and sold or used as an independent product, it can also be stored in a computer readable storage medium. The storage medium can be a read-only memory, a magnetic disk or an optical disk, etc.

[0154] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of various changes or replacements within the technical scope disclosed in the present application, and these should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope recorded in the claims.

Claims

1. A blockchain-based security management method, characterized by, The method comprises: acquiring an access request; performing multi-factor verification on the access request through a verification rule of a smart contract in a blockchain network to obtain a verification result; when the verification result indicates passing, allowing the access request to access a corresponding accessible range, and in the process of accessing the accessible range, determining a trust score through a trust score rule of the smart contract, specifically comprising: in the process of accessing the accessible range, respectively analyzing a behavior factor, a device legality factor, a location factor and a network activity factor through the trust score rule of the smart contract to determine a behavior score, a legality score, a location score and a network activity score; performing weighted calculation on the behavior score, the legality score, the location score and the network activity score by using corresponding weight parameters to obtain the trust score; wherein the behavior factor, the device legality factor, the location factor and the network activity factor are all preset basic scores under normal circumstances, and when any one of the behavior factor, the device legality factor, the location factor and the network activity factor is not normal, the basic score of the corresponding factor is reduced; dynamically adjusting the accessible range according to the trust score, specifically: when the trust score is greater than or equal to a first score threshold, keeping the current accessible range; when the trust score is greater than a second score threshold and less than the first score threshold, adjusting the accessible range to non-core resources; when the trust score is less than or equal to the second score threshold, adjusting the accessible range to non-core resources and then reducing the accessible range or adjusting the accessible range to empty to isolate; or, as long as any basic score is reduced, adjusting the accessible range to non-core resources. 2.The blockchain-based security management method of claim 1, wherein: The method further comprises: performing multi-factor verification on the access request through a verification rule of a smart contract in a blockchain network to obtain a verification result; verifying the username, the password, the digital certificate, the identity token, the biological information and the geographic location corresponding to the access request through the verification rule of the smart contract in the blockchain network to obtain the verification result; 3.The blockchain-based security management method of any one of claims 1-2, wherein: wherein when the username, the password, the digital certificate, the identity token, the biological information and the geographic location are all verified, the verification result indicates passing. The method further comprises: in the process of accessing the accessible range, determining difference data, using the difference data to perform data synchronization in the blockchain network through a QUIC protocol, and obtaining synchronization data from an edge server; wherein the blockchain network is deployed based on a 5G private network; when receiving information, determining the priority of the information, and processing the information with the highest priority; when the base station of the accessed node is switched or the IP address is changed, notifying the remaining nodes in the blockchain network through real-time broadcasting or multicasting, and assigning a dynamic domain name to the node through a dynamic domain name system; 4.The blockchain-based security management method of claim 3, wherein: when the accessed node performs node switching, maintaining node communication through connection migration or multi-path transmission of the QUIC protocol. The method further comprises: determining the deployment scenario of the blockchain network; When the deployment scenario is a high-security scenario, the node deployment density of the blockchain network is increased, and an election algorithm and multi-layer identity are used for identity verification; When the deployment scenario is a low-security scenario, the node deployment density of the blockchain network is reduced, and a scheduling algorithm of the CPU is used for identity verification. 5.The blockchain-based security management method of any one of claims 1-2, wherein: The method further comprises: encrypting the adjusted accessible range and the access information of the access request to obtain encrypted log data; transmitting the log data to the blockchain network for storage. 6.A blockchain-based security management apparatus, characterized by, Comprise: an acquisition module, configured to acquire an access request; a verification module, configured to perform multi-factor verification on the access request through a verification rule of a smart contract in a blockchain network to obtain a verification result; a determination module, configured to allow the access request to access a corresponding accessible range when the verification result indicates passing, and determine a trust score through a trust score rule of the smart contract in the process of accessing the accessible range, specifically comprising: analyzing a behavior factor, a device legality factor, a location factor and a network activity factor through the trust score rule of the smart contract to determine a behavior score, a legality score, a location score and a network activity score in the process of accessing the accessible range; performing weighted calculation on the behavior score, the legality score, the location score and the network activity score by using corresponding weight parameters to obtain the trust score; wherein the behavior factor, the device legality factor, the location factor and the network activity factor are all preset basic scores under normal circumstances, and the basic score of any one of the behavior factor, the device legality factor, the location factor and the network activity factor is reduced when the corresponding factor is not in the normal circumstance; an adjustment module, configured to dynamically adjust the accessible range according to the trust score, specifically: when the trust score is greater than or equal to a first score threshold, the current accessible range is maintained; when the trust score is greater than a second score threshold and less than the first score threshold, the accessible range is adjusted to a non-core resource; and when the trust score is less than or equal to the second score threshold, the accessible range is adjusted to a non-core resource, and then the accessible range is reduced or the accessible range is adjusted to empty for isolation; or, as long as any basic score is reduced, the accessible range is adjusted to a non-core resource.

7. An electronic device, comprising: Comprise: a processor and a memory, the memory stores instructions, the instructions are loaded and executed by the processor to implement the method of any one of claims 1-5.

8. A computer readable storage medium, the computer readable storage medium stores a computer program, the computer program is executed to implement the method of any one of claims 1-5.

Images