Data access processing method and device

Abstract

The embodiment of the invention provides a data access processing method and device, and the method comprises the steps: reading a user attribute voucher of a user according to a data access request of the user, and then transmitting the data access request and the user attribute voucher to a block chain node, and the block chain node performs access admission detection according to an access control strategy corresponding to the data access request and the user attribute certificate, finally receives a data storage address returned by the block chain node after the detection is passed, and decrypts encrypted data corresponding to the data storage address based on a user private key to obtain access data. Therefore, when user data access is carried out, fine-grained access control can be carried out on the user based on the user attribute information, and a safer, more efficient and user-friendly identity identification method is provided for data access.

Description

Technical Field

[0001] This document relates to the field of data processing, and in particular to a data access processing method and device. Background Art

[0002] With the continuous development of Internet technology and the continuous advancement of social information, in order to simplify the identity authentication process for data access, more and more SIM card managers have begun to use smart contracts to implement identity authentication on the blockchain. Blockchain technology is considered to be an ideal choice for improving identity security due to its decentralized, tamper-proof and transparent characteristics. However, although blockchain technology provides a decentralized method for storing user information, in practical applications, how to effectively manage and verify user identity information remains a challenge; Existing technical solutions still rely on traditional authentication methods, such as username and password, SMS verification code or biometric technology. These methods have multiple disadvantages, including being vulnerable to security threats such as phishing attacks, man-in-the-middle attacks and replay attacks. In addition, traditional methods usually require a centralized identity authentication server, which may become a single point of failure for attacks and pose a risk of data leakage. Summary of the invention

[0003] An embodiment of the present specification aims to provide a data access processing method and device to solve the problem of low efficiency and poor security of identity authentication during data access.

[0004] To solve the above technical problems, an embodiment of this specification is implemented as follows: In a first aspect, an embodiment of the present specification provides a data access processing method, which is applied to a server, and the method includes: Reading a user attribute credential of the user according to a data access request of the user; the user attribute credential is generated by an attribute-based encryption system based on user attribute information of the user; Sending the data access request and the user attribute certificate to a blockchain node; the blockchain node performs access permission detection according to the access control policy corresponding to the data access request and the user attribute certificate; Receive the data storage address returned by the blockchain node after the detection is passed, and decrypt the encrypted data corresponding to the data storage address based on the user private key to obtain access data; the user private key is generated by the attribute-based encryption system based on the preset master key and the user attribute information.

[0005] In a second aspect, another embodiment of this specification provides a data access processing method, which is applied to a blockchain node, and the method includes: Receiving a data access request and a user attribute credential of a user sent by a server; the user attribute credential is generated by an attribute-based encryption system based on user attribute information of the user; Calling and executing a smart contract to perform access permission detection according to the access control policy corresponding to the data access request and the user attribute credential; If the detection passes, the data storage address obtained by executing the smart contract is returned to the server, and the server decrypts the encrypted data corresponding to the data storage address based on the user's private key to obtain access data; the user's private key is generated by the attribute-based encryption system based on the preset master key and the user's attribute information.

[0006] In a third aspect, an embodiment of the present specification provides a data access processing device, which runs on a server, and the device includes: A credential reading module is configured to read a user attribute credential of the user according to a data access request of the user; the user attribute credential is generated by an attribute-based encryption system based on the user attribute information of the user; The credential sending module is configured to send the data access request and the user attribute credential to the blockchain node; the blockchain node performs access permission detection according to the access control policy corresponding to the data access request and the user attribute credential; The data decryption module is configured to receive the data storage address returned by the blockchain node after the detection is passed, and decrypt the encrypted data corresponding to the data storage address based on the user private key to obtain access data; the user private key is generated by the attribute-based encryption system based on a preset master key and the user attribute information.

[0007] In a fourth aspect, another embodiment of the present specification provides a data access processing device, which runs on a blockchain node, and the device includes: A credential receiving module is configured to receive a user's data access request and a user attribute credential sent by a server; the user attribute credential is generated by an attribute-based encryption system based on the user attribute information of the user; An access detection module is configured to call and execute a smart contract to perform access access detection according to an access control policy corresponding to the data access request and the user attribute credential; If the detection passes, the address return module is run. The address return module is configured to return the data storage address obtained by executing the smart contract to the server if the detection passes. The server decrypts the encrypted data corresponding to the data storage address based on the user private key to obtain access data; the user private key is generated by the attribute-based encryption system based on the preset master key and the user attribute information.

[0008] In a fifth aspect, an embodiment of the present specification provides a data access processing device running on a server, the device comprising: a memory, a processor, and computer executable instructions stored on the memory and executable on the processor, the computer executable instructions, when executed by the processor, implement the steps of the data access processing method described in the first aspect above.

[0009] In the sixth aspect, another embodiment of the present specification provides a data access processing device running on a blockchain node, the device comprising: a memory, a processor, and computer executable instructions stored on the memory and executable on the processor, and the computer executable instructions, when executed by the processor, implement the steps of the data access processing method as described in the second aspect above.

[0010] In a seventh aspect, an embodiment of the present specification provides a computer-readable storage medium that runs on a server, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the steps of the data access processing method described in the first aspect above are implemented.

[0011] In the eighth aspect, another embodiment of the present specification provides a computer-readable storage medium, which runs on a blockchain node, and the computer-readable storage medium is used to store computer-executable instructions, which, when executed by a processor, implement the steps of the data access processing method described in the second aspect above.

[0012] In a ninth aspect, an embodiment of the present specification provides a computer program product that runs on a server, wherein the computer program product includes a data access processing program that is executed by a processor to implement the steps of the data access processing method described in the first aspect above.

[0013] In the tenth aspect, another embodiment of the present specification provides a computer program product that runs on a blockchain node, wherein the computer program product includes a data access processing program, and the data access processing program is executed by a processor to implement the steps of the data access processing method described in the second aspect above.

[0014] A data access processing method provided in this embodiment first reads the user attribute certificate of the user according to the user's data access request, and then sends the data access request and the user attribute certificate to the blockchain node, so that the blockchain node can perform access permission detection according to the access control policy and the user attribute certificate corresponding to the data access request, and finally receives the data storage address returned by the blockchain node after the detection is passed, and decrypts the encrypted data corresponding to the data storage address based on the user's private key to obtain the access data, so that when the user accesses the data on the blockchain, the access control policy in the smart contract can be used to perform fine-grained access control on the user. On the one hand, the access control policy is automatically executed with the help of the smart contract, thereby improving the efficiency of access control. On the other hand, it ensures that only users who meet the access control policy can decrypt and access the data, thereby protecting data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in one or more embodiments of the present specification, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0016] Figure 1 A processing flow chart of a data access processing method provided by one embodiment of this specification; Figure 2 A processing flow chart of a data access processing method applied to a SIM card data access scenario provided by one embodiment of this specification; Figure 3 A processing flow chart of a data access processing method provided by one embodiment of this specification; Figure 4 A schematic diagram of a data access processing device provided in one embodiment of this specification; Figure 5 A schematic diagram of a data access processing device provided in one embodiment of this specification; Figure 6 A schematic diagram of the structure of a data access processing device provided in one embodiment of this specification; Figure 7 A schematic diagram of the structure of a data access processing device provided in one embodiment of this specification. DETAILED DESCRIPTION

[0017] In order to enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the following will be combined with the drawings in one or more embodiments of this specification to clearly and completely describe the technical solutions in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this document.

[0018] One or more embodiments of a data access processing method provided in this specification are as follows: Reference Figure 1 , which shows a processing flow chart of a data access processing method provided in this embodiment, specifically including the following steps S102 to S106.

[0019] Step S102: Read the user attribute credentials of the user according to the user's data access request.

[0020] In practical applications, when users access data stored on the blockchain, they usually need to verify their identity. However, the simple blockchain-based identity authentication method has low security and poses a risk of data leakage. To address this, this solution combines attribute-based encryption (ABE) with blockchain. On the basis of the decentralized and tamper-proof data storage environment provided by the blockchain, it uses attribute-based encryption to allow fine-grained access control based on user attribute information, providing users with a secure and flexible data access solution.

[0021] In the specific implementation process, in order to combine attribute-based encryption with blockchain, initial configuration can be performed first. On the one hand, Ethereum is selected as the blockchain platform because it provides mature smart contract functions and can support the integration of complex logic and attribute-based encryption (ABE). On the other hand, a preset master key and a preset public key are generated based on the attribute-based encryption system for subsequent generation of user attribute credentials and user private keys.

[0022] Specifically, in the process of generating the preset master key and the preset public key, a bilinear mapping can be defined, G1×G1→GT, where G1, G1 and GT are cyclic groups of order p, and the generator of G1 is g. Then, the system key is generated, including the preset master key MK and the preset public key PK, where the preset master key MK=ga, a is randomly selected, and the preset public key PK=ga, g is the generator of G1.

[0023] After the initial configuration is completed, the attribute-based encryption system can be used to generate user attribute credentials and user private keys to facilitate subsequent access permission detection and data decryption. In an optional implementation provided in this embodiment, the user attribute credentials and user private keys are obtained in the following manner: sending the user attribute information of the user to the attribute-based encryption system; Receive the user attribute credential and the user private key returned by the attribute-based encryption system.

[0024] Optionally, after receiving the user attribute information, the attribute-based encryption system signs the user attribute information to obtain the user attribute certificate, and generates the user private key of the user based on the user attribute information and a preset public key of the attribute-based encryption system, that is, the user attribute certificate is generated by the attribute-based encryption system based on the user attribute information of the user, and the user private key is generated by the attribute-based encryption system based on a preset master key and the user attribute information.

[0025] Specifically, in the process of obtaining the user attribute certificate and the user private key, the user attribute information of the user can be sent to the certificate management entity of the attribute-based encryption system, and the user attribute certificate and the user private key returned by the certificate management entity can be received.

[0026] The credential management entity includes an attribute authority (AA). After sending the user attribute information to the attribute authority, the attribute authority verifies the authenticity of the user attribute information. After the verification is passed, the user attribute information is signed to obtain a user attribute credential, and a user private key is generated based on the user attribute information and a preset public key. The user attribute information includes at least one of the following: the user's identity, role, or other information related to the user's attributes. The user attribute credential can be a user attribute certificate.

[0027] For example, user attribute information can be submitted to the attribute authority of the attribute-based encryption system through a secure communication channel. The attribute authority verifies the authenticity of the user attribute information. After the verification is passed, the attribute authority generates a user attribute certificate Certattributes for the user. The user attribute certificate contains the user attribute information and a certificate signature SigAA (Certattributes) signed by the attribute authority. In addition, the attribute authority generates the user private key SKuser based on the user attribute information and the preset public key PK using the attribute-based encryption algorithm. The formula for generating user attribute certificates is:

[0028] Attrs represents the user's attribute set, and SigAA (Certattributes) is the digital signature of the attribute authority on the certificate content.

[0029] The formula for generating the user private key is:

[0030] a is the master key component of the system, h(attr) is a hash function that maps each attribute to a unique value, g is the generator of the group G1, and p is the order of the group.

[0031] In the specific execution process, after receiving the user attribute certificate returned by the certificate management entity, the blockchain registration can be performed based on the user attribute certificate. Here, only users who have successfully registered on the blockchain have the right to access the encrypted data on the blockchain. In an optional implementation method provided in this embodiment, the user is registered on the blockchain in the following manner: Send a blockchain registration request carrying the user attribute credential to the blockchain node.

[0032] Optionally, the blockchain node calls and executes a smart contract to perform a valid verification based on the user attribute certificate, and registers the user on the blockchain after the verification is passed. Specifically, the user registration information and the user attribute certificate can be recorded on the blockchain.

[0033] Specifically, a blockchain registration request carrying the user attribute certificate is sent to the blockchain node. The blockchain node calls and executes the smart contract. The smart contract is responsible for verifying the authenticity and validity of the certificate. After the verification is passed, the smart contract records the user registration information and user attribute certificate on the blockchain, indicating that the registration is successful.

[0034] After the initial configuration is completed and the user is registered on the blockchain, the user's data access request can be obtained. According to the user's data access request, the user's user attribute credentials are read to perform access permission detection and obtain access data based on the user attribute credentials.

[0035] Step S104, sending the data access request and the user attribute credential to the blockchain node.

[0036] After reading the user attribute certificate according to the user's data access request, the data access request and the user attribute certificate are sent to the blockchain node. Optionally, the blockchain node performs access permission detection according to the access control policy corresponding to the data access request and the user attribute certificate.

[0037] During the specific execution process, the access control policy and the reference of the encrypted data (for example, the data storage address of the encrypted data) can be deployed in advance to the smart contract. After sending the data access request and the user attribute certificate to the blockchain node, the blockchain node can call and execute the smart contract, and verify through the smart contract whether the user who initiates the data access request satisfies the access control policy to achieve fine-grained access control. In an optional implementation manner provided in this embodiment, the following method is used to perform access permission detection according to the access control policy corresponding to the data access request and the user attribute certificate: Performing usability verification on the user attribute credential; If the verification passes, the user attribute information contained in the user attribute credential is detected to see whether it satisfies the access control policy. If so, the detection is determined to be passed; if not, the detection is determined to be failed, and a receipt indicating no access rights may be returned to the user.

[0038] Specifically, the smart contract automatically verifies whether the user attribute certificate is available, and checks whether the user attribute information contained in the user attribute certificate satisfies the access control policy for accessing the data. If the access control policy is satisfied, the smart contract reads the data storage address of the encrypted data that the user is allowed to access.

[0039] The access control policy specifies which users have which user attribute information can access the data. Optionally, the access control policy can be an attribute logic expression. For example, an access control policy can be "user attribute 1 AND user attribute 2", indicating that only users who have both user attribute 1 and user attribute 2 can access the data.

[0040] Optionally, the encrypted data is obtained by encrypting initial data by the attribute-based encryption system. In an optional implementation manner provided by this embodiment, encrypting the initial data includes: The initial data is encrypted based on the access control policy and a preset public key of the attribute-based encryption system to obtain the encrypted data.

[0041] For example, the formula for encrypting the initial data is:

[0042] Where D is the initial data, Policy is the access control policy, and EPolicy(D) is the data encrypted according to the access control policy.

[0043] During the specific execution process, the blockchain node returns to the server after obtaining the data storage address obtained by executing the smart contract.

[0044] Step S106, receiving the data storage address returned by the blockchain node after the detection is passed, and decrypting the encrypted data corresponding to the data storage address based on the user private key to obtain access data.

[0045] After the data access request and the user attribute certificate are sent to the blockchain node, and the blockchain node performs access permission detection according to the access control policy corresponding to the data access request and the user attribute certificate, in this step, the data storage address returned by the blockchain node after the detection is passed is received, and the encrypted data corresponding to the data storage address is decrypted based on the user private key to obtain the access data. The data storage address may be a hash address.

[0046] In addition, in this embodiment, an access credit management system can also be introduced, and the user's access credit score can be automatically managed through a smart contract to encourage users to behave honestly and further improve the overall trust and security of the system. In an optional implementation provided by this embodiment, the user's access credit score is managed in the following manner: The smart contract is executed to detect whether the user behavior data of the user complies with the update rules of the access credit score, and the access credit score of the user is updated if the detection passes.

[0047] Furthermore, in the process of updating the user's access credit score, the change in the user's access credit score may be calculated, and the user's initial credit score may be updated according to the change. In an optional implementation provided by this embodiment, the credit score of the user is updated in the following manner, including: Inputting the user behavior data of the user into a credit score calculation algorithm to calculate the change in the access credit score of the user; The initial credit score of the user is updated according to the change.

[0048] The access credit score update rules are used to adjust the user's access credit score according to the user's data access behavior. The update rules include rules for positive data access behavior (such as providing real information, effective participation, etc.) and rules for negative data access behavior (such as providing false information, malicious behavior, etc.).

[0049] Specifically, the user's initial credit score R in the system can be set to a preset positive value, such as R0, and then the initial credit score is updated according to the user's data access behavior, and then the update rules are deployed to the smart contract, which is responsible for monitoring the user's data access behavior, automatically calculating and updating the user's access credit score; the user's user behavior data (such as data access requests, information submissions, etc.) is recorded and verified by the smart contract, and according to the update rule F, the smart contract automatically updates the user's credit value R: positive behavior increases the credit value, and negative behavior decreases the credit value. The user's access credit score R affects his access rights. Users with high access credit scores obtain more rights and resource access rights, while users with low access credit scores are restricted. Optionally, the credit score can be a reputation value.

[0050] For example, the following formula can be used to update the user's credit score:

[0051]

[0052]

[0053]

[0054] Among them, Rold is the user's current credit score, ΔR is the credit score change calculated by rule F based on the user's behavior, and Rnew is the updated credit score. is a decay function used to consider the decreasing effect of time on the credit score, where λ is the decay rate, t is the time variable, f(Bt,Ct) is the information filtering function used to calculate the change of the credit score based on the user's behavior Bt and context Ct at time t, Z is a normalization constant to ensure that ΔR is within a reasonable range, σ(...) is an exponential function used to amplify or reduce the cumulative effect and increase the flexibility of the model. wi is the weight, Ai is the user's attribute or behavior, g(Ai) is used to calculate the contribution of these factors to the credit score, N is the total number of attributes or behaviors considered, Bt is the user's behavior score at time t, which can be a quantitative indicator based on user behavior, such as the quality of the published content, the enthusiasm of the interaction, etc. Ct represents the context score, which can be a quantitative indicator based on the context environment in which the user behavior occurs, such as the time, place, social environment and other factors of the user behavior. The comprehensive score, w1 and w2 are weight coefficients used to adjust the relative importance of the behavior score and the context score in the change of the credit score. e is the base of the natural logarithm, which is approximately equal to 2.71828. k is the context sensitivity coefficient, which is used to adjust the sensitivity of the context score to the credit score. C0 is the basis of the context score. Line value, used to adjust the center point of the context score, Ai represents the quantitative value of the i-th attribute or behavior of the user, which can be the frequency of user activities, the quality score of the content, the enthusiasm of interaction, etc., Aij: represents the quantitative value of the j-th dimension in the i-th attribute or behavior of the user, wj is the weight coefficient of the j-th dimension, used to adjust the relative importance of different attribute or behavior dimensions in the total contribution, kj is the sensitivity coefficient of the j-th dimension, used to adjust the sensitivity of the function to changes in the attribute or behavior dimension value, μj is the baseline value of the j-th dimension, used to calibrate the center point of the dimension value, which is the average or median of the historical data of the dimension, n is the total number of dimensions of user attributes or behaviors, tanh is the hyperbolic tangent function, used to ensure that the growth rate of the contribution of each attribute or behavior dimension to the credit score gradually decreases with the increase of the value, so as to avoid excessive influence of extreme values ​​on the total contribution.

[0055] To summarize, the data access processing method provided in this embodiment first reads the user's user attribute certificate according to the user's data access request, then sends the data access request and the user attribute certificate to the blockchain node, and the blockchain node performs access permission detection according to the access control policy and the user attribute certificate corresponding to the data access request. Finally, the blockchain node receives the data storage address returned by the blockchain node after the detection is passed, and decrypts the encrypted data corresponding to the data storage address based on the user's private key to obtain the access data, so that when the user accesses the data on the blockchain, the access control policy written in the smart contract can be used to perform fine-grained access control on the user, thereby improving data security and access control efficiency.

[0056] The implementation process of a data access processing method provided above can be executed by a server, and the implementation process of another data access processing method provided in the following method embodiment can be executed by a blockchain node. The two can cooperate with each other during the execution process. Therefore, when reading the above implementation process, you can refer to the corresponding content of the following another data access processing method embodiment. Correspondingly, when reading the following another data access processing method embodiment, you can also refer to the corresponding content of the above method embodiment.

[0057] The following combination Figure 2 , taking the application of the data access processing method provided by this embodiment in the SIM card data access scenario as an example, the data access processing method provided by this embodiment is further described. Figure 2 The data access processing method applied to the SIM card data access scenario specifically includes the following steps.

[0058] Step S202: Read the user attribute certificate of the user according to the SIM card data access request of the user.

[0059] Step S204, sending a SIM card data access request and user attribute credentials to the blockchain node.

[0060] Step S212, receiving the data storage address returned by the blockchain node after the detection is passed, and decrypting the encrypted data corresponding to the data storage address based on the user's private key to obtain the SIM card data.

[0061] The above steps S202 to S204 and step S212 provided in this embodiment are executed by the server. It should be noted that the above steps S202 to S204 and step S212 executed by the server and steps S206 to S210 and step S214 executed by the blockchain node in the following embodiment can cooperate with each other during the execution process. Therefore, when reading this embodiment, please refer to the corresponding contents of steps S206 to S210 and step S214 provided in the following method embodiment, and when reading the following method embodiment, please refer to the corresponding contents of steps S202 to S204 and step S212 provided in this embodiment.

[0062] It should be noted that any one of steps S202 to S214 or any combination of multiple steps can be replaced by the corresponding technical means provided in the above steps S102 to S106 according to the needs of implementation and deployment, and will not be described one by one here.

[0063] Another data access processing method embodiment provided in this specification: Reference Figure 3, which shows a processing flow chart of a data access processing method provided in this embodiment. The data access processing method provided in this embodiment specifically includes the following steps S302 to S306.

[0064] Step S302: receiving a user's data access request and user attribute credentials sent by a server.

[0065] In practical applications, when users access data stored on the blockchain, they usually need to verify their identity. However, the simple blockchain-based identity authentication method has low security and poses a risk of data leakage. To address this, this solution combines attribute-based encryption (ABE) with blockchain. On the basis of the decentralized and tamper-proof data storage environment provided by the blockchain, it uses attribute-based encryption to allow fine-grained access control based on user attribute information, providing users with a secure and flexible data access solution.

[0066] In the specific implementation process, in order to combine attribute-based encryption with blockchain, initial configuration can be performed first. On the one hand, Ethereum is selected as the blockchain platform because it provides mature smart contract functions and can support the integration of complex logic and attribute-based encryption (ABE). On the other hand, a preset master key and a preset public key are generated based on the attribute-based encryption system for subsequent generation of user attribute credentials and user private keys.

[0067] Specifically, in the process of generating the preset master key and the preset public key, a bilinear mapping can be defined, G1×G1→GT, where G1, G1 and GT are cyclic groups of order p, and the generator of G1 is g. Then, the system key is generated, including the preset master key MK and the preset public key PK, where the preset master key MK=ga, a is randomly selected, and the preset public key PK=ga, g is the generator of G1.

[0068] After the initial configuration is completed, the attribute-based encryption system can be used to generate user attribute credentials and user private keys to facilitate subsequent access permission detection and data decryption. In an optional implementation provided in this embodiment, the user attribute credentials and user private keys are obtained in the following manner: sending the user attribute information of the user to the attribute-based encryption system; Receive the user attribute credential and the user private key returned by the attribute-based encryption system.

[0069] Optionally, after receiving the user attribute information, the attribute-based encryption system signs the user attribute information to obtain the user attribute certificate, and generates the user private key of the user based on the user attribute information and a preset public key of the attribute-based encryption system, that is, the user attribute certificate is generated by the attribute-based encryption system based on the user attribute information of the user, and the user private key is generated by the attribute-based encryption system based on a preset master key and the user attribute information.

[0070] Specifically, in the process of obtaining the user attribute certificate and the user private key, the user attribute information of the user can be sent to the certificate management entity of the attribute-based encryption system, and the user attribute certificate and the user private key returned by the certificate management entity can be received.

[0071] The credential management entity includes an attribute authority (AA). After sending the user attribute information to the attribute authority, the attribute authority verifies the authenticity of the user attribute information. After the verification is passed, the user attribute information is signed to obtain a user attribute credential, and a user private key is generated based on the user attribute information and a preset public key. The user attribute information includes at least one of the following: the user's identity, role, or other information related to the user's attributes. The user attribute credential can be a user attribute certificate.

[0072] For example, user attribute information can be submitted to the attribute authority of the attribute-based encryption system through a secure communication channel. The attribute authority verifies the authenticity of the user attribute information. After the verification is passed, the attribute authority generates a user attribute certificate Certattributes for the user. The user attribute certificate contains the user attribute information and a certificate signature SigAA (Certattributes) signed by the attribute authority. In addition, the attribute authority generates the user private key SKuser based on the user attribute information and the preset public key PK using the attribute-based encryption algorithm. The formula for generating user attribute certificates is:

[0073] Attrs represents the user's attribute set, and SigAA (Certattributes) is the digital signature of the attribute authority on the certificate content.

[0074] The formula for generating the user private key is:

[0075] a is the master key component of the system, h(attr) is a hash function that maps each attribute to a unique value, g is the generator of the group G1, and p is the order of the group.

[0076] In the specific execution process, after receiving the user attribute certificate returned by the certificate management entity, the blockchain registration can be performed based on the user attribute certificate. Here, only users who have successfully registered on the blockchain have the right to access the encrypted data on the blockchain. In an optional implementation method provided in this embodiment, the user is registered on the blockchain in the following manner: Receiving a blockchain registration request sent by the server and carrying the user attribute certificate; The smart contract is called and executed to verify the validity of the user attribute certificate. After the verification is passed, the user is registered on the blockchain.

[0077] Specifically, a blockchain registration request carrying the user attribute certificate is sent to the blockchain node. The blockchain node calls and executes the smart contract. The smart contract is responsible for verifying the authenticity and validity of the certificate. After the verification is passed, the smart contract records the user registration information and user attribute certificate on the blockchain, indicating that the registration is successful.

[0078] After the initial configuration is completed and the user is registered in the blockchain, the user's data access request and user attribute credentials sent by the server can be received to perform access permission detection and obtain access data based on the user attribute credentials.

[0079] Step S304, calling and executing the smart contract to perform access permission detection according to the access control policy corresponding to the data access request and the user attribute certificate.

[0080] During the specific execution process, the access control policy and the reference of the encrypted data (for example, the data storage address of the encrypted data) can be deployed in advance to the smart contract. After sending the data access request and the user attribute certificate to the blockchain node, the blockchain node can call and execute the smart contract, and verify through the smart contract whether the user who initiates the data access request satisfies the access control policy to achieve fine-grained access control. In an optional implementation manner provided in this embodiment, the following method is used to perform access permission detection according to the access control policy corresponding to the data access request and the user attribute certificate: Performing usability verification on the user attribute credential; If the verification passes, the user attribute information contained in the user attribute credential is detected to see whether it satisfies the access control policy. If so, the detection is determined to be passed; if not, the detection is determined to be failed, and a receipt indicating no access rights may be returned to the user.

[0081] Specifically, the smart contract automatically verifies whether the user attribute certificate is available, and checks whether the user attribute information contained in the user attribute certificate satisfies the access control policy for accessing the data. If the access control policy is satisfied, the smart contract reads the data storage address of the encrypted data that the user is allowed to access.

[0082] The access control policy specifies which users have which user attribute information can access the data. Optionally, the access control policy can be an attribute logic expression. For example, an access control policy can be "user attribute 1 AND user attribute 2", indicating that only users who have both user attribute 1 and user attribute 2 can access the data.

[0083] Optionally, the encrypted data is obtained by encrypting initial data by the attribute-based encryption system. In an optional implementation manner provided by this embodiment, encrypting the initial data includes: The initial data is encrypted based on the access control policy and a preset public key of the attribute-based encryption system to obtain the encrypted data.

[0084] For example, the formula for encrypting the initial data is:

[0085] Where D is the initial data, Policy is the access control policy, and EPolicy(D) is the data encrypted according to the access control policy.

[0086] During the specific execution process, the blockchain node returns to the server after obtaining the data storage address obtained by executing the smart contract.

[0087] Step S306: If the detection passes, the data storage address obtained by executing the smart contract is returned to the server.

[0088] Optionally, the server decrypts the encrypted data corresponding to the data storage address based on a user private key to obtain access data; the user private key is generated by the attribute-based encryption system based on a preset master key and the user attribute information.

[0089] In addition, in this embodiment, an access credit management system can also be introduced, and the user's access credit score can be automatically managed through a smart contract to encourage users to behave honestly and further improve the overall trust and security of the system. In an optional implementation provided by this embodiment, the user's access credit score is managed in the following manner: The smart contract is executed to detect whether the user behavior data of the user complies with the update rules of the access credit score, and the access credit score of the user is updated if the detection passes.

[0090] Furthermore, in the process of updating the user's access credit score, the change in the user's access credit score may be calculated, and the user's initial credit score may be updated according to the change. In an optional implementation provided by this embodiment, the credit score of the user is updated in the following manner, including: Inputting the user behavior data of the user into a credit score calculation algorithm to calculate the change in the access credit score of the user; The initial credit score of the user is updated according to the change.

[0091] The access credit score update rules are used to adjust the user's access credit score according to the user's data access behavior. The update rules include rules for positive data access behavior (such as providing real information, effective participation, etc.) and rules for negative data access behavior (such as providing false information, malicious behavior, etc.).

[0092] Specifically, the user's initial credit score R in the system can be set to a preset positive value, such as R0, and then the initial credit score is updated according to the user's data access behavior, and then the update rules are deployed to the smart contract, which is responsible for monitoring the user's data access behavior, automatically calculating and updating the user's access credit score; the user's user behavior data (such as data access requests, information submissions, etc.) is recorded and verified by the smart contract, and according to the update rule F, the smart contract automatically updates the user's credit value R: positive behavior increases the credit value, and negative behavior decreases the credit value. The user's access credit score R affects his access rights. Users with high access credit scores obtain more rights and resource access rights, while users with low access credit scores are restricted. Optionally, the credit score can be a reputation value.

[0093] For example, the following formula can be used to update the user's credit score:

[0094]

[0095]

[0096]

[0097] Among them, Rold is the user's current credit score, ΔR is the credit score change calculated by rule F based on the user's behavior, and Rnew is the updated credit score. is a decay function used to consider the decreasing effect of time on the credit score, where λ is the decay rate, t is the time variable, f(Bt,Ct) is the information filtering function used to calculate the change in credit score based on the user's behavior Bt and context Ct at time t, Z is a normalization constant to ensure that ΔR is within a reasonable range, σ(...) is an exponential function used to amplify or reduce the cumulative effect and increase the flexibility of the model, wi is the weight, Ai is the user's attribute or behavior, g(Ai) is used to calculate the contribution of these factors to the credit score, N is the total number of attributes or behaviors considered, Bt is the user's behavior score at time t, which can be a quantitative indicator based on user behavior, such as the quality of the published content, the enthusiasm of the interaction, etc., Ct represents the context score, which can be a quantitative indicator based on the context environment in which the user behavior occurs, such as the comprehensive score of factors such as the time, location, and social environment of the user behavior, w1 and w2 are weight coefficients used to adjust the relative importance of the behavior score and the context score in the change of the credit score, e is the base of the natural logarithm, which is approximately equal to 2.71828, k is the context sensitivity coefficient, which is used to adjust the sensitivity of the context score to the credit score, C0 is the baseline value of the context score, which is used to adjust the center point of the context score, and Ai represents the quantification of the i-th attribute or behavior of the user value, which can be the frequency of user activities, the quality score of the content, the enthusiasm of interaction, etc. Aij represents the quantitative value of the jth dimension in the i-th attribute or behavior of the user, wj is the weight coefficient of the j-th dimension, which is used to adjust the relative importance of different attribute or behavior dimensions in the total contribution, kj is the sensitivity coefficient of the j-th dimension, which is used to adjust the sensitivity of the function to changes in the attribute or behavior dimension value, μj is the baseline value of the j-th dimension, which is used to calibrate the center point of the dimension value, and is the average or median of the historical data of the dimension, n is the total number of dimensions of user attributes or behaviors, and tanh is the hyperbolic tangent function, which is used to ensure that the growth rate of the contribution of each attribute or behavior dimension to the credit score gradually decreases with the increase of the value, so as to avoid excessive influence of extreme values ​​on the total contribution.

[0098] To summarize, the data access processing method provided in this embodiment first reads the user's user attribute certificate according to the user's data access request, then sends the data access request and the user attribute certificate to the blockchain node, and the blockchain node performs access permission detection according to the access control policy and the user attribute certificate corresponding to the data access request. Finally, the blockchain node receives the data storage address returned by the blockchain node after the detection is passed, and decrypts the encrypted data corresponding to the data storage address based on the user's private key to obtain the access data, so that when the user accesses the data on the blockchain, the access control policy written in the smart contract can be used to perform fine-grained access control on the user, thereby improving data security and access control efficiency.

[0099] The following combination Figure 2 , taking the application of the data access processing method provided by this embodiment in the SIM card data access scenario as an example, the data access processing method provided by this embodiment is further described. Figure 2 The data access processing method applied to the SIM card data access scenario specifically includes the following steps.

[0100] Step S206: receiving the user's SIM card data access request and user attribute certificate sent by the server.

[0101] Step S208, calling and executing the smart contract to perform access permission detection according to the user attribute information in the user attribute certificate and the access control policy corresponding to the SIM card data access request.

[0102] Step S210: If the detection passes, the data storage address obtained by executing the smart contract is returned to the server.

[0103] Step S214, executing the smart contract to detect whether the user behavior data of the user complies with the update rules of the access credit score, and updating the access credit score of the user if the detection passes.

[0104] Figure 4 A schematic diagram of a data access processing device provided by an embodiment of the present invention is shown in FIG. Figure 4 As shown, the device comprises: The credential reading module 402 is configured to read the user attribute credential of the user according to the data access request of the user; the user attribute credential is generated by the attribute-based encryption system based on the user attribute information of the user; The credential sending module 404 is configured to send the data access request and the user attribute credential to the blockchain node; the blockchain node performs access permission detection according to the access control policy corresponding to the data access request and the user attribute credential; The data decryption module 406 is configured to receive the data storage address returned by the blockchain node after the detection is passed, and decrypt the encrypted data corresponding to the data storage address based on the user private key to obtain access data; the user private key is generated by the attribute-based encryption system based on the preset master key and the user attribute information.

[0105] The data access processing device provided in this embodiment first runs the request acquisition module 402 to read the user attribute certificate of the user according to the user's data access request, and then runs the certificate reading module 404 to send the data access request and the user attribute certificate to the blockchain node; the blockchain node performs access permission detection according to the access control policy corresponding to the data access request and the user attribute certificate, and finally runs the certificate sending module 406 to receive the data storage address returned by the blockchain node after the detection is passed, and decrypts the encrypted data corresponding to the data storage address based on the user private key to obtain the access data; the user private key is generated by the attribute-based encryption system based on the preset master key and the user attribute information, and can perform fine-grained access control on the user through the access control policy written in the smart contract, thereby improving data security and improving access control efficiency.

[0106] The data access processing device provided in one embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0107] Figure 5 A schematic diagram of a data access processing device provided by an embodiment of the present invention is shown in FIG. Figure 5 As shown, the device comprises: The credential receiving module 502 is configured to receive a user's data access request and a user attribute credential sent by a server; the user attribute credential is generated by an attribute-based encryption system based on the user attribute information of the user; The access detection module 504 is configured to call and execute the smart contract to perform access access detection according to the access control policy corresponding to the data access request and the user attribute credential; If the detection passes, the address return module 506 is run, and the address return module 506 is configured to return the data storage address obtained by executing the smart contract to the server, and the server decrypts the encrypted data corresponding to the data storage address based on the user private key to obtain access data; the user private key is generated by the attribute-based encryption system based on the preset master key and the user attribute information.

[0108] The data access processing device provided in this embodiment first runs the credential receiving module 502 to receive the user's data access request and user attribute credential sent by the server, and then runs the access detection module 504 to call and execute the smart contract to perform access access detection according to the user attribute information and the access control policy corresponding to the data access request. If the detection passes, the address return module 506 returns the data storage address obtained by executing the smart contract to the server, so as to decrypt the encrypted data corresponding to the data storage address based on the user's private key to obtain the access data, so that when accessing user data, fine-grained access control can be performed on the user based on the user attribute information, providing a safer, more efficient and user-friendly identity authentication solution.

[0109] The data access processing device provided in one embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0110] Furthermore, an embodiment of the present specification also provides a data access processing device, Figure 6 A structural diagram of a data access processing device provided in an embodiment of this specification is shown as follows: Figure 6 As shown, the device includes: a memory 601, a processor 602, a bus 603 and a communication interface 604. The memory 601, the processor 602 and the communication interface 604 communicate through the bus 603, and the communication interface 604 may include an input and output interface, which includes but is not limited to a keyboard, a mouse, a display, a microphone, a loudspeaker, etc.

[0111] Figure 6 In the embodiment, the memory 601 stores computer executable instructions that can be run on the processor 602. When the computer executable instructions are executed by the processor 602, the following process is implemented: Reading a user attribute credential of the user according to a data access request of the user; the user attribute credential is generated by an attribute-based encryption system based on user attribute information of the user; Sending the data access request and the user attribute certificate to a blockchain node; the blockchain node performs access permission detection according to the access control policy corresponding to the data access request and the user attribute certificate; Receive the data storage address returned by the blockchain node after the detection is passed, and decrypt the encrypted data corresponding to the data storage address based on the user private key to obtain access data; the user private key is generated by the attribute-based encryption system based on the preset master key and the user attribute information.

[0112] The data access processing device provided in this embodiment, through the cooperation of the memory 601, the processor 602, the bus 603 and the communication interface 604, first obtains the user's data access request, and then responds to the data access request, reads the user's user attribute certificate, and again sends the data access request and the user attribute certificate to the blockchain node to perform access permission detection according to the user attribute information and the access control policy corresponding to the data access request, and finally receives the data storage address returned by the blockchain node after the detection is passed, and decrypts the encrypted data corresponding to the data storage address based on the user's private key to obtain the access data, so that when accessing user data, fine-grained access control can be performed on the user based on the user attribute information, providing a safer, more efficient and user-friendly identity authentication solution.

[0113] The data access processing device provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0114] Furthermore, an embodiment of the present specification also provides a data access processing device, Figure 7 A structural diagram of a data access processing device provided in an embodiment of this specification is shown as follows: Figure 7 As shown, the device includes: a memory 701, a processor 702, a bus 703 and a communication interface 704. The memory 701, the processor 702 and the communication interface 704 communicate through the bus 703, and the communication interface 704 may include an input and output interface, which includes but is not limited to a keyboard, a mouse, a display, a microphone, a loudspeaker, etc.

[0115] Figure 7 In the embodiment, the memory 701 stores computer executable instructions that can be run on the processor 702, and when the computer executable instructions are executed by the processor 702, the following process is implemented: Receiving a data access request and a user attribute credential of a user sent by a server; the user attribute credential is generated by an attribute-based encryption system based on user attribute information of the user; Calling and executing a smart contract to perform access permission detection according to the access control policy corresponding to the data access request and the user attribute credential; If the detection passes, the data storage address obtained by executing the smart contract is returned to the server, and the server decrypts the encrypted data corresponding to the data storage address based on the user's private key to obtain access data; the user's private key is generated by the attribute-based encryption system based on the preset master key and the user's attribute information.

[0116] The data access processing device provided in this embodiment, through the cooperation of the memory 701, the processor 702, the bus 703 and the communication interface 704, first receives the user's data access request and user attribute certificate sent by the server, and then calls and executes the smart contract to perform access permission detection according to the user attribute information and the access control policy corresponding to the data access request. If the detection passes, the data storage address obtained by executing the smart contract is returned to the server, and the encrypted data corresponding to the data storage address is decrypted based on the user's private key to obtain the access data, so that when accessing user data, fine-grained access control can be performed on the user based on the user attribute information, providing a safer, more efficient and user-friendly identity authentication solution.

[0117] The data access processing device provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0118] Furthermore, another embodiment of the present specification provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the following process is implemented: Reading a user attribute credential of the user according to a data access request of the user; the user attribute credential is generated by an attribute-based encryption system based on user attribute information of the user; Sending the data access request and the user attribute certificate to a blockchain node; the blockchain node performs access permission detection according to the access control policy corresponding to the data access request and the user attribute certificate; Receive the data storage address returned by the blockchain node after the detection is passed, and decrypt the encrypted data corresponding to the data storage address based on the user private key to obtain access data; the user private key is generated by the attribute-based encryption system based on the preset master key and the user attribute information.

[0119] The computer-readable storage medium provided in this embodiment first obtains the user's data access request, then responds to the data access request, reads the user's user attribute certificate, and again sends the data access request and the user attribute certificate to the blockchain node to perform access permission detection according to the user attribute information and the access control policy corresponding to the data access request, and finally receives the data storage address returned by the blockchain node after the detection is passed, and decrypts the encrypted data corresponding to the data storage address based on the user's private key to obtain the access data, so that when accessing user data, fine-grained access control can be performed on the user based on the user attribute information, providing a safer, more efficient and user-friendly identity authentication solution.

[0120] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0121] The computer-readable storage medium provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0122] Furthermore, another embodiment of the present specification provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the following process is implemented: Receiving a data access request and a user attribute credential of a user sent by a server; the user attribute credential is generated by an attribute-based encryption system based on user attribute information of the user; Calling and executing a smart contract to perform access permission detection according to the access control policy corresponding to the data access request and the user attribute credential; If the detection passes, the data storage address obtained by executing the smart contract is returned to the server, and the server decrypts the encrypted data corresponding to the data storage address based on the user's private key to obtain access data; the user's private key is generated by the attribute-based encryption system based on the preset master key and the user's attribute information.

[0123] The computer-readable storage medium provided in this embodiment first receives the user's data access request and user attribute credentials sent by the server, and then calls and executes the smart contract to perform access permission detection according to the user attribute information and the access control policy corresponding to the data access request. If the detection passes, the data storage address obtained by executing the smart contract is returned to the server, so that the encrypted data corresponding to the data storage address is decrypted based on the user's private key to obtain the access data, so that when accessing user data, fine-grained access control can be performed on the user based on the user attribute information, providing a safer, more efficient and user-friendly identity authentication solution.

[0124] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0125] The computer-readable storage medium provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0126] Furthermore, another embodiment of the present specification also provides a computer program product, which implements the following process when executed by a processor: Reading a user attribute credential of the user according to a data access request of the user; the user attribute credential is generated by an attribute-based encryption system based on user attribute information of the user; Sending the data access request and the user attribute certificate to a blockchain node; the blockchain node performs access permission detection according to the access control policy corresponding to the data access request and the user attribute certificate; Receive the data storage address returned by the blockchain node after the detection is passed, and decrypt the encrypted data corresponding to the data storage address based on the user private key to obtain access data; the user private key is generated by the attribute-based encryption system based on the preset master key and the user attribute information.

[0127] The computer program product provided in this embodiment first obtains the user's data access request, then responds to the data access request, reads the user's user attribute certificate, and again sends the data access request and the user attribute certificate to the blockchain node to perform access permission detection according to the user attribute information and the access control policy corresponding to the data access request, and finally receives the data storage address returned by the blockchain node after the detection is passed, and decrypts the encrypted data corresponding to the data storage address based on the user's private key to obtain the access data, so that when accessing user data, fine-grained access control can be performed on the user based on the user attribute information, providing a safer, more efficient and user-friendly identity authentication solution.

[0128] The computer program product provided in one embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0129] Furthermore, another embodiment of the present specification also provides a computer program product, which implements the following process when executed by a processor: Receiving a data access request and a user attribute credential of a user sent by a server; the user attribute credential is generated by an attribute-based encryption system based on user attribute information of the user; Calling and executing a smart contract to perform access permission detection according to the access control policy corresponding to the data access request and the user attribute credential; If the detection passes, the data storage address obtained by executing the smart contract is returned to the server, and the server decrypts the encrypted data corresponding to the data storage address based on the user's private key to obtain access data; the user's private key is generated by the attribute-based encryption system based on the preset master key and the user's attribute information.

[0130] The computer program product provided in this embodiment first receives the user's data access request and user attribute credentials sent by the server, and then calls and executes the smart contract to perform access permission detection according to the user attribute information and the access control policy corresponding to the data access request. If the detection passes, the data storage address obtained by executing the smart contract is returned to the server, so that the encrypted data corresponding to the data storage address is decrypted based on the user's private key to obtain the access data, so that when accessing user data, fine-grained access control can be performed on the user based on the user attribute information, providing a safer, more efficient and user-friendly identity authentication solution.

[0131] The computer program product provided in one embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0132] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0133] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0134] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0135] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0136] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0137] Memory may include non-permanent storage in a computer-readable storage medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable storage medium.

[0138] Computer-readable storage media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer-readable storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable storage media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0139] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0140] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0141] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A data access processing method, characterized in that: Applied to a server, the method comprises: Reading a user attribute credential of the user according to a data access request of the user; the user attribute credential is generated by an attribute-based encryption system based on user attribute information of the user; Sending the data access request and the user attribute certificate to a blockchain node; the blockchain node performs access permission detection according to the access control policy corresponding to the data access request and the user attribute certificate; Receive the data storage address returned by the blockchain node after the detection is passed, and decrypt the encrypted data corresponding to the data storage address based on the user private key to obtain access data; the user private key is generated by the attribute-based encryption system based on a preset master key and the user attribute information.

2. The data access processing method according to claim 1, characterized in that: Before the step of reading the user attribute credentials of the user according to the user's data access request is performed, the method further includes: The user attribute information is sent to the attribute-based encryption system; the attribute-based encryption system signs the user attribute information to obtain the user attribute certificate, and generates the user private key based on the user attribute information and a preset public key of the attribute-based encryption system; Receive the user attribute credential and the user private key returned by the attribute-based encryption system.

3. The data access processing method according to claim 2, characterized in that: After the step of receiving the user attribute certificate and the user private key returned by the attribute-based encryption system is executed, the method further includes: A blockchain registration request carrying the user attribute certificate is sent to the blockchain node; the blockchain node calls and executes a smart contract to verify the validity of the user attribute certificate, and registers the user on the blockchain after the verification passes.

4. The data access processing method according to claim 1, characterized in that: The performing access permission detection according to the access control policy corresponding to the data access request and the user attribute credential includes: Performing usability verification on the user attribute credential; In the case where the verification is passed, it is detected whether the user attribute information contained in the user attribute credential satisfies the access control policy, and if so, it is determined that the detection is passed.

5. The data access processing method according to claim 1, characterized in that: The encrypted data is obtained by encrypting the initial data by the attribute-based encryption system; The encrypting of the initial data comprises: The initial data is encrypted based on the access control policy and a preset public key of the attribute-based encryption system to obtain the encrypted data.

6. A data access processing method, characterized in that: Applied to a blockchain node, the method comprises: Receiving a data access request and a user attribute credential of a user sent by a server; the user attribute credential is generated by an attribute-based encryption system based on user attribute information of the user; Calling and executing a smart contract to perform access permission detection according to the access control policy corresponding to the data access request and the user attribute credential; If the detection passes, the data storage address obtained by executing the smart contract is returned to the server, and the server decrypts the encrypted data corresponding to the data storage address based on the user's private key to obtain access data; the user's private key is generated by the attribute-based encryption system based on the preset master key and the user's attribute information.

7. The data access processing method according to claim 6, characterized in that: Also includes: Receiving a blockchain registration request sent by the server and carrying the user attribute certificate; The smart contract is called and executed to verify the validity of the user attribute certificate. After the verification is passed, the user is registered on the blockchain.

8. The data access processing method according to claim 6, characterized in that: The performing access permission detection according to the access control policy corresponding to the data access request and the user attribute credential includes: Performing usability verification on the user attribute credential; In the case where the verification is passed, it is detected whether the user attribute information contained in the user attribute credential satisfies the access control policy, and if so, it is determined that the detection is passed.

9. The data access processing method according to claim 6, characterized in that: Also includes: The smart contract is executed to detect whether the user behavior data of the user complies with the update rules of the access credit score, and the access credit score of the user is updated if the detection passes.

10. The data access processing method according to claim 9, characterized in that: The updating of the access credit score of the user includes: Inputting the user behavior data of the user into a credit score calculation algorithm to calculate the change in the access credit score of the user; The initial credit score of the user is updated according to the change.

Images