Distributed access control method and access control system based on block chain

Abstract

The invention discloses a distributed access control method and system based on a block chain, and relates to the field of information security, and the method comprises the steps: generating an initial block on a block chain network based on a preset access control strategy and an authorization node list; receiving and processing access request information submitted by a user based on the authorized node list, and generating an access request transaction in a standard format; performing permission verification on the access request transaction according to the access control strategy in the initial block to obtain a permission verification result; on the basis of the permission verification result, consensus confirmation is carried out on the access request transaction passing the permission verification among the authorization nodes, and a confirmation result is packaged to generate a newly-added block; and adding the newly added block to the block chain network, and performing synchronous updating between the authorized nodes. By implementing the application, the availability and stability of the access control system can be maintained when the central server fails or is attacked.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a distributed access control method and access control system based on blockchain. Background Art

[0002] With the rapid development of information technology and the widespread popularity of network applications, various organizations have put forward higher requirements for access control of information systems. As an important part of information system security protection, access control not only needs to ensure that legitimate users can access system resources smoothly, but also needs to effectively prevent illegal access and malicious attacks and protect the security of sensitive data. In the current network environment, access control systems face more complex security threats and higher performance requirements.

[0003] In related technologies, access control systems usually adopt a central server architecture to manage user identities and access rights by deploying authentication servers and permission databases. In this implementation, after receiving a user's access request, the system first verifies the legitimacy of the user's identity by the authentication server, and then queries the permission database to determine whether the user has the corresponding access rights. The permission database stores user identity information, resource information, and corresponding permission configuration rules, and administrators can uniformly manage and maintain this information through the central management interface.

[0004] However, when the central server fails or is attacked, the access control system dependent on the central server will not work properly, affecting the availability and stability of the access control system. Summary of the invention

[0005] The present application provides a distributed access control method and access control system based on blockchain, which are used to maintain the availability and stability of the access control system when a central server fails or is attacked.

[0006] In the first aspect, the present application provides a distributed access control method based on blockchain, which is applied to an access control system. The method includes: generating an initial block on a blockchain network based on a preset access control policy and an authorized node list; receiving and processing access request information submitted by a user based on the authorized node list, and generating an access request transaction in a standard format; performing authority verification on the access request transaction according to the access control policy in the initial block to obtain an authority verification result; based on the authority verification result, performing consensus confirmation on the access request transaction that passes the authority verification between authorized nodes, and packaging the confirmation results to generate a new block; adding the new block to the blockchain network, and synchronously updating it between authorized nodes.

[0007] In the above embodiment, the access control system generates an initial block based on a preset access control policy on the blockchain network, uses distributed nodes to receive and process access requests, implements permission verification and consensus confirmation, and finally synchronizes updates to the blockchain network; this distributed architecture avoids single point failures, and the system can still maintain normal operation even if some nodes fail. The tamper-proof nature of the blockchain ensures the reliability and traceability of access control records.

[0008] In combination with some embodiments of the first aspect, in some embodiments, after the step of performing permission verification on the access request transaction according to the access control policy in the initial block to obtain the permission verification result, the method also includes: based on the permission verification result, establishing an access exception record for the access request transaction that failed the permission verification; determining the user's credit level based on the cumulative number of access exception records, and adjusting the user's access permission threshold accordingly.

[0009] In the above embodiment, the access control system implements a dynamic access control mechanism by establishing access exception records and adjusting the user's credit level and access permission threshold based on the cumulative number of times. It can adaptively adjust the access permission according to the user's historical behavior, which not only ensures the security of the system, but also provides a flexible permission management solution.

[0010] In combination with some embodiments of the first aspect, in some embodiments, after the step of determining the user's credit level based on the cumulative number of access exception records and adjusting the user's access permission threshold accordingly, the method also includes: when it is detected that the user's credit level is lower than a preset level, increasing the difficulty of user access verification within a preset time period; packaging the access exception records, credit level adjustment information, and restriction policy execution status to generate an exception handling block, and adding the exception handling block to the blockchain network.

[0011] In the above embodiment, the access control system takes measures to increase the difficulty of access verification for users with low credit ratings, and records relevant information in the exception handling block, effectively preventing potential malicious access, while preserving complete processing records to provide a basis for subsequent security audits.

[0012] In combination with some embodiments of the first aspect, in some embodiments, based on the permission verification result, consensus confirmation is performed between authorized nodes for access request transactions that pass the permission verification, and the confirmation result is packaged to generate a new block, specifically including: based on the permission verification result, consensus confirmation is performed between authorized nodes for access request transactions that pass the permission verification to obtain a confirmation result; the system load status of the blockchain network is obtained; when it is detected that the system load exceeds a preset high voltage threshold, the consensus difficulty coefficient of the blockchain network is reduced and the block generation interval is shortened; consensus voting is performed between authorized nodes based on the adjusted consensus difficulty coefficient, and a new block is generated when the number of votes exceeds the preset confirmation threshold.

[0013] In the above embodiment, the access control system monitors the load status of the blockchain network and dynamically adjusts the consensus difficulty and block generation interval, thereby optimizing system performance while ensuring consensus reliability. When the load is high, the difficulty coefficient is reduced to improve processing efficiency and ensure system availability.

[0014] In combination with some embodiments of the first aspect, in some embodiments, after the step of adding a new block to the blockchain network and synchronizing and updating between authorized nodes, the method also includes: parsing the user's access request information to determine the access resource; obtaining the sensitivity level of the access resource, determining the encryption strength and transmission strategy corresponding to the access resource; and returning the access resource to the user based on the encryption strength and transmission strategy.

[0015] In the above embodiment, the access control system adopts corresponding encryption strength and transmission strategy based on the sensitivity level of the accessed resources, thereby achieving differentiated protection of resource access, which not only ensures the security of sensitive resources but also avoids the use of excessive protection measures for ordinary resources.

[0016] In combination with some embodiments of the first aspect, in some embodiments, before the step of obtaining the sensitivity level of the access resource and determining the encryption strength and transmission strategy corresponding to the access resource, the method also includes: grading the access resource according to the sensitivity level of the access resource to obtain ordinary level, important level and confidential level; when the access resource is at an ordinary level, setting the encryption strength and transmission strategy to a lightweight encryption algorithm and a standard transmission channel; when the access resource is at an important level, setting the encryption strength and transmission strategy to an enhanced encryption algorithm and an encrypted communication tunnel; when the access resource is at a confidential level, setting the encryption strength and transmission strategy to a double encryption mechanism and a dedicated secure channel, and dynamically adjusting the encryption key during the transmission process.

[0017] In the above embodiment, the access control system divides access resources into three levels: ordinary, important and confidential, and configures corresponding encryption algorithms and transmission channels for each level, which not only ensures the security requirements of resources at different levels, but also realizes the rational use of system resources.

[0018] In combination with some embodiments of the first aspect, in some embodiments, after the step of returning access resources to the user based on encryption strength and transmission strategy, the method also includes: obtaining network delay information and calculating a real-time network performance score value; the network delay information includes communication delay between nodes and data packet transmission time; when the network performance score value is lower than a preset low-quality threshold, reducing the complexity of the encryption algorithm.

[0019] In the above embodiment, the access control system optimizes system performance while ensuring security by monitoring network performance in real time and dynamically adjusting the complexity of the encryption algorithm. When the network condition is poor, the encryption complexity is reduced to reduce transmission overhead and ensure the responsiveness of the system.

[0020] In a second aspect, an embodiment of the present application provides an access control system, which includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the access control system to execute the method described in the first aspect and any possible implementation method of the first aspect.

[0021] In a third aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when executed on an access control system, enables the access control system to execute the method described in the first aspect and any possible implementation of the first aspect.

[0022] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on an access control system, enable the access control system to execute the method described in the first aspect and any possible implementation of the first aspect.

[0023] It can be understood that the access control system provided in the second aspect, the computer program product provided in the third aspect, and the computer storage medium provided in the fourth aspect are all used to execute the method provided in the embodiment of the present application. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method, which will not be repeated here.

[0024] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: 1. Due to the adoption of a distributed architecture and multi-node consensus mechanism based on blockchain, the authorized node list and standardized access request transaction processing flow are introduced in the access control process, so the system can achieve decentralized verification and confirmation when processing access requests, effectively solving the single point failure problem caused by reliance on central servers in existing technologies, thereby achieving high availability of the system and reliability of access control. Through the distributed storage and consensus mechanism of blockchain technology, even if some nodes fail, other nodes can still work normally, ensuring the continuous operation of the entire access control system. At the same time, the authenticity and traceability of access records are ensured based on the tamper-proof characteristics of blockchain.

[0025] 2. Due to the adoption of a dynamic consensus mechanism that perceives system load, by real-time monitoring of the system load status of the blockchain network and dynamically adjusting the consensus difficulty coefficient and block generation interval, the system can adaptively optimize processing performance when the load is high, effectively solving the performance bottleneck problem caused by the fixed consensus mechanism in the existing technology, and thus achieving the scalability and processing efficiency of the system under high load. This dynamic adjustment mechanism not only ensures the reliability of the consensus, but also avoids excessive computing overhead, enabling the system to flexibly adjust according to the actual load situation, while ensuring security and improving the system throughput.

[0026] 3. Due to the adoption of a three-level hierarchical protection mechanism based on resource sensitivity, differentiated security strategies such as lightweight, enhanced and double encryption are adopted for different levels of access resources. Therefore, the system can provide corresponding levels of protection measures according to the importance of resources, effectively solving the problem of resource waste caused by the "one-size-fits-all" security protection in the existing technology, and thus achieving fine-grained security protection and optimization of resource utilization. This hierarchical protection mechanism ensures the security of important resources and avoids over-protection of ordinary resources by configuring corresponding encryption algorithms and transmission channels for resources of different levels, thus achieving a balance between security and efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a flowchart of a distributed access control method based on blockchain in an embodiment of the present application; Figure 2 It is another flowchart of the distributed access control method based on blockchain in an embodiment of the present application; Figure 3 It is a schematic diagram of the structure of a physical device of the access control system in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The terms used in the following embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification of the present application, the singular expressions "one", "a kind of", "above", "the" and "this" are intended to also include plural expressions, unless there is a clear indication to the contrary in the context. It should also be understood that the term "and / or" used in the present application refers to any or all possible combinations comprising one or more of the listed items.

[0029] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0030] For ease of understanding, the application scenarios of the embodiments of the present application are introduced below.

[0031] A large financial institution has thousands of employees and numerous sensitive data systems. As the business expands, the system needs to process tens of thousands of access requests every day, involving information of multiple security levels such as customer information, transaction data, and risk control reports. Traditional central authentication servers often experience response delays when processing high-concurrency access, and once the server is attacked or fails, the entire access control system will be paralyzed, resulting in business interruption. In addition, since permission records are stored centrally, hackers can obtain or tamper with sensitive data by simply breaking into the main control server, posing a major security risk to the institution.

[0032] In the related art, unified permission management and access control are performed by using a central server to verify and respond to user access requests. The following describes the scenario of using the blockchain-based distributed access control method in the related art.

[0033] The financial institution originally used a traditional centralized access control system to manage all user permissions through a single authentication server. During a system upgrade, the main server suffered a DDoS attack, causing the entire system to be paralyzed for 4 hours. Thousands of employees were unable to access the business system, causing huge losses. The investigation found that the attacker also tried to tamper with the permission log in an attempt to cover up the intrusion. The centralized architecture has a serious single point failure risk and it is difficult to ensure data integrity.

[0034] By adopting the distributed access control method based on blockchain in the embodiment of the present application, decentralized secure access control is achieved through multiple nodes jointly maintaining access control policies and processing access requests, which not only improves system availability but also enhances data integrity. The following introduces the scenario in which the distributed access control method based on blockchain in the present application is used.

[0035] After financial institutions adopt a distributed access control system based on blockchain, they store access control policies in a blockchain network maintained by multiple authorized nodes. When Xiao Wang, an employee in the trading department, needs to access customer information, the system first receives his request, and then multiple authorized nodes verify his permissions in parallel. Even if one of the nodes fails, the other nodes can still work normally to ensure the continuous operation of the system. All access records are recorded on the blockchain, forming an unalterable audit chain, which effectively prevents internal cheating and external attacks. During peak hours, the system automatically reduces the difficulty of consensus to ensure rapid response to concurrent access requests from tens of thousands of users.

[0036] It can be seen that the distributed access control method based on blockchain in the embodiment of the present application can not only achieve efficient access control, but also effectively solve the problems of single point failure and data tampering, thereby achieving the reliability and security of the system.

[0037] For ease of understanding, the following describes the process of the method provided by this implementation in combination with the above scenario. Figure 1 , which is a flow chart of a distributed access control method based on blockchain in an embodiment of the present application.

[0038] S101. Generate an initial block on the blockchain network based on a preset access control policy and authorized node list.

[0039] Among them, access control policy refers to a set of rules pre-defined by the system for regulating user access rights, including user role definition, resource classification, access rules, etc.; the authorized node list represents a set of nodes that have been authenticated and can participate in the consensus and maintenance of the blockchain network; the blockchain network refers to a distributed network system composed of multiple authorized nodes; the initial block is used to represent the first block in the blockchain and contains basic access control information.

[0040] During the system initialization phase, the access control system needs to establish a basic blockchain network environment. Specifically, the system first reads the pre-configured access control policy file to verify its integrity and validity; then confirms the availability status of each node in the authorized node list; finally, serializes the access control policy, authorized node information and other data, and uses a predefined block structure to package this information to generate an initial block as the starting point of the blockchain.

[0041] In some embodiments, the generation process of the initial block can be implemented in a variety of ways: Optionally, it can be generated by the following steps: loading access control policies from configuration files; verifying the syntactic correctness of policies; encoding policy content to generate policy hashes; constructing block headers and block bodies; calculating block hash values. Optionally, it can be generated by the following steps: electing a master node through a consensus algorithm; the master node integrates the policy recommendations submitted by each node; generating a comprehensive strategy; writing the strategy into the block; broadcasting to other nodes for verification. It is understandable that other methods can also be used to generate the initial block, such as automatic generation through smart contracts, etc., which are not limited here.

[0042] S102: Receive and process access request information submitted by the user based on the authorized node list, and generate an access request transaction in a standard format.

[0043] Among them, access request information refers to the resource access application data initiated by the user, including user identity, target resources, operation type and other information; the access request transaction in the standard format represents the request data structure that has been standardized to ensure that the system can handle it uniformly; the authorized node refers to the blockchain network node that has the authority to process access requests.

[0044] When a user initiates an access request, the access control system needs to standardize the request. Specifically, the system first verifies the identity information of the request initiator and confirms the integrity of the request; then selects the appropriate node to process the request based on the authorized node list; finally, converts the request information into a predefined standard data format and generates a request transaction containing complete access control information.

[0045] In some embodiments, the access request processing process can be implemented in a variety of ways: Optionally, the following steps are used for processing: verifying the digital signature of the request; parsing the request content to extract key information; formatting the request data; adding a timestamp and a sequence number; generating a request transaction hash. Optionally, the following steps are used for processing: load balancing and distributing processing nodes; verifying the validity of the request in parallel; integrating the verification results; standardizing and encapsulating the request; broadcasting the request transaction. It is understandable that other methods can also be used to implement the processing of access requests, such as sequential processing using a queue mechanism, etc., which are not limited here.

[0046] S103: Perform authority verification on the access request transaction according to the access control policy in the initial block to obtain an authority verification result.

[0047] Among them, permission verification means judging the legitimacy of access requests according to access control policies; permission verification results refer to the judgment output of the verification process, including states such as allowed access and denied access; access control policies refer to the set of rules used to determine access rights.

[0048] After receiving the access request transaction in the standard format, the access control system needs to perform permission verification. Specifically, the system first reads the access control policy from the initial block; then matches the access information in the request transaction with the policy rules; finally, generates the permission verification result based on the matching result, including the verification status and related description information.

[0049] In some embodiments, the permission verification process can be implemented in a variety of ways: Optionally, verification is performed in accordance with the following steps: extracting a policy rule set; constructing a verification rule tree; traversing the rule tree for matching; recording the matching process; and generating a verification report. Optionally, verification is performed in accordance with the following steps: distributing verification tasks in parallel; verifying multiple nodes simultaneously; collecting verification results; comprehensively determining the results; and recording verification logs. It is understandable that permission verification can also be implemented in other ways, such as intelligent verification based on machine learning, which is not limited here.

[0050] S104: Based on the permission verification result, consensus confirmation is performed among the authorized nodes on the access request transaction that has passed the permission verification, and the confirmation result is packaged to generate a new block.

[0051] Among them, consensus confirmation refers to the process by which multiple nodes in a blockchain network reach an agreement on the same transaction; the confirmation result represents the output status of the consensus process; and the newly added block refers to the blockchain data block that contains the processing result of this access request.

[0052] After completing the permission verification, the access control system needs to reach a consensus in the network. Specifically, the system first broadcasts the verified request transaction to the authorized node; then each node votes to confirm according to the consensus algorithm; finally, the consensus result is packaged and a new block is generated to record the access control process.

[0053] In some embodiments, the consensus confirmation process can be implemented in a variety of ways: Optionally, it can be implemented through the following steps: broadcasting verified transactions; exchanging confirmation messages between nodes; counting confirmation votes; generating consensus proofs; packaging block data. Optionally, it can be implemented through the following steps: selecting a consensus node group; executing a Byzantine fault tolerance algorithm; recording the consensus process; verifying the consensus results; and building a new block. It is understandable that consensus confirmation can also be implemented in other ways, such as using a proof of stake mechanism, which is not limited here.

[0054] S105. Add the new block to the blockchain network and synchronize updates between authorized nodes.

[0055] Among them, synchronous update refers to the process of ensuring that all authorized nodes maintain the same copy of blockchain data; blockchain network refers to a distributed network composed of multiple authorized nodes; new blocks represent new data blocks that need to be added to the blockchain.

[0056] After consensus is confirmed, the access control system needs to update the blockchain status. Specifically, the system first verifies the validity of the newly added block; then adds the new block to the local blockchain; and finally ensures that all authorized nodes are updated to the latest status through the network synchronization mechanism to maintain the consistency of the blockchain.

[0057] In some embodiments, the block synchronization process can be implemented in a variety of ways: Optionally, synchronization is performed in the following steps: broadcast new block data; node verification of block validity; adding blocks to the local chain; updating chain status; confirming synchronization completion. Optionally, synchronization is performed in the following steps: shard transmission of block data; parallel verification of blocks; atomic update of the local chain; checking data consistency; feedback of synchronization status. It is understandable that other methods can also be used to achieve block synchronization, such as using an incremental synchronization mechanism, which is not limited here.

[0058] In the above embodiment, the system implements distributed access control through blockchain. In practical applications, the consensus difficulty can also be dynamically adjusted according to the load conditions, and differentiated encryption strategies can be adopted for different security levels. The following is a supplement to the scenario of this embodiment.

[0059] As business develops, financial institutions further optimize access control systems. The system automatically divides security levels according to resource sensitivity: lightweight encryption is used for ordinary market reports; enhanced encryption channels are used for customer transaction records; dual encryption mechanisms are enabled for core system configurations and keys are dynamically updated. When it is detected that user Xiao Li frequently attempts to access beyond his authority, the system automatically lowers his credit rating and increases the difficulty of access verification. When the network is congested, the system dynamically adjusts the complexity of the algorithm to ensure security while maintaining good performance, truly achieving a balance between security and efficiency.

[0060] After combining the above scenarios, the following is a more detailed description of the process of the method provided by this implementation. Figure 2 , which is another flow chart of the distributed access control method based on blockchain in an embodiment of the present application.

[0061] S201. Generate an initial block on the blockchain network based on a preset access control policy and authorized node list.

[0062] Referring to step S101, the access control system generates an initial block on the blockchain network.

[0063] S202: Receive and process access request information submitted by the user based on the authorized node list, and generate an access request transaction in a standard format.

[0064] Referring to step S102 , the access control system generates an access request transaction.

[0065] S203: Perform authority verification on the access request transaction according to the access control policy in the initial block to obtain an authority verification result.

[0066] Referring to step S103, the access control system determines the authority verification result.

[0067] S204: Based on the authority verification result, consensus confirmation is performed between the authorized nodes on the access request transaction that has passed the authority verification to obtain a confirmation result.

[0068] Among them, the permission verification result represents the output information of the security check on the access request, including verification status, verification time and other data; consensus confirmation refers to the process by which the authorized nodes reach an agreement on the request processing results; the confirmation result is used to represent the final state of the consensus process; the consensus among authorized nodes refers to the mechanism by which nodes with voting rights confirm the same transaction.

[0069] When the system obtains the permission verification result, it needs to ensure that all authorized nodes in the network reach a consensus on the result. Specifically, the system first broadcasts the verified access request transaction information to all authorized nodes; then starts the preset consensus algorithm to collect confirmation information from each node; finally, the confirmation results are counted to form the final consensus state to ensure consistency in the network.

[0070] In some embodiments, the consensus confirmation process can be implemented in a variety of ways: Optionally, the following steps are performed: construct a consensus proposal; broadcast to authorized nodes; nodes verify the legitimacy of the proposal; execute the voting process; count the voting results; generate a consensus certificate. Optionally, the following steps are performed: select a leader node; generate a pre-confirmation message; collect node responses; verify the validity of the response; reach a final confirmation; record the confirmation results. It is understandable that other methods can also be used to achieve consensus confirmation, such as using a hybrid consensus mechanism or a multi-round voting mechanism, which is not limited here.

[0071] S205. Obtain the system load status of the blockchain network.

[0072] Among them, the system load status indicates the current resource usage of the blockchain network, including indicators such as CPU usage, memory usage, and network bandwidth utilization; the blockchain network refers to a distributed system composed of multiple authorized nodes; load monitoring indicators are used to represent quantitative data on system performance and resource usage.

[0073] Before consensus processing, the access control system needs to evaluate the processing capacity of the current network. Specifically, the system first collects the resource usage of each authorized node; then calculates the average load level of the entire network; and finally compares the calculation result with the preset load reference value for subsequent performance optimization decisions.

[0074] In some embodiments, system load monitoring can be implemented in a variety of ways: Optionally, the following steps are performed: collecting node performance data; calculating resource utilization; counting network throughput; evaluating processing queue length; generating load reports. Optionally, the following steps are performed: deploying monitoring probes; collecting indicator data in real time; aggregating and analyzing data; predicting load trends; and updating status records. It is understandable that other methods can also be used to implement system load monitoring, such as distributed monitoring or intelligent load prediction, which are not limited here.

[0075] S206. When it is detected that the system load exceeds the preset high-voltage threshold, the consensus difficulty coefficient of the blockchain network is reduced and the block generation interval is shortened.

[0076] Among them, the preset high-voltage threshold represents the maximum load level that the system can withstand; the consensus difficulty coefficient refers to the adjustable parameter that affects the speed of reaching consensus; the block generation interval is used to represent the time difference between the generation of adjacent blocks; and the system performance optimization index represents the various parameters used to adjust the system performance.

[0077] When the system detects that the load is too high, it needs to adjust parameters to improve processing efficiency. Specifically, the system first compares the current load with the preset threshold; then calculates the new difficulty coefficient based on the degree of excess; and finally adjusts the block generation time parameters to improve system throughput by reducing calculation complexity.

[0078] In some embodiments, performance parameter adjustment can be achieved in a variety of ways: Optionally, the following steps are performed: calculate load deviation value; generate adjustment plan; update difficulty parameter; modify time interval; verify adjustment effect; synchronize configuration update. Optionally, the following steps are performed: evaluate performance bottleneck; calculate optimal parameters; gradually adjust difficulty; monitor system response; optimize generation strategy; record adjustment process. It is understandable that other methods can also be used to achieve performance optimization, such as adaptive parameter adjustment or dynamic load balancing, which are not limited here.

[0079] It should be noted that the dynamic load balancing in this application can use a dynamic threshold adjustment model, which inputs historical load data (including CPU usage, memory occupancy, network bandwidth utilization, request queue length, etc.) and corresponding system performance indicators (response time, throughput, etc.) during training, and establishes a load-performance mapping relationship through supervised learning. The training goal is to minimize the error between the predicted threshold and the optimal threshold, while considering the system stability constraint. The dynamic threshold adjustment model adopts an adaptive algorithm, including a load evaluation layer, a threshold calculation layer, and a parameter optimization layer. The load evaluation layer normalizes and extracts features of multi-dimensional system indicators; the threshold calculation layer dynamically calculates the appropriate difficulty coefficient based on the current load state; the parameter optimization layer continuously adjusts the model parameters through a feedback mechanism. By inputting the system load indicators in real time, the dynamic threshold adjustment model can output the current optimal consensus difficulty coefficient and block generation interval. When it is detected that the load exceeds the preset threshold, the difficulty coefficient is automatically reduced to speed up the processing speed; when the load is low, the difficulty is appropriately increased to ensure safety. The system dynamically adjusts the consensus mechanism based on the output parameters to achieve a balance between performance and security.

[0080] S207. Consensus voting is performed among authorized nodes based on the adjusted consensus difficulty coefficient, and a new block is generated when the number of votes exceeds a preset confirmation threshold.

[0081] Among them, the consensus difficulty coefficient refers to the adjustment parameter that affects the difficulty of block generation; consensus voting refers to the process of authorized nodes confirming the validity of blocks; the preset confirmation threshold refers to the minimum number of votes required to determine whether a consensus has been reached; and the newly added block is used to represent the data block to be added to the blockchain.

[0082] After completing the system parameter adjustment, the access control system needs to execute the block generation process. Specifically, the system first initializes the consensus environment based on the adjusted difficulty coefficient; then organizes the authorized nodes to vote and confirm; finally, after collecting a sufficient number of confirmation votes, it generates a new block in a predetermined format and verifies the validity of the block.

[0083] In some embodiments, the block generation process can be implemented in a variety of ways: Optionally, the following steps are performed: construct block proposals; distribute voting requests; collect node votes; verify voting validity; count voting results; package and generate blocks. Optionally, the following steps are performed: select block proposers; broadcast block templates; execute consensus algorithms; verify the number of votes; check threshold conditions; confirm block generation. It is understandable that other methods can also be used to implement block generation, such as sharding or parallel consensus, which are not limited here.

[0084] S208. Based on the authority verification result, create an access exception record for the access request transaction that fails the authority verification.

[0085] Among them, the permission verification result indicates the audit status of the access request; the access exception record refers to the detailed record of the access request that failed the verification; failure of permission verification means that the access request violates the preset access control policy; the exception record attributes include time, type, reason and other information.

[0086] When the system detects an access request that fails verification, it needs to create a corresponding exception record. Specifically, the system first extracts the details of the request that fails verification; then analyzes the failure cause and determines the type of exception; finally, the exception information is recorded and stored in a standard format for subsequent security analysis and user credit assessment.

[0087] In some embodiments, the establishment of exception records can be implemented in a variety of ways: Optionally, the following steps are performed: extract verification failure information; analyze the cause of the exception; classify the exception type; generate an exception report; store the exception record; trigger the alarm mechanism. Optionally, the following steps are performed: collect environmental data; locate the source of the exception; evaluate the scope of impact; record detailed information; establish correlation analysis; update the exception library. It is understandable that other methods can also be used to implement exception records, such as intelligent exception classification or real-time risk assessment, which are not limited here.

[0088] S209: Determine the user's credit rating according to the cumulative number of abnormal access records, and adjust the user's access authority threshold accordingly.

[0089] Among them, the cumulative number of access exception records represents the total number of abnormal accesses generated by the user; the credit level refers to the credit assessment result of the user; the access permission threshold is used to indicate the level of resources that the user can access; and the user credit assessment index includes factors such as abnormal frequency and severity.

[0090] When the system has accumulated enough abnormal records, it needs to conduct a credit assessment on the user. Specifically, the system first counts the number of abnormal records of the user; then calculates the credit score according to the preset assessment rules; and finally adjusts the user's access rights based on the new credit level to implement a dynamic permission management mechanism.

[0091] In some embodiments, credit assessment adjustment can be implemented in a variety of ways: Optionally, the following steps are performed: count the number of abnormalities; calculate the credit score; determine the credit level; update the permission configuration; record the adjustment history; notify the relevant parties. Optionally, the following steps are performed: extract abnormal patterns; evaluate the impact of abnormalities; calculate the attenuation coefficient; generate a credit report; adjust the access policy; monitor the effect of the adjustment. It is understandable that other methods can also be used to implement credit management, such as multi-dimensional credit assessment or behavioral analysis, which are not limited here.

[0092] It should be noted that the credit assessment in this application can use a credit assessment model; the credit assessment model inputs the user's historical access records (including the number, type, frequency, etc. of abnormal access) and security event data during training, and identifies abnormal behavior patterns through unsupervised learning. The training goal is to maximize the distinction between normal access and abnormal access and establish a reasonable credit scoring standard. The credit assessment model includes a behavior analysis module, a scoring calculation module, and a grading module. The behavior analysis module extracts features from user access patterns; the scoring calculation module comprehensively evaluates user credit based on multi-dimensional indicators; the grading module dynamically adjusts the credit grade threshold. By inputting user access behavior data in real time, the credit assessment model can output the user's credit score and grade. Dynamically adjust the user's access permission threshold based on the evaluation results, increase the difficulty of access verification for low-credit users, and implement differentiated access control based on credit.

[0093] In some embodiments, the access control system will also increase the difficulty of user access verification within a preset time period when it detects that the user's credit level is lower than a preset level; package the access exception records, credit level adjustment information and restriction policy execution status to generate an exception handling block, and add the exception handling block to the blockchain network.

[0094] Among them, credit rating refers to the user's credit assessment result; preset rating represents the credit baseline set by the system; access verification difficulty is used to indicate the complexity of user identity authentication and authority verification; access exception record refers to the user's illegal access history; credit rating adjustment information represents a detailed record of user credit changes; restriction policy execution status is used to indicate the execution of restriction measures taken against the user; exception handling block refers to a blockchain data structure that records user abnormal behavior and processing results.

[0095] When the system needs to implement special management for low-credit users, the credit management mechanism will be activated. Specifically, the system first compares the user's current credit rating with the preset benchmark; then increases the user's identity verification frequency and verification steps within a specified time; finally, the information of the entire processing process is packaged into blocks and added to the blockchain to ensure the immutability and traceability of the records.

[0096] In some embodiments, the credit management process can be implemented in a variety of ways: Optionally, the following steps are performed: monitor credit rating changes; trigger restriction strategies; adjust verification parameters; record processing; generate abnormal blocks; and update the blockchain synchronously. Optionally, the following steps are performed: analyze the reasons for credit decline; formulate restriction plans; implement temporary control; evaluate the control effect; record the complete process; and maintain the blockchain status. It is understandable that other methods can also be used to implement credit management, such as progressive restrictions or multi-dimensional control, which are not limited here.

[0097] S210, adding the new block to the blockchain network and performing synchronous updates between authorized nodes.

[0098] Referring to step S105, the access control system will add the newly added block to the blockchain network.

[0099] S211. Analyze the user's access request information and determine the access resource.

[0100] Among them, the access request information represents the resource request data initiated by the user, including the request type, target resource identifier, etc.; the parsing process refers to the steps of structured processing of the request information; the access resource is used to represent the target data or service that the user wants to obtain; the resource identifier represents the index information that uniquely locates the resource in the system.

[0101] When the system needs to process a specific access request, it must first determine the specific target of the request. Specifically, the system first verifies the format of the received request information; then parses the resource identifier and access parameters in the request; and finally determines the specific location and basic properties of the target resource through the resource location mechanism.

[0102] In some embodiments, the request parsing process can be implemented in a variety of ways: Optionally, the following steps are performed: verify the request format; extract the resource identifier; parse the request parameters; verify the validity of the parameters; locate the target resource; return the resource information. Optionally, the following steps are performed: decompose the request structure; normalize the request data; match the resource mapping; verify the existence of the resource; obtain the resource attributes; generate the resource description. It is understandable that other methods can also be used to implement request parsing, such as semantic parsing or intelligent resource matching, which are not limited here.

[0103] S212: Obtain the sensitivity level of the access resource and determine the encryption strength and transmission strategy corresponding to the access resource.

[0104] Among them, the sensitivity level indicates the importance of the resource and the level of security requirements; encryption strength refers to the complexity and security of the data encryption algorithm; the transmission strategy is used to indicate the security protection measures adopted during resource transmission; resource security attributes include confidentiality, integrity, availability and other characteristics.

[0105] After determining the access resource, the system needs to evaluate the security requirements of the resource. Specifically, the system first retrieves the sensitivity configuration information of the resource; then selects the corresponding encryption algorithm and security parameters according to the sensitivity level; and finally formulates a transmission strategy that meets the security requirements to ensure the security of the resource transmission process.

[0106] In some embodiments, security policy determination can be implemented in a variety of ways: Optionally, the following steps are performed: query sensitivity configuration; evaluate security requirements; select encryption algorithm; configure encryption parameters; formulate transmission plan; verify policy validity. Optionally, the following steps are performed: obtain resource tags; analyze security attributes; match security templates; optimize encryption plans; generate transmission rules; record policy configuration. It is understandable that other methods can also be used to implement security policy determination, such as dynamic policy adjustment or multi-layer security protection, which are not limited here.

[0107] In some embodiments, the access control system will classify the access resources according to the sensitivity level of the access resources, and obtain ordinary level, important level and confidential level; when the access resources are at ordinary level, the encryption strength and transmission strategy are set to lightweight encryption algorithm and standard transmission channel; when the access resources are at important level, the encryption strength and transmission strategy are set to enhanced encryption algorithm and encrypted communication tunnel; when the access resources are at confidential level, the encryption strength and transmission strategy are set to double encryption mechanism and dedicated secure channel, and the encryption key is dynamically adjusted during the transmission process.

[0108] Among them, sensitivity level refers to the security importance of resources; access resource classification means dividing resources into levels according to security requirements; encryption strength is used to indicate the security level of encryption algorithm; transmission strategy refers to the security protection scheme for data transmission; encrypted communication tunnel refers to a secure data transmission channel; dynamic encryption key refers to the encryption key updated in real time during the transmission process.

[0109] When the system needs to process resource access requests of different security levels, it will start the hierarchical protection mechanism. Specifically, the system first determines the sensitivity level of the resource based on its characteristics; then selects the corresponding encryption algorithm and transmission scheme for different levels; finally, implements corresponding security protection measures according to the level requirements to ensure the security of resource access.

[0110] In some embodiments, the hierarchical protection process can be implemented in a variety of ways: Optionally, the following steps are performed: assess resource sensitivity; determine protection level; select encryption scheme; configure transmission channel; implement security measures; monitor protection effect. Optionally, the following steps are performed: analyze resource attributes; match security templates; deploy encryption algorithms; establish secure channels; perform transmission control; record protection logs. It is understandable that other methods can also be used to implement hierarchical protection, such as adaptive security policies or multi-level protection, which are not limited here.

[0111] It should be noted that the resource sensitivity assessment model can be used for the assessment of resource sensitivity in this application; the resource sensitivity assessment model inputs resource feature data (such as resource type, importance, access frequency, etc.) and security level annotations during training, and establishes a resource classification model through supervised learning. The training goal is to accurately divide resource security levels and optimize encryption policy allocation. The resource sensitivity assessment model includes a feature extraction layer, a classification decision layer, and a policy matching layer. The feature extraction layer analyzes resource attributes; the classification decision layer determines the resource sensitivity level; the policy matching layer assigns corresponding encryption and transmission schemes to resources of different levels. By inputting resource-related information, the resource sensitivity assessment model can output the resource sensitivity level and the corresponding security policy. Based on this, the system selects appropriate encryption algorithms and transmission channels to achieve differentiated protection of resource access.

[0112] S213. Based on the encryption strength and transmission strategy, return the access resource to the user.

[0113] Among them, encryption strength refers to the level of encryption algorithm used to protect data; transmission policy refers to the set of rules that specify resource transmission methods and security measures; resource return process refers to the operation of securely delivering requested resources to users; secure transmission channel refers to the encrypted link used to protect data transmission.

[0114] After completing the security policy configuration, the system needs to perform resource transmission operations. Specifically, the system first encrypts the resources according to the determined encryption strength; then establishes a secure transmission channel according to the transmission policy; and finally transmits the encrypted resource data to the requesting user through the channel, ensuring the security of the transmission process.

[0115] In some embodiments, secure resource transmission can be achieved in a variety of ways: Optionally, the following steps are performed: prepare resource data; perform encryption operations; establish a secure session; transmit encrypted data; verify transmission integrity; confirm reception status. Optionally, the following steps are performed: slice resource data; parallel encryption processing; select transmission routes; establish an encryption channel; perform secure transmission; monitor the transmission process. It is understandable that other methods can also be used to achieve resource transmission, such as breakpoint resume or multi-path transmission, which are not limited here.

[0116] In some embodiments, the access control system obtains network delay information and calculates a real-time network performance score; the network delay information includes communication delay between nodes and data packet transmission time; when the network performance score is lower than a preset low-quality threshold, the complexity of the encryption algorithm is reduced.

[0117] Among them, network delay information represents the time delay data of network transmission; network performance score value refers to the quantitative evaluation result of network quality; inter-node communication delay is used to represent the data transmission time between blockchain nodes; data packet transmission time represents the transmission time of a single data packet in the network; preset low-quality threshold refers to the minimum network performance standard defined by the system.

[0118] When the system needs to optimize network transmission performance, it will start the performance monitoring mechanism. Specifically, the system first collects various network delay data; then calculates the network performance score according to the preset algorithm; finally, dynamically adjusts the complexity of the encryption algorithm according to the performance evaluation results, improving transmission efficiency while ensuring security.

[0119] In some embodiments, the performance optimization process can be implemented in a variety of ways: Optionally, the following steps are performed: collect delay data; calculate performance scores; evaluate network status; adjust encryption parameters; monitor optimization effects; update system configuration. Optionally, the following steps are performed: monitor network indicators; analyze performance bottlenecks; generate optimization plans; implement parameter adjustments; verify adjustment effects; record optimization processes. It is understandable that other methods can also be used to achieve performance optimization, such as intelligent load balancing or adaptive transmission control, which are not limited here.

[0120] In the embodiment of the present application, since a distributed access control system is constructed using blockchain technology and combined with a dynamic threshold adjustment algorithm and a hierarchical encryption transmission scheme, decentralized authority management and secure access control are achieved. The system adopts a multi-node consensus mechanism when maintaining access control policies, dynamically adjusts performance parameters according to the load when processing access requests, and adopts differentiated encryption protection for resources at different levels, effectively solving the single point failure risks, performance bottlenecks, and insufficient security protection problems existing in traditional centralized architectures, thereby achieving high availability of the system, good real-time performance, and comprehensive security protection, and improving the reliability, efficiency, and security of the access control system.

[0121] The access control system in the embodiment of the present invention is described below from the perspective of hardware processing. Figure 3 , is a schematic diagram of a physical device structure of an access control system in an embodiment of the present application.

[0122] It should be noted that Figure 3 The structure of the access control system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0123] like Figure 3As shown, the access control system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage part 308 to the random access memory (RAM) 303, such as executing the method described in the above embodiment. In the RAM 303, various programs and data required for system operation are also stored. The CPU 301, the ROM 302 and the RAM 303 are connected to each other through the bus 304. The input / output (I / O) interface 305 is also connected to the bus 304.

[0124] The following components are connected to the I / O interface 305: an input section 306 including an audio input device, a button switch, etc.; an output section 307 including a liquid crystal display (LCD) and an audio output device, an indicator light, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 310 as needed so that a computer program read therefrom is installed into the storage section 308 as needed.

[0125] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 309, and / or installed from a removable medium 311. When the computer program is executed by the central processing unit (CPU) 301, various functions defined in the present invention are performed.

[0126] It should be noted that specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device.

[0127] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. Each box in the flowchart or block diagram may represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings.

[0128] Specifically, the access control system of this embodiment includes a processor and a memory. A computer program is stored in the memory. When the computer program is executed by the processor, the distributed access control method based on blockchain provided in the above embodiment is implemented.

[0129] As another aspect, the present invention further provides a computer-readable storage medium, which may be included in the access control system described in the above embodiment; or may exist independently without being assembled into the access control system. The above storage medium carries one or more computer programs, and when the above one or more computer programs are executed by a processor of the access control system, the access control system implements the distributed access control method based on blockchain provided in the above embodiment.

[0130] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0131] As used in the above embodiments, the term "when..." may be interpreted to mean "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. Similarly, the phrases "upon determining..." or "if (the stated condition or event) is detected" may be interpreted to mean "if determining..." or "in response to determining..." or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)", depending on the context.

[0132] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

Claims

1. A distributed access control method based on blockchain, characterized in that: Applied to an access control system, the method comprises: Generate the initial block on the blockchain network based on the preset access control policy and authorized node list; Receive and process access request information submitted by the user based on the authorized node list, and generate an access request transaction in a standard format; Performing permission verification on the access request transaction according to the access control policy in the initial block to obtain a permission verification result; Based on the permission verification result, the access request transaction that has passed the permission verification is confirmed by consensus among the authorized nodes, and the confirmation result is packaged to generate a new block; The newly added block is added to the blockchain network and synchronized and updated between authorized nodes.

2. The method according to claim 1, characterized in that After the step of performing permission verification on the access request transaction according to the access control policy in the initial block to obtain a permission verification result, the method further includes: Based on the permission verification result, creating an access exception record for the access request transaction that fails the permission verification; The credit rating of the user is determined according to the accumulated number of abnormal access records, and the access authority threshold of the user is adjusted accordingly.

3. The method according to claim 2, characterized in that After the step of determining the user's credit rating according to the cumulative number of abnormal access records and adjusting the user's access authority threshold accordingly, the method further includes: When it is detected that the credit rating of the user is lower than a preset rating, increasing the difficulty of access verification of the user within a preset time period; The access exception record, credit rating adjustment information and restriction policy execution status are packaged to generate an exception handling block, and the exception handling block is added to the blockchain network.

4. The method according to claim 1, characterized in that: The step of performing consensus confirmation on the access request transaction that has passed the authority verification among the authorized nodes based on the authority verification result, and packaging the confirmation result to generate a new block specifically includes: Based on the permission verification result, the access request transaction that has passed the permission verification is confirmed by consensus among the authorized nodes to obtain a confirmation result; Obtaining the system load status of the blockchain network; When it is detected that the system load exceeds a preset high-voltage threshold, the consensus difficulty coefficient of the blockchain network is reduced and the block generation interval is shortened; Consensus voting is conducted among authorized nodes based on the adjusted consensus difficulty coefficient, and new blocks are generated when the number of votes exceeds the preset confirmation threshold.

5. The method according to claim 1, characterized in that: After the step of adding the newly added block to the blockchain network and performing synchronous updates between authorized nodes, the method further includes: Parsing the access request information of the user to determine access resources; Obtaining the sensitivity level of the access resource, and determining the encryption strength and transmission strategy corresponding to the access resource; Based on the encryption strength and the transmission policy, the access resource is returned to the user.

6. The method according to claim 5, characterized in that Before the step of obtaining the sensitivity level of the access resource and determining the encryption strength and transmission strategy corresponding to the access resource, the method further includes: According to the sensitivity level of the access resource, the access resource is graded to obtain a normal level, an important level and a confidential level; When the access resource is at a normal level, the encryption strength and transmission strategy are set to a lightweight encryption algorithm and a standard transmission channel; When the access resource is at an important level, the encryption strength and transmission strategy are set to an enhanced encryption algorithm and an encrypted communication tunnel; When the access resource is at a confidential level, the encryption strength and transmission strategy are set to a double encryption mechanism and a dedicated security channel, and the encryption key is dynamically adjusted during the transmission process.

7. The method according to claim 5, characterized in that After the step of returning the access resource to the user based on the encryption strength and the transmission strategy, the method further includes: Obtaining network delay information and calculating a real-time network performance score; the network delay information includes inter-node communication delay and data packet transmission time; When the network performance score is lower than a preset low-quality threshold, the complexity of the encryption algorithm is reduced.

8. An access control system, characterized in that: The access control system includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the access control system to execute the method described in any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that: When the instruction is executed on an access control system, the access control system is caused to execute the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that When the computer program product is run on an access control system, the access control system is caused to execute the method according to any one of claims 1 to 7.

Images