Block chain-based cross-domain data sharing system and method in industrial Internet of Things

Abstract

The invention discloses a cross-domain data sharing system and method based on a block chain in an industrial internet of things, and the method comprises the steps: carrying out the identity registration of a user and equipment under each mechanism in an alliance chain system on a chain, and enabling a data sharing party to upload resources and strategies to an IPFS system; formulating a cross-domain attribute-based access control strategy according to an alliance mechanism, and uploading intra-domain metadata to an alliance block chain by a domain main management end of each domain through a contract; an access party applies for accessing data information of other domain device ends through a department management end, an accessed party detects the identity and access authority of a visitor through an intelligent contract, a domain master device carries out identity verification and access authorization, and after authorization is passed, cross-domain users carry out key negotiation; and the cross-domain user transmits the link of the IPFS system according to the negotiated key, so that both parties having the same negotiated key can share data information. According to the invention, data integrity and secure data sharing are realized.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain technology and data sharing, and in particular to a cross-domain data sharing system and method based on blockchain in an industrial Internet of Things. Background Art

[0002] As the number of connected things in the IoT system increases, the demand for cross-domain collaboration in the Industrial IoT is becoming more and more common. There is a trust gap between users and devices in different domains, and the security, integrity and trust management of data sharing face great challenges. If there is a lack of trust between domains and no secure identity authentication, the devices involved in the collaboration will be vulnerable to threats. In addition, data transmission in interactive collaboration is often carried out in unsecure channels, which will threaten the security of data. This further leads to the leakage of user privacy and security.

[0003] The key to solving cross-domain trust is identity authentication, while traditional identity authentication schemes usually rely on central servers, which have security risks of single point failure and centralized management. Blockchain technology has broad application prospects in industrial IoT identity management. It can solve the key challenges of large-scale IoT device identity issues by providing a unified, interoperable, and tamper-proof infrastructure. Blockchain adopts a decentralized approach to record and verify each identity through a distributed ledger, eliminating the risk of single point failure and improving the robustness and security of the system. Therefore, it is necessary to use blockchain to design a unified data sharing solution between different domains for trusted data transmission. Summary of the invention

[0004] The present invention provides a cross-domain data sharing system and method based on blockchain in an industrial Internet of Things scenario, which is used to solve the low security and data incompleteness of data transmission in the prior art, and the problem of distrust in cross-domain sharing, and realize the security and integrity of data transmission in sharing while effectively solving the problem of cross-domain untrustworthiness.

[0005] To achieve the above objectives, the present invention provides a cross-domain data sharing system and method based on blockchain in the industrial Internet of Things. Among them, a cross-domain data sharing method based on blockchain in the industrial Internet of Things includes:

[0006] The users and devices of each organization in the alliance chain system are registered on the chain, and the data sharing party uploads resources and policies to the IPFS system;

[0007] According to the cross-domain attribute-based access control policy formulated by the alliance organization, the domain master management end of each domain uploads the metadata within the domain to the alliance blockchain through the contract;

[0008] The accessing party applies to access the data information of other domain devices through the department management end. The accessed party detects the identity and access rights of the visitor through the smart contract. The domain master device performs identity authentication and access authorization. After the authorization is passed, the cross-domain users negotiate the key.

[0009] Cross-domain users transmit the link of the IPFS system based on the negotiated key, allowing both parties with the same negotiated key to share data information.

[0010] Preferably, the process of registering the identities of users and devices under each organization in the alliance chain system on the chain includes:

[0011] Register the devices and users of each organization in the alliance chain system with their own on-chain identity DID, and use it as the identity credential on the chain;

[0012] The device and user use identity encryption-based authentication to authenticate the domain before joining the alliance chain system. After the domain authentication is successful, the domain key manager issues an identity token to the device and user and registers them as nodes on the chain.

[0013] The successfully registered node generates the corresponding on-chain public and private key pair, where the public key address serves as the only on-chain identity credential.

[0014] Preferably, the process of performing intra-domain identity authentication based on identity encryption includes:

[0015] DS selects a secure random number R, R∈[1,n], n is a 256-bit large prime number, and generates its own anonymous identity DID=Hash(ID+R) based on the random number and its own identity ID; wherein DS is a common device user terminal;

[0016] DS initiates an identity certificate application and uses DS's private key Anonymous identity information for signing DS

[0017] Verify the identity of DS and sign the information through the identity domain manager of DS:

[0018]

[0019] The domain manager MG issues the identity credentials of the devices and users in the domain, and the AS signs the identity using the private key on the blockchain: Among them, the AS is the proxy device of the domain master on the blockchain network BC, responsible for the verification and management of the identity and data on the blockchain;

[0020]

[0021] DS initiates a registration request to the blockchain network BC;

[0022] The consortium blockchain uses the on-chain public key of the corresponding AS in the corresponding domain to verify its identity credentials:

[0023]

[0024] The alliance blockchain issues certificates in the alliance system to DS devices or users to complete intra-domain identity authentication.

[0025] Preferably, the process of data sharing parties uploading resources and policies to the IPFS system includes:

[0026] After the device and user's verification token authentication is registered and the on-chain identity is obtained, the data sharing participants can use the domain master management end AS i Resources and policies are stored on the blockchain, and then users and devices between different domains share data across domains, and set corresponding access control policies based on the attribute information and data resource information of each domain device user.

[0027] Preferably, after the device and user's verification token identity authentication registration is completed and the on-chain identity is obtained, the data sharing participants can use the domain master management end AS i The process of storing resources and policies on the blockchain includes:

[0028] The DS in domain A initiates an access request to the BS in other domains in the alliance blockchain through the BS. After receiving the request, the BS in domain A detects whether the DS has an identity certificate on the chain, verifies the signature of the certificate using the public key of domain A, and verifies whether the DS is a device or user in domain A. Among them, the DS is a common device user end;

[0029] After the BS in domain A passes the verification, it publishes the application request to the on-chain message. After receiving the request, the BS in domain B triggers the smart contract of AC, executes the access control policy to match the policy attributes, and returns the information that the access control is successful when the attributes of the visitor and the requested operation meet the attributes of the accessed resources.

[0030] Preferably, the process of detecting whether the DS has an identity certificate on the chain, using the public key of domain A to verify the signature of the certificate, and verifying whether the DS is a device or user in domain A includes:

[0031] Verify the on-chain identity of the node by calling the storage contract to query the unique address Addr on the chain in the form of a key-value pair to detect whether it is a node in the system;

[0032] Call the monitoring contract to check whether it is in the malicious list Blacklist. When a node with malicious behavior is found, call setBlackList(Addr) in the contract. Nodes in the malicious list cannot pass verification and data sharing. At the same time, the number of malicious times of the node is selected according to the tolerance of the system. When the number of malicious times exceeds the tolerance, it will be added to the permanent blacklist;

[0033] Call the policy decision contract to compare and decide on the attributes of the visitor with the attributes and operations of the resources to be accessed on the chain. When all conditions are met, a message indicating that access is passed is returned, otherwise the access control fails.

[0034] Preferably, the process of performing key negotiation between two cross-domain users includes:

[0035] The ECDHE-based key negotiation method is used to enable cross-domain users to negotiate keys. and the visited party Each of them selects their own random number as their own private key, and calculates the corresponding negotiated public key based on their own private key. and

[0036] Use the on-chain private key SK to respectively and Sign and verify the signature using the public key on the chain. After the verification is passed, the corresponding negotiated public key is used to calculate the negotiated key K.

[0037] Preferably, before the cross-domain users transmit the link of the IPFS system according to the negotiated key, the data integrity of the cross-domain data sharing is also verified;

[0038] The process of verifying the integrity of cross-domain data sharing includes:

[0039] After receiving the data, the data applicant will hash the data and compare it with the data hash information stored on the chain. If they are exactly the same, it means the data is correct;

[0040] When the data is incomplete, the verification function on the chain is activated to analyze the authenticity of the data. The validators in the alliance chain analyze the data, trace back and verify the transaction.

[0041] Preferably, when the data is incomplete, the verification function on the chain is started to analyze the authenticity of the data. The verifier in the alliance chain analyzes the data, and the process of tracing and verifying the transaction includes:

[0042] Transaction information on the chain, data sharing The encrypted data hash(data ipfs ))Sent to the blockchain via BS;

[0043] The BS of the accessing party receives the shared data information and sends it to the data requester. Using on-chain private keys And K decrypts the sent information

[0044] After successful decryption, find IPFS to search for keywords and find the corresponding data;

[0045] By judging the query data (hash (data ipfs )) Verify the correctness of the data by checking whether it is consistent with the data on the chain.

[0046] The present invention also provides a cross-domain data sharing system based on blockchain in an industrial Internet of Things, comprising:

[0047] The alliance chain module is used to form an alliance blockchain by combining management nodes in industrial organizations through protocols;

[0048] Smart contract module, which is used to implement access control code in cross-domain sharing. It interacts with the alliance chain module through contracts to achieve identity authentication and access authorization detection between different domains.

[0049] A data storage module, used for storing different types of data;

[0050] Industrial IoT devices, including but not limited to domain master management end AS i , Department Management BS i and DS on common resource-constrained devices i , where the domain master management end and department management end in multiple institutions serve as the main nodes, and the resource-constrained device end serves as the light node, together forming the alliance chain system.

[0051] Compared with the prior art, the present invention has the following advantages and technical effects:

[0052] The present invention uses the alliance chain in blockchain technology to require network nodes to undergo identity authentication and authorization before joining, which ensures the credibility and security of participating nodes, making it suitable for scenarios where multiple organizations need to jointly manage and share data. In addition, nodes can be supervised by designing smart contracts, thereby monitoring every transaction executed.

[0053] The present invention uses the alliance blockchain to build a trust bridge between institutions. Each institutional domain has a representative node responsible for maintaining the global account book. An attribute-based access control scheme is designed to promote cross-domain interaction and effectively solve the fine-grained access control in data sharing. The malicious behavior of node sharing participants is constrained through certain penalties, which encourages nodes to actively share safely. At the same time, in order to protect data from malicious attacks, a designed key negotiation scheme is adopted to ensure data security sharing. In secure sharing, access control, key negotiation and blockchain are combined to achieve data integrity and secure data sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0055] Figure 1 A schematic diagram of the system structure of an embodiment of the present invention;

[0056] Figure 2 A schematic diagram of a blockchain node according to an embodiment of the present invention;

[0057] Figure 3 This is an overall flow chart of data sharing in an embodiment of the present invention;

[0058] Figure 4 This is a flow chart of obtaining on-chain identity credentials for intra-domain identity authentication in an embodiment of the present invention. DETAILED DESCRIPTION

[0059] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0060] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0061] The organizations and institutions participating in the collaborative sharing in the Industrial Internet of Things form a consortium blockchain system, which can supervise and trace the correctness of the data source and ensure the integrity of the data. The devices in the Industrial Internet of Things are composed of many different types of devices such as ordinary users, department management devices, domain management devices, etc. Due to the different functions of the devices, their storage and computing capabilities are also different. Ordinary physical devices such as cameras and industrial machinery have weak storage and computing capabilities, and with the addition of a large number of devices and data transmission in the blockchain, full nodes need to have strong computing processing capabilities and space to store data. Therefore, using these devices with weak computing capabilities as light nodes can solve the problem of limited device resources, and light nodes do not need to reach consensus and synchronously store the data of the entire blockchain at the same time as full nodes.

[0062] To this end, this embodiment provides a cross-domain data sharing system and method based on blockchain in the industrial Internet of Things. The method includes cross-domain sharing between multiple institutions. The cross-domain data sharing method process is as follows: Figure 2-3 As shown, the specific steps are as follows:

[0063] Step 1: User and device identity registration on the chain;

[0064] Step 2: The data sharing party uploads resources and strategies to the IPFS system;

[0065] Step 3: The alliance organization formulates a cross-domain attribute-based access control policy;

[0066] Step 4: The domain master management end AS of each domain i Upload the metadata in the domain to the alliance blockchain through the contract;

[0067] Step 5: The access party accesses the department management terminal BS i Apply to access DS on other domain devices i data information;

[0068] Step 6: The visited party detects the visitor’s identity and access rights through the smart contract, and the domain master device performs identity authentication and access authorization;

[0069] Step 7: After authorization is passed, the two cross-domain users negotiate the key;

[0070] Step 8: Cross-domain users transmit the link of the IPFS system based on the negotiated key. Only two parties with the same negotiated key can share data information.

[0071] Furthermore, in step 1, each device and user under each organization in the alliance chain system needs to register their own on-chain identity DID and use it as the identity credential on the chain;

[0072] In the sharing system, the first thing to do is to solve the problem of untrusted cross-domain user or device identity, such as Figure 4 As shown in the figure, this embodiment addresses the problem of untrusted cross-domain devices. All devices and users need to undergo identity authentication before joining the alliance chain system, but at the same time, the anonymity between devices is maintained. The identity authentication method uses identity encryption-based verification. After the intra-domain identity authentication is successful, the domain key manager MG issues an identity token, i.e., an identity credential. Only devices and users with the token can register as nodes on the chain. The successfully registered node will generate the corresponding public-private key pair on the chain. The public key address serves as the only on-chain identity credential.

[0073] To further optimize the solution, the identity authentication method uses identity encryption-based authentication to verify the following:

[0074] DS selects a secure random number R (R∈[1,n], n is a 256-bit large prime number) and combines it with its own identity ID to generate its own anonymous identity DID=Hash(ID+R); DS is a common device user end;

[0075] DS initiates an identity certificate application and uses DS's private key Anonymous identity information for signing DS

[0076] Verify the identity of DS and sign the information through the identity domain manager of DS:

[0077]

[0078] The domain manager MG issues the identity credentials of the devices and users in the domain, and the AS signs the identity using the private key on the blockchain: Among them, the AS is the proxy device of the domain master on the blockchain network BC, responsible for the verification and management of the identity and data on the blockchain;

[0079]

[0080] DS initiates a registration request to the blockchain network BC;

[0081] BC uses the on-chain public key of the corresponding AS in the corresponding domain to verify its identity credentials:

[0082]

[0083] BC issues certificates in the alliance system to DS devices or users;

[0084] Furthermore, in step 2, the data sharing participants use AS i Storing resources and policies on the blockchain;

[0085] To further optimize the solution, in step 2, in order to address the security issues of cross-domain data sharing, this embodiment completes the registration of the verification token (Token) authentication of the device and the user and obtains the on-chain identity. Only then can users and devices between different domains share data across domains, and set corresponding access control policies based on the attribute information and data resource information of each domain device user, etc.

[0086] Specifically include:

[0087] 1) The DS in domain A initiates an access request to the BS in other domains in BC through the BS. The request content includes access information, DS identity credentials, etc. request (message, Token, addr), where the message includes the access device or user and the department to which it belongs, and a summary message of the access data (O: DominB, data.desc, dept BSi ;acticon:read);

[0088] 2) After receiving the application, the BS in domain A checks whether the DS has the identity certificate on the chain, and uses the public key of domain A to verify the signature of the certificate to verify whether the DS is a device or user in domain A;

[0089] 3) After the BS in domain A passes the verification, it publishes the application request to the message on the chain. After receiving the request, the BS in domain B triggers the smart contract of AC, executes the access control policy to match the policy attributes, and returns the information that the access control is successful when the attributes of the visitor and the requested operation meet the attributes of the accessed resources.

[0090] More specifically, first verify the on-chain identity of the node, and query the unique address Addr on the chain in the form of a key-value pair by calling the storage contract to detect whether it is a node in the system;

[0091] Call the monitoring contract to check whether it is in the malicious list Blacklist. When a node with malicious behavior is found, setBlackList(Addr) in the contract will be called. Nodes in the malicious list cannot pass the verification and data sharing will be performed. At the same time, the number of malicious times of the node will be selected according to the tolerance of the system. When the number of malicious times exceeds the tolerance, it will be added to the permanent blacklist.

[0092] Call the policy decision contract to compare and decide on the attributes of the visitor with the attributes and operations of the resources to be accessed on the chain. When all conditions are met, a message indicating that access is passed is returned, otherwise access control fails.

[0093] Furthermore, in step 3, the master nodes of the alliance formulate access control policies based on the attribute permissions of devices and users and the access permissions of resources. This requires the collaborating parties to discuss the access authorization status of relevant resources in advance so that they can make quick decisions based on the attribute permissions in subsequent accesses.

[0094] Furthermore, in step 4, the domain master management end AS i It consists of trusted devices and users in the domain, including {AS a ,AS b ,AS c …AS n}, using subscripts to indicate different domains, such as AS a Identifies the AS of domain a, manages the device attribute information in the domain, and uploads the metadata to the blockchain when the system is initialized. DATA(DID||Addr||Domn||Depart||PK||Type||TS||Data_hash);

[0095] Furthermore, in step 5, the department manager BS i Usually from the same department as the visitor, including Manage the information of devices and users under the department, common device user end DS i include The application will be successful only if the visitor's domain identity is verified within the domain. Otherwise, the department manager will refuse to submit the access application to the chain, and subsequent access will be terminated.

[0096] Further, in step 6, taking domains a and b as an example, the trusted authentication agent of the visited user, i.e., AS b First, the visitor's on-chain identity is verified. After the identity verification is passed, the visitor's attributes are verified to match the corresponding access control policy. If both verifications are passed, the authorization and verification results are given to the visitor's proxy AS. a , and the proxy sends the result and the public key on the chain and Return to visitors in the domain separately and the interviewee

[0097] Furthermore, considering the data storage capacity and data security of blockchain, the data transmission process is transferred to the off-chain, and the chain only stores the key data such as the hash value and timestamp used for verification. At the same time, authentication is performed on the chain, but communication may be completed through an insecure channel, so key negotiation is used to solve the problem of insecure communication;

[0098] In step 7, the process of using the ECDHE-based key negotiation method to enable two cross-domain users to perform key negotiation includes:

[0099] Data access party and the visited party The negotiated public key is calculated and

[0100] The calculated negotiated public keys are signed with the on-chain private key SK to prevent malicious tampering;

[0101] Use the public key on the chain to verify the signature respectively;

[0102] After verification, the corresponding negotiated public key is used to calculate the negotiated key K;

[0103] More specifically, using a public elliptic curve and a G point as an example, the selection of the curve and the G point are both public in the present invention. The present invention uses the secp256r1 elliptic curve, specifically including:

[0104] Data access party and the visited party Select random numbers r respectively a , r b (r i ∈[1,n-1],i={a,b…}, n is a 256-bit prime number) as your own private key;

[0105] Calculate separately for both parties Get the negotiated public key and

[0106] Use the on-chain private key for the calculated negotiated public key Sign to prevent malicious tampering;

[0107] Use the public keys on the chain to verify the signatures respectively. The public keys on the chain have been verified in step 1. Here, the public keys of all parties are used to verify the signature data.

[0108] After verification, the corresponding negotiated public key is used to calculate the negotiated key

[0109] To further optimize the solution, when using key negotiation, in order to prevent the leakage of the negotiated public key, the negotiating parties sign the negotiated public key with the on-chain private key, so that the correctness of the negotiated public key can be verified by the on-chain public key during negotiation. After the negotiation is completed, the negotiated key K is generated by calculation to complete the subsequent transmission;

[0110] The data owner uses K to encrypt the IPFS link and then encrypts it with the on-chain private key and sends it to the blockchain This step will bring up transaction data information, and subsequently make shared data responsibility traceable;

[0111] After receiving the encrypted data, the receiver uses the sender's on-chain public key to decrypt it. After the negotiated key K is used to obtain the data information, it is decrypted to obtain the data keyword search information of IPFS, thus completing the data sharing;

[0112] Furthermore, in step 8, after the key negotiation is completed, both parties use the negotiated key to transmit the link ID of IPFS, and the data requester can download the corresponding data information in IPFS; at the same time, hash (data ipfs ))=Data_hash detects whether the transmitted data matches the data hash stored in the blockchain after hashing, so as to confirm the correctness and integrity of the data.

[0113] To further optimize the solution, this embodiment is based on the data integrity verifiability problem of cross-domain data sharing:

[0114] In order to verify the integrity and correctness of the received data, after receiving the data, the data applicant can hash the data and compare it with the data hash information stored on the chain. If they are exactly the same, the correctness of the data can be proved;

[0115] Since the shared data information is stored on the blockchain, when the data is incomplete, the verification function on the chain can be activated to analyze the authenticity of the data. The verifiers in the alliance chain analyze the data, trace back and verify the transaction;

[0116] Specifically, transaction information is uploaded to the chain, and data is shared by The encrypted data hash(data ipfs )) is sent to the blockchain through BS. The BS of the accessing party sends the shared data information to the data requester after receiving it. Using on-chain private keys And K decrypts the sent information

[0117] After successful decryption, find IPFS to search for keywords and find the corresponding data;

[0118] The correctness of the data can be verified by using the query data judgment (hash (data ipfs )) is consistent with the one on the chain;

[0119] like Figure 1As shown, this embodiment also provides a cross-domain data sharing system based on blockchain in the industrial Internet of Things. The system structure mainly completes data sharing from the device layer, contract layer, blockchain layer and IPFS storage layer to solve the problem of untrusted cross-domain user or device identity. It includes industrial Internet of Things device module, alliance chain module, smart contract, and data storage;

[0120] Among them, the consortium chain module (BC) is used to form a consortium blockchain through a certain protocol with multiple management nodes in multiple industrial organizations;

[0121] Smart contract module: code used to implement access control in cross-domain sharing, interacting with the alliance chain module through contracts to achieve identity authentication and access authorization detection between different domains;

[0122] Data storage module: used to store different types of data. Institutional data storage uses IPFS and off-chain storage;

[0123] Industrial IoT devices: consist of many different types of devices, including but not limited to the domain master management end AS i , Department Management BS i and DS on common resource-constrained devices i , where the domain master management end and department management end in multiple institutions serve as master nodes, and the resource-constrained device end serves as light nodes, together forming a consortium chain system.

[0124] The present invention uses the FISCOBCOS platform to build and implement the alliance chain system, which is divided into three organizations and various types of equipment including AS, BS, and DS, each with multiple nodes. DS equipment and users act as light nodes, and gradually implement the above-mentioned system solutions and methods through the roles and functions of different nodes.

[0125] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A cross-domain data sharing method based on blockchain in industrial Internet of Things, characterized in that: include: The users and devices of each organization in the alliance chain system are registered on the chain, and the data sharing party uploads resources and policies to the IPFS system; According to the cross-domain attribute-based access control policy formulated by the alliance organization, the domain master management end of each domain uploads the metadata within the domain to the alliance blockchain through the contract; The accessing party applies to access the data information of other domain devices through the department management end. The accessed party detects the identity and access rights of the visitor through the smart contract. The domain master device performs identity authentication and access authorization. After the authorization is passed, the cross-domain users negotiate the key. Cross-domain users transmit the link of the IPFS system based on the negotiated key, allowing both parties with the same negotiated key to share data information.

2. The cross-domain data sharing method based on blockchain in the industrial Internet of Things according to claim 1 is characterized in that: The process of registering the identities of users and devices under each organization in the alliance chain system on the chain includes: Register the devices and users of each organization in the alliance chain system with their own on-chain identity DID, and use it as the identity credential on the chain; The device and user use identity encryption-based authentication to authenticate the domain before joining the alliance chain system. After the domain authentication is successful, the domain key manager issues an identity token to the device and user and registers them as nodes on the chain. The successfully registered node generates the corresponding on-chain public and private key pair, where the public key address serves as the only on-chain identity credential.

3. The cross-domain data sharing method based on blockchain in the industrial Internet of Things according to claim 2 is characterized in that: The process of performing intra-domain identity authentication based on identity encryption includes: DS selects a secure random number R, R∈[1,n], n is a 256-bit large prime number, and generates its own anonymous identity DID=Hash(ID+R) based on the random number and its own identity ID; wherein DS is a common device user terminal; DS initiates an identity certificate application and uses DS's private key Anonymous identity information for signing DS Verify the identity of DS and sign the information through the identity domain manager of DS: The domain manager MG issues the identity credentials of the devices and users in the domain, and the AS signs the identity using the private key on the blockchain: Among them, the AS is the proxy device of the domain master on the blockchain network BC, responsible for the verification and management of the identity and data on the blockchain; DS initiates a registration request to the blockchain network BC; The consortium blockchain uses the on-chain public key of the corresponding AS in the corresponding domain to verify its identity credentials: The alliance blockchain issues certificates in the alliance system to DS devices or users to complete domain identity authentication.

4. The cross-domain data sharing method based on blockchain in the industrial Internet of Things according to claim 1 is characterized in that: The process of data sharing parties uploading resources and strategies to the IPFS system includes: After the device and user's verification token authentication is registered and the on-chain identity is obtained, the data sharing participants can use the domain master management end AS i Resources and policies are stored on the blockchain, and then users and devices between different domains share data across domains, and set corresponding access control policies based on the attribute information and data resource information of each domain device user.

5. The cross-domain data sharing method based on blockchain in the industrial Internet of Things according to claim 4 is characterized in that: After the device and user's verification token authentication is registered and the on-chain identity is obtained, the data sharing participants can use the domain master management end AS i The process of storing resources and policies on the blockchain includes: The DS in domain A initiates an access request to the BS in other domains in the alliance blockchain through the BS. After receiving the request, the BS in domain A detects whether the DS has an identity certificate on the chain, verifies the signature of the certificate using the public key of domain A, and verifies whether the DS is a device or user in domain A. Among them, the DS is a common device user end; After the BS in domain A passes the verification, it publishes the application request to the on-chain message. After receiving the request, the BS in domain B triggers the smart contract of AC, executes the access control policy to match the policy attributes, and returns the information that the access control is successful when the attributes of the visitor and the requested operation meet the attributes of the accessed resources.

6. The cross-domain data sharing method based on blockchain in the industrial Internet of Things according to claim 5 is characterized in that: The process of checking whether DS has an identity certificate on the chain and using the public key of domain A to verify the signature of the certificate and whether DS is a device or user in domain A includes: Verify the on-chain identity of the node by calling the storage contract to query the unique address Addr on the chain in the form of a key-value pair to detect whether it is a node in the system; Call the monitoring contract to check whether it is in the malicious list Blacklist. When a node with malicious behavior is found, call setBlackList(Addr) in the contract. Nodes in the malicious list cannot pass verification and data sharing. At the same time, the number of malicious times of the node is selected according to the tolerance of the system. When the number of malicious times exceeds the tolerance, it will be added to the permanent blacklist; Call the policy decision contract to compare and decide on the attributes of the visitor with the attributes and operations of the resources to be accessed on the chain. When all conditions are met, a message indicating that access is passed is returned, otherwise the access control fails.

7. The cross-domain data sharing method based on blockchain in the industrial Internet of Things according to claim 1 is characterized in that: The process of cross-domain users performing key negotiation includes: The ECDHE-based key negotiation method is used to enable cross-domain users to negotiate keys. and the visited party Each of them selects their own random number as their own private key, and calculates the corresponding negotiated public key based on their own private key. and Use the on-chain private key SK to respectively and Sign and verify the signature using the public key on the chain. After the verification is passed, the corresponding negotiated public key is used to calculate the negotiated key K.

8. The cross-domain data sharing method based on blockchain in the industrial Internet of Things according to claim 1 is characterized in that: Before cross-domain users transmit the link of the IPFS system according to the negotiated key, the integrity of the data shared across domains is also verified; The process of verifying the integrity of cross-domain data sharing includes: After receiving the data, the data applicant will hash the data and compare it with the data hash information stored on the chain. If they are exactly the same, it means the data is correct; When the data is incomplete, the verification function on the chain is activated to analyze the authenticity of the data. The validators in the alliance chain analyze the data, trace back and verify the transaction.

9. The cross-domain data sharing method based on blockchain in the industrial Internet of Things according to claim 1 is characterized in that: When the data is incomplete, the verification function on the chain is activated to analyze the authenticity of the data. The verifier in the alliance chain analyzes the data, and the process of tracing and verifying the transaction includes: Transaction information on the chain, data sharing The encrypted data hash(data ipfs ))Sent to the blockchain via BS; The BS of the accessing party receives the shared data information and sends it to the data requester. Using on-chain private keys And K decrypts the sent information After successful decryption, find IPFS to search for keywords and find the corresponding data; By judging the query data (hash (data ipfs )) Verify the correctness of the data by checking whether it is consistent with the data on the chain.

10. A cross-domain data sharing system based on blockchain in industrial Internet of Things, characterized in that: include: The alliance chain module is used to form an alliance blockchain by combining management nodes in industrial organizations through protocols; Smart contract module, which is used to implement access control code in cross-domain sharing. It interacts with the alliance chain module through contracts to achieve identity authentication and access authorization detection between different domains. A data storage module, used for storing different types of data; Industrial IoT devices, including but not limited to domain master management end AS i , Department Management BS i and DS on common resource-constrained devices i , where the domain master management end and department management end in multiple institutions serve as the main nodes, and the resource-constrained device end serves as the light node, together forming the alliance chain system.

Images