A blockchain-based cross-domain data sharing system and method in an industrial internet of things

Abstract

The application discloses a kind of industrial internet of things in blockchain-based cross-domain data sharing system and method, comprising: the user and equipment under each organization in alliance chain system are registered on chain identity, data sharing party uploads resource and strategy to IPFS system;According to the cross-domain attribute-based access control policy formulated by alliance organization, the domain master management end in each domain uploads the metadata in domain to alliance blockchain through contract;Access party applies for access to the data information of other domain device end through department management end, and the accessed party detects the identity and access authority of visitor through smart contract, and the domain master device carries out identity verification and access authorization, after authorization, cross-domain user both sides carry out key negotiation;Cross-domain user transmits the link of IPFS system according to the key after negotiation, so that the two parties with same negotiation key realize data information sharing.The application realizes the data integrity and safe data sharing.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain technology and data sharing, and in particular relates to a blockchain-based cross-domain data sharing system and method in the industrial Internet of Things. Background Art

[0002] As the number of connected things in IoT systems continues to grow, cross-domain collaboration within the Industrial IoT is becoming increasingly common. Trust gaps exist between users and devices in different domains, posing significant challenges to the security, integrity, and trust management of data sharing. Without trust between domains and secure identity authentication, devices involved in collaboration are vulnerable to threats. Furthermore, data transmission during interactive collaboration often occurs over insecure channels, posing a threat to data security. This further compromises user privacy and security.

[0003] The key to cross-domain trust lies in identity authentication. Traditional authentication schemes often rely on central servers, which pose security risks due to single points of failure and centralized management. Blockchain technology holds great promise for industrial IoT identity management. By providing a unified, interoperable, and tamper-proof infrastructure, it can address the key challenge of large-scale IoT device identity management. Blockchain utilizes a decentralized approach, recording and verifying each identity through a distributed ledger, eliminating the risk of single points of failure and improving system robustness and security. Therefore, it is necessary to design a unified data sharing solution across different domains using blockchain for trusted data transmission. Summary of the Invention

[0004] The present invention provides a cross-domain data sharing system and method based on blockchain in an industrial Internet of Things scenario, which is used to solve the low security and data incompleteness of data transmission in the existing technology, and the distrust problem in cross-domain sharing, and realize the security and integrity of data transmission in sharing while effectively solving the problem of cross-domain untrustworthiness.

[0005] To achieve the above objectives, the present invention provides a cross-domain data sharing system and method based on blockchain in the industrial Internet of Things. Specifically, a cross-domain data sharing method based on blockchain in the industrial Internet of Things includes:

[0006] The users and devices of each organization in the alliance chain system are registered on the chain, and the data sharing party uploads resources and strategies to the IPFS system;

[0007] According to the cross-domain attribute-based access control policy formulated by the alliance organization, the domain master management terminal of each domain uploads the domain metadata to the alliance blockchain through the contract;

[0008] The accessing party applies to access data and information on devices in other domains through the department management terminal. The accessed party uses the smart contract to detect the identity and access rights of the accessor. The domain master device performs identity authentication and access authorization. After authorization is passed, the two cross-domain users conduct key negotiation.

[0009] Cross-domain users transmit the link of the IPFS system based on the negotiated key, enabling both parties with the same negotiated key to share data information.

[0010] Preferably, the process of registering the identities of users and devices under each organization in the alliance chain system on the chain includes:

[0011] Register the devices and users of each organization in the alliance chain system with their own on-chain identity DID, and use it as the identity credential on the chain;

[0012] Before joining the consortium chain system, the device and user use identity encryption to perform domain identity authentication. After the domain identity authentication is successful, the domain key manager issues an identity token to the device and user, and registers them as nodes on the chain.

[0013] The successfully registered node generates the corresponding on-chain public and private key pair, where the public key address serves as the only on-chain identity credential.

[0014] Preferably, the process of performing intra-domain identity authentication based on identity encryption includes:

[0015] DS selects a secure random number R, R∈[1,n], where n is a 256-bit prime number, and generates its own anonymous identity DID=Hash(ID+R) based on the random number and its own identity ID. DS is a common device user terminal.

[0016] DS initiates identity certificate application and uses DS's private key Anonymous identity information for signing DS

[0017] Verify the identity of the DS and sign the information through the DS identity domain manager:

[0018]

[0019] The domain manager MG issues identity credentials for devices and users within the domain, and the AS uses the private key on the blockchain to sign the identity: The AS is the proxy device of the domain master on the blockchain network BC, responsible for the verification and management of identities and data on the blockchain;

[0020]

[0021] DS initiates a registration request to the blockchain network BC;

[0022] The consortium blockchain uses the public key on the chain of the corresponding AS in the corresponding domain to verify its identity credentials:

[0023]

[0024] The alliance blockchain issues certificates in the alliance system to DS devices or users to complete domain identity authentication.

[0025] Preferably, the process of data sharing parties uploading resources and policies to the IPFS system includes:

[0026] After the device and user's verification token identity authentication is registered and the on-chain identity is obtained, the data sharing participants can use the domain master management end AS i Resources and policies are stored on the blockchain, and then users and devices between different domains share data across domains, and set corresponding access control policies based on the attribute information and data resource information of each domain device user.

[0027] Preferably, after the device and user's verification token identity authentication registration is completed and the on-chain identity is obtained, the data sharing participants can use the domain master management end AS i The process of storing resources and policies on the blockchain includes:

[0028] The DS in domain A initiates an access request to the BSs in other domains in the consortium blockchain through the BS. After receiving the request, the BS in domain A checks whether the DS has an identity certificate on the chain and verifies the signature of the certificate using the public key of domain A to verify whether the DS is a device or user in domain A. Among them, the DS is a common device user end.

[0029] After the BS in domain A passes the verification, it publishes the application request to the on-chain message. After receiving the request, the BS in domain B triggers the smart contract of AC, executes the access control policy and matches the policy attributes. When the attributes of the visitor, the requested operation and the attributes of the accessed resource meet the policy, it returns the information that the access control is successful.

[0030] Preferably, the process of detecting whether the DS has an identity certificate on the chain, verifying the certificate signature using the public key of domain A, and verifying whether the DS is a device or user in domain A includes:

[0031] Verify the node's on-chain identity by calling the storage contract to query the unique address Addr on the chain in the form of a key-value pair to detect whether it is a node in the system;

[0032] Call the monitoring contract to check whether it is in the Blacklist. When a node with malicious behavior is found, call setBlackList(Addr) in the contract. Nodes in the malicious list cannot pass verification and data sharing. At the same time, the number of malicious times of the node is selected according to the tolerance of the system. When the number of malicious times exceeds the tolerance, it will be permanently blacklisted.

[0033] The policy decision contract is called to compare and decide the attributes of the visitor with the attributes and operations of the resources to be accessed on the chain. When all conditions are met, a message indicating that access is passed is returned, otherwise the access control fails.

[0034] Preferably, the process of performing key negotiation between two cross-domain users includes:

[0035] The ECDHE-based key negotiation method is used to enable cross-domain users to negotiate keys. and the visited party Each of them selects their own random number as their own private key, and calculates the corresponding negotiated public key based on their own private key. and

[0036] Use the on-chain private key SK to negotiate the public key and Sign and verify the signature using the public key on the chain. After the verification is passed, the corresponding negotiated public key is used to calculate the negotiated key K.

[0037] Preferably, before the cross-domain users transmit the link of the IPFS system according to the negotiated key, the integrity of the data shared across the domains is also verified;

[0038] The process of verifying the integrity of cross-domain data sharing includes:

[0039] After receiving the data, the data applicant will hash the data and compare it with the data hash information stored on the chain. If they are exactly the same, it means the data is correct;

[0040] When the data is incomplete, the verification function on the chain is activated to analyze the authenticity of the data. The validators in the alliance chain analyze the data, trace back and verify the transaction.

[0041] Preferably, when the data is incomplete, the verification function on the chain is activated to analyze the authenticity of the data. The verifier in the alliance chain analyzes the data and the process of tracing and verifying the transaction includes:

[0042] Transaction information is uploaded to the chain, and data is shared by The encrypted data hash(data ipfs ))Sent to the blockchain via BS;

[0043] The BS of the accessing party sends the shared data information to the data requester after receiving it. Use on-chain private keys And K decrypts the sent information

[0044] After successful decryption, find IPFS and perform keyword search to find the corresponding data;

[0045] By judging the query data (hash (data ipfs )) Verify the correctness of the data by checking whether it is consistent with the data on the chain.

[0046] The present invention also provides a cross-domain data sharing system based on blockchain in an industrial Internet of Things, comprising:

[0047] The alliance chain module is used to organize the management nodes in industrial organizations into an alliance blockchain through a protocol;

[0048] Smart contract module, which is used to implement access control code in cross-domain sharing. It interacts with the consortium chain module through contracts to achieve identity authentication and access authorization detection between different domains.

[0049] A data storage module, used for storing different types of data;

[0050] Industrial IoT devices, including but not limited to domain master management end AS i , Department Management BS i and DS on common resource-constrained devices i Among them, the domain master management end and department management end in multiple institutions serve as the main nodes, and the resource-constrained device end serves as the light node, which together constitute the alliance chain system.

[0051] Compared with the prior art, the present invention has the following advantages and technical effects:

[0052] This invention leverages the consortium chain within blockchain technology to require network nodes to undergo identity verification and authorization before joining. This ensures the credibility and security of participating nodes, making it suitable for scenarios where multiple organizations need to jointly manage and share data. Furthermore, smart contracts can be designed to oversee nodes, enabling monitoring of every executed transaction.

[0053] This invention utilizes a consortium blockchain to build a bridge of trust between organizations. Each organizational domain has a representative node responsible for maintaining the global ledger. An attribute-based access control scheme is designed to facilitate cross-domain interaction, effectively addressing fine-grained access control in data sharing. Penalties are implemented to constrain malicious behavior by node sharing participants, incentivizing them to actively and securely share data. Furthermore, to protect data from malicious attacks, a designed key negotiation scheme is implemented to ensure secure data sharing. Access control, key negotiation, and blockchain are combined in secure sharing to achieve data integrity and secure data sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0055] Figure 1 Schematic diagram of the system structure of an embodiment of the present invention;

[0056] Figure 2 This is a schematic diagram of a blockchain node according to an embodiment of the present invention;

[0057] Figure 3 This is an overall flow chart of data sharing according to an embodiment of the present invention;

[0058] Figure 4 This is a flowchart of obtaining on-chain identity credentials for intra-domain identity authentication in an embodiment of the present invention. DETAILED DESCRIPTION

[0059] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0060] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0061] Organizations and institutions participating in collaborative sharing within the Industrial Internet of Things (IIoT) form a consortium blockchain system, enabling mutual oversight and tracing of data sources, ensuring data integrity. IIoT devices are comprised of a variety of different types, including general-purpose devices, department management devices, and domain management devices. These devices have varying storage and computing capabilities depending on their role. Ordinary physical devices, such as cameras and industrial machinery, have relatively weak storage and computing capabilities. However, with the influx of devices and the resulting data transmission, full nodes in a blockchain require significant computing power and storage capacity. Therefore, designating these less powerful devices as light nodes can address resource constraints. Light nodes do not require the simultaneous consensus and synchronized storage of data across the entire blockchain, as full nodes do.

[0062] To this end, this embodiment provides a cross-domain data sharing system and method based on blockchain in the industrial Internet of Things. The method includes cross-domain sharing between multiple organizations. The cross-domain data sharing method process is as follows: Figure 2-3 The specific steps are as follows:

[0063] Step 1: User and device identity registration on the chain;

[0064] Step 2: The data sharing party uploads resources and strategies to the IPFS system;

[0065] Step 3: The federated organization formulates a cross-domain attribute-based access control policy;

[0066] Step 4: The domain master management end AS of each domain i Upload the domain metadata to the alliance blockchain through the contract;

[0067] Step 5: The access party accesses the department management terminal BS i Apply for access to DS on devices in other domains i data information;

[0068] Step 6: The visited party detects the visitor's identity and access rights through the smart contract, and the domain master device performs identity authentication and access authorization;

[0069] Step 7: After authorization is passed, the two cross-domain users negotiate a key.

[0070] Step 8. Cross-domain users transmit the link of the IPFS system based on the negotiated key. Only two parties with the same negotiated key can share data information.

[0071] Furthermore, in step 1, each device and user under each organization in the alliance chain system needs to register their own on-chain identity DID and use it as the identity credential on the chain;

[0072] In the sharing system, the first thing to do is to solve the problem of untrusted cross-domain user or device identity, such as Figure 4 As shown in the figure, this embodiment addresses the problem of untrusted cross-domain devices. All devices and users need to undergo identity authentication before joining the alliance chain system, but at the same time, the anonymity between devices is maintained. The identity authentication method uses identity-based encryption for verification. After the domain identity authentication is successful, the domain key manager MG issues an identity token, i.e., an identity credential. Only devices and users with the token can register as nodes on the chain. The successfully registered node will generate the corresponding public and private key pair on the chain. The public key address serves as the only on-chain identity certificate.

[0073] To further optimize the solution, the identity authentication method uses identity-based encryption to verify the following:

[0074] DS selects a secure random number R (R∈[1,n], where n is a 256-bit prime number) and combines it with its own identity ID to generate its own anonymous identity DID=Hash(ID+R); DS is a common device user terminal.

[0075] DS initiates identity certificate application and uses DS's private key Anonymous identity information for signing DS

[0076] Verify the identity of the DS and sign the information through the DS identity domain manager:

[0077]

[0078] The domain manager MG issues identity credentials for devices and users within the domain, and the AS uses the private key on the blockchain to sign the identity: The AS is the proxy device of the domain master on the blockchain network BC, responsible for the verification and management of identities and data on the blockchain;

[0079]

[0080] DS initiates a registration request to the blockchain network BC;

[0081] BC uses the on-chain public key of the corresponding AS in the corresponding domain to verify its identity credentials:

[0082]

[0083] BC issues certificates in the alliance system to DS devices or users;

[0084] Furthermore, in step 2, participants in data sharing use AS i Storing resources and policies on the blockchain;

[0085] To further optimize the solution, in step 2, in order to address the security issues of cross-domain data sharing, this embodiment completes the registration of the verification token (Token) identity authentication of the device and user and obtains the on-chain identity. Only then can users and devices between different domains share data across domains, and set corresponding access control policies based on the attribute information and data resource information of each domain device user, etc.

[0086] Specifically include:

[0087] 1) The DS of domain A initiates an access request to the BS of other domains in BC through BS. The request content includes access information, DS identity credentials, etc. request (message, Token, addr), where the message includes the access device or user and the department to which it belongs, and a summary message of the access data (O:DominB, data.desc, dept BSi ;acticon:read);

[0088] 2) After receiving the application, the BS in domain A checks whether the DS has the identity certificate on the chain, uses the public key of domain A to verify the signature of the certificate, and verifies whether the DS is a device or user in domain A;

[0089] 3) After the BS in domain A passes the verification, it publishes the application request to the on-chain message. After receiving the request, the BS in domain B triggers the smart contract of AC, executes the access control policy and matches the policy attributes. When the attributes of the visitor, the requested operation and the attributes of the accessed resource meet the policy, it returns the information that the access control is successful.

[0090] More specifically, the node's on-chain identity is first verified by calling the storage contract to query the unique address Addr on the chain in the form of a key-value pair to detect whether it is a node in the system;

[0091] Call the monitoring contract to check whether it is in the Blacklist. When a node with malicious behavior is found, the setBlackList(Addr) in the contract will be called. Nodes in the malicious list cannot pass the verification and data sharing will be carried out. At the same time, the number of malicious times of the node will be selected according to the tolerance of the system. When the number of malicious times exceeds the tolerance, it will be permanently blacklisted.

[0092] Call the policy decision contract to compare the visitor's attributes with the attributes and operations of the resources to be accessed on the chain and make a decision. When all conditions are met, a message indicating that access is passed is returned; otherwise, access control fails.

[0093] Furthermore, in step 3, the master nodes of the alliance formulate access control policies based on the attribute permissions of devices and users and the access rights of resources. This requires the collaborating parties to discuss the access authorization status of relevant resources in advance so that they can make quick decisions based on attribute permissions in subsequent access.

[0094] Furthermore, in step 4, the domain master management end AS i It consists of trusted devices and users in the domain including {AS a ,AS b ,AS c …AS n}, different domains are indicated by subscripts, such as AS a Identifies the AS of domain a, manages device attribute information within the domain, and uploads metadata to the blockchain during system initialization. DATA(DID||Addr||Domn||Depart||PK||Type||TS||Data_hash);

[0095] Furthermore, in step 5, the department manager BS i Typically belongs to the same department as the visitor including Information about devices and users under the management department, common device user end DS i include The application will be successful only if the visitor's domain identity is verified within the domain. Otherwise, the department manager will refuse to submit the access application to the chain, and subsequent access will be terminated.

[0096] Furthermore, in step 6, taking domains a and b as an example, the trusted authentication agent of the visited user, i.e., AS b First, verify the visitor's on-chain identity. After the identity verification is passed, verify whether the visitor's attributes match the corresponding access control policy. If both verifications are passed, the authorization and verification results are given to the visitor's proxy AS. a , and the agent sends the result and the public key on the chain and Return to visitors within the domain and the interviewees

[0097] Furthermore, considering the data storage capacity limitations and data security of blockchain, the data transmission process is moved off-chain. Only key data such as the data hash value and timestamp used for verification is stored on-chain. Authentication is performed on-chain, but communication may be completed through insecure channels. Therefore, key negotiation is used to solve the problem of insecure communication.

[0098] In step 7, the process of using the ECDHE-based key negotiation method to enable two cross-domain users to perform key negotiation includes:

[0099] Data access party and the visited party Calculate the negotiated public key and

[0100] The calculated negotiated public key is signed with the on-chain private key SK to prevent malicious tampering;

[0101] Use the public key on the chain to verify the signature;

[0102] After verification, the negotiated key K is calculated using the corresponding negotiated public key;

[0103] More specifically, using a public elliptic curve and G-point as an example, the choice of curve and G-point are both public in the present invention. The present invention uses the secp256r1 elliptic curve, specifically including:

[0104] Data access party and the visited party Select random numbers r respectively a , r b (r i ∈[1,n-1],i={a,b…}, n is a 256-bit prime number) as your own private key;

[0105] Calculate separately for both parties Obtain the negotiated public key and

[0106] Use the on-chain private key for the calculated negotiated public key Sign to prevent malicious tampering;

[0107] Use the public keys on the chain to verify the signatures. The public keys on the chain have been verified in step 1. Here, the public keys of each party are used to verify the signature data.

[0108] After verification, the negotiated key is calculated using the corresponding negotiated public key.

[0109] To further optimize the solution, when using key negotiation, to prevent the leakage of the negotiated public key, both parties sign the negotiated public key with the on-chain private key. This way, the correctness of the negotiated public key can be verified by the on-chain public key during negotiation. After the negotiation is completed, the negotiated key K is generated by calculation and used for subsequent transmission.

[0110] The data owner uses K to encrypt the IPFS link and then encrypts it with the on-chain private key and sends it to the blockchain. This step will bring up transaction data information, allowing shared data accountability to be traced later;

[0111] After receiving the encrypted data, the receiver uses the sender's on-chain public key to decrypt it. After the negotiated key K is used to obtain data information, it is decrypted to obtain IPFS data keyword search information, thus completing data sharing;

[0112] Furthermore, in step 8, after the key negotiation is completed, both parties use the negotiated key to transmit the link ID of IPFS, and the data requester can download the corresponding data information in IPFS; at the same time, hash (data ipfs ))=Data_hash checks whether the transmitted data matches the data hash stored in the blockchain to confirm the correctness and integrity of the data.

[0113] To further optimize the solution, this embodiment addresses the data integrity and verifiability issues related to cross-domain data sharing:

[0114] In order to verify the integrity and correctness of the received data, the data applicant can hash the data after receiving it and compare it with the data hash information stored on the chain. If they are exactly the same, the correctness of the data can be proved;

[0115] Since shared data information is stored on the blockchain, when the data is incomplete, the chain verification function can be activated to analyze the authenticity of the data. The validators in the alliance chain analyze the data, trace back and verify the transaction;

[0116] Specifically, transaction information is uploaded to the blockchain, and data is shared by The encrypted data hash(data ipfs )) is sent to the blockchain through BS. The BS of the accessing party sends the shared data information to the data requester after receiving it. Use on-chain private keys And K decrypts the sent information

[0117] After successful decryption, find IPFS and perform keyword search to find the corresponding data;

[0118] You can verify the correctness of the data by using the query data judgment (hash (data ipfs )) is consistent with the one on the chain;

[0119] like Figure 1As shown, this embodiment also provides a blockchain-based cross-domain data sharing system in the Industrial Internet of Things. The system structure mainly implements data sharing from the device layer, contract layer, blockchain layer, and IPFS storage layer to solve the problem of untrusted cross-domain user or device identities. It includes an Industrial Internet of Things device module, a consortium chain module, a smart contract, and data storage.

[0120] Among them, the consortium chain module (BC) is used to form a consortium blockchain through a certain protocol with multiple management nodes in multiple industrial organizations;

[0121] Smart contract module: code used to implement access control in cross-domain sharing. It interacts with the consortium chain module through contracts to achieve identity authentication and access authorization detection between different domains.

[0122] Data storage module: used to store different types of data. Institutional data storage uses IPFS and off-chain storage;

[0123] Industrial IoT devices: consist of various types of devices, including but not limited to domain master management end AS i , Department Management BS i and DS on common resource-constrained devices i , in which the domain master management end and department management end in multiple institutions serve as the main nodes, and the resource-constrained device end serves as the light node, together forming the alliance chain system.

[0124] The present invention uses the FISCOBCOS platform to build and implement the alliance chain system, which is divided into three organizations and multiple nodes of various types of equipment including AS, BS, and DS. DS devices and users serve as light nodes, and gradually implement the above-mentioned system solutions and methods through the roles and functions of different nodes.

[0125] The above are merely preferred embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A cross-domain data sharing method based on blockchain in industrial Internet of Things, characterized by: include: The users and devices of each organization in the alliance chain system are registered on the chain, and the data sharing party uploads resources and strategies to the IPFS system; According to the cross-domain attribute-based access control policy formulated by the alliance organization, the domain master management terminal of each domain uploads the domain metadata to the alliance blockchain through the contract; The accessing party applies to access data and information on devices in other domains through the department management terminal. The accessed party uses the smart contract to detect the identity and access rights of the accessor. The domain master device performs identity authentication and access authorization. After authorization is passed, the two cross-domain users conduct key negotiation. Cross-domain users transmit the link of the IPFS system based on the negotiated key, enabling both parties with the same negotiated key to share data information; The process of registering the identities of users and devices under each organization in the consortium chain system on the chain includes: Register the devices and users of each organization in the alliance chain system with their own on-chain identity DID, and use it as the identity credential on the chain; Before joining the consortium chain system, the device and user use identity encryption to perform domain identity authentication. After the domain identity authentication is successful, the domain key manager issues an identity token to the device and user, and registers them as nodes on the chain. The successfully registered node generates the corresponding on-chain public and private key pair, where the public key address serves as the only on-chain identity certificate; The process of performing intra-domain identity authentication based on identity encryption includes: DS selects a secure random number R, R∈[1,n], where n is a 256-bit prime number, and generates its own anonymous identity DID=Hash(ID+R) based on the random number and its own identity ID. DS is a common device user terminal. DS initiates identity certificate application and uses DS's private key Anonymous identity information for signing DS Verify the identity of the DS and sign the information through the DS identity domain manager: The domain manager MG issues identity credentials for devices and users within the domain, and the AS uses the private key on the blockchain to sign the identity: The AS is the proxy device of the domain master on the blockchain network BC, responsible for the verification and management of identities and data on the blockchain; DS initiates a registration request to the blockchain network BC; The consortium blockchain uses the public key on the chain of the corresponding AS in the corresponding domain to verify its identity credentials: The alliance blockchain issues certificates in the alliance system to DS devices or users to complete domain identity authentication.

2. The cross-domain data sharing method based on blockchain in the industrial Internet of Things according to claim 1 is characterized in that: The process of data sharing parties uploading resources and strategies to the IPFS system includes: After the device and user's verification token identity authentication is registered and the on-chain identity is obtained, the data sharing participants can use the domain master management end AS i Resources and policies are stored on the blockchain, and then users and devices between different domains share data across domains, and set corresponding access control policies based on the attribute information and data resource information of each domain device user.

3. The cross-domain data sharing method based on blockchain in the industrial Internet of Things according to claim 2 is characterized in that: After the device and user's verification token identity authentication is registered and the on-chain identity is obtained, the data sharing participants can use the domain master management end AS i The process of storing resources and policies on the blockchain includes: The DS in domain A initiates an access request to the BSs in other domains in the consortium blockchain through the BS. After receiving the request, the BS in domain A checks whether the DS has an identity certificate on the chain and verifies the signature of the certificate using the public key of domain A to verify whether the DS is a device or user in domain A. Among them, the DS is a common device user end. After the BS in domain A passes the verification, it publishes the application request to the on-chain message. After receiving the request, the BS in domain B triggers the smart contract of AC, executes the access control policy and matches the policy attributes. When the attributes of the visitor, the requested operation and the attributes of the accessed resource meet the policy, it returns the information that the access control is successful.

4. The cross-domain data sharing method based on blockchain in the industrial Internet of Things according to claim 3 is characterized in that: The process of checking whether DS has an identity certificate on the chain and using the public key of domain A to verify the signature of the certificate and verify whether DS is a device or user in domain A includes: Verify the node's on-chain identity by calling the storage contract to query the unique address Addr on the chain in the form of a key-value pair to detect whether it is a node in the system; Call the monitoring contract to check whether it is in the Blacklist. When a node with malicious behavior is found, call setBlackList(Addr) in the contract. Nodes in the malicious list cannot pass verification and data sharing. At the same time, the number of malicious times of the node is selected according to the tolerance of the system. When the number of malicious times exceeds the tolerance, it will be permanently blacklisted. The policy decision contract is called to compare and decide the attributes of the visitor with the attributes and operations of the resources to be accessed on the chain. When all conditions are met, a message indicating that access is passed is returned, otherwise the access control fails.

5. The cross-domain data sharing method based on blockchain in the industrial Internet of Things according to claim 1 is characterized in that: The process of cross-domain user key negotiation includes: The ECDHE-based key negotiation method is used to enable cross-domain users to negotiate keys. and the visited party Each of them selects their own random number as their own private key, and calculates the corresponding negotiated public key based on their own private key. and Use the on-chain private key SK to respectively and Sign and verify the signature using the public key on the chain. After the verification is passed, the corresponding negotiated public key is used to calculate the negotiated key K.

6. The cross-domain data sharing method based on blockchain in the industrial Internet of Things according to claim 1 is characterized in that: Before cross-domain users transmit the link of the IPFS system based on the negotiated key, the integrity of the data shared across domains must be verified; The process of verifying the integrity of cross-domain data sharing includes: After receiving the data, the data applicant will hash the data and compare it with the data hash information stored on the chain. If they are exactly the same, it means the data is correct; When the data is incomplete, the verification function on the chain is activated to analyze the authenticity of the data. The validators in the alliance chain analyze the data, trace back and verify the transaction.

7. The cross-domain data sharing method based on blockchain in the industrial Internet of Things according to claim 1 is characterized in that: When the data is incomplete, the verification function on the chain is activated to analyze the authenticity of the data. The validator in the alliance chain analyzes the data and traces and verifies the transaction. The process includes: Transaction information is uploaded to the chain, and data is shared by The encrypted data Send to the blockchain via BS; The BS of the accessing party sends the shared data information to the data requester after receiving it. Use on-chain private keys And K decrypts the sent information After successful decryption, find IPFS and perform keyword search to find the corresponding data; By judging the query data (hash (data ipfs )) Verify the correctness of the data by checking whether it is consistent with the data on the chain.

8. A cross-domain data sharing system based on blockchain in an industrial Internet of Things, used to execute the method according to any one of claims 1 to 7, characterized in that: include: The alliance chain module is used to organize the management nodes in industrial organizations into an alliance blockchain through a protocol; Smart contract module, which is used to implement access control code in cross-domain sharing. It interacts with the consortium chain module through contracts to achieve identity authentication and access authorization detection between different domains. A data storage module, used for storing different types of data; Industrial IoT devices, including but not limited to domain master management end AS i , Department Management BS i and DS on common resource-constrained devices i Among them, the domain master management end and department management end in multiple institutions serve as the main nodes, and the resource-constrained device end serves as the light node, which together constitute the alliance chain system.

Images