Internet of vehicles dynamic access control method and control system based on block chain

Abstract

The invention belongs to the technical field of Internet of Vehicles, and discloses an Internet of Vehicles dynamic access control method and control system based on a block chain, and the control method comprises the steps: S1, carrying out the identity verification of an access subject, entering S2 after the verification succeeds, and refusing the access after the verification fails; s2, obtaining an access request of an access subject; s3, verifying the access request through an access strategy of the smart contract, allowing access and entering a step S4 if verification succeeds, and rejecting access if verification fails; and S4, obtaining access feedback of the access subject after the access is completed, performing comprehensive trust evaluation on the access subject through the access feedback and historical access data stored on the block chain, and updating an access strategy of the smart contract according to a comprehensive trust evaluation result. In conclusion, the trust evaluation mechanism established by the invention can effectively identify malicious vehicles and effectively resist distributed attacks, denial of service attacks and the like, so that the stability and the reliability of the system are ensured.

Description

Technical Field

[0001] The present invention belongs to the technical field of Internet of Vehicles, and specifically relates to a blockchain-based Internet of Vehicles dynamic access control method and control system. Background Art

[0002] In recent years, the Internet of Vehicles has become one of the most important development directions for vehicle management in urban road traffic systems, and has attracted widespread attention and research. With the explosive number of road devices connected to the Internet, how to ensure the security of the Internet of Vehicles has become a major challenge we face. As the first line of defense against system security, access control strictly controls which devices can be accessed and only allows devices with legal permissions to access data, thereby meeting the security needs of the Internet of Vehicles to a certain extent.

[0003] Currently, the Internet of Vehicles generally uses traditional, trusted centralized authorization policy entities for access control, which inevitably leads to single point failure problems. The application of blockchain technology can effectively solve these problems. In the distributed system of blockchain, access records and authorization rules can be effectively stored in a verifiable and permanent way. However, due to the rapid mobility and high dynamics of the Internet of Vehicles, simply combining the traditional access control model with blockchain technology is still not enough to provide effective control. Summary of the invention

[0004] In view of this, in order to solve the problems raised in the above background technology, the purpose of the present invention is to provide a dynamic access control method and control system for the Internet of Vehicles based on blockchain, introduce trust attributes into the attribute-based access control model, and use the Dirichlet distribution trust model to consider the diversity of ratings. At the same time, with the help of blockchain and smart contracts, it supports the secure storage of data and the automatic execution of access control policies, thereby constructing a secure, dynamic and fine-grained Internet of Vehicles access control method.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] A blockchain-based Internet of Vehicles dynamic access control method, comprising:

[0007] S1. Authenticate the access subject. If the authentication succeeds, proceed to step S2. If the authentication fails, access is denied.

[0008] S2. Obtain the access request of the access subject;

[0009] S3. Verify the access request through the access policy of the smart contract. If the verification is successful, access is allowed and the process goes to step S4. If the verification fails, access is denied.

[0010] S4. After the access is completed, the access feedback of the access subject is obtained, and a comprehensive trust evaluation is performed on the access subject based on the access feedback and the historical access data stored on the blockchain, and the access policy of the smart contract is updated according to the comprehensive trust evaluation result.

[0011] Preferably, the method of authenticating the access subject's identity at least includes verifying the access subject's identity ID and verifying the access subject's device MAC address.

[0012] Preferably, the access policy is expressed as P(E,A)={R,L,Θ}; wherein E represents the resource that the access subject wants to access based on the access request, A represents the operation that the access subject intends to perform on the resource E based on the access request, R represents the set of access rules, L represents the integration algorithm when different rules conflict, and Θ represents the trust value of the access subject.

[0013] Preferably, the comprehensive trust evaluation includes trust calculation and trust update.

[0014] Preferably, the trust calculation is performed using a Dirichlet distribution trust model, and the calculation expression is: Where α represents the concentration parameter, N={N1,N2,L,N K} represents the set of the number of occurrences of each access feedback, N i Indicates the number of times the i-th access feedback occurs.

[0015] Preferably, the probability distribution density function of the Dirichlet distribution trust model is:

[0016]

[0017] Where, θ={θ1,θ2,L,θ K} is a multivariate continuous random variable, and B(α) is a normalized multivariate function.

[0018] Preferably, the trust update is a prediction update, and the prediction expression is:

[0019]

[0020] In the formula, εi is the attenuation factor.

[0021] Preferably, the access feedback includes positive feedback, negative feedback, neutral feedback and empty feedback, and when the access feedback is empty feedback, N i (t N )=0.

[0022] Preferably, the attenuation factor values ​​of the negative feedback, neutral feedback, and positive feedback decrease in sequence.

[0023] As a general inventive concept, the present invention also provides the following technical solutions:

[0024] A blockchain-based Internet of Vehicles dynamic access control system, including a trusted center, an on-board unit, a roadside unit, and an edge server;

[0025] The trusted center is used to authenticate the access subject;

[0026] The onboard unit is used to send an access request to the roadside unit after the access subject passes the identity authentication, and is also used to send access feedback to the roadside unit after the access is completed;

[0027] The roadside unit is used to receive access requests and access feedback, and is also used to verify the access request according to the access policy of the smart contract;

[0028] The edge server is used to perform a comprehensive trust evaluation based on access feedback and historical access data stored on the blockchain, and update the access policy of the smart contract based on the comprehensive trust evaluation result.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] (1) The trust evaluation mechanism established by the present invention can effectively identify malicious vehicles and effectively resist distributed and denial-of-service attacks, thereby ensuring the stability and reliability of the system.

[0031] (2) By using smart contract technology, the present invention enables access control policies to be updated in real time and dynamically adjust permissions according to actual conditions, thereby improving the flexibility and adaptability of the system. The automatic execution of smart contracts reduces human intervention and improves the efficiency and accuracy of access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a flow chart of the vehicle networking dynamic access control method based on blockchain of the present invention;

[0033] Figure 2 This is a structural diagram of the Internet of Vehicles dynamic access control system based on blockchain of the present invention;

[0034] Figure 3 This is a simulation diagram of the number of successful accesses under different proportions of malicious behaviors;

[0035] Figure 4 This is a simulation comparison diagram of the Internet of Vehicles dynamic access control method based on blockchain of the present invention and the traditional access control method. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] The present invention provides a Figure 2 The vehicle network dynamic access control system based on blockchain shown in the figure, and the vehicle network dynamic access control method based on blockchain is executed by the system, and the specific reference is Figure 1 As shown, the following steps are included:

[0038] S0. Initialize the network

[0039] Initialize the trusted center, on-board unit, roadside unit, and edge server in the control system.

[0040] S1. Identity Authentication

[0041] (1) Identity construction: The vehicle entity uploads identity information such as identity ID and device MAC address through the trusted center to build the access subject identity, and the corresponding identity information is distributed and stored in the blockchain;

[0042] (2) Identity verification: Based on the information stored in the blockchain, the access subject is authenticated. If the verification is successful, the process goes to step S2. If the verification fails, access is denied.

[0043] S2. Access Request

[0044] The authenticated access subject generates an access request from the vehicle-mounted unit and sends the access request to the roadside unit;

[0045] Since data transmission has a certain distance limitation, the roadside unit that can communicate with the on-board unit of the access subject receives the access request of the access subject.

[0046] S3. Policy Verification

[0047] After receiving the access request, the roadside unit automatically triggers the access policy of the smart contract and verifies the access request through the triggered access policy; if the verification is successful, access is allowed and the process goes to step S4; if the verification fails, access is denied.

[0048] The ABAC model is adopted as the access policy management mechanism in the present invention, and the access control policy based on ABAC is defined as P={E, A, S, O}; wherein E represents the resource that the access subject wants to access according to the access request, A represents the operation (such as read, write, execute) that the access subject intends to perform on the resource E according to the access request, S represents the on-board unit of the access subject, and O represents the roadside unit that receives the access request sent by the on-board unit.

[0049] The present invention takes into account that the traditional ABAC model is static, while the Internet of Vehicles is fast and highly dynamic. Therefore, the present invention introduces trust as the main attribute of the subject to reflect the security status of the subject in real time and prevent malicious access. At the same time, the trust attribute will be updated regularly through trust evaluation. Therefore, for each access request, the access policy of the present invention can be expressed as P(E,A)={R,L,Θ}; where R represents the set of access rules, L represents the integration algorithm when different rules conflict, and Θ represents the trust value of the access subject.

[0050] S4. Trust Assessment

[0051] After the visit is completed, the visit subject's visit feedback is obtained. The visit feedback is specifically manifested as the rating of the current visit process, and the visit feedback includes positive feedback, negative feedback, neutral feedback and empty feedback.

[0052] A comprehensive trust evaluation is performed on the access subject through access feedback and historical access data stored on the blockchain, and the comprehensive trust evaluation includes trust calculation and trust update:

[0053] (1) Trusted Computing

[0054] The present invention uses the Dirichlet distribution trust model to take into account the diversity of access feedback ratings, and its Dirichlet probability distribution density function is:

[0055] Where, θ={θ1,θ2,L,θ K} is a multivariate continuous random variable, α represents the concentration parameter;

[0056] B(α) is a normalized multivariate function, and

[0057] Γ(x) is the Gamma function, and

[0058] In addition, in the present invention, it is assumed that the blockchain stores the H visits of the vehicle-mounted unit. The rating D = {d1, d2, L, d H}, according to Bayes' theorem:

[0059] P(D|θ) is the likelihood function, P(D|α) is the prior distribution,

[0060] Where N = {N1, N2, L, N K} represents the set of the number of occurrences of each access feedback, N i represents the number of times the i-th access feedback occurs;

[0061] From the above calculation, we can get:

[0062]

[0063] The posterior distribution is

[0064] The posterior distribution of the upper surface follows the Dirichlet distribution Dir(α+N), that is, θ|D,α~Dir(α+N);

[0065] In summary, the expression of trust calculation (expected access feedback rating of category i) is:

[0066]

[0067] (2) Trust Update

[0068] Considering that the value of access feedback rating has the characteristic of time decay, in order to ensure that the historical value of access feedback rating is reasonably and scientifically evaluated, the present invention uses a decay function in constructing trust evaluation. The time period of access feedback rating records received within a fixed time period is recorded as period t, and the current period is recorded as t N , the number of statistical results is recorded as W(t N ), where the result of the i-th rating is W i (t N ) is calculated as:

[0069] In the formula, εi is the attenuation factor.

[0070] Control the decay rate of the i-th access feedback rating over time. In the present invention, each access feedback rating is set to have its own specific decay rate to reflect its characteristics of changing over time. In practice, due to the potential threat of malicious behavior or even more serious damage, it is preferred to limit the values ​​of the decay factors of the negative feedback, neutral feedback, and positive feedback to decrease in sequence, and then obtain the predicted trust update expression:

[0071]

[0072] In addition, for empty feedback, that is, no visit feedback rating about the visit subject is obtained after the visit is completed, then N i (tN )=0, and accordingly, the predicted trust update expression is:

[0073] (Return to initial value).

[0074] S5. Update the access policy of the smart contract according to the comprehensive trust evaluation result.

[0075] In view of the above-mentioned blockchain-based Internet of Vehicles dynamic access control method, the present invention uses OMNeT++ combined with Veins and SUMO to simulate the Internet of Vehicles environment, and implements the interaction with the smart contract through web3.py. The smart contract is compiled using Solidy0.7.0, and then the method provided by the present invention is verified. The simulation parameters are shown in Table 1.

[0076]

[0077] To ensure the effectiveness of this method, the smart contract was compiled and deployed in Remix, and a complete access control process was performed, where Subject1 and Subject2 were two devices with the same attribute but different trust values. Through Event monitoring, Subject1 was denied access because the trust value did not meet the standard, while Subject2 was allowed.

[0078] In order to verify the security advantage of the method of the present invention in preventing malicious vehicle behavior, the method of the present invention simulates the number of successful accesses when the number of accesses increases from 50 to 200 when the proportion of malicious vehicles is 10%, 30%, 50%, and 70% respectively. The access results are shown in Figure 4 As shown in Figure 1, as the proportion of malicious vehicles gradually increases, the number of successful accesses shows a downward trend. Especially when the proportion of malicious vehicles exceeds 50%, the number of successful accesses decreases significantly.

[0079] The method of the present invention is further compared with the traditional access control method. The results are as follows: Figure 4 As shown in the figure, as the proportion of malicious access behaviors continues to increase, the access success rates of different access control methods all decrease, but the method of the present invention decreases significantly faster. When the proportion of malicious vehicles exceeds 50%, the access success rate of the method of the present invention has dropped below 50%, while the traditional access control method is still above 90%. Therefore, the method of the present invention can effectively reduce the risk of malicious access and realize dynamic access control.

[0080] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A blockchain-based Internet of Vehicles dynamic access control method, characterized in that: include: S1. Authenticate the access subject. If the authentication succeeds, proceed to step S2. If the authentication fails, access is denied. S2. Obtain the access request of the access subject; S3. Verify the access request through the access policy of the smart contract. If the verification is successful, access is allowed and the process proceeds to step S4. If the verification fails, access is denied. S4. After the access is completed, the access feedback of the access subject is obtained, and a comprehensive trust evaluation is performed on the access subject based on the access feedback and the historical access data stored on the blockchain, and the access policy of the smart contract is updated according to the comprehensive trust evaluation result.

2. The method for dynamic access control of Internet of Vehicles based on blockchain according to claim 1 is characterized in that: The method of authenticating the access subject at least includes verifying the access subject's identity ID and verifying the access subject's device MAC address.

3. The method for dynamic access control of Internet of Vehicles based on blockchain according to claim 1 is characterized in that: The access policy is expressed as P(E,A)={R,L,Θ}; wherein E represents the resource that the access subject wants to access based on the access request, A represents the operation that the access subject intends to perform on the resource E based on the access request, R represents the set of access rules, L represents the integration algorithm when different rules conflict, and Θ represents the trust value of the access subject.

4. The method for dynamic access control of Internet of Vehicles based on blockchain according to claim 3 is characterized in that: The comprehensive trust evaluation includes trust calculation and trust update.

5. The method for dynamic access control of Internet of Vehicles based on blockchain according to claim 4 is characterized in that: The trust calculation is performed using the Dirichlet distribution trust model, and the calculation expression is: Where α represents the concentration parameter, N={N1,N2,L,N K } represents the set of the number of occurrences of each access feedback, N i Indicates the number of times the i-th access feedback occurs.

6. The method for dynamic access control of Internet of Vehicles based on blockchain according to claim 5 is characterized in that: The probability distribution density function of the Dirichlet distribution trust model is: Where, θ={θ1,θ2,L,θ K } is a multivariate continuous random variable, and B(α) is a normalized multivariate function.

7. The method for dynamic access control of Internet of Vehicles based on blockchain according to claim 6 is characterized in that: The trust update is a prediction update, and the prediction expression is: In the formula, εi is the attenuation factor.

8. The method for dynamic access control of Internet of Vehicles based on blockchain according to claim 7 is characterized in that: The access feedback includes positive feedback, negative feedback, neutral feedback and empty feedback, and when the access feedback is empty feedback, N i (t N )=0.

9. The method for dynamic access control of Internet of Vehicles based on blockchain according to claim 8 is characterized in that: The values ​​of the attenuation factors of the negative feedback, neutral feedback, and positive feedback decrease in sequence.

10. A blockchain-based Internet of Vehicles dynamic access control system, characterized by: Includes trusted center, onboard unit, roadside unit and edge server; The trusted center is used to authenticate the access subject; The on-board unit is used to send an access request to the roadside unit after the access subject passes the identity authentication, and is also used to send access feedback to the roadside unit after the access is completed; The roadside unit is used to receive access requests and access feedback, and is also used to verify the access request according to the access policy of the smart contract; The edge server is used to perform a comprehensive trust evaluation based on access feedback and historical access data stored on the blockchain, and update the access policy of the smart contract based on the comprehensive trust evaluation result.

Images