An internet of things data access control method and system

Abstract

The application discloses an Internet of Things data access control method and system, and relates to the technical field of computers, which comprises the following steps: obtaining device information of an Internet of Things device, sending the device information of the Internet of Things device to a blockchain based on an agent node for identity registration, encrypting data obtained by the Internet of Things device to obtain data ciphertext, sending the data ciphertext to an IPFS system based on the agent node for storage to obtain a hash address; generating an access token based on a preset access strategy of a data owner and a decryption key of the data ciphertext, and sending the access token to the blockchain for storage after the access token is encrypted by the Internet of Things device based on the agent node and using a preset CP-ABE algorithm; obtaining a set attribute of a data visitor, matching the set attribute of the data visitor with the preset access strategy of the data owner, and if the matching is consistent, using a private key of a preset algorithm to decrypt the access token of the blockchain to obtain the access permission of the data, thereby realizing the implementation of access control.

Description

Technical Field

[0001] This invention relates to the field of computer technology, specifically to an Internet of Things (IoT) data access control method and system. Background Technology

[0002] With the rapid development of the internet and sensor technology, the Internet of Things (IoT) has been widely applied in various fields, enabling connectivity between things and between people and things, resulting in exponential growth of IoT data. In the IoT field, IoT devices face not only traditional security issues such as software security, hardware security, and network security, but also more severe new security risks, such as unauthorized access, data tampering, and information leakage. These issues pose serious threats to the security and privacy of data in the IoT field. Access control is an effective means of achieving controlled data sharing; therefore, the primary issue in ensuring data security in the IoT environment is to control data access and prevent unauthorized access. In traditional IoT systems, data collected by devices is uploaded to a centralized cloud server for storage and management. The centralized model implies the existence of a trusted entity that can distribute access permissions according to access policies. Once this trusted entity is maliciously attacked, the entire access control system will go out of control, all data information will be exposed, and privacy will be completely compromised, failing to meet the requirements for data security and privacy. Blockchain, with its advantages of decentralization and immutability, has begun to be used in the IoT field. However, traditional blockchain technologies, such as the Bitcoin system, suffer from disadvantages such as low throughput and high latency, making their availability unsuitable for the IoT field. Summary of the Invention

[0003] To address the shortcomings mentioned in the background section, the present invention aims to provide an Internet of Things (IoT) data access control method and system.

[0004] Firstly, the objective of this invention can be achieved through the following technical solution: an Internet of Things (IoT) data access control method, the method comprising the following steps:

[0005] Obtain device information of IoT devices, send the device information of IoT devices to the blockchain for identity registration based on the agent node, encrypt the data obtained by IoT devices to obtain data ciphertext, send the data ciphertext to the IPFS system for storage based on the agent node to obtain the hash address, and send the hash address to the blockchain for storage based on the agent node.

[0006] An access token is generated based on the access policy preset by the data owner and the decryption key of the encrypted data. The IoT device uses the preset CP-ABE algorithm to encrypt the access token based on the agent node and then sends it to the blockchain for storage.

[0007] The system obtains the set attributes of data visitors and matches them with the data owner's preset access policy. If the match is found, the system uses the private key of the preset CP-ABE algorithm to decrypt the blockchain access token to obtain data access rights. Otherwise, data access rights cannot be obtained. Based on the data access rights, the system publishes access events.

[0008] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: the process of sending the device information of the IoT device to the blockchain for identity registration based on the proxy node includes:

[0009] IoT device A generates a public-private key pair (PK). a SK a Then, based on the unique identifier ID of the IoT device a itself... a Public key PK a Private key SK a Generate a signing certificate Cert a ={ID a PK a ,sig(SK a ,(ID a PK a ))}, where sig(SK a ,(ID a PK a )) represents the signature of IoT device a;

[0010] After connecting to the proxy node, according to the proxy node G net public key PK net IoT device a uses the generated signature certificate Cert a Encryption is performed using an asymmetric encryption algorithm, and the data is then sent to the proxy node G. net Declare your identity; Proxy node G net After receiving encrypted information from IoT device a, it uses its own private key SK. net Decrypt the information to obtain Cert a ;

[0011] Agent node G net Cert is obtained through decryption. a Then, based on the public key PK of IoT device a contained therein... a For the signature sig(SK) a ,(ID a PK a Perform verification, verify Cert a The legitimacy;

[0012] Agent node G netGenerate an attribute set ATT for IoT device a a ={att a1 ,att a2 ,… ,att ai ,…,att an}, where att ai (i=1,2,3,…,n) represents the i-th attribute of IoT device a, and the attribute is stored in key-value pairs; agent node G net Based on the unique identifier ID of IoT device a a and the attribute set ATT a The set of attributes is used to generate an attribute authentication application (Re) for IoT device a. a_att ;

[0013] Re a_att ={ID a G net ,ATT a ,sig(SK net ,(ID a G net ,ATT a ))}

[0014] Agent node G ne Attribute authentication application Re a_att The attribute set is sent to the Trusted Private Key Authority (TA) in the CP-ABE algorithm system for verification of its validity. After verification, the TA signs the attribute set and generates an attribute certificate (Cert). a_att ;

[0015] Cert a_att ={ID a ,ATT a ,sig(SK TA ,(ID a ,ATT a ))}

[0016] Trusted Authority (TA) will assign attribute certificates (Cert). a_att Send to proxy node G net This represents the set of attributes ATT for IoT device a. a The certification indicates that the attributes of IoT device a have passed the validity check;

[0017] Agent node G net Check the Tangle ledger in the access control chain to see if IoT device 'a' has been registered. If not, then proxy node G... net First use your own private key SK net (ID) a G net PKnet Sign the signature and generate the signature sig(SK). net ,(ID a G net PK net Then sign sig(SK) net ,(ID a G net PK net The ID of IoT device a a Agent node G net public key PK net The set of attributes of IoT device a, ATT a and attribute certificate Cert a_att Assemble into identity registration transaction T reg ;

[0018] T reg ={ID a G net PK net , sig(SK net ,(ID a G net PK net )),ATT a Cert a_att};

[0019] Agent node G net The Markov Chain Monte Carlo Random Walk (MCMC) algorithm used in the IOTA system is applied to the registration transaction T in the access control chain. reg Select two parent transactions that require confirmation; after the parent transactions pass the check, the proxy node G... net By referencing these two parent transactions, the identity registration transaction T for IoT device a is... reg Add the identity registration transaction T to the Tangle ledger of the access control chain, and simultaneously broadcast the identity registration transaction T within the blockchain network of the access control chain. reg To inform other nodes so that transaction T reg It has been confirmed.

[0020] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: the process of sending the encrypted data to storage within the IPFS system based on the proxy node:

[0021] After IoT device a collects data, the data is denoted as R. a The data R is calculated using the SHA256 algorithm. aThe hash value is used, with the first 128 bits of the SHA256 algorithm output as the key K and the last 128 bits as the hash fragment seHash. The AES128 symmetric encryption algorithm is then used, with the key K and data R... a To obtain the encrypted eData as input, IoT device a then sends the data message MSG to the agent node;

[0022] MSG={eData,seHash,ID a ,descD,timestamp,PK a ,sign}

[0023] Among them: ID a This indicates the identity of IoT device 'a', which is the sender of data; descD indicates the data R. a The label; timestamp represents the timestamp of the sending; sign=sig(SK a ,(eData,seHash, ID a ,descD,timestamp,PK a This indicates that IoT device a accesses data R. a The signature.

[0024] Agent node G net Received data message MSG={eData,seHash,ID a ,descD,timestamp,PK a After `,sign}`, based on the public key PK of IoT device a... a Verify the signature (sign). If the verification is successful, transfer the data (R). a The encrypted eData is uploaded to the IPFS storage system. IPFS returns the hash address IPFS_Hash that identifies the encrypted eData. Proxy node G... net Using the public key PK of IoT device a a The IPFS_Hash is encrypted and sent to IoT device a. After receiving the ciphertext, IoT device a uses its own private key SK. a Decrypt the ciphertext to obtain the IPFS_Hash, and store the IPFS_Hash locally for use in constructing access tokens;

[0025] The agent node device converts the data message MSG into a standardized JSON format and assembles it into a data storage T. stor ={IPFS_Hash, seHash, ID a ,descD,timestamp,PK a ,sign}, proxy node Gnet The Markov Chain Monte Carlo Random Walk Algorithm (MCMC) used in the IOTA system is applied to data storage transactions (T) within the data storage chain. stor Select two parent transactions that require confirmation, and store the data in transaction T by referencing these two parent transactions. stor It is added to the Tangle ledger in the data storage chain.

[0026] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: the process of generating an access token based on the access policy preset by the data owner and the decryption key of the data ciphertext is as follows:

[0027] The CP-ABE algorithm is initialized, and the trusted organization TA generates the system's master key MK and public key PK.

[0028] Using the Boolean formula strategy in the CP-ABE algorithm, the data R of IoT device a... a The access control policy that needs to embed ciphertext is determined by the formula: Policy = A1∧A2∧A3∧⋯∧A n , where A i ATT={att} in the data visitor attribute set 1, att 2,····， att i,····， att n at in} i One-to-one correspondence, where i = 1, 2, 3, ···· ,n represents that access to data R of IoT device a is permitted only if the data visitor's attribute set satisfies the policy. a ;

[0029] IoT device a constructs an access token Token={sig(SK a ID a ), Policy, IPFS_Hash, K}, where sig(SK a ID a This indicates that IoT device a uses its own private key to create a unique identifier ID for IoT device a. a Perform a signature; IPFS_Hash represents the data R. a The unique identifier, and also the data R a The ciphertext's hash address in the IPFS system; K represents the hash address used to decrypt the data R. a The key for the encrypted eData;

[0030] IoT device A sends the constructed access token to the proxy node. The proxy node, based on the access control policy set in the token, encrypts the access token using the public key (PK) of the CP-ABE algorithm to obtain the enToken. The enToken is then decrypted by the CP-ABE private key of the data user conforming to the policy. Finally, the proxy node uses the unique identifier ID of IoT device A... a Encrypted access token (enToken), data R a IPFS_Hash and its own information G net Generate access policy and publish transaction T pol ={ID a enToken, G net IPFS_Hash, sig(ID) a enToken, G net )};

[0031] Agent node G net The IOTA system uses the Markov Chain Monte Carlo No-Rules Walk (MCMC) algorithm to publish transactions T for access policies in the access control chain. pol Select two parent transactions that require confirmation; after the parent transactions pass the check, the proxy node G... net By referencing two parent transactions, the access strategy publication transaction T is obtained. pol Add it to the Tangle ledger in the access control chain.

[0032] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: the process of matching the set attributes of data visitors with the access strategy preset by the data owner; if the match is found, then using the private key of the preset CP-ABE algorithm to decrypt the access token of the blockchain to obtain access to the data.

[0033] Data user B from data storage transaction T in the data storage chain stor ={IPFS_Hash, seHash, ID} a ,descD,timestamp,PK a Data R from IoT device a is obtained in ,sign} a After obtaining the unique identifier IPFS_hash, the stored data R is located in the access control chain based on the unique identifier IPFS_hash. a Transactions of encrypted access token enToken (T) pol ={ID a enToken, G net IPFS_Hash, sig(ID) aenToken, G net )}, obtain enToken;

[0034] Data user B obtains their own attribute certificate Cert from the access control chain based on their registration information. B_att ={ID B ,ATT B ,sig(SK TA ,(ID B ,ATT B ))}, will Cert B_att Send it to a trusted authority (TA) to request TA to distribute the private key;

[0035] After receiving the request, the trusted authority (TA) verifies the Cert. B_att ={ID B ,ATT B ,sig(SK TA ,(ID B ,ATT B After validating the validity of ))}, the property set ATT is used as the basis for further validation. B The master key MK generates a private key CP-ABESK corresponding to the attributes of data user B. B Trusted organization TA will CP-ABESK B Send to data user B;

[0036] Data user B obtains the private key CP-ABESK B Then, the encrypted access token enToken is decrypted to obtain the plaintext access token Token, Token={sig(SK a ID a ),Policy,IPFS_Hash,K};

[0037] Data user B downloads data R from the IPFS system based on the IPFS_Hash. a The ciphertext eData is decrypted using the symmetric key K to obtain the plaintext data R. a Then use the SHA256 algorithm to calculate the data R. a The hash value is used to combine the last 128 bits of the result returned by the SHA256 algorithm with the data storage transaction T. stor The `seHash` in `={IPFS_Hash, seHash, IDa,descD,timestamp, PKa,sign}` is compared. If they match, it means the data has not been tampered with, and data user B obtains data R. a Access permissions.

[0038] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: the process of publishing access events based on data access permissions:

[0039] Based on the data access permissions, a zero-knowledge proof with access permissions is generated, and an access log is constructed based on it and published on the blockchain to realize the publication of access events.

[0040] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: the generation process of the zero-knowledge proof:

[0041] Data user B constructs two parameter groups: a public parameter group, Public Inputs = {SHA256(Policy), IPFS_Hash, nonce}, where SHA256(Policy) represents the hash of the access policy and nonce represents a random number; and a private parameter group, Private Inputs = {CP-ABESK}. B ,ATT B ,K,SHA246(R a )}, where SHA256(R a ) represents data R a The hash value;

[0042] Four verification logic steps: Data user B's private key CP-ABESK B The corresponding attribute satisfies the access policy; CP-ABESK is used. B After decrypting the encrypted access token enToken, the correct key K is obtained; K can decrypt the data corresponding to IPFS_Hash, and the result is complete; the proof process is not replayed, and the data user B encodes the four verification logics into an arithmetic circuit with parameters in the public parameter group Public Inputs and the private parameter group Private Inputs.

[0043] Data user B inputs secret data: user attribute set ATT B Private key CP-ABESK B Key K, Data R a Hash value SHA256(R) a ) and input public data: access policy hash SHA256 (Policy), data R a The unique data identifier IPFS_Hash and the random number nonce are used to obtain the zero-knowledge proof zkp_proof after compiling and running the arithmetic circuit.

[0044] Access event publication: Data users assemble access event transaction T based on the public parameter set Public Inputs={SHA256(Policy), IPFS_Hash, nonce} and ZKP zero-knowledge proof zkp_proof. acclog ={ID B The transaction, named `access`, specifies the purpose of the transaction as accessing a record of an event. Data consumer B runs a Markov chain Monte Carlo random walk algorithm (MCMC) to select two parent transactions that require confirmation. After the parent transactions pass the check, the access log transaction `T` is confirmed by referencing these two parent transactions. acclog Adding to the Tangle ledger indicates that data R a An access request was made and access was successfully granted.

[0045] Secondly, in order to achieve the above objectives, the present invention discloses an Internet of Things (IoT) data access control system, comprising:

[0046] The encrypted storage module is used to obtain device information of IoT devices, send the device information of IoT devices to the blockchain for identity registration based on the agent node, encrypt the data obtained by IoT devices to obtain data ciphertext, send the data ciphertext to the IPFS system for storage based on the agent node to obtain the hash address, and send the hash address to the blockchain for storage based on the agent node.

[0047] The token generation module is used to generate access tokens based on the access policy preset by the data owner and the decryption key of the encrypted data. The IoT device uses the preset CP-ABE algorithm to encrypt the access tokens based on the agent node and then sends them to the blockchain for storage.

[0048] The access control module is used to obtain the set attributes of data visitors, match the set attributes of data visitors with the access policy preset by the data owner, and if the match is found, use the private key of the preset CP-ABE algorithm to decrypt the access token of the blockchain to obtain access to the data; otherwise, access to the data cannot be obtained, and access events are published based on the data access permissions.

[0049] In another aspect of the present invention, in order to achieve the above-mentioned objective, a terminal device is disclosed, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor. The memory stores the computer program capable of running on the processor, and when the processor loads and executes the computer program, it employs an Internet of Things data access control method as described above.

[0050] In another aspect of the present invention, in order to achieve the above objectives, a computer-readable storage medium is disclosed, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is loaded and executed by a processor, an Internet of Things data access control method as described above is employed.

[0051] The beneficial effects of this invention are:

[0052] This invention utilizes an attribute-based encryption algorithm to achieve fine-grained access control; it employs IPFS technology to store encrypted data, resolving the single point of failure issues that may arise with traditional cloud storage; and it adopts IOTA blockchain technology, whose ledger uses a directed acyclic graph structure, alleviating the low throughput and scalability problems of traditional blockchains. A dual-chain design is employed: one chain is used for access control, storing identity registration information and CP-ABE-encrypted data, while the other stores the hash address of the data within the IPFS system. This dual-chain design avoids resource contention on a single chain, ensuring improved system throughput. Furthermore, the dual-chain design ensures that access policy writes do not block data writes, making it suitable for high-frequency IoT scenarios. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 This is a schematic diagram of the method flow of the present invention;

[0055] Figure 2 This is a schematic diagram of the technical framework of the present invention;

[0056] Figure 3 This is a performance indicator diagram of the present invention with the participation of a single node;

[0057] Figure 4 This is a performance index diagram of the present invention with the participation of multiple nodes;

[0058] Figure 5 This is a diagram showing the performance of the present invention in the face of double-flower attacks;

[0059] Figure 6 This is a diagram illustrating how the present invention performs when facing node asynchrony attacks;

[0060] Figure 7 This is a schematic diagram of the system structure of the present invention. Detailed Implementation

[0061] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0062] Example 1:

[0063] like Figure 1 As shown, an Internet of Things (IoT) data access control method includes the following steps:

[0064] S101: Obtain device information of IoT devices, send the device information of IoT devices to the blockchain for identity registration based on the agent node, encrypt the data obtained by IoT devices to obtain data ciphertext, send the data ciphertext to the IPFS system for storage based on the agent node to obtain the hash address, and send the hash address to the blockchain for storage based on the agent node.

[0065] Specifically, the identity registration process:

[0066] IoT device A generates a public-private key pair (PK). a SK a Then, based on the unique identifier ID of the IoT device a itself... a Public key PK a Private key SK a Generate a signing certificate Cert a ={ID a PK a ,sig(SK a ,(ID a PK a ))}, where sig(SK a ,(ID a PK a )) represents the signature of IoT device a.

[0067] After connecting to the proxy node, use the proxy node's public key PK. net IoT device a uses the generated signature certificate Cert a Encrypt the data using an asymmetric encryption algorithm and then send it to the proxy node G. net Declare your identity. Proxy node G net After receiving encrypted information from IoT device a, it uses its own private key SK. net Decrypt the information to obtain Cert a .

[0068] The proxy node obtains the Cert through decryption.a Then, based on the public key PK of IoT device a contained therein... a For the signature sig(SK) a ,(ID a PK a Perform verification, verify Cert a The legitimacy of it.

[0069] Agent node G net Generate an attribute set ATT for IoT device a a ={att a1 ,att a2 ,… ,att ai ,…,att an}, where att ai (i=1,2,3,…,n) represents the i-th attribute of IoT device a, stored as key-value pairs. Agent node G net Based on the unique identifier ID of IoT device a a and the attribute set ATT a The attribute set generates the attribute request Re a_att .

[0070] Re a_att ={ID a G net ,ATT a ,sig(SK net ,(ID a G net ,ATT a ))}

[0071] Among them, sig(SK) net ,(ID a G net ,ATT a )) represents the proxy node G net A signature generated using your own private key.

[0072] Agent node G net Request the attribute Re a_att The attribute set is sent to the Trusted Authority (TA) of the CP-ABE algorithm for verification. After verification, the TA signs the attribute set and generates an attribute certificate (Cert). a_att .

[0073] Cert a_att ={ID a ,ATT a ,sig(SK TA ,(ID a ,ATT a))}

[0074] Among them, sig(SK) TA ,(ID a ,ATT a This represents the signature of the set of attributes of IoT device a by a trusted institution TA using its own private key.

[0075] Trusted Authority (TA) will assign attribute certificates (Cert). a_att Send to proxy node G net This represents the set of attributes ATT for IoT device a. a Authentication.

[0076] Agent node G net Check the Tangle ledger in the access control chain to see if IoT device 'a' has been registered. If not, then proxy node G... net First use your own private key SK net (ID) a G net PK net Sign the signature and generate the signature sig(SK). net ,(ID a G net PK net Then, the signature, the ID of IoT device a, will be generated. a Agent node G net public key PK net The set of attributes of IoT device a, ATT a and attribute certificate Cert a_att Assemble into an identity registration transaction T reg .

[0077] T reg ={ID a G net PK net , sig(SK net ,(ID a G net PK net )),ATT a Cert a_att}

[0078] Agent node G net The IOTA system uses the Markov Chain Monte Carlo Unstructured Walk (MCMC) algorithm to register transaction T in the access control chain. reg Select two parent transactions that require confirmation. After the parent transactions pass the check, the proxy node G... net By referencing these two parent transactions, the identity registration transaction T for IoT device a is... regAdd it to the Tangle ledger in the access control chain.

[0079] Data storage:

[0080] IoT device a collects data (denoted as R) a After that, the SHA256 algorithm is used to calculate the data R. a The hash value is used to determine the key K, with the first 128 bits of the SHA256 algorithm output being used as the key K, and the last 128 bits being used as the hash fragment seHash. seHash is then used for the data R. a Integrity verification is then performed. Following this, the AES128 symmetric encryption algorithm is used, with key K and data R... a The encrypted text eData is obtained as input. Then, IoT device a sends the data message MSG to the agent node;

[0081] MSG={eData,seHash,ID a ,descD,timestamp,PK a ,sign}

[0082] Among them: ID a This indicates the identity of IoT device 'a', which is the sender of data; descD represents data 'R'. a The tag briefly describes the data type and content; timestamp represents the timestamp of the sending; sign=sig(SK a ,(eData,seHash, ID a ,descD,timestamp,PK a ), indicating that IoT device a accesses data R a The signature.

[0083] Agent node G net Received data message MSG={eData,seHash,ID a ,descD,timestamp,PK a After `,sign}`, based on the public key PK of IoT device a... a Verify the signature (sign). If the verification is successful, transfer the data (R). a The encrypted eData is uploaded to the IPFS storage system, and IPFS returns a hash address, IPFS_Hash, that identifies the encrypted eData. The proxy node uses the public key PK of IoT device a. a The IPFS_Hash is encrypted and sent to IoT device a. IoT device a stores the IPFS_Hash locally for use in constructing subsequent access tokens.

[0084] The agent node device converts the data message MSG into a standardized JSON format and assembles it into a data storage T. stor ={IPFS_Hash, seHash, ID} a ,descD,timestamp,PK a ,sign}. Proxy node G net The IOTA system uses the Markov Chain Monte Carlo Random Walk (MCMC) algorithm to perform data storage transactions T in the data storage chain. stor Select two parent transactions that require confirmation. Store the data in transaction T by referencing these two parent transactions. stor It is added to the Tangle ledger in the data storage chain.

[0085] S102: An access token is generated based on the access policy preset by the data owner and the decryption key of the encrypted data. The IoT device encrypts the access token using the preset CP-ABE algorithm based on the agent node and sends it to the blockchain for storage.

[0086] The process of generating an access token based on a preset access policy and the decryption key of the encrypted data is as follows:

[0087] The CP-ABE algorithm is initialized, and the trusted organization TA generates the system's master key MK and public key PK.

[0088] A Boolean formula strategy is adopted. IoT device a data R a The access control policy that needs to embed ciphertext is determined by the formula: Policy = A1∧A2∧A3∧⋯∧A n , where A i (i=1,2,3, ···· (n) and ATT={att) in the data visitor attribute set 1, att 2,····， att i,····， att n at in} i (i=1,2,3, ···· A one-to-one correspondence exists between the attributes (n) of an IoT device. This means that data access to device a's data R is only permitted when the data accessor's attribute set satisfies the policy. a .

[0089] IoT device a constructs an access token Token={sig(SK a ID a ), Policy, IPFS_Hash, K}. Where sig(SK a ID a This indicates that IoT device a uses its own private key to create a unique identifier ID for IoT device a.a Signatures are used to prevent tampering and denial; IPFS_Hash represents the data R. a The unique identifier, and also the data R a The ciphertext's hash address in the IPFS system; K represents the hash address used to decrypt the data R. a The key for the encrypted eData.

[0090] IoT device A sends its constructed access token (Token) to the proxy node. The proxy node then encrypts the Token using the CP-ABE algorithm's public key (PK) according to the access control policy set in the Token, obtaining an enToken. The enToken can only be decrypted by the CP-ABE private key of the data user conforming to the policy. The proxy node then uses IoT device A's unique identifier (ID)... a Encrypted access token (enToken), data R a IPFS_Hash and its own information G net Generate an access strategy and publish transaction T pol ={ID a enToken, G net IPFS_Hash, sig(ID) a enToken, G net )}.

[0091] Agent node G net The IOTA system uses the Markov Chain Monte Carlo Unstructured Walk (MCMC) algorithm to publish transactions T for access policies in the access control chain. pol Select two parent transactions that require confirmation. After the parent transactions pass the check, the proxy node G... net By referencing these two parent transactions, the access strategy will be published by transaction T. pol Add it to the Tangle ledger in the access control chain.

[0092] S103: Obtain the set attributes of data visitors, match the set attributes of data visitors with the access policy preset by the data owner. If the match is found, use the private key of the preset CP-ABE algorithm to decrypt the access token of the blockchain to obtain access to the data. Otherwise, access to the data cannot be obtained. Based on the access permissions of the data, the access event is published.

[0093] The process involves matching the data accessor's set attributes with the data owner's preset access policy. If a match is found, the access token to the blockchain is decrypted using the private key of the preset CP-ABE algorithm, thus granting access to the data.

[0094] Data user B from data storage transaction T in the data storage chain stor ={IPFS_Hash, seHash, ID} a ,descD,timestamp,PK a Data R from IoT device a is obtained in ,sign} a After obtaining the unique identifier IPFS_hash, the stored data R is located in the access control chain based on the unique identifier IPFS_hash. a Transactions of encrypted access token enToken (T) pol ={ID a enToken, G net IPFS_Hash, sig(ID) a enToken, G net )}, obtain enToken.

[0095] Data user B obtains their own attribute certificate Cert from the access control chain based on their registration information. B_att ={ID B ,ATT B ,sig(SK TA ,(ID B ,ATT B ))}, will Cert B_att Send it to a trusted authority (TA) to request that TA distribute the private key.

[0096] After receiving the request, the trusted authority (TA) verifies the Cert. B_att ={ID B ,ATT B ,sig(SK TA ,(ID B ,ATT B The validity of ))} is verified, and after passing the verification, it is based on the attribute set ATT. B The master key MK generates a private key CP-ABESK corresponding to the attributes of data user B. B Trusted institution TA will CP-ABESK B Send to data user B.

[0097] Data user B obtains the private key CP-ABESK B Then, the encrypted access token enToken is decrypted to obtain the plaintext access token Token, Token={sig(SK a ID a ),Policy,IPFS_Hash,K}.

[0098] Data user B downloads data R from the IPFS system based on the IPFS_Hash. a The ciphertext eData is decrypted using the symmetric key K to obtain the plaintext data R. a Then use the SHA256 algorithm to calculate the data R. a The hash value is used to combine the last 128 bits of the result returned by the SHA256 algorithm with the data storage transaction T. stor The `seHash` in `={IPFS_Hash, seHash, IDa,descD,timestamp, PKa,sign}` is compared; if they match, the data has not been tampered with. Data user B obtains data R. a Access permissions.

[0099] Specifically, the zero-knowledge proof generation process:

[0100] Data user B constructs two parameter groups: a public parameter group, Public Inputs = {SHA256(Policy), IPFS_Hash, nonce}, where SHA256(Policy) represents the hash of the access policy and nonce represents a random number; and a private parameter group, Private Inputs = {CP-ABESK}. B ,ATT B ,K,SHA246(R a )}, where SHA256(R a ) represents data R a The hash value.

[0101] Four verification logic steps: Data user B's private key CP-ABESK B The corresponding attribute satisfies the access policy; CP-ABESK is used. B After decrypting the encrypted access token enToken, the correct key K is obtained; K can decrypt the data corresponding to IPFS_Hash, and the result is complete; the proof process was not replayed. Data user B encodes these four verification logics into an arithmetic circuit, with parameters in the public parameter group Public Inputs and the private parameter group Private Inputs.

[0102] Data user B inputs secret data: user attribute set ATT B Private key CP-ABESK B Key K, Data R a Hash value SHA256(R) a ) and input public data: access policy hash SHA256 (Policy), data R aThe unique data identifier is IPFS_Hash, and the random number is nonce. After compiling and running the arithmetic circuit, a zero-knowledge proof, zkp_proof, is obtained.

[0103] Access event publication process: Data users assemble an access event transaction T based on the public parameter group Public Inputs={SHA256(Policy), IPFS_Hash, nonce} and the ZKP zero-knowledge proof zkp_proof. acclog ={ID B The transaction is defined as follows: `access, IPFS_Hash, timestamp, SHA256(Policy), nonce, zkp_proof`, where `access` indicates that the purpose of this transaction is to access the record of the event. Data consumer B runs the Markov Chain Monte Carlo Random Walk Algorithm (MCMC) to select two parent transactions that need to be confirmed. After the parent transactions pass the check, the access log transaction T is confirmed by referencing these two parent transactions. acclog Adding to the Tangle ledger indicates that you have access to the data R. a An access request was made and access was successfully granted. The existence of access event transactions enhances the decentralized auditing of access logs.

[0104] like Figure 2 The following is a technical implementation flow of an IoT data access control method:

[0105] Encrypted storage technology process:

[0106] A1. Signature Certificate Sending: IoT device A generates a signature certificate, encrypts it, and sends it to the proxy node. A2. Device Attribute Set Sending: The proxy node generates an attribute set for IoT device A and generates an attribute authentication request, which is sent to the trusted authority involved in private key distribution in the CP-ABE algorithm. A3. Attribute Certificate Sending: After verifying the legality of the attribute set, the trusted authority generates an attribute authentication certificate and sends it to the proxy node. A4. Device Information Upload: The proxy node assembles an identity registration transaction containing IoT device A's information and publishes the identity registration transaction to the access control chain. A5. Encrypted Data Sending: After collecting data, IoT device A encrypts the data and sends it to the proxy node. A6. Encrypted Data Upload: The proxy node uploads the encrypted data to the IPFS storage system. A7. Hash Address Return: The IPFS storage system returns the hash address of the encrypted data to the proxy node. A8. Hash Address Sending: The proxy node sends the hash address to IoT device A. A9. Storage Transaction Upload: The proxy node assembles a data storage transaction and publishes it to the resource storage chain.

[0107] Token generation technology process:

[0108] B1. Access policy determines the construction of an access token. IoT device a determines the access policy for the data and constructs an access token. The access token contains the hash address of the data, the access policy, and a key used to decrypt the encrypted data stored in the IPFS storage system. B2. Access token is sent. IoT device a sends the access token to the proxy node. B3. The access token is encrypted and uploaded to the blockchain. The proxy node obtains the public key used for encryption from a trusted institution involved in private key distribution in the CP-ABE algorithm, encrypts the access token according to the access policy set in the access token, assembles the access policy, and publishes the transaction, which includes the encrypted access token, the hash address of the data, the data owner, and other information, and publishes it to the access control chain.

[0109] Access control technology process:

[0110] C1. Data storage transaction lookup: Data visitors query data storage transactions in the resource storage chain and obtain the data's hash address from the transaction. C2. Encrypted access token lookup: Data visitors query the access control chain based on this hash address to publish a transaction corresponding to the access policy for the data and obtain an encrypted access token from the transaction. C3. Visitor registration information lookup: Data visitors query their own registration information from the access control chain and obtain their attribute set. C4. Attribute set submission: Data visitors submit their attribute set to a trusted institution, requesting the distribution of the private key corresponding to each attribute. C5. Private key issuance. C6. The trusted institution generates a private key for the data access user based on the attribute set and sends it to the data access user; C7. The data access user decrypts the access token using the private key corresponding to the attribute to obtain the key used to decrypt the encrypted data; C8. The data access user downloads the encrypted data based on the hash address of the data and then uses the key to decrypt the encrypted data to obtain the original data; C9. The data access event is uploaded to the blockchain. The data access user generates a zero-knowledge proof that has obtained the key and the original data, assembles it into the access event transaction, and publishes it to the access control chain.

[0111] Performance and safety evaluation of the invention:

[0112] The performance of this invention was tested through experiments. The simulation system was deployed and run on a Windows system with 16.0 GB of RAM and an AMD Ryzen 7 6800H CPU with Radeon Graphics @ 3.20 GHz.

[0113] Performance evaluation:

[0114] Design single-node and multi-node schemes to evaluate system throughput and transaction confirmation latency.

[0115] First, we tested the system performance with a single full node. Specifically, we tested whether the system throughput improved as the number of transactions transmitted per unit time increased when the system had only a single full node. The results are as follows: Figure 3 As shown. Figure 3 The horizontal axis represents the number of incoming transactions per unit time, the main vertical axis represents the confirmation latency (in milliseconds, ms), and the secondary vertical axis represents the throughput (tps, transactions processed per second). The blue smooth curve represents the confirmation latency, and the orange smooth curve represents the throughput. The results show that as the number of incoming transactions per unit time increases, the system throughput gradually increases.

[0116] Then, with a fixed number of transactions input into the system per unit time of 8, the system performance was tested with multiple full nodes. Specifically, the test examined whether the system throughput improved as the number of participating full nodes increased. The results are as follows: Figure 4 As shown. Figure 4 The horizontal axis represents the number of full nodes, the primary vertical axis represents the confirmation latency (in milliseconds, ms), and the secondary vertical axis represents the throughput (tps, transactions processed per second). The blue smooth curve represents the confirmation latency, and the orange smooth curve represents the throughput. The results show that as the number of participating full nodes increases, the system throughput also gradually increases.

[0117] The analysis of the two experimental results above shows that the throughput of the present invention increases with the increase of the number of transactions and participating nodes, making it suitable for IoT scenarios and able to meet the high-frequency, multi-party participation requirements of IoT scenarios.

[0118] Security Analysis:

[0119] To evaluate the security of this invention, two common attack schemes were designed to test the performance of this invention under attack.

[0120] The first test was a double-spending attack, sending two transactions that cost the same amount of money into the system. As the number of transactions entering the system per unit time increased, the test verified whether the system could still quickly detect double-spending attacks, minimizing the number of transactions connected to illegitimate transactions. The results were as follows... Figure 5 As shown. Figure 5The horizontal axis represents the number of incoming transactions per unit time, and the vertical axis represents the number of affected transactions. The blue line represents the results of the first test, the orange line represents the results of the second test, the gray line represents the results of the third test, and the yellow line represents the results of the fourth test. The results show that the detection speed of double-spending attacks is independent of the transaction incoming speed. Once a transaction is directly or indirectly connected to two double-spending transactions, the system can detect the double-spending attack, and one of the two double-spending transactions will be marked as illegal and deleted from the ledger. Furthermore, although the detection time for double-spending attacks is uncertain, no more than 14 transactions were observed throughout the entire test, indicating that the system can detect double-spending attacks.

[0121] The second test examines the system's performance against node desynchronization attacks, specifically assessing system stability after a node loses synchronization. The test protocol involves a fixed number of transactions (8) entering the system per unit time. A node is shut down after 60 seconds and restarted after 120 seconds. Simultaneously, the database of the desynchronized node is cleared. This test is repeated three times, and the average throughput is analyzed. The test results are as follows: Figure 6 As shown, Figure 6 The horizontal axis represents runtime (in seconds), the main vertical axis represents confirmation latency (in milliseconds), and the secondary vertical axis represents throughput (transactions per second, TPS). The blue smoothed curve represents confirmation latency, and the orange smoothed curve represents throughput. The results show that although system throughput is affected during the 60 seconds of node desynchronization, system performance returns to normal within only 240 seconds. After all nodes synchronize at 480 seconds, the system can continue to provide normal service. Furthermore, the confirmation latency remains stable throughout the experiment, indicating that the system is stable throughout the test.

[0122] The two test schemes above show that this system can cope with common blockchain attack scenarios and has a certain degree of security.

[0123] Example 2: Second aspect, such as Figure 7 As shown, in order to achieve the above objectives, the present invention discloses an Internet of Things (IoT) data access control system, comprising:

[0124] The encrypted storage module 11 is used to obtain the device information of IoT devices, send the device information of IoT devices to the blockchain for identity registration based on the agent node, encrypt the data obtained by IoT devices to obtain data ciphertext, send the data ciphertext to the IPFS system for storage based on the agent node to obtain the hash address, and send the hash address to the blockchain for storage based on the agent node.

[0125] The token generation module 12 is used to generate an access token based on the access policy preset by the data owner and the decryption key of the data ciphertext. The IoT device uses the preset CP-ABE algorithm to encrypt the access token based on the agent node and then sends it to the blockchain for storage.

[0126] Access control module 13 is used to obtain the set attributes of data visitors, match the set attributes of data visitors with the access policy preset by the data owner, if the match is found, use the private key of the preset CP-ABE algorithm to decrypt the access token of the blockchain to obtain access to the data; otherwise, access to the data cannot be obtained, and access events are published based on the access permissions of the data.

[0127] Based on the same inventive concept, this invention also provides a computer device, comprising: one or more processors, and a memory for storing one or more computer programs; the programs include program instructions, and the processor executes the program instructions stored in the memory. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, used to implement one or more instructions, specifically for loading and executing one or more instructions stored in a computer storage medium to implement the above-described method.

[0128] It should be further explained that, based on the same inventive concept, the present invention also provides a computer storage medium storing a computer program, which, when executed by a processor, performs the above-described method. This storage medium can be any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the present invention, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0129] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this disclosure. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0130] The foregoing has shown and described the basic principles, main features, and advantages of this disclosure. Those skilled in the art should understand that this disclosure is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of this disclosure. Various changes and modifications can be made to this disclosure without departing from its spirit and scope, and all such changes and modifications fall within the scope of this disclosure as claimed.

Claims

1. A data access control method for the Internet of Things (IoT), characterized in that, The method includes the following steps: Obtain device information of IoT devices, send the device information of IoT devices to the blockchain for identity registration based on the agent node, encrypt the data obtained by IoT devices to obtain data ciphertext, send the data ciphertext to the IPFS system for storage based on the agent node to obtain the hash address, and send the hash address to the blockchain for storage based on the agent node. The process of sending the device information of IoT devices to the blockchain for identity registration based on the agent node includes: IoT device A generates a public-private key pair (PK). a SK a Then, based on the unique identifier ID of the IoT device a itself... a Public key PK a Private key SK a Generate a signing certificate Cert a ={ID a PK a ,sig(SK a ,(ID a PK a ))}, where sig(SK a ,(ID a PK a )) represents the signature of IoT device a; After connecting to the proxy node, according to the proxy node G net public key PK net IoT device a uses the generated signature certificate Cert a Encryption is performed using an asymmetric encryption algorithm, and the data is then sent to the proxy node G. net Declare your identity; Proxy node G net After receiving encrypted information from IoT device a, it uses its own private key SK. net Decrypt the information to obtain Cert a ; Agent node G net Cert is obtained through decryption. a Then, based on the public key PK of IoT device a contained therein... a For the signature sig(SK) a ,(ID a PK a Perform verification, verify Cert a The legitimacy; Agent node G net Generate an attribute set ATT for IoT device a a ={att a1 ,att a2 ,…,att ai ,…,att an }, where att ai (i = 1, 2, 3, ..., n) represents the i-th attribute of IoT device a, and the attribute is stored in key-value pairs; agent node G net Based on the unique identifier ID of IoT device a a and the attribute set ATT a The set of attributes is used to generate an attribute authentication application (Re) for IoT device a. a_att ; RE a_att ={ID a ,G net ,TO a ,sig(SK net ,(ID a ,G net ,TO a ))} Agent node G ne Attribute authentication application Re a_att The attribute set is sent to the Trusted Private Key Authority (TA) in the CP-ABE algorithm system for verification of its validity. After verification, the TA signs the attribute set and generates an attribute certificate (Cert). a_att ; Certificate a_att ={ID a ,TO a ,sig(SK TA ,(ID a ,TO a ))} Trusted Authority (TA) will assign attribute certificates (Cert). a_att Send to proxy node G net This represents the set of attributes ATT for IoT device a. a The certification indicates that the attributes of IoT device a have passed the validity check; Agent node G net Check the Tangle ledger in the access control chain to see if IoT device 'a' has been registered. If not, then proxy node G... net First use your own private key SK net (ID) a G net PK net Sign the signature and generate the signature sig(SK). net ,(ID a G net PK net Then sign sig(SK) net ,(ID a G net PK net The ID of IoT device a a Agent node G net public key PK net The set of attributes of IoT device a, ATT a and attribute certificate Cert a_att Assemble into identity registration transaction T reg ; T reg ={ID a ,G net ,PK net ,sig(SK net ,(ID a ,G net ,PK net )),TO a ,Cert a_att }; Agent node G net The Markov Chain Monte Carlo Random Walk (MCMC) algorithm used in the IOTA system is applied to the registration transaction T in the access control chain. reg Select two parent transactions that require confirmation; after the parent transactions pass the check, the proxy node G... net By referencing these two parent transactions, the identity registration transaction T for IoT device a is... reg The identity registration transaction T is added to the Tangle ledger of the access control chain and simultaneously broadcast in the blockchain network of the access control chain. reg To inform other nodes so that transaction T reg Confirmed; The process of sending encrypted data to the IPFS system storage via the proxy node: After IoT device a collects data, the data is denoted as R. a The data R is calculated using the SHA256 algorithm. a The hash value is used, with the first 128 bits of the SHA256 algorithm output as the key K and the last 128 bits as the hash fragment seHash. The AES128 symmetric encryption algorithm is then used, with the key K and data R... a To obtain the encrypted eData as input, IoT device a then sends the data message MSG to the agent node; MSG={eData,seHash,ID a ,descD,timestamp,PK a ,sign} Among them: ID a This indicates the identity of IoT device 'a', which is the sender of data; descD indicates the data R. a The label; timestamp represents the timestamp of the sending; sign = sig(SK a ,(eData,seHash,ID a ,descD,timestamp,PK a This indicates that IoT device a accesses data R. a The signature; Agent node G net Received data message MSG = {eData, seHash, ID} a ,descD,timestamp,PK a After `,sign}`, based on the public key PK of IoT device a... a Verify the signature (sign). If the verification is successful, transfer the data (R). a The encrypted eData is uploaded to the IPFS storage system. IPFS returns the hash address IPFS_Hash that identifies the encrypted eData. Proxy node G... net Using the public key PK of IoT device a a The IPFS_Hash is encrypted and sent to IoT device a. After receiving the ciphertext, IoT device a uses its own private key SK. a Decrypt the ciphertext to obtain the IPFS_Hash, and store the IPFS_Hash locally for use in constructing access tokens; The agent node device converts the data message MSG into a standardized JSON format and assembles it into a data storage T. stor ={IPFS_Hash, seHash, ID a ,descD,timestamp,PK a ,sign}, proxy node G net The Markov Chain Monte Carlo Random Walk Algorithm (MCMC) used in the IOTA system is applied to data storage transactions (T) within the data storage chain. stor Select two parent transactions that require confirmation, and store the data in transaction T by referencing these two parent transactions. stor Add it to the Tangle ledger in the data storage chain; An access token is generated based on the access policy preset by the data owner and the decryption key of the encrypted data. The IoT device uses the preset CP-ABE algorithm to encrypt the access token based on the agent node and then sends it to the blockchain for storage. The process of generating an access token based on the data owner's preset access policy and the decryption key of the encrypted data is as follows: The CP-ABE algorithm is initialized, and the trusted organization TA generates the system's master key MK and public key PK. Using the Boolean formula strategy in the CP-ABE algorithm, the data R of IoT device a... a The access control policy that needs to embed ciphertext is determined by the formula: Policy = A1∧A2∧A3∧…∧A n , where A i With the data visitor attribute set ATT = {att1, att2, ..., att} i ,····,att n at in} i A one-to-one correspondence, where i = 1, 2, 3, ..., n, represents that access to data R of IoT device a is allowed only when the data visitor's attribute set satisfies the policy. a ; IoT device a constructs an access token Token = {sig(SK a ID a ),Policy,IPFS_Hash,K}, where sig(SK a ID a This indicates that IoT device a uses its own private key to create a unique identifier ID for IoT device a. a Perform a signature; IPFS_Hash represents the data R. a The unique identifier, and also the data R a The ciphertext's hash address in the IPFS system; K represents the hash address used to decrypt the data R. a The key for the encrypted eData; IoT device A sends the constructed access token to the proxy node. The proxy node, based on the access control policy set in the token, encrypts the access token using the public key (PK) of the CP-ABE algorithm to obtain the enToken. The enToken is then decrypted by the CP-ABE private key of the data user conforming to the policy. Finally, the proxy node uses the unique identifier ID of IoT device A... a Encrypted access token (enToken), data R a IPFS_Hash and its own information G net Generate access policy and publish transaction T pol ={ID a ,enToken,G net IPFS_Hash, sig(ID) a ,enToken,G net )}; Agent node G net The IOTA system uses the Markov Chain Monte Carlo No-Rules Walk (MCMC) algorithm to publish transactions T for access policies in the access control chain. pol Select two parent transactions that require confirmation; after the parent transactions pass the check, the proxy node G... net By referencing two parent transactions, the access strategy publication transaction T is obtained. pol Add it to the Tangle ledger in the access control chain; The system obtains the set attributes of data visitors and matches them with the access policy preset by the data owner. If the match is found, the system uses the private key of the preset CP-ABE algorithm to decrypt the access token of the blockchain to obtain access to the data. Otherwise, access to the data cannot be obtained. Access events are published based on the data access permissions. The process involves matching the data visitor's set attributes with the data owner's preset access strategy. If the match is successful, the access token to the blockchain is decrypted using the private key of the preset CP-ABE algorithm to obtain data access rights. Data user B from data storage transaction T in the data storage chain stor ={IPFS_Hash, seHash, ID a ,descD,timestamp,PK a Data R from IoT device a is obtained in ,sign} a After obtaining the unique identifier IPFS_hash, the stored data R is located in the access control chain based on the unique identifier IPFS_hash. a Transactions of encrypted access token enToken (T) pol ={ID a ,enToken,G net IPFS_Hash, sig(ID) a ,enToken,G net )}, obtain enToken; Data user B obtains their own attribute certificate Cert from the access control chain based on their registration information. B_att ={ID B ,ATT B ,sig(SK TA ,(ID B ,ATT B ))}, will Cert B_att Send it to a trusted authority (TA) to request TA to distribute the private key; After receiving the request, the trusted authority (TA) verifies the Cert. B_att ={ID B ,ATT B ,sig(SK TA ,(ID B ,ATT B After validating the validity of ))}, the property set ATT is used as the basis for further validation. B The master key MK generates a private key CP-ABESK corresponding to the attributes of data user B. B Trusted institution TA will CP-ABESK B Send to data user B; Data user B obtains the private key CP-ABESK B Then, the encrypted access token enToken is decrypted to obtain the plaintext access token Token, Token = {sig(SK a ID a ),Policy,IPFS_Hash,K}; Data user B downloads data R from the IPFS system based on the IPFS_Hash. a The ciphertext eData is decrypted using the symmetric key K to obtain the plaintext data R. a Then use the SHA256 algorithm to calculate the data R. a The hash value is used to combine the last 128 bits of the result returned by the SHA256 algorithm with the data storage transaction T. stor The `seHash` value in `{IPFS_Hash, seHash, IDa, descD, timestamp, PKa, sign}` is compared. If they match, it means the data has not been tampered with, and data user B obtains data R. a Access permissions.

2. The IoT data access control method according to claim 1, characterized in that, The process of publishing access events based on data-driven access permissions: Based on the data access permissions, a zero-knowledge proof with access permissions is generated, and an access log is constructed based on it and published on the blockchain to realize the publication of access events.

3. The IoT data access control method according to claim 2, characterized in that, The generation process of the zero-knowledge proof: Data user B constructs two parameter groups: a public parameter group, Public Inputs = {SHA256(Policy), IPFS_Hash, nonce}, where SHA256(Policy) represents the hash of the access policy and nonce represents a random number; and a private parameter group, Private Inputs = {CP-ABESK}. B ,ATT B ,K,SHA246(R a )}, where SHA256(R a ) represents data R a The hash value; Four verification logic steps: Data user B's private key CP-ABESK B The corresponding attributes satisfy the access policy; use CP-ABESK. B After decrypting the encrypted access token enToken, the correct key K is obtained; K can decrypt the data corresponding to IPFS_Hash, and the result is complete; the proof process is not replayed, and the data user B encodes the four verification logics into an arithmetic circuit with parameters in the public parameter group Public Inputs and the private parameter group Private Inputs. Data user B inputs secret data: user attribute set ATT B Private key CP-ABESK B Key K, Data R a Hash value SHA256(R) a Input public data: Access policy hash SHA256 (Policy), data R a The unique data identifier IPFS_Hash and the random number nonce are used to obtain the zero-knowledge proof zkp_proof after compiling and running the arithmetic circuit. Access event publication: Data users assemble access event transaction T based on the public parameter set Public Inputs = {SHA256(Policy), IPFS_Hash, nonce} and ZKP zero-knowledge proof zkp_proof. acclog ={ID B The transaction name is defined as follows: `access, IPFS_Hash, timestamp, SHA256(Policy), nonce, zkp_proof`. Here, `access` indicates that the purpose of this transaction is to record access events. Data consumer B runs the Markov Chain Monte Carlo Random Walk Algorithm (MCMC), selects two parent transactions that need confirmation, and after the parent transactions pass the check, access log transaction T is confirmed by referencing these two parent transactions. acclog Adding to the Tangle ledger indicates that data R a An access request was made and access was successfully granted.

4. An Internet of Things (IoT) data access control system, employing the IoT data access control method according to any one of claims 1 to 3, characterized in that, include: The encrypted storage module is used to obtain device information of IoT devices, send the device information of IoT devices to the blockchain for identity registration based on the agent node, encrypt the data obtained by IoT devices to obtain data ciphertext, and send the data ciphertext to the blockchain for storage based on the agent node. The token generation module is used to obtain device information of IoT devices, send the device information of IoT devices to the blockchain for identity registration based on the agent node, encrypt the data obtained by IoT devices to obtain data ciphertext, send the data ciphertext to the IPFS system for storage based on the agent node to obtain the hash address, and send the hash address to the blockchain for storage based on the agent node. The access control module is used to obtain the set attributes of data visitors, match the set attributes of data visitors with the access policy preset by the data owner, and if the match is found, use the private key of the preset CP-ABE algorithm to decrypt the access token of the blockchain to obtain access to the data; otherwise, access to the data cannot be obtained, and access events are published based on the data access permissions.

5. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that, The memory stores a computer program that can run on a processor. When the processor loads and executes the computer program, it employs an Internet of Things data access control method according to any one of claims 1 to 3.

6. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is loaded and executed by the processor, it employs an Internet of Things (IoT) data access control method as described in any one of claims 1 to 3.

Images