Blockchain-based digital product uniqueness identification and access right control method

Abstract

The application discloses a digital product uniqueness identification and access permission control method based on a blockchain, which comprises the following steps: S1, collecting data, constructing a digital product dataset and an access user attribute dataset; S2, assigning a decentralized identity to an access user, generating an access user public key and an access user private key; S3, generating a request digest value through a hash algorithm, and generating a signed access request structure; S4, constructing an ABAC model, and formulating an access control strategy rule set; S5, introducing a Boolean operation optimization mechanism into the ABAC model, and obtaining an optimized ABAC model; S6, verifying the request signature in the signed access request structure, and generating an access authorization token; and S7, based on the access authorization token, extracting an access behavior and recording the access behavior to the blockchain. The application realizes digital product uniqueness identification and access permission control by combining blockchain storage, ECDSA digital signature and Boolean logic to optimize the ABAC access control strategy.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchain access control, and particularly relates to a method for unique identification and access control of digital products based on a blockchain. BACKGROUND

[0002] With the development of digital economy and the wide application of Internet technology, various digital products have been rapidly popularized in the fields of e-commerce, entertainment creation, software distribution, and intellectual property protection. How to effectively identify the uniqueness of digital products and control their access rights in a fine-grained manner has become an important research direction in the field of information security and data governance. In this context, blockchain technology is widely used in the rights protection, traceability and access control of digital products due to its characteristics of decentralization, tamper resistance and traceability. By recording the key information of digital products on the blockchain, the transparency of resource distribution process can be realized, and the security and credibility of the system can be enhanced.

[0003] Existing access control methods based on blockchain are mainly based on traditional access control models, such as identity-based access control (IBAC) and role-based access control (RBAC). These methods usually define access control rules in blockchain smart contracts to bind user and resource access rights. However, the IBAC model has problems of complex authorization management and insufficient flexibility when facing large-scale users and dynamic changes in resources. Although RBAC simplifies authorization management through role intermediation, the static binding of roles makes it difficult for the model to respond to fine-grained and dynamic access requirements. In addition, in practical applications, context factors such as user identity, geographic location, device type, and access time have an important influence on access decisions, and it is difficult to cover all access control requirements relying on simple identity or role attributes, resulting in the fact that traditional models are not up to the task in complex application scenarios.

[0004] In order to improve the flexibility and accuracy of access control, researchers have proposed an attribute-based access control (ABAC) model. The ABAC model defines access policies through user attributes, resource attributes, and environmental attributes, and can achieve more dynamic and fine-grained permission management. In recent years, some research has combined ABAC model with blockchain to attempt to store access control policies on the chain and make access decisions. However, existing technologies mostly use direct mapping of attribute conditions, lack depth optimization of access decision-making process, and result in long decision chain, low matching efficiency, and high computational resource consumption when the number of attributes increases and the complexity of policy conditions increases. In addition, on-chain execution of access decisions is susceptible to smart contract execution performance limitations, and when access requests are frequent and attribute conditions are complex, system response speed decreases significantly, affecting overall system availability.

[0005] In digital product management, the unique identification of digital products is also a technical challenge that cannot be ignored. Existing identification methods rely on traditional centralized databases or single signature mechanisms, and there are risks of identification conflicts, forgery and tampering in a decentralized environment. Although blockchain provides an unalterable foundation, in the actual identification generation and verification process, if there is a lack of effective encryption signature support, it may still be forged or misused. The digital signature technology based on public key cryptography systems such as RSA and ECDSA is widely used in existing technologies, which can generate unique and verifiable identification for digital products. However, the mere application of the signature mechanism without close integration with the access control system often cannot form a closed-loop management, leading to disconnection between identification authentication and access control, and reducing the overall security protection capability.

[0006] To solve the problem of access control efficiency, some existing researches propose to optimize access strategies using Boolean logic, simplify complex attribute conditions logically, and reduce the depth of decision trees to improve matching efficiency. However, such methods usually stay at the theoretical level and lack engineering implementation combined with actual blockchain systems. Existing methods mostly use single-round simplification and do not consider factors such as access attribute frequency and matching path weight, resulting in limited optimization effect of the strategy. In addition, traditional Boolean optimization often ignores the evolution needs of access control strategies in dynamic environments, lacks mechanisms for adaptive adjustment of strategy structure according to real-time access patterns, and affects the long-term stability and scalability of the system.

[0007] Therefore, how to provide a blockchain-based digital product unique identification and access permission control method is a problem that needs to be solved by those skilled in the art. SUMMARY

[0008] One object of the present application is to provide a blockchain-based digital product unique identification and access permission control method. The present application fully combines blockchain technology, elliptic curve digital signature and optimized ABAC access control model, and describes in detail the complete process of digital product identification generation, access permission verification and access behavior evidence storage. By constructing decentralized identity authentication, optimizing access decision process and on-chain evidence storage mechanism, the present application solves the problems of identification forgery, permission abuse and audit absence in traditional access control methods. The method has the advantages of high security, high access decision efficiency and strong traceability, and is suitable for the protection and access management of large-scale digital resources, and has wide application prospects and practical engineering value.

[0009] The blockchain-based digital product unique identification and access permission control method according to an embodiment of the present application comprises the following steps:

[0010] S1, collect digital product data and attribute information of access users, and construct digital product data set and access user attribute data set;

[0011] S2, based on the access user attribute data set, assign a decentralized identity to the access user, generate an access user public key and an access user private key using an elliptic curve cryptography algorithm, and form a key pair;

[0012] S3, based on the digital product data set and the access user attribute data set, generate a request digest value through a hash algorithm, and use the access user private key to perform an elliptic curve digital signature on the request digest value to generate a signed access request structure;

[0013] S4, build an ABAC model, model the access user as an access request body with attribute observation and access decision capability, and based on the digital product data set, formulate an access control policy rule set;

[0014] S5, introduce a Boolean operation optimization mechanism in the ABAC model, initialize multiple Boolean logic expression units, process the access control policy, and obtain an optimized ABAC model;

[0015] S6, verify the request signature in the signed access request structure, input the access user attribute data set into the optimized ABAC model for matching judgment, and generate an access authorization token;

[0016] S7, based on the access authorization token, extract the access behavior and record it to the blockchain, realize the audit and traceability of the access process.

[0017] Optionally, the digital product data set includes resource identifier, resource type, security level, version information and metadata information, and the access user attribute data set includes role attribute, regional attribute, device attribute, access time attribute and optional dynamic attribute.

[0018] Optionally, the S2 specifically includes:

[0019] S21, based on the access user attribute data set, extract information including role attribute, regional attribute and device attribute, and construct an access user identity feature vector;

[0020] S22, concatenate the access user identity feature vector with the timestamp of the current generation moment, process it through a decentralized identity generation hash function to generate a decentralized identity of the access user:

[0021] ;

[0022] Wherein, is the decentralized identity of the access user, is an identifier namespace prefix, is a binary concatenation operator, is a first layer encryption hash function, a second layer encryption hash function, an access user identity feature vector, a randomly generated encryption salt value, a current system timestamp;

[0023] S23, based on the decentralized identity of the access user, an elliptic curve encryption algorithm is used to generate a key pair of the access user in a manner of scalar multiplication operation between the private key of the access user and the standard elliptic curve base point, wherein the public key of the access user is the point coordinate obtained by multiplying the private key of the access user and the standard elliptic curve base point, forming a public key and a private key pair exclusive for the access user;

[0024] S24, storing the generated private key of the access user in the local terminal device of the access user, and binding and registering the generated public key of the access user with the decentralized identity.

[0025] Optionally, the S3 specifically comprises:

[0026] S31, extracting a resource identifier from a digital product data set, and extracting a role attribute, a region attribute, a device attribute and an access time attribute from an access user attribute data set, arranging them in order and combining them into an access request vector;

[0027] S32, passing the access request vector as input data to a hash function, and performing one-way digest calculation on all field contents of the access request vector, including the resource identifier, the role attribute, the region attribute, the device attribute and the access time attribute, through a hash algorithm, and outputting a corresponding access request digest value;

[0028] S33, using the private key of the access user to perform elliptic curve digital signature on the request digest value, and generating an access request signature through an elliptic curve digital signature algorithm;

[0029] S34, combining the decentralized identity of the access user, the access request vector, the request digest value, the access request signature and the access user attribute data set to construct a signed access request structure.

[0030] Optionally, the elliptic curve digital signature algorithm comprises randomly selecting an integer greater than or equal to 1 and less than the elliptic curve order as a signature random number; then, using the random number to multiply the elliptic curve base point to obtain a coordinate point on the elliptic curve; extracting the abscissa from the point coordinate, and taking the elliptic curve order as a modulus to obtain the first component of the signature;

[0031] the second component of the signature is calculated as follows :​

[0032] ;

[0033] wherein, is the second component of the signature, is a random number is the multiplicative inverse of under modulo is the access request digest value, is the access request vector, is the private key of the access user, is the access user, is the first component of the signature, is the modulo operation, is the elliptic curve order;

[0034] combining the first component of the signature and the second component of the signature to obtain the access request signature.

[0035] Optionally, the S4 specifically comprises:

[0036] S41, modeling the access user as an access request body, the access request body having attribute observation and access decision-making capabilities, based on a user attribute data set and a digital product data set, extracting role attributes, regional attributes, device attributes, access time attributes, resource type attributes, and resource security level attributes, and combining to form an attribute observation vector of the access request body;

[0037] S42, according to the attribute observation vector of the access request body, setting an attribute initial state value for each access request body, the initial state value being determined according to real-time identity information, device state, geographic location, and time period classification of the user when the access request occurs;

[0038] S43, according to the role attribute and the device attribute, assigning an access sensitivity parameter to the access request body when the role attribute is a system administrator and the device attribute is a trusted device, when the role attribute is a normal user and the device attribute is a trusted device, when the device attribute is a non-trusted device, regardless of the user role, ;

[0039] S44, according to the regional attribute and the access time attribute, setting an access confidence parameter for the access request body when the regional attribute is located in a trusted area and the access time attribute is in a working time period, when the regional attribute is located in an unknown area or the access time attribute is in a non-working time period, When the regional attribute is located in a high-risk area, ;

[0040] S45, integrating the attribute observation vector of the access request body, the access sensitivity parameter and the access confidence parameter , forming an access control feature vector;

[0041] S46, based on the access control feature vector, combining the access control policy rules according to the preset Boolean logic condition combination mode, and generating an access control policy set according to the access decision result.

[0042] Optionally, the S5 specifically includes:

[0043] S51, based on the access control attribute vector and the access control policy set, extracting each access control policy rule, and converting the attribute combination condition in the access control policy rule into an initial Boolean logic expression;

[0044] S52, performing logic simplification on the initial Boolean logic expression, merging similar items and eliminating redundant logic conditions according to the Boolean algebra rule, to obtain a simplified Boolean logic expression;

[0045] S53, performing short-circuit optimization processing on the simplified Boolean logic expression, rearranging the judgment path according to the attribute value appearance probability order, determining the access decision output in advance, and generating a short-circuit optimized Boolean logic expression;

[0046] S54, performing path pruning processing on the short-circuit optimized Boolean logic expression, deleting redundant judgment nodes and unreachable paths, and generating a pruned Boolean logic expression;

[0047] S55, based on the pruned Boolean logic expression, performing performance evaluation according to the attribute matching complexity index and the access decision efficiency index, and screening out an optimized expression set meeting the optimal threshold;

[0048] S56, integrating the optimized expression set to form an optimized access control policy rule set, and updating the ABAC model based on the optimized access control policy rule set, to form an optimized ABAC model.

[0049] Optionally, the S6 specifically includes:

[0050] S61, extracting the centralized identity included in the signature access request structure, the access request vector, the request digest value, the access request signature and the access user attribute data set, and combining them into an access request verification data packet;

[0051] S62, use the public key of the access user to verify the request digest value and the access request signature in the access request verification data packet, when the verification is successful, confirm that the access request is from a trusted source and the content is not tampered with, allow to enter the attribute matching stage, otherwise reject the subsequent processing;

[0052] S63, according to the user attribute data set and the access request vector in the access request verification data packet, construct the access request attribute observation vector, input into the optimized ABAC model, execute the access decision judgment:

[0053] ;

[0054] Wherein, is the matching decision result, is the result of access request signature verification, is the logical and operator, is the logical or operator, is the total number of rules in the optimized access control policy rule set, is the policy rule index variable, is the matching judgment function, is the attribute observation vector corresponding to the current access request, is the optimized th access control policy Boolean logic expression;

[0055] S64, if the matching decision result is true and the signature verification is passed, generate an access authorization token.

[0056] Optionally, the generating an access authorization token includes generating identity and resource binding data, generating an access authorization timestamp, and extracting an access permission range; the generating identity and resource binding data is extracting a decentralized identity and a resource identifier; combining the decentralized identity, the resource identifier, the access authorization timestamp, and the extracted access permission range to generate the access authorization token.

[0057] Optionally, the S7 specifically includes:

[0058] S71, extract the decentralized identity, resource identifier, access permission range, authorization timestamp, and access decision result in the access authorization token, and combine to form an access behavior basic information set;

[0059] S72, after the access behavior is executed, collect the actual access timestamp when the access occurs, combine the access behavior basic information set and the actual access timestamp to form an access behavior record data structure;

[0060] S73, perform a secure hash operation on the access behavior record data structure, and generate an access behavior record hash value using the SHA-256 algorithm;

[0061] S74, based on the access behavior record hash value, the address information of the access user in the blockchain network is combined with the current transaction generation time to construct a blockchain transaction data structure;

[0062] S75, the blockchain transaction data structure is broadcast to the blockchain network, confirmed by the consensus mechanism of the blockchain system and written into the blockchain ledger, forming an unalterable access behavior evidence, realizing complete audit and traceability of access behavior

[0063] The beneficial effects of the present application are:

[0064] The present application is based on the blockchain technology and the attribute-based access control (ABAC) model, and for the first time in the digital product uniqueness identification and access permission control system, the ECDSA digital signature mechanism and the Boolean logic optimization decision framework are introduced. Unlike the existing access management methods relying on traditional identity control or role control, the present application constructs a dynamic fine-grained access control system by combining user attributes, resource attributes and environment attributes, and innovatively introduces a Boolean logic optimization mechanism to logically simplify, short-circuit evaluate and path prune the access control strategy, effectively reducing the complexity of the access attribute decision link and improving the decision efficiency and system response ability in high-frequency access request scenarios, breaking through the technical bottleneck of existing blockchain access control execution delay and large resource overhead.

[0065] In terms of digital product uniqueness identification, the present application generates a key pair for the access user based on the ECDSA elliptic curve cryptography system, and digitally signs the access request digest value with the user private key to form a chain-verifiable signed access request structure, realizing the authenticity and integrity protection of the access request and preventing the risks of forgery, impersonation and tampering in traditional centralized identification systems. At the same time, the present application constructs a decentralized identity identification (DID) system, deeply integrates identity authentication and access control, and connects the whole chain of user identity generation, resource access authorization and behavior audit, providing complete and reliable technical support for digital product management and protection.

[0066] In terms of access control strategy optimization, the present application introduces a dynamic path selection and redundancy pruning mechanism in the attribute condition matching process through multiple rounds of logical simplification and short-circuit optimization, reconstructs the decision expression according to the attribute complexity and decision priority, avoids the performance bottleneck caused by traditional static attribute matching table, and realizes the structural optimization of the access control strategy system. Through this method, the present application significantly reduces the computing resources and delay time required in the access decision process, especially in high-concurrency, multi-user and multi-resource practical application environments, with better system scalability and maintainability.

[0067] In the aspects of access behavior audit and traceability, the application constructs a unified access behavior record data structure, combines access authorization information and access execution timestamp, adopts SHA-256 hash algorithm to perform digest processing on the access behavior, and submits the hash value and related transaction information as tamper-proof evidence to a block chain ledger to form a complete and continuous access operation evidence chain. Unlike the existing method of only recording a single resource state or access action, the application realizes the whole-process audit link from the initiation of an access request, permission verification, access execution to behavior evidence, effectively enhances the responsibility definition capability and compliance of the system, and meets the needs of high-standard digital governance and data security audit.

[0068] Overall, the application first breaks through the complete closed loop of digital product management from unique identification generation, access identity authentication, attribute dynamic authorization to behavior chain evidence storage, forming a "identification-control-verification-traceability" integrated technology system. Compared with the existing method, the application has multiple advantages of clear data flow, reasonable module decoupling, excellent computing efficiency, high security and complete audit traceability in the system architecture, providing a new technical path and engineering implementation basis for future practical applications in the fields of digital content rights protection, intellectual property protection, supply chain traceability and data sharing security access. BRIEF DESCRIPTION OF DRAWINGS

[0069] The accompanying drawings are included to provide a further understanding of the application, and constitute a part of the specification, which together with the embodiments of the application, are used to explain the application, and do not constitute a limitation on the application. In the drawings:

[0070] Figure 1 A flowchart of the digital product unique identification and access permission control method based on a block chain proposed by the application;

[0071] Figure 2 A schematic diagram of the optimized ABAC model structure in the digital product unique identification and access permission control method based on a block chain proposed by the application;

[0072] Figure 3 A flowchart of access behavior record and chain storage in the digital product unique identification and access permission control method based on a block chain proposed by the application. DETAILED DESCRIPTION

[0073] The application will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, and only illustrate the basic structure of the application in a schematic manner, and therefore only show the components related to the application.

[0074] Reference Figures 1-3 The digital product unique identification and access permission control method based on a block chain includes the following steps:

[0075] S1, collect digital product data and access user attribute information, construct digital product data set and access user attribute data set;

[0076] S2, based on the access user attribute data set, assign a decentralized identity to the access user, generate an access user public key and an access user private key using an elliptic curve cryptography algorithm, and form a key pair;

[0077] S3, based on the digital product data set and the access user attribute data set, generate a request digest value through a hash algorithm, and use the access user private key to perform elliptic curve digital signature on the request digest value to generate a signed access request structure body;

[0078] S4, construct an ABAC model, model the access user as an access request body with attribute observation and access decision capability, and based on the digital product data set, formulate an access control policy rule set;

[0079] S5, introduce a Boolean operation optimization mechanism in the ABAC model, initialize multiple Boolean logic expression units, process the access control policy, and obtain an optimized ABAC model;

[0080] S6, verify the request signature in the signed access request structure body, input the access user attribute data set into the optimized ABAC model for matching judgment, and generate an access authorization token;

[0081] S7, based on the access authorization token, extract the access behavior and record it to the blockchain, realize the audit and traceability of the access process.

[0082] The present application proposes a digital product unique identification and access permission control method based on blockchain, and constructs a complete process from data collection, digital signature generation, ABAC model construction, Boolean optimization, access verification to on-chain evidence. In the method, the decentralized identity and elliptic curve digital signature technology are introduced to ensure the security and non-tamperability of the access request; the Boolean logic optimization improves the access decision efficiency of the ABAC model, and significantly reduces the computational resource consumption in a high concurrency environment. Compared with the traditional access control method, the present application enhances the flexibility and security of access control, provides complete access audit and traceability capability, has stronger system scalability and adaptability, and can effectively cope with diversified digital product management requirements.

[0083] In the embodiment, the digital product data set includes resource identification, resource type, security level, version information and metadata information, and the access user attribute data set includes role attribute, regional attribute, device attribute, access time attribute and optional dynamic attribute.

[0084] By detailed definition of the digital product data set and the access user attribute data set, the application ensures that the input data covers the key attributes of the digital product, such as resource identification, resource type, security level, version information, metadata information, and the role attribute, regional attribute, device attribute, access time attribute and optional dynamic attribute of the access user. After standardized processing, the data set is input into the ABAC model, ensuring that the access control decision can accurately reflect the dynamic changes of multi-dimensional user and resource information. In a variable access request environment, the method of the application effectively improves the adaptability of the system to complex access scenarios, enhances the flexibility and security of the access control policy, ensures the efficient management and audit of the unique identification and access permission of the digital product, and has wide application prospects and practical value.

[0085] In the embodiment, S2 specifically includes:

[0086] S21, based on the access user attribute data set, extracting information including role attribute, regional attribute and device attribute, and constructing an access user identity feature vector;

[0087] S22, concatenating the access user identity feature vector with the timestamp of the current generation moment, processing by a decentralized identity generation hash function to generate a decentralized identity identifier of the access user:

[0088] ;

[0089] Wherein, is the decentralized identity identifier of the access user, is an identification namespace prefix, is a binary concatenation operator, is a first layer encryption hash function, is a second layer encryption hash function, is the access user identity feature vector, is a randomly generated encryption salt value, is the current system timestamp;

[0090] S23, based on the decentralized identity identifier of the access user, using an elliptic curve encryption algorithm, performing scalar multiplication operation between the access user private key and the standard elliptic curve base point to generate a key pair of the access user, wherein the access user public key is the point coordinate obtained by multiplying the access user private key and the standard elliptic curve base point, forming a public key and private key pair exclusive to the access user;

[0091] S24, storing the generated access user private key in the access user local terminal device, and binding and registering the generated access user public key and the decentralized identity identifier.

[0092] Through the decentralized identity generation mechanism of the user attribute, the application realizes efficient management and safe control of the access right of the digital product. Specifically, by extracting features from the role attribute, regional attribute, and device attribute of the access user, an access user identity feature vector is constructed, and a decentralized identity is generated in combination with the current timestamp, thereby ensuring the uniqueness and tamper resistance of each user identity. In addition, an elliptic curve encryption algorithm is used to generate a user key pair, further enhancing the security and privacy of identity authentication. By binding the public key with the decentralized identity, the system realizes the whole process of decentralized identity authentication, thereby avoiding single point failure and security risks in traditional centralized identity authentication.

[0093] In the embodiment, the S3 specifically includes:

[0094] S31, extracting a resource identifier from a digital product dataset, extracting a role attribute, a regional attribute, a device attribute, and an access time attribute from an access user attribute dataset, arranging them in order, and combining them into an access request vector;

[0095] S32, passing the access request vector as input data to a hash function, and performing one-way digest calculation on all field contents of the access request vector, including the resource identifier, the role attribute, the regional attribute, the device attribute, and the access time attribute, through a hash algorithm, to output a corresponding access request digest value;

[0096] S33, using the private key of the access user to perform elliptic curve digital signature on the request digest value, and generating an access request signature through an elliptic curve digital signature algorithm;

[0097] S34, combining the decentralized identity of the access user, the access request vector, the request digest value, the access request signature, and the access user attribute dataset to construct a signed access request structure.

[0098] Through the hash algorithm of the access request vector and the elliptic curve digital signature mechanism, the application realizes efficient security verification and tamper-proof mechanism in digital product access control. Specifically, by extracting the resource identifier, the role attribute, the regional attribute, the device attribute, and the access time attribute from the digital product dataset and the access user attribute dataset, an access request vector is constructed, and one-way digest calculation is performed thereon to generate an access request digest value. An elliptic curve digital signature is generated in combination with the private key of the access user, thereby ensuring the authenticity and integrity of each access request. In addition, by combining the decentralized identity with the access request vector, the signature, and other information, a signed access request structure is constructed, realizing secure, complete, and tamper-proof access request transmission.

[0099] In the embodiment, the elliptic curve digital signature algorithm includes randomly selecting an integer greater than or equal to 1 and less than the order of the elliptic curve an integer as a signature random number; subsequently, a random number is multiplied by an elliptic curve base point to obtain a coordinate point on an elliptic curve; an abscissa is extracted from the point coordinate, and an elliptic curve order modulo, to obtain a first component of the signature

[0100] a second component of the signature is calculated

[0101]

[0102] wherein, is a second component of the signature, is a random number a multiplicative inverse element in the sense of modulo is an access request digest value, is an access request vector, is a private key of an access user, is an access user, is a first component of the signature, is a remainder operation, is an elliptic curve order; a first component of the signature

[0103] and a second component of the signature are combined to obtain an access request signature. By means of the elliptic curve digital signature algorithm, the present application provides high security and high efficiency in digital product access permission control. Specifically, the present application generates a unique signature value by using a randomly selected signature random number to calculate with an elliptic curve base point. This signature process not only ensures the non-tamperability of the signature, but also, by virtue of the operation characteristics of the private key and the random number, ensures the authenticity and integrity of the request without revealing the private key. By combining the first and second components of the signature, the access request signature is finally generated, thereby ensuring that the access process of the digital product has high security and tamper resistance. This method effectively improves the access control capability of the system, reduces the risk of illegal access, and has significant technical advantages.

[0104] In the present embodiment, the S4 specifically comprises:

[0105]

[0106] ​​​​S41, model the access user as an access request body, the access request body has attribute observation and access decision capability, based on the user attribute data set and the digital product data set, the role attribute, the region attribute, the device attribute, the access time attribute, the resource type attribute and the resource security level attribute are extracted, and the attribute observation vector of the access request body is combined to form;

[0107] S42, according to the attribute observation vector of the access request body, set the attribute initial state value for each access request body, the initial state value is determined according to the real-time identity information of the user, the device state, the geographical position and the time period classification when the access request occurs;

[0108] S43, according to the role attribute and the device attribute, the access sensitivity parameter is allocated to the access request body , when the role attribute is system administrator and the device attribute is trusted device, , when the role attribute is ordinary user and the device attribute is trusted device, , when the device attribute is untrusted device, regardless of the user role, ;

[0109] S44, according to the region attribute and the access time attribute, set the access confidence parameter for the access request body , when the region attribute is located in the trusted area and the access time attribute is in the working time period, , when the region attribute is located in the unknown area or the access time attribute is in the non-working time period, , when the region attribute is located in the high-risk area, ;

[0110] S45, integrate the attribute observation vector, the access sensitivity parameter and the access confidence parameter of the access request body , form the access control feature vector;

[0111] S46, based on the access control feature vector, access control strategy rules are formulated according to the preset Boolean logic condition combination mode, and the access control strategy set is generated according to the access decision result association.

[0112] By constructing an access request body based on user attributes and digital product attributes, the application realizes accurate modeling of access control decisions. Specifically, the application constructs an access request body with attribute observation and access decision capability by extracting multi-dimensional attributes such as user role, region, device, access time, etc. Each request body sets the initial state according to real-time identity information, device status and geographic location, etc. parameters, and further optimizes the access control strategy through the setting of access sensitivity and access confidence parameters. Based on these attribute information, the application generates an access control feature vector, and combines a Boolean logic optimization strategy rule to ensure efficient decision-making for each access request. Compared with traditional methods, the application not only enhances the flexibility and accuracy of access control, but also improves the adaptability and security of the system in a variable environment.

[0113] In the embodiment, S5 specifically includes:

[0114] S51, based on the access control attribute vector and the access control policy set, extracting each access control policy rule, and converting the attribute combination condition in the access control policy rule into an initial Boolean logic expression;

[0115] S52, performing logical simplification on the initial Boolean logic expression, merging similar items and eliminating redundant logic conditions according to Boolean algebra rules, to obtain a simplified Boolean logic expression;

[0116] S53, for the simplified Boolean logic expression, performing short-circuit optimization processing, rearranging the judgment path according to the attribute value appearance probability order, determining the access decision output in advance, and generating a short-circuit optimized Boolean logic expression;

[0117] S54, performing path pruning processing on the short-circuit optimized Boolean logic expression, deleting redundant judgment nodes and unreachable paths, and generating a pruned Boolean logic expression;

[0118] S55, based on the pruned Boolean logic expression, according to the attribute matching complexity index and the access decision efficiency index, performance evaluation is carried out, and the optimized expression set meeting the optimal threshold is selected;

[0119] S56, integrating the optimized expression set to form an optimized access control policy rule set, and updating the ABAC model based on the optimized access control policy rule set to form an optimized ABAC model.

[0120] By introducing a Boolean logic optimization mechanism, the application significantly improves the decision efficiency and computing performance of the ABAC access control model. Specifically, by performing logical simplification, short-circuit optimization and path pruning on the access control policy rules, the application reduces redundant logical conditions, optimizes the judgment path, and significantly reduces the computational complexity in the access decision process. The simplified Boolean logic expression not only improves the speed of attribute matching, but also selects the optimal optimization expression set through performance evaluation, thereby forming a more efficient access control policy rule set. This optimization method can ensure the response speed and accuracy of the system in high-concurrency and high-frequency access request scenarios.

[0121] In the embodiment, S6 specifically includes:

[0122] S61, extract the centralized identity, access request vector, request digest value, access request signature and access user attribute data set contained in the signature access request structure, and combine them into an access request verification data packet;

[0123] S62, use the public key of the access user to perform digital signature verification on the request digest value and access request signature in the access request verification data packet. When the verification is successful, it is confirmed that the access request source is trustworthy and the content has not been tampered with, allowing entry into the attribute matching stage, otherwise the subsequent processing is rejected;

[0124] S63, according to the user attribute data set and access request vector in the access request verification data packet, construct an access request attribute observation vector, input it into the optimized ABAC model, and execute access decision judgment:

[0125] ;

[0126] wherein, is the matching decision result, is the result of access request signature verification, is a logical AND operator, is a logical OR operator, is the total number of rules in the optimized access control policy rule set, is a policy rule index variable, is a matching judgment function, is the attribute observation vector corresponding to the current access request, is the optimized th access control policy Boolean logic expression;

[0127] S64, if the matching decision result is true and the signature verification is passed, an access authorization token is generated.

[0128] By accessing the request verification mechanism, the application effectively improves the security and credibility of digital product access control. Specifically, the application extracts the signature, digest value and user attribute data set in the access request, generates an access request verification data packet, and verifies the signature using the access user public key to ensure that the source of the access request is credible and the content has not been tampered with. This process effectively prevents the risk of fake requests or malicious tampering of access content. Once the verification is successful, the system generates an access request attribute observation vector according to the user attributes and request vector, and executes access decision judgment according to the optimized ABAC model. This method significantly improves the accuracy of access decision and system response speed, ensuring the efficiency and security of access control, and has high scalability, suitable for large-scale digital resource protection and management. Compared with traditional methods, the application has stronger advantages in tamper resistance, security verification, decision efficiency and other aspects, and provides a more reliable digital product access control solution.

[0129] In this embodiment, the generation of the access authorization token includes generating identity and resource binding data, generating an access authorization timestamp, and extracting an access permission range; the identity and resource binding data is extracted as a decentralized identity and a resource identifier; the decentralized identity, the resource identifier, the access authorization timestamp, and the extracted access permission range are combined to generate the access authorization token.

[0130] Through the access authorization token generation mechanism, the application realizes efficient and credible authentication of digital product access permissions. Specifically, by extracting the decentralized identity and resource identifier, combining the access authorization timestamp and the access permission range, an access authorization token containing identity and resource binding data is generated. This method ensures the identity verification and accurate control of resource access for each access request, enhancing the flexibility and security of resource protection. At the same time, the generation process of the authorization token makes the access permission have a clear time limit, avoiding the potential security risks brought by long-term effective authorization. Compared with traditional access control methods, the application provides a more secure, transparent and efficient authorization management mechanism, suitable for large-scale digital resource access protection and management.

[0131] In this embodiment, the S7 specifically includes:

[0132] S71, extract the decentralized identity, resource identifier, access permission range, authorization timestamp and access decision result in the access authorization token, and combine to form an access behavior basic information set;

[0133] S72, after the access behavior is executed, collect the actual access timestamp when the access occurs, combine the access behavior basic information set and the actual access timestamp to form an access behavior record data structure;

[0134] S73, performing a secure hash operation on the access behavior record data structure, generating an access behavior record hash value using the SHA-256 algorithm;

[0135] S74, based on the access behavior record hash value, combining the address information of the access user in the blockchain network and the current transaction generation time, constructing a blockchain transaction data structure;

[0136] S75, broadcasting the blockchain transaction data structure to the blockchain network, confirming it through the consensus mechanism of the blockchain system and writing it into the blockchain ledger, forming an unalterable access behavior evidence, realizing complete audit and traceability of access behavior

[0137] Through the access behavior evidence mechanism of the blockchain, the present application ensures the complete audit and traceability of the digital product access process. Specifically, by combining the key data in the access authorization token with the actual access timestamp, an access behavior record data structure is formed, and an access behavior record hash value is generated by the SHA-256 hash algorithm, ensuring the security and unalterability of the record. Further combined with the blockchain transaction data structure, it is written into the blockchain ledger by using the consensus mechanism of the blockchain system, providing a complete and transparent access behavior audit chain. This method significantly improves the security and transparency of digital resource management, ensuring the traceability of each access, and provides strong technical support for the safe management and compliance audit of digital products.

[0138] Example 1:

[0139] In order to verify the feasibility of the present application in implementation, the present application is applied to a certain national large-scale digital content distribution and intellectual property protection platform, and from February 1 to February 7 as a typical operation period, the digital product uniqueness identification and access permission control method based on blockchain proposed by the present application. The platform covers various types of digital content resources such as e-books, music, video, design works, etc., with more than 4.2 million daily online active users, and the peak system access request volume can reach about 180,000 times per hour, with typical characteristics such as frequent access requests, rich data types, and variable user dynamic attributes.

[0140] In this platform, the traditional access control system mainly relies on centralized identity authentication and role-based permission management, which has problems such as insufficient access authorization flexibility, high decision delay, weak resource identification anti-counterfeiting, and broken access audit chain. Especially during peak hours, the access control module is prone to become a system performance bottleneck, leading to a decline in user experience and an increase in resource management risks. The present application has carried out systematic deployment and verification for the above problems.

[0141] In a specific application process, first, the blockchain subsystem proposed in the application is deployed on the platform data center node, which is used to store access behavior evidence data and manage DID identification. The system collects six types of key attribute information including user role, regional location, device type, login time period, resource type, and resource access level, constructs digital product data set and user attribute data set. By introducing the ECDSA elliptic curve cryptography algorithm, the platform generates a corresponding key pair for each registered user, and dynamically allocates DID identity based on user attributes. In the access request stage, the system signs the request digest based on the user private key, generates a signed access request structure, and ensures the integrity of identity authentication and request in the access link.

[0142] In the access control decision process, the system takes the collected user attribute data and resource attribute data as input, constructs a standard ABAC access control policy model, and introduces a Boolean logic optimization mechanism based on this. For access control rules, the system implements three rounds of processing of Boolean simplification, logical short circuit optimization, and path pruning, generates an optimized access control decision expression, and greatly improves the execution efficiency of the decision link. In the access verification stage, the platform verifies the authenticity of the access request signature, then inputs the user attribute data into the optimized ABAC model for decision judgment, and if the decision is true, generates and issues an access authorization token, which contains DID identity, resource identification, access range, and authorization time information.

[0143] All access behaviors, including request initiation, decision authorization, and access execution, are recorded by the system, and the access behavior hash value is generated by the SHA-256 algorithm, then submitted to the blockchain ledger, realizing tamper-proof access evidence throughout the chain, forming a complete access audit evidence chain. The blockchain adopts a consortium chain architecture, and the nodes are maintained by the platform main center, content distribution nodes, and cooperative institution servers, ensuring efficient and stable data redundancy storage and consensus mechanism.

[0144] During this verification period, the platform selected high access frequency resources (such as popular video resources, best-selling e-books) and general access resources (such as niche design works) as test objects, covering user access request samples from different regions and different terminal devices (mobile devices, PC devices, smart TVs). To ensure the objectivity of the data, the test data are cross-verified by system logs and blockchain ledgers.

[0145] The verification result shows that after the deployment of the application, the overall access control response time of the platform is significantly reduced. In the access request verification stage, the average response time is reduced from 184 ms of the traditional system to 112 ms, which is shortened by nearly 39%; during the peak period (20:00-22:00 every day), the highest processing capacity of the optimized access decision module reaches 510 requests per second, which is about 27% higher than that of the traditional method. The resource access authorization accuracy is improved to 99.92%, and the unauthorized access blocking rate is improved to 99.98%. The digital product identification forgery event is zero in the verification period, and the authenticity of all key access behaviors is verified through on-chain data, and the audit evidence integrity rate reaches 100%.

[0146] In terms of resource access audit, the traditional system has a missing rate of 5.2% in high-concurrency scenarios due to broken record chain, while the application system realizes 0 missing through complete access record chain, greatly improving the audit reliability. At the same time, in terms of security, the application realizes 100% success rate of access request tamper-proofing through ECDSA signature protection, effectively blocking the man-in-the-middle forgery request attack.

[0147] Overall, the application has achieved remarkable results in improving access control real-time response capability, enhancing digital product uniqueness authentication, preventing forgery and tampering, and improving audit evidence integrity, fully verifying the engineering feasibility and promotion value of the application in actual complex application scenarios.

[0148] Table 1 Comparison of key performance data of access control system during platform deployment

[0149] Item Conventional method Inventive method Lifting range Average access verification response time (ms) 184 112 39.1% Peak access processing capacity (times / sec) 402 510 26.9% Resource access authorization accuracy 98.7% 99.92% +1.22% Unauthorized access blocking rate 99.5% 99.98% +0.48% Audit evidence integrity rate 94.8% 100% +5.2% Access counterfeit event occurrence 3 per week 0 per week Eliminate counterfeit Blockchain evidence record coverage rate 92.3% 100% +7.7%

[0150] As can be seen from the comparison data in Table 1 above, in the large-scale digital product distribution and access control scenario, the application is significantly superior to the traditional centralized access control system in multiple key performance indicators, fully verifying its application value and engineering feasibility in high-frequency access and multi-source attribute dynamic change environment. Specifically, in terms of access verification response speed, the application constructs an optimized Boolean logic ABAC decision link, greatly shortening the access request processing time, and the average verification response time is reduced from 184 ms of the traditional method to 112 ms, with a reduction of 39.1%. This improvement is particularly evident during peak periods, effectively alleviating the system bottleneck caused by high concurrency of access, improving the overall user experience and platform service continuity.

[0151] In terms of access processing capability, the optimized access control module of the application has a peak processing capability of 510 requests per second under high load conditions, which is 26.9% higher than the 402 times of the traditional method. This shows that the application not only has an advantage in static conditions, but also can maintain efficient and stable access control output in a dynamic load changing environment, demonstrating good system scalability and pressure resistance.

[0152] In terms of access authorization accuracy, the application improves the resource access authorization accuracy from 98.7% of the traditional method to 99.92% through the introduction of DID identity identification and signature verification mechanism, and further improves the unauthorized access blocking rate from 99.5% to 99.98%. This not only effectively reduces the risk of illegal access and resource abuse, but also greatly improves the protection of digital content resources and strengthens the overall data security protection system of the platform.

[0153] In terms of audit evidence integrity, the application successfully achieves 100% audit data integrity through the block chain on-chain evidence mechanism, which records the entire access process from request initiation, decision authorization to access execution. The traditional method has 5.2% data loss in high concurrency scenarios. The complete audit chain greatly enhances the traceability of access behavior, providing strong support for digital property protection and compliance audit.

[0154] In terms of security, the application uses ECDSA signature mechanism to ensure the integrity and non-repudiation of access requests during transmission and verification. During the entire test period, the application system did not have any access forgery events, while the traditional method had an average of 3 forgery attacks per week, showing the absolute advantage of the application in resisting forgery and tampering risks. At the same time, through the on-chain evidence coverage rate of 100%, the application further ensures that all access behaviors have a trusted and verifiable on-chain record, perfecting the tamper-proof and responsibility tracing system of the access process.

[0155] Overall, the application systematically improves access control response speed, processing capability, authorization accuracy, security and audit integrity through dynamic perception of user attributes, optimized Boolean logic access decision, ECDSA signature authentication and block chain evidence system. In a complex, high concurrency, multi-source attribute changing actual running environment, the application shows excellent stability and robustness. Compared with the traditional method, not only in performance indicators, but also in system security protection, data trusted protection and responsibility traceability, the application provides a higher standard solution, laying a solid technical foundation for the intelligent upgrade of future digital resource management platform in the field of access control, security audit and compliance governance.

[0156] The above merely describes preferred specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art, according to the technical solution and inventive concept of the present application, makes equivalent replacement or change within the technical range disclosed by the present application, which should be covered within the protection scope of the present application.

Claims

1.A method for digital product uniqueness identification and access control based on blockchain, characterized in that, The method comprises the following steps: S1, collecting digital product data and attribute information of an access user, and constructing a digital product data set and an access user attribute data set; S2, based on the access user attribute data set, assigning a decentralized identity to the access user, generating an access user public key and an access user private key using an elliptic curve encryption algorithm, and forming a key pair; S3, based on the digital product data set and the access user attribute data set, generating a request digest value through a hash algorithm, performing elliptic curve digital signature on the request digest value using the access user private key, and generating a signed access request structure; S4, constructing an ABAC model, modeling the access user as an access request body with attribute observation and access decision capability, and formulating an access control policy rule set based on the digital product data set; S5, introducing a Boolean operation optimization mechanism into the ABAC model, initializing a plurality of Boolean logic expression units, processing the access control policy, and obtaining an optimized ABAC model; S6, verifying the access request signature in the signed access request structure, inputting the access user attribute data set into the optimized ABAC model for matching judgment, and generating an access authorization token; S7, based on the access authorization token, extracting the access behavior and recording it to the blockchain, realizing the audit and traceability of the access process; The S2 specifically comprises: S21, based on the access user attribute data set, extracting information including role attribute, regional attribute and device attribute, and constructing an access user identity feature vector; S22, concatenating the access user identity feature vector with the timestamp of the current generation moment, processing through a decentralized identity generation hash function, and generating a decentralized identity of the access user: ； wherein, is a decentralized identity of the access user, is is an identity namespace prefix, is a binary concatenation operator, is a first layer cryptographic hash function, is a second layer cryptographic hash function, is an access user identity feature vector, is a randomly generated cryptographic salt value, is a current system timestamp; S23, based on the decentralized identity of the access user, using an elliptic curve encryption algorithm, performing scalar multiplication operation between the access user private key and the standard elliptic curve base point, generating a key pair of the access user, wherein the access user public key is the point coordinate obtained by multiplying the access user private key and the standard elliptic curve base point, forming a public key and a private key pair exclusive for the access user; S24, storing the generated access user private key in the access user local terminal device, and binding and registering the generated access user public key and the decentralized identity. 2.The blockchain-based digital product uniqueness identification and access right control method of claim 1, wherein, The digital product data set comprises resource identifier, resource type, security level, version information and metadata information, and the access user attribute data set comprises role attribute, regional attribute, device attribute, access time attribute and optional dynamic attribute. 3.The blockchain-based digital product uniqueness identification and access right control method of claim 1, wherein, The S3 specifically comprises: S31, extracting the resource identifier from the digital product data set, extracting the role attribute, regional attribute, device attribute and access time attribute from the access user attribute data set, arranging them in order, and combining them into an access request vector; S32, passing the access request vector as input data to the hash function, performing one-way digest calculation on all field contents of the access request vector including resource identifier, role attribute, regional attribute, device attribute and access time attribute through the hash algorithm, and outputting the corresponding access request digest value; S33, the private key of the access user is used to perform elliptic curve digital signature on the request digest value, and an access request signature is generated through an elliptic curve digital signature algorithm; S34, the decentralized identity of the access user, the access request vector, the request digest value, the access request signature and the access user attribute data set are combined to construct a signed access request structure. 4.The blockchain-based digital product uniqueness identification and access right control method of claim 3, wherein, The elliptic curve digital signature algorithm includes randomly selecting an integer greater than or equal to 1 and less than an elliptic curve order as a signature random number; subsequently, multiplying the random number by an elliptic curve base point to obtain a coordinate point on the elliptic curve; extracting an abscissa from the point coordinate and taking modulo of the elliptic curve order to obtain a first component part in the signature ;​ The second component of the computed signature : ； wherein, is a second component of the signature, is a random number is a multiplicative inverse in the field is a multiplicative inverse in the field is an access request digest value, is an access request vector, is a private key of an access user, is an access user, is a first component of the signature, is a modulo operation, is an elliptic curve order; combining the first component of the signature and the second component of the signature yields the access request signature. 5.The blockchain-based digital product uniqueness identification and access right control method of claim 1, wherein, The S4 specifically comprises: S41, the access user is modeled as an access request body, the access request body has attribute observation and access decision capability, and based on the user attribute data set and the digital product data set, role attributes, regional attributes, device attributes, access time attributes, resource type attributes and resource security level attributes are extracted and combined to form an attribute observation vector of the access request body; S42, according to the attribute observation vector of the access request body, an attribute initial state value is set for each access request body, and the initial state value is determined according to the real-time identity information, device state, geographical position and time period classification of the user when the access request occurs; S43, according to the role attribute and the device attribute, assigning an access sensitivity parameter to the access request body when the role attribute is a system administrator and the device attribute is a trusted device, when the role attribute is a normal user and the device attribute is a trusted device, when the device attribute is a non-trusted device, regardless of the user role, ; S44, setting an access confidence parameter for the access request body according to the regional attribute and the access time attribute when the regional attribute is located in a trusted area and the access time attribute is in a working time period, when the regional attribute is located in an unknown area or the access time attribute is in a non-working time period, when the regional attribute is located in a high-risk area, ; S45, integrating the attribute observation vector of the access request body, the access sensitivity parameter with the access confidence parameter to form an access control feature vector S46, based on the access control feature vector, an access control policy rule is formulated according to a preset Boolean logic condition combination mode, and an access control policy set is generated according to an access decision result. 6.The blockchain-based digital product uniqueness identification and access right control method of claim 1, wherein, The S5 specifically comprises: S51, based on the access control attribute vector and the access control policy set, each access control policy rule is extracted, and an attribute combination condition in the access control policy rule is converted into an initial Boolean logic expression; S52, the initial Boolean logic expression is executed to simplify the logic, and according to the Boolean algebra rule, the same items are combined and the redundant logic conditions are eliminated, to obtain a simplified Boolean logic expression; S53, for the simplified Boolean logic expression, short circuit optimization processing is performed, the judgment path is rearranged according to the attribute value appearance probability order, the access decision output is determined in advance, and a short circuit optimized Boolean logic expression is generated; S54, the short circuit optimized Boolean logic expression is subjected to path pruning processing, and redundant judgment nodes and unreachable paths are deleted, to generate a pruned Boolean logic expression; S55, based on the pruned Boolean logic expression, performance evaluation is performed according to the attribute matching complexity index and the access decision efficiency index, and an optimized expression set meeting an optimal threshold is selected; S56, the optimized expression set is integrated to form an optimized access control policy rule set, and the ABAC model is updated based on the optimized access control policy rule set, to form an optimized ABAC model. 7.The blockchain-based digital product uniqueness identification and access right control method of claim 1, wherein, The S6 specifically comprises: S61, the centralized identity, the access request vector, the request digest value, the access request signature and the access user attribute data set contained in the signed access request structure are extracted and combined into an access request verification data packet; S62, the public key of the access user is used to perform digital signature verification on the request digest value and the access request signature in the access request verification data packet, when the verification is successful, it is confirmed that the access request source is credible and the content is not tampered, and the attribute matching stage is allowed to enter, otherwise the subsequent processing is rejected; S63, verify the user attribute dataset in the data packet and the access request vector according to the access request, build an access request attribute observation vector, input to the optimized ABAC model, and execute access decision judgment: ； wherein, is a match decision result, is a result of signature verification for the access request, is a logical and operator, is a logical or operator, is a total number of rules in the optimized access control policy rule set, is a policy rule index variable, is a match judgment function, is an attribute observation vector corresponding to the current access request, is an optimized th access control policy Boolean logic expression; S64, if the matching decision result is true and the signature verification is passed, an access authorization token is generated. 8.The blockchain-based digital product uniqueness identification and access right control method of claim 7, wherein, The generation of the access authorization token includes generating identity and resource binding data, generating an access authorization timestamp, and extracting an access permission range; the identity and resource binding data are extracted from a decentralized identity and a resource identifier; The access authorization token is generated by combining the decentralized identity, the resource identifier, the access authorization timestamp, and the extracted access permission range. 9.The blockchain-based digital product uniqueness identification and access right control method of claim 1, wherein, The S7 specifically includes: S71, extract the decentralized identity, resource identifier, access permission range, authorization timestamp, and access decision result in the access authorization token, and combine them to form an access behavior basic information set; S72, after the access behavior is executed, the actual access timestamp when the access occurs is collected, the access behavior basic information set is combined with the actual access timestamp to form an access behavior record data structure; S73, perform a secure hash operation on the access behavior record data structure, and generate an access behavior record hash value using the SHA-256 algorithm; S74, based on the access behavior record hash value, combine the address information of the access user in the blockchain network and the current transaction generation time to build a blockchain transaction data structure; S75, broadcast the blockchain transaction data structure to the blockchain network, confirm it through the consensus mechanism of the blockchain system, and write it into the blockchain ledger to form an unalterable access behavior evidence, and realize complete auditing and tracing of the access behavior.

Images