Multi-subject data element hierarchical control method and system based on block chain

Abstract

The invention discloses a multi-subject data element hierarchical control method and system based on a block chain, and relates to the technical field of data security crossover, and the method comprises the steps: obtaining nested subject data, carrying out the privacy classification of an overlapping interval of the nested subject data, and carrying out the access authorization through a clustering signature mode, the nested main body data comprises personal data and enterprise data; based on a BBS04 short group signature technology, cluster distribution, cluster encryption and authentication are carried out on the data asset privacy level of the nested main body data to obtain authenticated data, and access control is carried out on the authenticated data to obtain a control result; and a brand new solution and thought are provided for data supervision on the aspects of data privacy, data protection, data processing and the like.

Description

Technical Field

[0001] The present invention relates to the field of cross-technical data security, and specifically to a method and system for hierarchical control of multi-subject data elements based on blockchain. Background Art

[0002] Data assets are characterized by economies of scale and network effects, unlocking significant value through cross-regional and cross-industry circulation. However, in the data-driven digital economy, personal and corporate data assets are highly intertwined and nested. Personal data is often a crucial component of corporate data. For example, e-commerce user behavior records and financial institution customer information, after internal aggregation, processing, and analysis, can become more commercially valuable corporate data assets. This intertwined relationship also creates a complex trade-off between personal privacy and corporate interests. Summary of the Invention

[0003] In order to address the deficiencies mentioned in the above background technology, the purpose of the present invention is to provide a multi-subject data element hierarchical control method and system based on blockchain, providing a new solution and idea for data supervision.

[0004] In a first aspect, the purpose of the present invention can be achieved by the following technical solution: a multi-subject data element hierarchical control method based on blockchain, the method comprising the following steps:

[0005] Obtaining nested subject data, dividing overlapping intervals of the nested subject data into privacy levels, and authorizing access using cluster signatures, wherein the nested subject data includes personal data and enterprise data;

[0006] Based on the BBS04 short group signature technology, cluster allocation, cluster encryption and authentication are performed on the privacy level of the data assets of the nested subject data to obtain the authenticated data, and access control is performed on the authenticated data to obtain the control result.

[0007] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: the enterprise data includes personal data, and the individuals are divided into clusters according to the proportion of overlapping data assets, thereby converting the individual classification into a cluster classification authorization containing several individuals, but the privacy rights of each member in the cluster are equally protected. When verifying the signature u of a member with permission L in cluster Cluster(x), x,L When checking the validity, it will be verified based on the query results returned by the authorization list.

[0008] In conjunction with the first aspect, in certain implementations of the first aspect, the method further includes: the cluster grading is performed based on the degree of privacy data assets of individual members; the inter-cluster hierarchical permissions are divided based on the proportion of nested personal privacy data, and the hierarchical levels of individual subjects within the cluster are mapped to signature permissions;

[0009] The algorithm is defined as follows: The subject in the cluster obtains a unique corresponding permission identifier R according to the permission level of its cluster F =Hash1(F,L2), individual F is calculated by hash function Hash1 combined with the corresponding cluster level L2. Only subjects with corresponding permissions can sign a specific data asset level and verify the permission identifier R in the level verification process. F Match the cluster level to which it belongs. Clusters do not interact with data assets based on individual entities. C1 ABC =C1 and C2 ABCD =Member B in C2 corresponds to two permission flags: and Represents the authority level within each cluster, C1 includes ABC, C2 includes ABCD; data asset interaction requests between clusters will be carried out through group signatures after considering the cluster level tree diagram. Each cluster obtains a unique identifier through the hash function Hash2, and the identifier of C2 The public data asset set of the cluster is Null, so its cluster level depends on the smallest sub-cluster level nested in it. The hierarchical relationship of the tree structure does not have the conventional parent-child node permission coverage. How individual entities between clusters, between clusters, and enterprises obtain signature authorization for individuals relies on the short signature scheme.

[0010] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: members of the cluster generate corresponding signatures according to the cluster level, which can meet the characteristics of being unforgeable, anonymous, traceable and resistant to joint attacks in the blockchain network. The short signature scheme is based on the BBS04 segment group signature, and the cluster parameters and secret key generation are expanded on the basis of BBS04. The system defines the cluster level as a unique identifier R L , clusters C1, C2 generators are c1, c2 respectively, and at the same time satisfy the StrongDiffie-Hellman assumption on (C1, C2) and the decision linearity assumption on C1. In the rank assignment stage, x is regarded as the main member A, which corresponds to cluster C AB , public data m = α; generate public information p = γ, M = ζ in the signature phase, that is, C AB with C BC Same as nested in C ABC C AB In the middle, subject A interacts to obtain C BC The data in γ.

[0011] In conjunction with the first aspect, in certain implementations of the first aspect, the method further includes: the short signature scheme is based on the BBS04 segment group signature, and the process is as follows:

[0012] Signature system initialization: First, select n cluster members in the KeyGen(n) function, randomly select and Suppose there exists u,v∈C1 such that Then select calculate Through η, the subject x (1≤x≤n) in the cluster generates an SDH tuple (Cert x ,i x );choose in i x ,set up The resulting cluster public key is cpk = (c1, c2, l, u, v, w), the cluster supervisor node private key cmsk {τ1, τ2}, and the private key of the cluster member subject x is a tuple csk[x] = (Cert x ,i x ), the cluster supervisory node generates a level key i for each level L , and calculate the corresponding level public key Take it and the cluster public key as parameters After being made public, the verifier can verify the signature according to the level;

[0013] Level allocation: The cluster supervisory node holds the level permission table (x, p, L). The nested subject member x in the cluster can be assigned level L and has permission to the public data m in the corresponding cluster. The cluster supervisory node identifies R according to the role of the subject member. x , assign parameter L to it x , and update its private key csk[x] and L x , that is, csk[x]=sk x,L =(Cert x ,i x,L );

[0014] Generate signature: When a nested principal member x needs to sign a public message p, it uses its personal private key sk x,L And add level information R L , the corresponding cluster and random number Based on the cluster public key cpk and the nested subject user private key sk with cluster authority x,L And the corresponding public information M, using the signature function Sign(cpk,sk x,L ,M) signature, based on the theoretical basis of SDH, select random numbers and calculate Continue to calculate the auxiliary value λ1=ix,L ξ1,λ2=i x,L ·ξ2, then randomly select of Calculate G1, G2, G3, G4, G5 from the above parameters;

[0015]

[0016] Continue calculation and its response value

[0017]

[0018] Final output signature and Among them, Cert x,L It is a cluster level certificate generated based on the level list;

[0019] Verification phase: Use smart contracts to automatically execute the verification function Verify(cpk,M,ψ), where cpk(c1,c2,l,u,v,w) is the cluster public key, which is used to verify M and cluster signature ψ′, and verify that it will be legally derived through SDH

[0020]

[0021] Check the challenge value g, if If the formula matches successfully, the signature verification is completed, and the cluster level verification is performed at the same time. The signature verification party determines the data corresponding level L based on the public data M and signature ψ, and then uses the public cluster level public key Verify that the formula e(ψ′,c)=e(ψ,CSK)·e(G,T) holds, where R=c h , Determine R x , L x Is it in the expected range? Signature tracing: through the cluster public key cpk(c1,c2,l,u,v,w) and the corresponding cluster supervisory private key cmsk{τ1,τ2}, as well as the accessed public information M and the corresponding signature The information access member can be located by executing the traceback signature function Trace(cpk,cmsk,M,ψ); the operation is to first verify that the signature ψ′ is a valid signature on M, and regard (K1,K2,K3) as a linear encryption, which can be calculated by Retroactively track specific users.

[0022] In conjunction with the first aspect, in certain implementations of the first aspect, the method further includes: performing access control on the authenticated data based on an authentication / access module, the authentication / access module being responsible for verifying the identity and authority of the subject, ensuring that only legitimate subjects with corresponding authority can access specific data assets, and performing the following four basic operations based on the BBS04 short signature scheme and in combination with the cluster hierarchical authorization mechanism:

[0023] Identity authentication: When a subject initiates a data access request, it first needs to pass the identity authentication link; the subject uses its private key to generate a signature, and attaches the level information, and submits it to the authentication module; the authentication module uses the cluster public key and related parameters to verify the legitimacy of the signature. If the signature is valid, it indicates that the subject's identity is legal and has the corresponding authority level, thus allowing it to enter the subsequent access control process; authority verification: After the identity authentication is passed, the authentication module verifies the subject's authority, and judges whether the subject has the authority to access the requested data asset based on the level information embedded in the subject's signature and the cluster level hierarchy tree diagram; if the subject's authority is If the limit level meets the access requirements of the data asset, it is allowed to access the data, otherwise the access request is rejected; access record, for each data access request, the authentication / access module will record detailed access information, including the identity of the access subject, access time, accessed data asset type and permission level; the record is stored on the blockchain; after completing identity authentication and permission verification, the authentication / access module makes an access control decision based on the verification results. If the subject is legal and has the corresponding authority, it is allowed to access the data and provide it with the corresponding data assets. If the verification fails, the access request is rejected and the reason for the rejection is fed back to the subject.

[0024] In conjunction with the first aspect, in certain implementations of the first aspect, the method further includes: the asset access control mechanism for the nested subject data is implemented based on cluster supervision, and its functions include: cluster grading and authorization, where the cluster supervision module is responsible for cluster grading the nested subject data assets and assigning corresponding permissions to different clusters and their members based on the grading results. Based on the proportion of overlapping personal data assets, the cluster supervision module divides scattered individuals into multiple clusters and sets a unique cluster level identifier for each cluster. The cluster supervision module also assigns individual permission levels to cluster members and ensures that the privacy rights of all cluster members are equally protected; permission management and adjustment, where the cluster supervision module monitors the permission usage of cluster members in real time and dynamically adjusts cluster levels and member permissions based on dynamic changes in data assets and business needs. When there is a significant change in data assets within a cluster or a change in the enterprise business model, the cluster supervision module promptly updates the cluster level and member permissions to ensure the adaptability and effectiveness of the access control policy; abnormal behavior detection and early warning, where the cluster supervision module monitors the access behavior of the subject in real time, analyzes its access pattern and frequency and other indicators, and immediately issues an early warning when abnormal behavior is detected and takes corresponding measures.

[0025] In combination with the first aspect, in some implementations of the first aspect, the method further includes: in the asset access control mechanism of the nested subject data, the smart contract ensures the compliance and transparency of the data access process by automatically executing preset rules and conditions, and the collaborative operation is as follows: rule setting and execution, the smart contract sets a series of data access control rules according to the enterprise data management and privacy protection policies. When the subject initiates a data access request, the smart contract automatically checks whether the request complies with the preset rules. If it does, access is allowed; if it does not, access is denied or the corresponding approval process is initiated; permission verification and authorization, in the permission verification link, the smart contract automatically verifies its authority based on the subject's signature and cluster level information. Whether the access requirements of data assets are met. If the verification is successful, the smart contract will automatically authorize the subject to access the data and record the authorization information. If the verification fails, the authorization will be rejected and the reason for rejection will be recorded. For data interaction and sharing, in the process of interaction and sharing of nested subject data assets within the enterprise, the smart contract can automatically perform compliance checks on data transmission and sharing. For auditing and supervision, the smart contract can record detailed information on each data access and interaction, including the identity of the access subject, access time, access data asset type, and data operation type. According to the preset audit rules, the smart contract regularly conducts automatic audits on data access, discovers potential security issues and violations, and promptly notifies relevant personnel for processing.

[0026] In a second aspect, in order to achieve the above-mentioned purpose, the present invention discloses a multi-subject data element hierarchical control system based on blockchain, comprising:

[0027] A data access module, configured to obtain nested subject data, divide overlapping intervals of the nested subject data into privacy levels, and authorize access using clustered signatures, wherein the nested subject data includes personal data and enterprise data;

[0028] The hierarchical control module is used to perform cluster allocation, cluster encryption and authentication on the privacy level of data assets of nested subject data based on BBS04 short group signature technology, obtain authenticated data, perform access control on the authenticated data, and obtain control results.

[0029] In another aspect of the present invention, in order to achieve the above-mentioned purpose, a terminal device is disclosed, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor. The memory stores a computer program capable of running on the processor, and when the processor loads and executes the computer program, it adopts the above-mentioned blockchain-based multi-subject data element hierarchical control method.

[0030] Beneficial effects of the present invention:

[0031] This paper improves traditional divide-and-conquer privacy protection solutions into a holistic governance framework by constructing a cluster-level mechanism for nested subject data assets. This framework integrates a hierarchical signature scheme based on an improved BBS04 short signature, enabling dynamic permission management of data asset identity attributes. This provides a novel solution and approach to data regulation at the levels of data privacy, data protection, and data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0033] Figure 1 Schematic diagram of the process of the present invention;

[0034] Figure 2 This is a framework diagram of the method scheme of the present invention;

[0035] Figure 3 This is a diagram of the cluster supervision organization structure in the present invention;

[0036] Figure 4 This is a diagram of the cluster allocation module in the present invention;

[0037] Figure 5 This is a framework diagram of the signature scheme in the present invention;

[0038] Figure 6 This is a logic flow chart of the access control mechanism in the present invention;

[0039] Figure 7 This is a diagram showing the impact of malicious nodes on system stability in the present invention;

[0040] Figure 8 This is a comparison chart of the time efficiency of data interaction in the blockchain under the influence of the number of clusters in the present invention;

[0041] Figure 9 Schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0042] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0043] Example 1:

[0044] like Figure 1 As shown, a multi-subject data element hierarchical control method based on blockchain includes the following steps:

[0045] S101: Acquire nested subject data, divide overlapping intervals of the nested subject data into privacy levels, and authorize access using cluster signatures, wherein the nested subject data includes personal data and enterprise data;

[0046] Individual and enterprise data assets are reduced to nested subject data assets, and the two are merged into a network. In the context of blockchain technology, privacy levels are divided according to the overlapping intervals of personal data, and access authorization is performed in the form of clustered signatures; at the same time, the hierarchical rules of access authorization belong to a role-based access control scheme. By utilizing the characteristics of smart contracts, the access control strategy that integrates cryptographic technology, privacy protection and dynamic programming can operate autonomously without being interfered with by the external environment, and takes both security and efficiency into account. The invention is based on the BBS04 short group signature technology, which performs cluster allocation, cluster encryption and authentication according to the privacy level of data assets, avoiding the shackles of existing group signature technology such as high management complexity and large signature key size that limit flexibility and scalability; in the authentication / access control module, four basic operations are executed by smart contracts, and the control links of data asset collection, processing, and processing of each subject are carried out throughout to ensure the orderly interaction of data assets between different modules and levels, including the audit, encryption and authentication of data asset information flows; the trusted network module not only relies on its own security to maintain system operation, but can also dynamically adjust the structural layout according to scale. The scheme framework diagram is attached. Figure 2 shown.

[0047] In the blockchain, group signatures are reduced to achieve flexibility and scalability in data interaction management in nested subject data assets. The subject level and cluster level mechanisms are embedded in the BBS04 short signature scheme, and privacy levels are divided in the form of a clustered permission list tree, taking into account multiple personal subject identities and the scale of enterprises and industries. At the same time, for the compatibility issues that need to be considered for complex heterogeneous data assets on the blockchain network, this solution is led by the cluster supervision module, and optimizes the interaction requirements of compatible heterogeneous nested subjects under the premise of security, so as to achieve efficient and secure communication between enterprises and individuals, and between individuals. The cluster supervision architecture is as follows: Figure 3 As shown. The supervision module has the right to formulate the signature authority and hierarchical classification of clusters and cluster members, and monitors the node state machine node activities in the network to predict abnormal behavior in advance. Before cluster supervision is carried out, the data asset cluster needs to be hierarchically authorized. The internal data assets of the enterprise include personal data assets, and how to distinguish the privacy part of personal data assets is the focus of the present invention. To this end, the invention divides a large number of scattered individuals into clusters according to the proportion of the overlapping parts of their data assets, thereby transforming the individual classification into the hierarchical authorization of clusters containing several individuals, but the privacy rights of each member in the cluster are equally protected, that is, the supervision module verifies the signature u of a member with permission L in the cluster Cluster(x) x,L The validity will be verified based on the query results returned by the authorization list and will not be affected by the cluster level permissions. The cluster supervision organization structure is as follows Figure 3 shown.

[0048] In this scheme, the hierarchical classification is not only a comparison of the permissions between two clusters, but also the classification of personal data assets nested within the cluster. The intra-cluster classification is based on the degree of privacy data assets of individual members; the inter-cluster hierarchical permissions are divided according to the proportion of nested personal privacy data. The hierarchical classification of individual subjects within the cluster will be mapped to signature permissions. The algorithm is defined as follows: the subject within the cluster is assigned a unique corresponding permission identifier R according to the permission level of its cluster. F =Hash1(F,L2), taking individual F as an example, the hash function Hash1 is combined with the corresponding cluster level L2 for calculation. Only subjects with corresponding permissions can sign a specific data asset level and verify the permission identifier R in the level verification process. F Match it with the cluster level it is in. It is worth noting that a subject may exist in multiple clusters, but the permission identifier corresponding to the subject is only valid within the corresponding cluster. Data assets are not exchanged between clusters based on individual subjects. For example, member B in C(ABC) and C(ABCD) corresponds to two permission identifiers: and It only represents the authority level within each cluster. Data asset interaction requests between clusters will be processed through group signatures after considering the cluster level tree diagram. Each cluster obtains a unique identifier through the hash function Hash2. Taking C(ABCD) as an example, its identifier is It is worth noting that the public data asset set of this cluster is Null, so its cluster level depends on the smallest sub-cluster level nested in it. This tree-structured hierarchical relationship does not have the conventional parent-child node permission coverage. However, when enterprise entities interact with clusters for data assets, they can refer to the hierarchical level. At this time, all clusters are nested in the enterprise, similar to an alliance. After an enterprise has a certain level of access rights, it can have access rights lower than its level. This can greatly improve the efficiency of data asset interaction. How individual entities between clusters, between clusters, and between enterprises and individuals obtain signature authorization depends on the short signature scheme. The cluster allocation module is shown in the attached figure. Figure 4 shown.

[0049] The method described in the present invention generates corresponding signatures according to the cluster level, which can meet the characteristics of non-forgeability, anonymity, traceability and resistance to joint attacks in the blockchain network. The short signature scheme proposed in the present invention is based on the BBS04 segment group signature. On this basis, the cluster management is used as the key generation center (PKG), and group signatures are performed based on the hierarchical authorization to verify the legitimacy of each cluster and cluster node, thereby realizing anonymous identity authentication and authorization of nested data assets within the enterprise, and providing a new solution for safe and efficient data interaction. This solution expands the cluster parameters and key generation based on BBS04. The system defines the cluster level as a unique identifier R L Take two clusters C1 and C2 with bilinear mapping properties as examples. Their generators are c1 and c2, respectively. They also satisfy the Strong Diffie-Hellman (SDH) assumption on (C1, C2) and the decision linearity assumption on C1. In the rank assignment phase, x can be regarded as the subject member A, which corresponds to cluster C(AB) and public data m = α. In the signature generation phase, public information p = γ and M = ζ. That is, C(AB) and C(BC) are both nested in C(ABC), and subject A in C(AB) interactively obtains data γ in C(BC).

[0050] The present invention is directed to the setting of the method, which is characterized in that the signature system is initialized by first selecting n cluster members in the KeyGen(n) function, randomly selecting and Assume that there exists u,v∈C1 such that Then select calculate Through η, the subject x (1≤x≤n) in the cluster generates an SDH tuple (Cert x ,i x ).choose In ix, set The resulting cluster public key is cpk = (c1, c2, l, u, v, w), the cluster supervisor node private key cmsk {τ1, τ2}, and the private key of the cluster member subject x is a tuple csk[x] = (Cert x ,i x The cluster supervisory node generates a level secret key iL for each level and calculates the corresponding level public key Take it and the cluster public key as parameters After being made public, the verifier can verify the signature according to the level. Level allocation: The cluster supervisory node holds the level permission table (x, p, L). The nested subject member x in the cluster can be assigned level L and has permission to the public data m in the corresponding cluster. The cluster supervisory node identifies Rx according to the role of the subject member, assigns parameters Lx to it, and updates its private key csk[x] and Lx at the same time, that is, csk[x] = sk x,L =(Cert x ,i x,L Generate signature: Because the signature parameter in this link adds hierarchical information, that is, when the nested subject member x needs to sign the public message p, it uses the personal private key sk x,L And add level information RL, the corresponding cluster and random number Based on the cluster public key cpk and the nested subject user private key sk with cluster authority x,L And the corresponding public information M, using the signature function Sign(cpk,sk x,L ,M) signature. Based on the theoretical basis of SDH, random numbers are selected and calculate Continue to calculate the auxiliary value λ1=i x,L ξ1,λ2=i x,L ·ξ2. Then randomly select of Calculate G1, G2, G3, G4, and G5 using the above parameters.

[0051]

[0052] Continue calculation and its response value

[0053]

[0054] Final output signature and Among them, Cert x,LIt is a cluster level certificate generated based on the level list. Verification phase: This solution uses smart contracts to automatically execute the verification function Verify(cpk,M,ψ), where cpk(c1,c2,l,u,v,w) is the cluster public key to verify M and cluster signature ψ′, and verify that it will be legally derived through SDH

[0055]

[0056] After calculating the formula from the above formula, check the challenge value g. If If the formula matches successfully, the signature verification is completed, and the cluster level verification is performed at the same time. The signature verification party determines the data corresponding level L based on the public data M and signature ψ, and then uses the public cluster level public key Verify that the formula e(ψ′,c)=e(ψ,CSK)·e(G,T) holds, where R=c h , Determine whether Rx, Lx are in the expected range. Signature tracing: This scheme uses the cluster public key cpk (c1, c2, l, u, v, w) and the corresponding cluster supervisory private key cmsk {τ1, τ2}, as well as the accessed public information M and the corresponding signature The information access member can be located by executing the traceback signature function Trace(cpk,cmsk,M,ψ). The operation is to first verify that the signature ψ′ is a valid signature on M, and then treat (K1,K2,K3) as a linear encryption, which can be calculated by Backtrack to track specific users. The signature scheme framework diagram is as follows Figure 5 shown.

[0057] S102: Based on the BBS04 short group signature technology, cluster allocation, cluster encryption and authentication are performed on the data asset privacy level of the nested subject data to obtain the authenticated data, and access control is performed on the authenticated data to obtain the control result.

[0058] An efficient, secure and flexible access control mechanism is constructed based on hierarchical signatures to address the balance between privacy protection and data utilization faced by personal data assets embedded within the enterprise when interacting between different entities. The logical flow chart of the access control mechanism is shown in the attached figure. Figure 6 shown.

[0059] The authentication / access module is the foundation for implementing nested subject data asset access control. It is responsible for verifying the subject's identity and permissions, ensuring that only legitimate subjects with appropriate permissions can access specific data assets. Based on the BBS04 short signature scheme and combined with a cluster-level authorization mechanism, this module performs the following four basic operations: Identity authentication: When a subject initiates a data access request, it must first pass the identity authentication stage. The subject uses its private key to generate a signature, along with level information, and submits it to the authentication module. The authentication module verifies the legitimacy of the signature using the cluster public key and related parameters. If the signature is valid, it indicates that the subject's identity is legitimate and has the appropriate level of permissions, allowing it to enter the subsequent access control process. Permission verification: After identity authentication is passed, the authentication module further verifies the subject's permissions. Based on the level information embedded in the subject's signature and combined with the cluster-level hierarchical tree diagram, it determines whether the subject has permission to access the requested data asset. If the subject's permission level meets the access requirements of the data asset, they are allowed to access the data; otherwise, the access request is denied. For access records, for each data access request, the authentication / access module will record detailed access information, including the access subject's identity, access time, accessed data asset type, and permission level. These records will be stored on the blockchain to ensure the traceability and transparency of the data access process, providing a basis for subsequent audits and supervision. For access control decisions, after completing identity authentication and permission verification, the authentication / access module makes access control decisions based on the verification results. If the subject is legitimate and has the corresponding permissions, they are allowed to access the data and the corresponding data assets are provided. If verification fails, the access request is denied and the reason for the denial is fed back to the subject to ensure data security and compliance.

[0060] The cluster supervision module plays a key supervisory and coordination role in the access control mechanism for nested subject data assets. Its main functions include: cluster grading and authorization. The cluster supervision module is responsible for grading the clusters of nested subject data assets and assigning appropriate permissions to different clusters and their members based on the grading results. It divides dispersed individuals into clusters based on the proportion of overlapping personal data assets and assigns a unique cluster level identifier to each cluster. The cluster supervision module also assigns individual permission levels to cluster members and ensures that the privacy rights of all cluster members are equally protected. The cluster supervision module monitors the use of permissions by cluster members in real time and dynamically adjusts cluster levels and member permissions based on dynamic changes in data assets and business needs. For example, when a cluster's data assets undergo significant changes or when the enterprise's business model shifts, the cluster supervision module can promptly update cluster levels and member permissions to ensure the adaptability and effectiveness of the access control policy. The cluster supervision module also provides abnormal behavior detection and early warning. It monitors the access behavior of subjects in real time and analyzes indicators such as access patterns and frequency. When abnormal behavior is detected, such as frequent access to sensitive data assets, access behavior that does not match the subject's permissions, etc., the cluster supervision module will immediately issue an early warning and take corresponding measures, such as suspending the subject's access rights, notifying relevant personnel to conduct investigations, etc., to prevent potential security risks.

[0061] Smart contracts play a crucial role in the access control mechanism for data assets among nested entities. They automatically enforce pre-defined rules and conditions, ensuring compliance and transparency in the data access process. The specific collaborative operations are as follows: Rule setting and execution: Smart contracts establish a series of data access control rules based on the enterprise's data management and privacy policies, such as data access rights allocation rules, data access approval processes, and data sharing compliance requirements. When a subject initiates a data access request, the smart contract automatically checks whether the request complies with the pre-defined rules. If so, access is granted; otherwise, access is denied or the corresponding approval process is initiated. Permission verification and authorization: Smart contracts work closely with the authentication / access module. During permission verification, the smart contract automatically verifies whether the subject's permissions meet the data asset access requirements based on the subject's signature and cluster level information. If verification passes, the smart contract automatically authorizes the subject to access the data and records the authorization information. If verification fails, authorization is denied and the reason for the denial is recorded. Regarding data interaction and sharing: During the interaction and sharing of data assets among nested entities within the enterprise, smart contracts can automatically perform compliance checks on data transmission and sharing, ensuring that data flows between different entities adhere to privacy protection and compliance requirements. For example, when data is shared between businesses and individuals, smart contracts automatically check the privacy level of the shared data, the permission levels of both parties, and the compliance of the sharing agreement, ensuring the security and legality of the data sharing process. For auditing and oversight, smart contracts also have auditing capabilities, recording detailed information about each data access and interaction, including the identity of the accessing entity, access time, accessed data asset type, and data operation type. These records are permanently stored on the blockchain, providing reliable data support for subsequent audits and oversight. Smart contracts can also automatically audit data access regularly based on pre-set audit rules, identifying potential security issues and violations and promptly notifying relevant personnel for resolution.

[0062] This paper aims to explore how to use blockchain technology to build an effective hierarchical signature and access control system for nested data elements to address the regulatory challenges brought about by the application of complex data relationships in the digital economy era and to promote the healthy development of financial technology. This example verifies the performance of the hierarchical signature framework in signature generation and verification using different proportions of malicious Byzantine nodes. The experiment aims to evaluate the robustness of the framework, that is, the system's ability to maintain normal functionality when the proportion of Byzantine nodes (i.e., malicious nodes) is 1 / 3, 1 / 2, and 2 / 3 of the total number of nodes in the experiment, respectively. In this example, when the proportion of malicious nodes is 1 / 3, the overall performance of the system remains stable, and the signature verification failure rate and interaction timeout rate remain at an average of 3.2% and 2.1% respectively; when the proportion of malicious nodes increases to 1 / 2, the two indicators increase to an average of 6.7% and 5.3% respectively, but the system can still maintain a high operating efficiency; under the extreme condition that the proportion of malicious nodes reaches 2 / 3, the signature verification failure rate and interaction timeout rate further increase to an average of 10.5% and 7.8%, but after multiple interactions, the system tends to be stable, verifying the robustness of the proposed scheme and its availability in a high malicious node environment. Figure 7 shown.

[0063] In the present invention, as the size of data assets increases, the signing time is within a reasonable growth range when the number of clusters increases at the same rate. The reduction in the verification time leads to a slight increase in the overall interaction time as the size of data assets increases. The increasing trend is nonlinear and tends to be stable. In comparison, the increase in the non-clustered group is significantly higher than that of the clustered solution. This is also due to the fact that the cluster signature mechanism can avoid repeated signature verification operations through the existing interaction history when the data size does not increase much.

[0064] The clustered solution of the present invention performs stably in TPS (bar chart) through clustered parallel processing and BBS04 short signature optimization. When the data volume increases from 512Byte to 5120Byte, the TPS is always maintained between 295.3 and 298.4, while the non-clustered solution decreases from 284.6 to 231.4, a decrease of 18.7%; in terms of consensus time (line chart), the clustered solution increases from 129.8ms to 504.2ms, an increase of 3.89 times, while the non-clustered solution increases from 262.6ms to 824.4ms, an increase of 3.14 times, indicating that this solution significantly reduces the global communication overhead. The experimental results verify the effectiveness of the clustered hierarchical signature mechanism in improving the efficiency of data asset interaction and balancing privacy protection and computing load. As shown in the attached figure Figure 8 shown.

[0065] Example 2: In order to achieve the above purpose, Figure 9 As shown, based on the first embodiment, the present invention discloses a multi-subject data element hierarchical control system based on blockchain, including:

[0066] Data access module 11, used to obtain nested subject data, divide the overlapping intervals of the nested subject data into privacy levels, and authorize access using cluster signatures, wherein the nested subject data includes personal data and enterprise data;

[0067] The hierarchical control module 12 is used to perform cluster allocation, cluster encryption and authentication on the data asset privacy level of the nested subject data based on the BBS04 short group signature technology, obtain the authenticated data, perform access control on the authenticated data, and obtain a control result.

[0068] Based on the same inventive concept, the present invention also provides a computer device, which includes: one or more processors and a memory for storing one or more computer programs; the program includes program instructions, and the processor is used to execute the program instructions stored in the memory. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is used to implement one or more instructions, specifically for loading and executing one or more instructions in a computer storage medium to implement the above method.

[0069] It should be further explained that, based on the same inventive concept, the present invention also provides a computer storage medium having a computer program stored thereon, which executes the above method when executed by a processor. The storage medium can be any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electrical, magnetic, infrared, or semiconductor system, device or component, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or component.

[0070] Throughout this specification, references to terms such as "one embodiment," "example," or "specific example" indicate that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present disclosure. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0071] The above shows and describes the basic principles, main features and advantages of the present disclosure. Those skilled in the art should understand that the present disclosure is not limited to the above embodiments. The above embodiments and descriptions are merely illustrative of the principles of the present disclosure. Various changes and improvements may be made to the present disclosure without departing from the spirit and scope of the present disclosure, and such changes and improvements shall fall within the scope of the present disclosure.

Claims

1. A multi-subject data element hierarchical control method based on blockchain, characterized in that: The method comprises the following steps: Obtaining nested subject data, dividing overlapping intervals of the nested subject data into privacy levels, and authorizing access using cluster signatures, wherein the nested subject data includes personal data and enterprise data; Based on the BBS04 short group signature technology, cluster allocation, cluster encryption and authentication are performed on the privacy level of the data assets of the nested subject data to obtain the authenticated data, and access control is performed on the authenticated data to obtain the control result.

2. A multi-subject data element hierarchical control method based on blockchain according to claim 1, characterized in that: The enterprise data contains personal data, and the individuals are divided into clusters according to the proportion of overlapping data assets. This transforms the individual classification into a cluster classification authorization containing several individuals, but the privacy rights of each member in the cluster are equally protected. When verifying the signature u of a member with permission L in cluster Cluster(x), x,L When checking the validity, it will be verified based on the query results returned by the authorization list.

3. A multi-subject data element hierarchical control method based on blockchain according to claim 2, characterized in that: The cluster classification is based on the degree of privacy data assets of individual members. The inter-cluster level permissions are divided according to the proportion of nested personal privacy data. The level of individual subjects in the cluster will be mapped to the signature permission. The algorithm is defined as follows: The subject in the cluster obtains a unique corresponding permission identifier R according to the permission level of its cluster F =Hash1(F,L2), individual F is calculated by hash function Hash1 combined with the corresponding cluster level L2. Only subjects with corresponding permissions can sign a specific data asset level and verify the permission identifier R in the level verification process. F Match the cluster level to which it belongs. Clusters do not interact with data assets based on individual entities. C1 ABC =C1 and C2 ABCD =Member B in C2 corresponds to two permission flags: and Represents the authority level within each cluster, C1 includes ABC, C2 includes ABCD; data asset interaction requests between clusters will be carried out through group signatures after considering the cluster level tree diagram. Each cluster obtains a unique identifier through the hash function Hash2, and the identifier of C2 The public data asset set of the cluster is Null, so its cluster level depends on the smallest sub-cluster level nested in it. The hierarchical relationship of the tree structure does not have the conventional parent-child node permission coverage. How individual entities between clusters, between clusters, and enterprises obtain signature authorization for individuals relies on the short signature scheme.

4. A multi-subject data element hierarchical control method based on blockchain according to claim 3, characterized in that: The members of the cluster generate corresponding signatures according to the cluster level, which can meet the characteristics of non-forgeability, anonymity, traceability and resistance to joint attacks in the blockchain network. The short signature scheme is based on the BBS04 segment group signature, and the cluster parameters and secret key generation are expanded on the basis of BBS04. The system defines the cluster level as a unique identifier R L , the generators of clusters C1 and C2 are c1 and c2 respectively, and at the same time, the Strong Diffie-Hellman assumption is satisfied on (C1, C2) and the decision linear assumption is satisfied on C1. In the rank assignment stage, x is regarded as the main member A, which corresponds to cluster C AB , public data m = α; Generate the public information p=γ, M=ζ in the signature phase, that is, C AB with C BC Same as nested in C ABC C AB In the middle, subject A interacts to obtain C BC The data in γ.

5. A multi-subject data element hierarchical control method based on blockchain according to claim 4, characterized in that: The short signature scheme is based on the BBS04 segment group signature, and the process is as follows: Signature system initialization: First, select n cluster members in the KeyGen(n) function, randomly select and Suppose there exists u,v∈C1 such that Then select calculate Through η, the subject x (1≤x≤n) in the cluster generates an SDH tuple (Cert x ,i x );choose in i x ,set up The resulting cluster public key is cpk = (c1, c2, l, u, v, w), the cluster supervisor node private key cmsk {τ1, τ2}, and the private key of the cluster member subject x is a tuple csk[x] = (Cert x ,i x ), the cluster supervisory node generates a level key i for each level L , and calculate the corresponding level public key Take it and the cluster public key as parameters After being made public, the verifier can verify the signature according to the level; Level assignment: The cluster supervisory node holds the level permission table (x, p, L). The nested subject member x in the cluster can be assigned level L and has permission to the public data m in the corresponding cluster. The cluster supervisory node identifies R according to the role of the subject member. x , assign parameter L to it x , and update its private key csk[x] and L x , that is, csk[x]=sk x,L =(Cert x ,i x,L ); Generate signature: When a nested principal member x needs to sign a public message p, it uses its personal private key sk x,L And add level information R L , the corresponding cluster and random number Based on the cluster public key cpk and the nested subject user private key sk with cluster authority x,L And the corresponding public information M, using the signature function Sign(cpk,sk x,L ,M) signature, based on the theoretical basis of SDH, select random numbers and calculate Continue to calculate the auxiliary value λ1=i x,L ξ1,λ2=i x,L ·ξ2, then randomly select of Calculate G1, G2, G3, G4, G5 from the above parameters; Continue calculation and its response value Final output signature and Among them, Cert x,L It is a cluster level certificate generated based on the level list; Verification phase: Use smart contracts to automatically execute the verification function Verify(cpk,M,ψ), where cpk(c1,c2,l,u,v,w) is the cluster public key, which is used to verify M and cluster signature ψ′, and verify that it will be legally derived through SDH Check the challenge value g, if If the formula matches successfully, the signature verification is completed, and the cluster level verification is performed at the same time. The signature verification party determines the data corresponding level L based on the public data M and signature ψ, and then uses the public cluster level public key Verify that the formula e(ψ′,c)=e(ψ,CSK)·e(G,T) holds, where R=c h , Determine R x , L x Is it in the expected range? Signature tracing: through the cluster public key cpk(c1,c2,l,u,v,w) and the corresponding cluster supervisory private key cmsk{τ1,τ2}, as well as the accessed public information M and the corresponding signature The information access member can be located by executing the traceback signature function Trace(cpk,cmsk,M,ψ); the operation is to first verify that the signature ψ′ is a valid signature on M, and regard (K1,K2,K3) as a linear encryption, which can be calculated by Retroactively track specific users.

6. The multi-subject data element hierarchical control method based on blockchain according to claim 1 is characterized in that: The access control of authenticated data is based on the authentication / access module, which is responsible for verifying the identity and permissions of the subject, ensuring that only legitimate subjects with corresponding permissions can access specific data assets. Based on the BBS04 short signature scheme and combined with the cluster hierarchical authorization mechanism, the following four basic operations are performed: Identity authentication: When a subject initiates a data access request, it first needs to pass the identity authentication link; the subject uses its private key to generate a signature, and attaches the level information, and submits it to the authentication module; the authentication module uses the cluster public key and related parameters to verify the legitimacy of the signature. If the signature is valid, it indicates that the subject's identity is legal and has the corresponding authority level, thus allowing it to enter the subsequent access control process; authority verification: After the identity authentication is passed, the authentication module verifies the subject's authority, and judges whether the subject has the authority to access the requested data asset based on the level information embedded in the subject's signature and the cluster level hierarchy tree diagram; if the subject's authority is If the limit level meets the access requirements of the data asset, it is allowed to access the data, otherwise the access request is rejected; access record, for each data access request, the authentication / access module will record detailed access information, including the identity of the access subject, access time, accessed data asset type and permission level; the record is stored on the blockchain; after completing identity authentication and permission verification, the authentication / access module makes an access control decision based on the verification results. If the subject is legal and has the corresponding authority, it is allowed to access the data and provide it with the corresponding data assets. If the verification fails, the access request is rejected and the reason for the rejection is fed back to the subject.

7. The multi-subject data element hierarchical control method based on blockchain according to claim 1 is characterized in that: The asset access control mechanism for nested subject data is implemented based on cluster supervision, and its functions include: cluster grading and authorization. The cluster supervision module is responsible for cluster grading of nested subject data assets and assigning corresponding permissions to different clusters and their members based on the grading results. According to the proportion of overlapping parts of personal data assets, scattered individuals are divided into multiple clusters, and a unique cluster level identifier is set for each cluster. The cluster supervision module also assigns personal permission levels to cluster members and ensures that the privacy rights of each cluster member are equally protected; permission management and adjustment. The cluster supervision module monitors the permission usage of cluster members in real time and dynamically adjusts cluster levels and member permissions based on the dynamic changes of data assets and business needs. When there are major changes in data assets within a cluster or changes in the enterprise business model, the cluster supervision module promptly updates the cluster level and member permissions to ensure the adaptability and effectiveness of the access control policy; abnormal behavior detection and early warning. The cluster supervision module monitors the access behavior of the subject in real time, analyzes its access pattern and frequency and other indicators, and immediately issues an early warning when abnormal behavior is detected and takes corresponding measures.

8. The multi-subject data element hierarchical control method based on blockchain according to claim 5 is characterized in that: In the asset access control mechanism of nested subject data, smart contracts ensure the compliance and transparency of the data access process by automatically executing preset rules and conditions, and work together as follows: rule setting and execution, the smart contract sets a series of data access control rules based on the enterprise data management and privacy protection policies. When the subject initiates a data access request, the smart contract automatically checks whether the request complies with the preset rules. If it does, access is allowed; if it does not, access is denied or the corresponding approval process is initiated; permission verification and authorization, in the permission verification link, the smart contract automatically verifies whether its permissions meet the access requirements of the data assets based on the subject's signature and cluster level information If the verification is successful, the smart contract will automatically authorize the subject to access the data and record the authorization information. If the verification fails, the authorization will be rejected and the reason for the rejection will be recorded. In terms of data interaction and sharing, in the process of interaction and sharing of data assets of nested subjects within the enterprise, the smart contract can automatically perform compliance checks on data transmission and sharing. In terms of auditing and supervision, the smart contract can record detailed information on each data access and interaction, including the identity of the access subject, access time, access data asset type, and data operation type. According to the preset audit rules, the smart contract will automatically audit data access on a regular basis to discover potential security issues and violations, and promptly notify relevant personnel for processing.

9. A multi-subject data element hierarchical control system based on blockchain, characterized in that: include: A data access module, configured to obtain nested subject data, divide overlapping intervals of the nested subject data into privacy levels, and authorize access using clustered signatures, wherein the nested subject data includes personal data and enterprise data; The hierarchical control module is used to perform cluster allocation, cluster encryption and authentication on the privacy level of data assets of nested subject data based on BBS04 short group signature technology, obtain authenticated data, perform access control on the authenticated data, and obtain control results.

10. A terminal device comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that: The memory stores a computer program that can be run on a processor. When the processor loads and executes the computer program, it adopts a blockchain-based multi-subject data element hierarchical control method as described in any one of claims 1 to 8.

Images