Energy big data right confirmation method, system and device based on hierarchical hash tree and dynamic authorization and storage medium

Abstract

The invention discloses an energy big data right confirmation method and system based on a hierarchical hash tree and dynamic authorization, and belongs to the field of energy big data management and information security, and the method comprises the steps: obtaining and standardizing original data in an energy scene, and dividing the original data into a data block set according to equipment and time; constructing a hierarchical hash tree and generating root hash; writing the root hash and the associated metadata into the block chain to realize right confirmation and evidence storage; executing proxy re-encryption according to the access token, and converting the ciphertext into a decryptable format; verifying the data consistency through the Hash path and the root Hash, and completing the access; and recording the access behavior and distributing transaction earnings by the smart contract based on the contribution degree. Hash calculation and local path updating of a data block level are supported through a layered Hash tree structure, so that when large-scale energy data is frequently updated, a new root Hash value can be quickly generated and right confirmation updating can be completed only by carrying out local Hash recalculation on a changed path.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of energy big data management and information security, and particularly relates to an energy big data right confirmation method, system and device based on a hierarchical hash tree and dynamic authorization, and a storage medium. BACKGROUND

[0002] With the deepening of the digital transformation of the energy industry, energy big data has become a core element driving industrial upgrading and national energy security. It is necessary to establish a data property registration system and promote the market allocation of data elements. In the field of energy data right confirmation, although the existing technology has made certain progress in data ownership verification and permission control, there are still significant defects, which are embodied in the following aspects:

[0003] (1) Vulnerability and applicability limitations of data watermarking technology.

[0004] The right confirmation technology based on digital watermarking declares ownership by embedding invisible identifiers in data, but its core defect is the lack of anti-interference ability. Energy data often needs to be frequently converted in format (such as CSV to Parquet), adjusted in precision (such as rounding), or modified locally (such as sensor calibration), which can easily lead to loss or damage of watermark information.

[0005] (2) Excessive sensitivity and efficiency bottleneck of blockchain hash storage technology.

[0006] The existing blockchain solution realizes right confirmation by storing data hash values, but its excessive sensitivity to small changes in data seriously restricts its practicality. For example, a power selling platform needs to recalculate and store the hash values of 100,000 records due to the correction of data field order (such as changing "time-power" to "power-time"), and the on-chain cost increases by 200%. At the same time, the efficiency of full hash verification is low, and it takes more than 40 hours to verify PB-level monthly data in a provincial power grid, which cannot meet the real-time demand. In addition, the hash value of specific structured data may also have the risk of privacy leakage.

[0007] (3) Delay and single point failure risk of centralized authentication mechanism.

[0008] The multi-party authentication mechanism relying on centralized CA institutions has complexity and systematic risk. The steps of generating one-time CA certificates, quantum signatures, etc. take an average of 8-12 hours, which cannot meet the real-time transaction demand of energy data. For example, a regional energy trading platform was interrupted for 6 hours due to the downtime of the CA server, resulting in direct economic losses of more than 10 million yuan.

[0009] (4) Rigidity and security contradiction of static permission control model.

[0010] Traditional permission management technologies (such as the RBAC model) adopt fixed strategies and are difficult to adapt to dynamic scene requirements. For example, temporary authorization of power grid companies to access data in a specific period requires manual approval, with an average delay of 48 hours, missing the peak shaving opportunity. Full data encryption can protect privacy, but it leads to data rigidity. In addition, static permission allocation cannot respond to real-time risks, such as abnormal login behavior (such as access from a remote IP), which fails to trigger permission downgrade, exacerbating the risk of data leakage.

[0011] (5) The black box of the revenue distribution mechanism and the lack of quantification.

[0012] Existing revenue distribution models lack the ability to quantify the contribution at a fine granularity, leading to unfair distribution of benefits and imbalance of incentives. At the same time, the lack of transparent record of data use makes it difficult for an industrial park to prove that its electricity consumption data was used in a carbon trading model, resulting in a potential loss of over one million yuan. Experiments show that the static model has a revenue distribution deviation rate of 42% when the electricity price fluctuates between peak and valley, making it difficult to adapt to dynamic market environments.

[0013] In summary, existing technologies generally have three major contradictions: static architecture and dynamic demand, security control and business efficiency, and property traceability and privacy protection. For example, the blockchain hash record technology has high maintenance costs due to excessive sensitivity, the centralized authentication mechanism hinders real-time collaboration due to process delays, and the static permission model exacerbates security risks due to rigid strategies. These problems restrict the trusted circulation and value release of energy big data, and urgent technical breakthroughs are needed through dynamic layered verification, intelligent strategy engines, and decentralized governance to build a new generation of rights confirmation system that balances security, flexibility, and economy. SUMMARY

[0014] To solve the above technical problems, an energy big data rights confirmation method based on layered hash tree and dynamic authorization is proposed, which includes obtaining raw data in an energy scene and performing standardization processing to form a data block set divided by equipment and time;

[0015] A layered hash tree structure is constructed based on the data block set, and a multi-level hash path is calculated to generate a root hash;

[0016] The root hash value is written into the blockchain as a rights confirmation root hash value for rights confirmation record, and the associated metadata is also written;

[0017] Based on the access subject, requested resource, and environmental context information, an access control policy is generated through a dynamic permission strategy engine, and an access token with access scope and effective time limit is generated;

[0018] According to the access token, proxy re-encryption operation is performed to convert the encrypted data corresponding to the access request into a format that can be decrypted by the visitor;

[0019] The hash path based on the data block is consistent with the root hash to perform consistency verification, and data decryption access is completed after verification;

[0020] The access behavior is recorded and the contribution value of data use is calculated, and the smart contract automatically allocates transaction income according to the contribution value proportion.

[0021] As a preferred scheme of the energy big data right protection method based on the hierarchical hash tree and dynamic authorization, wherein: the data block set is divided according to the preset device identifier and time window;

[0022] The hierarchical hash tree structure includes calculating the hash value of each data block in the data block set as a leaf node, and splicing the hash values of adjacent nodes in the same level in sequence and then hashing to generate an upper intermediate node,

[0023] Repeat until the root hash is constructed, indicating the integrity state of the data set;

[0024] When a data block in the data block set is updated, only the hash value of the hash path corresponding to the current data block is recalculated from bottom to top, including updating the leaf node hash value, and sequentially updating the intermediate node hash value of the branch, and finally regenerating the root hash.

[0025] As a preferred scheme of the energy big data right protection method based on the hierarchical hash tree and dynamic authorization, wherein: the associated metadata includes the collection time stamp, device identifier and data classification label corresponding to the data block set;

[0026] Writing the root hash value into the blockchain as the right protection root hash value for right protection and evidence storage is writing the root hash value generated by constructing the hierarchical hash tree into the blockchain as the right protection root hash value for consistency verification, and writing the associated metadata as an additional field into the blockchain. The classification retrieval and traceability tracking of the right protection record.

[0027] As a preferred scheme of the energy big data right protection method based on the hierarchical hash tree and dynamic authorization, wherein: the access control policy generated by the dynamic permission strategy engine includes,

[0028] Combining the user identity in the access request, the target data resource identifier and the current environment context parameter into an attribute set,

[0029] Based on the pre-defined role template and attribute condition combination rule, the attribute set is matched, when the matching result satisfies the authorization condition, an access control policy containing the accessible data block identifier set and the access valid time length is generated, and an access token bound to the visitor identity is generated based on the strategy;

[0030] The token is used to authorize access to the corresponding data block stored in an encrypted manner;

[0031] The rule includes joint judgment logic for user role, resource sensitivity, access time and access device state;

[0032] The attribute set includes the role identification of the visitor, the operation behavior, the resource sensitivity level, the access time and the geographic location information.

[0033] As a preferred scheme of the energy big data right protection method based on hierarchical hash tree and dynamic authorization, wherein: the proxy re-encryption operation according to the access token includes,

[0034] The proxy re-encryption key corresponding to the identity of the visitor is generated by the data owner;

[0035] After the proxy server receives the authorization token, the original ciphertext of the target data block is encrypted and converted by using the re-encryption key, so that the visitor can decrypt the current converted ciphertext using his own private key without knowing the original private key;

[0036] The proxy re-encryption key is calculated by hashing the public key of the visitor and the private key of the data owner;

[0037] The proxy server does not retain any intermediate plaintext or re-encryption key copy after completing the conversion operation, minimizing the risk of key leakage.

[0038] As a preferred scheme of the energy big data right protection method based on hierarchical hash tree and dynamic authorization, wherein: the consistency verification based on the hash path and the root hash of the data block includes,

[0039] After the access control policy is authorized, the visitor requests the corresponding data block and hash path information according to the obtained access token,

[0040] The current data block is hashed, and the intermediate node hash value is generated in sequence combined with the hash path information, and finally the verification root hash value is generated and compared with the right protection root hash value written in the blockchain;

[0041] When the comparison result is consistent, the key management mechanism is called to allow the visitor to perform the decryption operation on the target data block;

[0042] The hash path information includes all sibling node hash values of the target data block in the hierarchical hash tree structure, arranged in the order from the leaf node to the root node.

[0043] As a preferred scheme of the energy big data right confirmation method based on the hierarchical hash tree and dynamic authorization, wherein the access behavior is recorded and the data use contribution value is calculated, and the smart contract automatically allocates transaction income according to the contribution value proportion, including,

[0044] The access subject identifier, access timestamp and access range contained in the access token are recorded to the access log.

[0045] Based on the access log, the number of data entries accessed by each data holder, the data access frequency and the data response timeliness are counted, and the data use contribution value corresponding to the access party is calculated.

[0046] The smart contract automatically performs the proportion division and transfer operation of the transaction income according to the contribution value proportion of each data holder.

[0047] Another object of the present application is to provide an energy big data right confirmation system based on hierarchical hash tree and dynamic authorization, which solves the problems of lack of unified right confirmation mechanism, coarse data access control granularity, insufficient privacy protection and lack of income distribution mechanism in existing energy data management. The system realizes the construction of hierarchical hash tree to complete the data integrity right confirmation, realizes the fine-grained authorization access by combining with the dynamic permission strategy, and realizes the trusted sharing and income incentive of controllable and auditable data by integrating the proxy re-encryption and smart contract technology, which provides technical support for the trusted right confirmation, privacy protection and collaborative use of multi-party energy data.

[0048] As a preferred scheme of the energy big data right confirmation system based on the hierarchical hash tree and dynamic authorization, characterized in that it comprises a data processing and right confirmation module, a permission control and encryption module, a data verification and access module, and an access record and incentive settlement module.

[0049] The data processing and right confirmation module is to obtain the original data in the energy scene and perform standardization processing, divide the data into data block sets according to equipment and time, construct a hierarchical hash tree structure based on the data block set and generate a root hash value, write the root hash value as a right confirmation root hash value into a blockchain for right confirmation and storage, and write the associated metadata including the collection timestamp, device identifier and data classification label as an additional field, support classification retrieval and traceability tracking of the right confirmation record.

[0050] The permission control and encryption module is to generate an attribute set based on the access subject identity, request resource identifier and environmental context information, generate an access control policy by calling a dynamic permission strategy engine, and generate an access token based on the policy; after receiving the access token, the access request corresponding to the encrypted data is converted into a format that can be decrypted by the visitor through the proxy re-encryption mechanism, so that the data can be safely accessed under the authorization condition.

[0051] The data verification and access module requests a data block and its hash path according to an access token, performs a data block hash and path reconstruction operation, generates a verification root hash value, and compares the verification root hash value with a root hash value that has been verified in the blockchain, when the two are consistent, a key management mechanism is called to allow the visitor to decrypt the target data block and complete data access;

[0052] The access record and incentive settlement module records access behavior related information, including visitor identification, timestamp and access range, calculates the contribution value of the data holder based on the access log, and automatically executes the distribution operation of the transaction income according to the contribution value proportion of each holder by the smart contract, to realize the closed loop mechanism of data sharing incentive.

[0053] A computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the steps of the energy big data right method based on the hierarchical hash tree and dynamic authorization when executing the computer program.

[0054] A computer readable storage medium has a computer program stored thereon, and the computer program implements the steps of the energy big data right method based on the hierarchical hash tree and dynamic authorization when executed by a processor.

[0055] The beneficial effects of the present application: the hierarchical hash tree structure constructed by the present application supports hash calculation and local path update at the data block level, so that when facing frequent updates of large-scale energy data, only the local hash recalculation of the changed path is required, a new root hash value can be quickly generated and right update is completed, and the flexibility and calculation efficiency of the right structure are improved. The dynamic permission policy engine matches the access attributes, resource sensitivity and environmental context for authorization, and combines the proxy re-encryption mechanism to realize fine-grained controllable and decryptable data sharing, to ensure privacy security and access compliance in the access process. BRIEF DESCRIPTION OF DRAWINGS

[0056] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0057] Figure 1 The overall flowchart of a kind of energy big data right method based on hierarchical hash tree and dynamic authorization provided by an embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to make the above objectives, characteristics and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the protection scope of the present application.

[0059] Embodiment 1, reference Figure 1 For the first embodiment of the present application, the embodiment provides an energy big data right method based on hierarchical hash tree and dynamic authorization, comprising:

[0060] S1, obtaining original data under the energy scene and performing standardization processing to form a data block set divided by equipment and time.

[0061] The data block set is to divide the original data according to the preset equipment identifier and time window.

[0062] 1) Energy data access: real-time data stream of sensors, smart meters, wind power / photovoltaic equipment, etc.

[0063] 2) Energy data processing: mark data source according to region, equipment, time window (every hour).

[0064] 3) Data anomaly filtering: eliminate sensor error data (such as negative power generation).

[0065] 4) Data standardization: unify data format.

[0066] 5) Data encryption: encrypt the original data using the public key of the data owner (energy company A).

[0067] 6) Data block: block according to equipment type and time window, stored in Parquet format.

[0068] S2, constructing a hierarchical hash tree structure based on the data block set, calculating a multi-level hash path and generating a root hash. Calculate the hash value of each data block in the data block set as a leaf node, and concatenate the hash values of adjacent nodes in the same level in order and then hash to generate an intermediate node in the upper layer,

[0069] Repeat until the root hash is constructed, indicating the integrity status of the data set;

[0070] When a data block in the data block set is updated, only the hash value of the hash path corresponding to the current data block is recalculated from bottom to top, including updating the leaf node hash value, and sequentially updating the intermediate node hash value of the branch, and finally regenerating the root hash.

[0071] The construction of the hierarchical hash tree structure is as follows in the preferred embodiment of the present application:

[0072] The data of the data owner (energy company A) can be divided into multiple levels according to business requirements. Level 1 (device level): real-time data (per second / minute level) of a single device (such as smart meter 001); level 2 (region level): aggregated data (per hour) of all devices in the same region; level 3 (network level): daily / monthly summary data of all regions.

[0073] 1) Leaf node hash:

[0074] Calculate the hash value H leaf of each data block: i

[0075] Example: The hash value of the hourly power generation data block Data_i of smart meter 001 is 0x89a3df...

[0076] 2) Intermediate node hash:

[0077] Calculate the parent hash by concatenating the child node hashes in order:

[0078] H parent = SHA-256(H child1 || H child2 ||... || H childN )

[0079] Example: The hash of all devices in the same region is aggregated every hour to form the region-level hash.

[0080] 3) Root hash generation:

[0081] The final root hash represents the state of the complete data set:

[0082] H root = SHA-256(H region1 || H region2 ||... || H regionN )

[0083] When a data block (such as 2-hour data of smart meter 001) is modified, the block leaf hash H hour2_new is recalculated, and then the parent node hash is updated layer by layer (daily level → regional level → root hash). Therefore, only the affected branch needs to be updated, rather than the entire tree reconstruction.

[0084] Let the original branch path be Path = [H hour2 , H day_001 , H region1 , H root ],

[0085] ​The updated path is: Path new = [H hour2_new , H' day_001 , H' region1 , H' root ]

[0086] Wherein: H' day_001 = SHA-256(H hour1 || H hour2_new )

[0087] In an optional embodiment of the present application, the hierarchical hash tree structure is constructed as follows: the linear hash list scheme discards the hierarchical tree structure and uses a simple linear list to store the hash values of all data blocks (such as the Merkle linear list). Each time the data is updated, the hash of the full amount of data needs to be recalculated and the list needs to be reconstructed, and there is no hierarchical aggregation mechanism.

[0088] Specific operation process:

[0089] (1) Data block: cut the original data into fixed-size data blocks (such as 1MB / block), without distinguishing levels (device level, regional level, etc.).

[0090] (2) Hash calculation: calculate the hash value (such as SHA-256) of each data block and store it in a linear list (such as an array) in order.

[0091] (3) Storage and verification: store the full amount of hash list and metadata on the chain, and the storage cost increases linearly with the amount of data. Data verification needs to traverse all hash values in the list and compare block by block.

[0092] The optional embodiment is the same as the preferred embodiment and the present application, and the energy data needs to be encrypted and blocked (but not hierarchical), and stored in IPFS. The access permission needs to be assigned based on the data block ID in the linear list (such as "allow access to data blocks 100-200"). However, due to the lack of hierarchical structure, it is not possible to realize the rapid configuration of aggregated permissions at the regional level and the network level. The zero-knowledge proof module needs to generate a proof for the full amount of hash list when proving the data integrity, which has high computational complexity (such as verifying 1PB data needs to generate a proof containing millions of hashes), and the time consumption increases significantly. And the data usage record is counted by linear block ID, but cannot be associated with the aggregated levels such as device level, regional level, etc., resulting in coarse granularity of contribution calculation.

[0093] However, the optional embodiment has high storage cost, the full amount of hash list is chained, the storage amount increases linearly with the data amount, and the storage cost of 1TB data chain increases sharply (such as 120GB or more). The update efficiency is low, the full amount of hash needs to be calculated for local data modification, and the time consumption of 10TB data update is up to 20 hours, which cannot meet the demand of high-frequency dynamic update. The verification efficiency is poor, and the verification needs to traverse the full amount of hash, and the time consumption of 1PB data verification is more than 40 hours, which cannot meet the real-time demand. The permission granularity is coarse, only data block level permission is supported, and regional level / aggregated network level aggregated permission cannot be quickly configured, and the cross-level authorization efficiency is low. The synergy is insufficient, when the dynamic authorization, zero-knowledge proof and other modules are linked, the full amount of hash list needs to be operated, the strategy execution delay is high, and the proof volume is large. The contribution degree is distorted, the data level value (such as device level / region level) cannot be distinguished, the contribution degree calculation granularity is coarse, and the allocation deviation rate is more than 40%.

[0094] The preferred embodiment can match the business logic of energy data "collection-aggregation-analysis" through three-level layering of device level, region level and network level, support dynamic adjustment of verification granularity (such as verifying device level data in real-time transaction scenario first, and verifying network level root hash in statistical scenario), local update and layered verification mechanism, and completely solve the efficiency bottleneck of traditional hash storage "pulling a hair and moving the whole body", and meet the demand of high-frequency update (such as second-level sensor data) and real-time transaction of energy data.

[0095] The root hash and branch hash of the layered hash tree can be directly used as the permission control object (such as the root hash representing global permission and the branch hash representing regional permission), and the strategy engine does not need to parse the underlying data block, so that the permission configuration efficiency is improved by more than 10 times.

[0096] Zero-knowledge proof, the layered structure supports "on-demand proof" (such as proving only the compliance of data in a certain region), avoids full amount of data exposure, and achieves privacy protection and verification efficiency.

[0097] The hierarchical information can be directly used as one of the dimensions of data value (V) calculation (such as the rarity coefficient of regional level data is higher than that of single device data), so that the contribution quantification is more accurate.

[0098] In summary, the linear hash list scheme is not feasible in the energy big data right protection scene due to the defects of full amount of storage, low efficiency verification, coarse granularity permission control and the like.

[0099] The layered hash tree scheme of the application solves the inherent defects of traditional hash storage through hierarchical aggregation, dynamic block, and on-chain and off-chain cooperation, forms technical synergy with dynamic authorization, zero-knowledge proof and other modules, and builds an efficient, flexible and safe new generation right protection system, which is an optimal scheme that can meet the energy data element marketization demand.

[0100] S3, write the root hash value into the blockchain as the right root hash value for right storage, and write the associated metadata at the same time.

[0101] Write the root hash value into the blockchain as the right root hash value for right storage is to write the root hash value generated by constructing a hierarchical hash tree into the blockchain as a consistent verification right root hash value, and write the associated metadata as an additional field into the blockchain, for classified retrieval and traceability of right records.

[0102] 1) On-chain storage: write the root hash H root , timestamp, device ID, and owner DID into the chain.

[0103] 2) Off-chain storage: store the original encrypted data and hierarchical hash intermediate nodes in IPFS, and return the storage address IPFS_Addr.

[0104] S4, based on the access subject, requested resource and environmental context information, generate an access control policy through a dynamic permission policy engine, and generate an access token with access scope and effective time limit.

[0105] Combine the user identity in the access request, the target data resource identifier and the current environmental context parameters into an attribute set,

[0106] Based on the pre-defined role template and attribute condition combination rule, the attribute set is matched, when the matching result meets the authorization condition, an access control policy containing the accessible data block identifier set and the access effective time is generated, and an access token binding the access user identity is generated based on the policy;

[0107] The token is used to authorize access to the corresponding data block stored in encrypted form;

[0108] The rule includes a joint judgment logic for user role, resource sensitivity, access time and access device state;

[0109] The attribute set includes the role identifier of the access user, the operation behavior, the resource sensitivity level, the access time and the geographic location information.

[0110] The dynamic permission policy engine in the preferred embodiment of the application is: a hybrid policy model of ABAC (attribute-based access control) + RBAC (role-based access control) is used to combine the role template with dynamic attributes, reduce the complexity of policy configuration, generate permission rules in real time, and compile the policy code into a chain contract, which is automatically executed when the trigger condition is met.

[0111] Policy definition and modeling:

[0112] a) Policy element extraction.

[0113] According to business needs, compliance requirements, risk model extraction subjects (user roles, device types, organization identities, etc.), resources (data types, sensitivity levels, geographic tags, etc.), actions (operation types, execution environments, etc.), and environments (time windows, device security states, network risk scores, etc.).

[0114] b) Set the syntax of the policy rule: use the XACML3.0 extended syntax to support logical operations and custom functions.

[0115] c) Set the policy priority and conflict resolution

[0116] 2) Policy storage and index optimization: build a policy library, use a graph database to store policy relationships, establish B+ tree indexes for high-frequency attributes to reduce query delays, and shard policies.

[0117] The dynamic permission policy engine in the optional embodiment of the present application is a static permission approval scheme.

[0118] Using the traditional RBAC (Role-Based Access Control) model, the permission policy is fixed as a "role-permission" mapping, and all permission changes need to go through a manual approval process, without real-time risk assessment or dynamic adjustment mechanism. The technical process is as follows:

[0119] (1) Predefined roles: create fixed roles such as "data owner", "data user", "auditor", etc., and each role is bound to a static permission set (e.g. "data users can only read public data").

[0120] (2) Permission application: users need to submit permission change requests (e.g. "apply for access to real-time data in a certain area") through email / work order systems.

[0121] (3) Manual approval: administrators manually review the request, modify the role permissions if it meets the conditions (e.g. add the user to the "temporary access group"), and the average approval period is 48 hours.

[0122] (4) Permission verification: check the user role through hard-coded rules, without real-time risk interception (e.g. still allow login when accessing from a remote IP).

[0123] Optional embodiment permission verification needs to check whether the user role matches the data block permission one by one (e.g. "region-level data only allows 'power dispatchers' role to access"), but without a dynamic policy engine, it cannot quickly associate the region-level / device-level permissions in the hierarchical structure, and needs to manually maintain the "role-data block" mapping table, with high configuration complexity. Users need to prove their permissions through traditional CA certificates (e.g. submit role credentials), and cannot use zk-SNARKs to dynamically prove "temporary access permissions", resulting in the need to frequently exchange physical certificates when collaborating across agencies, increasing the process time by more than 50%.

[0124] Static permissions cannot trigger dynamic key generation (such as temporary authorization needs to manually generate fixed valid period keys, cannot be automatically revoked according to real-time risk), there is a risk of key leakage (such as the old key is not recycled in time after the permission is changed). The permission use record only records "role-operation", and cannot associate user behavior details (such as access frequency, abnormality), which leads to the fact that the contribution calculation ignores real-time risk factors (such as high-frequency abnormal access is still calculated as ordinary permission income).

[0125] Optional embodiment permission change needs manual processing, the average cycle is 48 hours, which cannot respond to real-time needs. There is no real-time risk assessment, and the abnormal operation interception rate is low (only 65%), which cannot dynamically adjust the permission. Only role-level permissions are supported, and field-level and time window-level fine control cannot be achieved. Manual configuration of role permissions is required, which is high in coordination cost and easy to cause permission conflicts. It cannot be associated with a hierarchical hash tree structure, and permission configuration needs to be operated on each data block, which is inefficient. The permission record is scattered, and manual tracing is time-consuming, which cannot meet the real-time audit requirements on the chain.

[0126] The preferred embodiment calculates the permission in real time through multi-dimensional attributes (user behavior, environmental parameters, data sensitivity), eliminates the delay of manual approval, meets the real-time transaction needs of energy data (such as responding to peak shaving instructions permission in seconds), and combines the ABAC model to refine the permission from "role level" to "field level" and "time level", accurately matching the business scenario. The built-in machine learning model analyzes the user behavior baseline and dynamically adjusts the permission (such as when abnormal login of an account is detected, the permission is automatically downgraded from "read and write" to "read only"), and actively blocks 98.5% of abnormal operations.

[0127] Further to be explained is:

[0128] The dynamic permission of the application directly operates the hash node of the hierarchical structure, realizes the efficient mapping of "root hash authorization = global permission, branch hash authorization = regional permission", and reduces the workload of 90% of the permission configuration.

[0129] Support users to prove "have certain level of data access permission" (such as "have regional level data decryption private key") through zk-SNARKs, without exposing the actual permission details, and improve the privacy security of cross-agency cooperation. Dynamically generate temporary keys bound to the permission (such as "read-only permission corresponds to read-only key"), and automatically revoke the key when the permission expires or the risk triggers, avoiding the "permission retention" risk of traditional static keys.

[0130] The core problem of the static permission approval scheme is that the static architecture is disconnected with dynamic demand, which cannot cope with high-frequency permission changes (such as temporary peak regulation and cross-regional transaction), real-time security threats (such as network attacks) and refined business requirements (such as field-level data sharing). The defects of artificial dependence, coarse-grained control and lagging risk response of the static permission approval scheme lead to low system efficiency and frequent security vulnerabilities, which cannot support the credible circulation of energy data elements. The dynamic permission strategy engine of the application solves the inherent shortcomings of the traditional permission model through the complete link design of “multi-dimensional real-time evaluation + intelligent strategy generation + automated execution”, and becomes the core hub of “security and efficiency balance” in the energy big data right confirmation system.

[0131] S5, proxy re-encryption operation is performed according to the access token, and the encrypted data corresponding to the access request is converted into a format that can be decrypted by the visitor.

[0132] The proxy re-encryption key corresponding to the identity of the visitor is generated by the data owner;

[0133] After the proxy server receives the authorization token, the original ciphertext of the target data block is encrypted and converted using the re-encryption key, so that the visitor can decrypt the current converted ciphertext using his own private key without knowing the original private key;

[0134] The proxy re-encryption key is obtained by hashing the public key of the visitor and calculating it with the private key of the data owner;

[0135] The proxy server does not retain any intermediate plaintext or re-encryption key copy after completing the conversion operation, minimizing the risk of key leakage.

[0136] 1) Key management

[0137] User key pair: the data owner generates a public-private key pair (pk A ,sk A ), and the authorized user generates a public-private key pair (pk B ,sk B ).

[0138] Re-encryption key generation: the data owner generates a proxy re-encryption key rk A→B , which is based on a bilinear pair: where H is a hash function and p is a prime number.

[0139] 2) Data encryption: the data owner encrypts the data m using the public key pk A : C A = (g r ,m·e(g,pk A ) r ), where r is a random number and e is a bilinear pair operation.

[0140] 3) Proxy Re-encryption: Proxy server uses rk A→B Convert ciphertext: C B = (g r ,m·e(g,pk A ) r )·e(g r ,rk A→B ), after simplification, the authorized user can decrypt the ciphertext: C B = (g r ,m·e(g,pk B ) r )

[0141] 4) Data decryption: authorized user uses private key decryption sk B Decryption C B :

[0142]

[0143] S6 performs consistency verification based on the hash path of the data block and the root hash, and completes data decryption access after verification.

[0144] After authorization of the access control policy, the visitor requests the corresponding data block and hash path information according to the obtained access token,

[0145] Hash calculation is performed on the current data block, and intermediate node hash values are generated in sequence combined with the hash path information, and finally a verification root hash value is generated and compared with the authentication root hash value written in the blockchain;

[0146] When the comparison result is consistent, the key management mechanism is called to allow the visitor to perform decryption operation on the target data block;

[0147] The hash path information includes all sibling node hash values of the target data block in the hierarchical hash tree structure, arranged in the order from leaf node to root node.

[0148] Download the target data block and its hash path from IPFS

[0149] Recalculate the hash H' block = BLAKE3(data block)

[0150] Reconstruct the root hash: calculate layer by layer using the hash path to generate a new root hash

[0151] H' root = BLAKE3(BLAKE3(...BLAKE3(H' block ,H sibling )...))

[0152] On-chain comparison: query the original root hash H stored in the smart contract root If H' root = H root , it means that the data is complete, otherwise the data is tampered.

[0153] Data ownership verification is successful, data integrity verification is successful, check the context attribute, calculate the dynamic risk score R.

[0154] If the conditions are met, generate a temporary decryption token.

[0155] The proxy server uses rk_userA→grid to convert the ciphertext.

[0156] The data acquirer (power grid company B) uses its own private key to decrypt and successfully acquires the data.

[0157] S7, record the access behavior and calculate the contribution value of data use, and the smart contract automatically allocates transaction income according to the contribution value proportion.

[0158] The access subject identifier, access timestamp and access range contained in the access token are recorded to the access log;

[0159] Based on the access log, the number of data entries accessed by each data holder, data access frequency and data response timeliness are calculated to calculate the data use contribution value of the access party;

[0160] The smart contract automatically performs proportional division and transfer operation of transaction income according to the contribution value proportion of each data holder.

[0161] Contribution value is calculated by weighting from three dimensions of data value, processing cost and use frequency, covering the whole life cycle of data generation, processing and use.

[0162] 1) Data value (V): Data value refers to the direct economic or strategic value of data to business objectives. The calculation method is:

[0163] V = α·R 实时性 + β·S 稀缺性 + γ·Q 质量

[0164] Where R is the real-time coefficient, the higher the data update frequency, the higher the value, for example:

[0165] (△t is the data update time interval, unit: second).

[0166] S is the scarcity coefficient, which is the uniqueness evaluation of data source.

[0167] Q is the quality score, calculated based on data integrity (proportion of missing values) and accuracy (error rate compared to benchmark data):

[0168] Q = 0.6 · integrity + 0.4 · (1 - error rate)

[0169] 2) Processing cost (C): Processing cost refers to the resource consumption of data cleaning, labeling, encryption, etc. The calculation method is:

[0170]

[0171] where C 基准 is the platform standard processing cost for normalization.

[0172] 3) Frequency of use (F):

[0173] Frequency of use refers to the number of times and the length of time the data is called. The calculation method is:

[0174]

[0175] 4) Contribution value (CS) is the weighted sum of the above dimensions:

[0176] CS = w v · V + w c · C + w F · F

[0177] where the weights w v , w c , w F are dynamically adjusted through on-chain governance, with initial values set as: w v = 0.6, w c = 0.3, w F = 0.1.

[0178] 5) The revenue is allocated to each participant in proportion to the contribution value and automatically executed through a smart contract. Let the total revenue of a certain data transaction be R total , and the set of participant contribution values be {CS1, CS2, …, CS n}, then the i-th participant's revenue is:

[0179]

[0180] Embodiment 2, which is different from the previous embodiment, is a second embodiment of the present application:

[0181] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the part of the technical solutions that essentially contribute to the prior art or the part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0182] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered a list of executable instructions for implementing logic functions, and can be specifically embodied in any computer-readable medium for use by an instruction execution system, apparatus, or device, such as a computer-based system, a system including a processor, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions, or in conjunction with these instructions execution systems, apparatuses, or devices. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport programs for use by an instruction execution system, apparatus, or device, or in conjunction with these instruction execution systems, apparatuses, or devices.

[0183] More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection having one or more wires (electrical devices), a portable computer diskette (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium can even be paper or other suitable medium on which the program can be printed, as the program can be electronically obtained, for example, by optical scanning of the paper or other medium, followed by editing, interpreting, or otherwise processing, if necessary, in other suitable ways to be electronically obtained, and then stored in the computer memory.

[0184] It should be understood that portions of the application can be implemented in hardware, software, firmware, or combinations thereof. In the embodiments described above, the various steps or methods can be implemented, in part, or in whole, by software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, and in another embodiment, the hardware can include any or a combination of the following: discrete logic circuits having logic gates for implementing logic functions upon an application of the data signals; application specific integrated circuits having logic gates, application specific integrated circuits having logic gates; field programmable gate arrays (FPGA), programmable logic arrays (PLA), and the like.

[0185] Embodiment 3 is a third embodiment of the present application, which provides an energy big data right system based on hierarchical hash tree and dynamic authorization, including a data processing and right module, an authority control and encryption module, a data verification and access module, and an access record and incentive settlement module;

[0186] The data processing and right module is to obtain original data in an energy scene and perform standardization processing, divide the data into a data block set according to equipment and time, construct a hierarchical hash tree structure based on the data block set and generate a root hash value, write the root hash value as a right root hash value into a blockchain for right storage, and write associated metadata including a collection timestamp, a device identifier, and a data classification label as an additional field, supporting classified retrieval and traceability tracking of the right record;

[0187] The authority control and encryption module is to generate an attribute set based on an access subject identity, a requested resource identifier, and environmental context information, generate an access control policy by calling a dynamic authority policy engine, and generate an access token based on the policy; after receiving the access token, the module converts the encrypted data corresponding to the access request into a format that can be decrypted by the access, so that the data is securely accessed under the authorization condition;

[0188] The data verification and access module is to request a data block and its hash path according to an access token, perform data block hashing and path reconstruction operations, generate a verification root hash value, and compare it with the right root hash value in the blockchain; when the two are consistent, the module calls a key management mechanism to allow the access to decrypt the target data block and complete the data access;

[0189] The access record and incentive settlement module is to record access behavior related information, including an access identifier, a timestamp, and an access range; based on the access log, the module calculates the contribution value of a data holder, and automatically executes a transaction income distribution operation according to the contribution value proportion of each holder by a smart contract, realizing a closed loop mechanism of data sharing incentive.

[0190] It should be noted that the above examples are only used to illustrate the technical solutions of the present application but not to limit the present application. Although the present application is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or equivalently replaced, without departing from the spirit and scope of the technical solutions of the present application, and all of them should be covered in the scope of the claims of the present application.

Claims

1. A method for determining the ownership of energy big data based on hierarchical hash trees and dynamic authorization, characterized in that: include, Acquire raw data from energy scenarios and standardize it to form a set of data blocks divided by device and time; A hierarchical hash tree structure is constructed based on a set of data blocks, multi-level hash paths are calculated, and a root hash is generated. Write the root hash value into the blockchain as the root hash value for confirming ownership and storing the evidence, and simultaneously write the associated metadata. Based on the access subject, requested resource, and environmental context information, an access control policy is generated through a dynamic permission policy engine, and an access token with access scope and validity period is generated. The proxy re-encrypts the data based on the access token, converting the encrypted data corresponding to the access request into a format that the visitor can decrypt. Consistency verification is performed between the hash path of the data block and the root hash. Once the verification is successful, the data is decrypted and accessed. Access behavior is recorded and the contribution value of data usage is calculated. The smart contract automatically distributes transaction revenue according to the contribution value ratio.

2. The energy big data rights confirmation method based on hierarchical hash tree and dynamic authorization as described in claim 1, characterized in that: The data block set is formed by dividing the raw data according to a preset device identifier and time window; The construction of the hierarchical hash tree structure includes calculating the hash value of each data block in the data block set as a leaf node, and concatenating the hash values ​​of adjacent nodes at the same level in order before hashing them again to generate upper-level intermediate nodes. Repeat this process until the root hash is constructed, representing the integrity status of the data set; When a data block in the data block set is updated, the hash value is recalculated from bottom to top only for the hash path corresponding to the current data block. This includes updating the hash value of the leaf nodes and updating the hash values ​​of the intermediate nodes in the branch in turn, and finally regenerating the root hash.

3. The energy big data rights confirmation method based on hierarchical hash tree and dynamic authorization as described in claim 2, characterized in that: The associated metadata includes the collection timestamp, device identifier, and data classification label of the corresponding data block set; Writing the root hash value into the blockchain as the root hash value for rights confirmation and notarization involves writing the root hash value generated by constructing a hierarchical hash tree into the blockchain as the root hash value for rights confirmation and notarization, and writing the associated metadata as an additional field into the blockchain to classify, retrieve and trace the rights confirmation records.

4. The energy big data rights confirmation method based on hierarchical hash tree and dynamic authorization as described in claim 3, characterized in that: The generation of access control policies through the dynamic permission policy engine includes... The user identity identifier, target data resource identifier, and current environment context parameters in the access request are combined into an attribute set. The system matches the attribute set based on predefined role templates and attribute condition combination rules. When the matching result meets the authorization conditions, it generates an access control policy containing a set of accessible data block identifiers and an access validity period, and generates an access token bound to the visitor's identity based on the policy. The token is used to authorize access to the corresponding data block that has been encrypted and stored. The rules include a combined judgment logic for user role, resource sensitivity, access time, and access device status; The attribute set includes the visitor's role identifier, operational behavior, resource sensitivity level, access time, and geographical location information.

5. The energy big data rights confirmation method based on hierarchical hash tree and dynamic authorization as described in claim 4, characterized in that: The step of performing proxy re-encryption based on the access token, converting the encrypted data corresponding to the access request into a format that the visitor can decrypt, includes: The data owner generates a proxy re-encryption key corresponding to the visitor's identity; After receiving the authorization token, the proxy server uses the re-encryption key to encrypt the original ciphertext of the target data block, enabling the visitor to decrypt the currently converted ciphertext using their own private key without knowing the original private key. The proxy re-encryption key is obtained by hashing the visitor's public key and calculating it with the data owner's private key; The proxy server does not retain any intermediate plaintext or re-encryption key copies after completing the conversion operation, minimizing the risk of key leakage.

6. The energy big data rights confirmation method based on hierarchical hash tree and dynamic authorization as described in claim 5, characterized in that: The hash path based on the data block performs a consistency verification with the root hash. After successful verification, data decryption and access are completed. After authorization by the access control policy, the visitor requests the corresponding data block and hash path information based on the obtained access token. The current data block is hashed, and the intermediate node hash values ​​are generated sequentially by combining the hash path information. Finally, the verification root hash value is generated and compared with the right confirmation root hash value written in the blockchain. When the comparison results match, the key management mechanism is invoked, allowing the accessor to perform decryption operations on the target data block; The hash path information includes the hash values ​​of all sibling nodes of the target data block in the hierarchical hash tree structure, arranged in order from leaf node to root node.

7. The energy big data rights confirmation method based on hierarchical hash tree and dynamic authorization as described in claim 6, characterized in that: The process of recording access behavior and calculating the contribution value of data usage, along with the smart contract automatically allocating transaction revenue based on the contribution value ratio, includes... The access token contains the access subject identifier, access timestamp, and access scope, which are recorded in the access log. Based on the access logs, the number of data entries accessed by each data holder, the frequency of data access, and the timeliness of data response are statistically analyzed to calculate the data usage contribution value of the accessing party. The smart contract automatically allocates and transfers transaction profits based on the contribution value of each data holder.

8. An energy big data rights confirmation system based on hierarchical hash trees and dynamic authorization, employing the energy big data rights confirmation method based on hierarchical hash trees and dynamic authorization as described in any one of claims 1 to 7, characterized in that, It includes: a data processing and rights confirmation module, an access control and encryption module, a data verification and access module, and an access record and incentive settlement module; The data processing and rights confirmation module acquires raw data from energy scenarios and performs standardized processing. The data is divided into data block sets according to device and time. A hierarchical hash tree structure is constructed based on the data block sets to generate a root hash value. The root hash value is written into the blockchain as the rights confirmation root hash value for rights confirmation and notarization. The associated metadata, including the collection timestamp, device identifier, and data classification label, is also written as an additional field to support the classification retrieval and traceability of rights confirmation records. The access control and encryption module generates an attribute set based on the access subject's identity, the requested resource identifier, and the environmental context information, calls the dynamic access control policy engine to generate an access control policy, and generates an access token based on the policy. After receiving the access token, the encrypted data corresponding to the access request is converted into a format that the visitor can decrypt through the proxy re-encryption mechanism, so that the data can be securely accessed under authorized conditions. The data verification and access module requests a data block and its hash path based on the access token, performs data block hashing and path reconstruction operations, generates a verification root hash value, and compares it with the root hash value that has been confirmed in the blockchain. When the two match, the key management mechanism is invoked to allow the accessor to decrypt the target data block and complete the data access. The access record and incentive settlement module records access behavior-related information, including visitor identifier, timestamp, and access scope; calculates the contribution value of data holders based on access logs, and the smart contract automatically executes the distribution of transaction revenue according to the contribution value ratio of each holder, realizing a closed-loop mechanism for data sharing incentives.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the energy big data rights confirmation method based on hierarchical hash tree and dynamic authorization as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the energy big data rights confirmation method based on hierarchical hash tree and dynamic authorization as described in any one of claims 1 to 7.

Images