Access control method and device based on smart contract

Abstract

The invention provides an access control method and device based on a smart contract, and the method comprises the steps: receiving a data request packet through a block chain, carrying out the matching of a request data index and at least one storage data index, and determining a successfully matched data owning device as a matching device; checking whether the current reputation value of the data request equipment is higher than the preset minimum reputation value of the matching equipment or not through the block chain based on the identity management contract according to the pseudonym of the request equipment; verifying whether the request equipment attribute set accords with the access control strategy through the block chain; generating a one-time authorization token based on the data sharing contract under the condition that the request equipment attribute set conforms to the access control strategy; sending the extracted data packet to a data request device through the block chain according to the one-time authorization token; and a multi-dimensional security foundation is laid for data sharing.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of Internet of Things data access control, and in particular to an access control method and device based on a smart contract. BACKGROUND

[0002] With the wide deployment of Internet of Things devices in smart cities, industrial automation and intelligent medical care, etc., secure and efficient data access control has become a key challenge to protect the trustworthiness and privacy protection of Internet of Things systems. In the Internet of Things environment, the number of devices is large, nodes are frequently online and offline, and resources are heterogeneous, which leads to the problem of single point of failure, privacy leakage and lack of scalability of traditional access control methods relying on centralized third parties. In recent years, blockchain and smart contracts have been used to build trusted Internet of Things access control systems due to their decentralized, tamper-proof and traceable characteristics, but they cannot achieve fine management of access permissions and have low security. SUMMARY

[0003] The present application provides an access control method and device based on a smart contract to solve the problem of insufficient fine management of access permissions and low security in the prior art, and to achieve fine management of access permissions by data owners.

[0004] The present application provides an access control method based on a smart contract, which is executed through an access control framework, the access control framework including: Internet of Things devices, trusted central agencies, blockchains and InterPlanetary File System; the method comprising the following steps: The data request package is received by the blockchain, and the request data index is matched with at least one storage data index to determine the matching device as the data owning device; the current reputation value of the data request device is checked based on the identity management contract of the blockchain according to the pseudonym of the request device, to check whether the current reputation value of the data request device is higher than the preset minimum reputation value of the matching device; wherein the data request device is a registered Internet of Things device requesting access to the stored data; the data request package includes: the request device pseudonym, the request device attribute set and the request data index; In the case where the current reputation value is higher than the preset minimum reputation value, the request device attribute set is verified by the blockchain to determine whether it meets the access control policy; in the case where the request device attribute set meets the access control policy, a one-time authorization token is generated based on the data sharing contract; The extraction data package is sent to the data request device by the blockchain according to the one-time authorization token; wherein the extraction data package includes: the data storage address of the matching device, the one-time authorization token and the device pseudonym of the matching device.

[0005] According to the access control method based on a smart contract provided by the present application, the method further comprises: Each data-owning device encrypts and stores its own data in the InterPlanetary File System (IPS), obtaining the data storage address returned by the IPS; wherein, the data-owning device is a registered Internet of Things (IoT) device. According to the data sharing contract, each data-owning device submits its own device data package to the blockchain. The device data package includes: the device pseudonym of the data-owning device, the data storage index, the data storage address, the access control policy, and the preset minimum reputation value.

[0006] According to the smart contract-based access control method provided by the present invention, multiple data-owning devices simultaneously correspond to a single stored data; the data-owning devices submit their respective device data packets to the blockchain according to a data sharing contract, including: Select one device from multiple data-owning devices according to preset rules; By selecting a device, a joint device data packet is submitted to the blockchain according to a data sharing contract; wherein, the joint device data packet includes: device pseudonyms of multiple data-owning devices, storage data index, data storage address, access control policies of multiple data-owning devices, and preset minimum reputation value; The blockchain is used to verify whether the requested device attribute set conforms to the access control policy, including: The blockchain is used to match the requesting device attribute set with the access control policy of each data-owning device in turn. If the requested device attribute set successfully matches the access control policy of each data-owning device, it is determined that the requested device attribute set conforms to the access control policy.

[0007] The access control method based on smart contracts provided by the present invention further includes: Each data-owning device signs the access control policy and the federated device data; The signature of each data-owning device is verified through blockchain, and a joint authorization identifier is generated based on the access control policies of multiple data-owning devices and the preset minimum reputation value. The on-chain contract stores the correspondence between the joint authorization identifier and the joint device data.

[0008] The access control method based on smart contracts provided by the present invention further includes: Public parameters are generated through a trusted central authority, and the system private key and system public key are obtained based on the public parameters; The trusted center generates credential information based on the system's private key and the received device information of the device to be registered, and sends the credential information to the blockchain through the device to be registered; wherein, the device to be registered is an IoT device to be registered; the device information includes: the device's real identity and the device's public key; the credential information includes: the device's pseudonym and the device's identity credential. By verifying and signing the credential information based on the device registration contract and the system public key using blockchain, the registered IoT device can be obtained.

[0009] The access control method based on smart contracts provided by the present invention further includes: Bayesian inference and Beta distribution are used to determine the intermediate reputation value of registered IoT devices based on the historical success and failure counts of the registered IoT devices. The current reputation value of a registered IoT device is determined based on the standard deviation of multiple intermediate reputation values, a stability adjustment factor, and the intermediate reputation value from the last historical task feedback.

[0010] The present invention also provides an access control device based on smart contracts, comprising the following modules: The reputation matching module receives data request packets via the blockchain and matches them with at least one stored data index based on the requested data index. It identifies the device owning the successfully matched data as the matching device. Using the blockchain and an identity management contract, it checks whether the current reputation value of the requesting device is higher than the preset minimum reputation value of the matching device based on the requesting device's pseudonym. The data requesting device is a registered IoT device requesting access to stored data. The data request packet includes: the requesting device pseudonym, the requesting device attribute set, and the requested data index. The attribute matching module is used to verify whether the requested device attribute set conforms to the access control policy through blockchain when the current reputation value is higher than the preset minimum reputation value; if the requested device attribute set conforms to the access control policy, a one-time authorization token is generated based on the data sharing contract. The data extraction module is used to send the extraction data packet to the data requesting device via blockchain; the extraction data packet includes: the data storage address of the matching device, a one-time authorization token, and the device pseudonym of the matching device.

[0011] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the smart contract-based access control method as described above.

[0012] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the smart contract-based access control method as described above.

[0013] The smart contract-based access control method and apparatus provided by this invention receive data request packets via blockchain and match them with at least one stored data index according to the requested data index, identifying the data-owning device as the matching device. Based on an identity management contract, the blockchain checks whether the current reputation value of the requesting device is higher than a preset minimum reputation value for the matching device. If the current reputation value is higher than the preset minimum reputation value, the blockchain verifies whether the requesting device's attribute set conforms to the access control policy. If the requesting device's attribute set conforms to the access control policy, a one-time authorization token is generated based on a data sharing contract. The blockchain then sends the extracted data packet to the requesting device based on the one-time authorization token. Compared to the insufficiently granular access control and low security of existing technologies, this invention achieves reliable verification of data sharing behavior through multiple smart contracts. Furthermore, by checking the current reputation value of the requesting device and verifying whether the requesting device's attribute set conforms to the access control policy, a multi-dimensional security foundation is laid for data sharing. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0015] Figure 1 This is a flowchart illustrating the access control method based on smart contracts provided by the present invention.

[0016] Figure 2 This is a schematic diagram of the access control framework provided by the present invention.

[0017] Figure 3 This is a schematic diagram of the data sharing process provided by the present invention.

[0018] Figure 4 This is a schematic diagram of the access control device based on smart contracts provided by the present invention.

[0019] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0021] The following is combined Figures 1-5 This invention is described.

[0022] The smart contract-based access control method of this invention is executed through an access control framework, such as... Figure 2 As shown, the access control framework includes: IoT devices, trusted central institutions, blockchain, and the InterPlanetary File System (IPFS).

[0023] IoT devices at the device layer register with TCA to obtain legitimate identities, periodically collect data, and encrypt and store it in IPFS at the storage layer. At the data sharing layer, devices upload data-related information and access permissions to the blockchain. Data users can request data according to their needs. After two layers of verification by the blockchain and the data owner, the corresponding data can be obtained, thus achieving secure and reliable data sharing.

[0024] Trusted Central Authority (TCA): A TCA is a trusted entity responsible for generating public parameters for the system. Furthermore, the TCA generates pseudonyms for entities within the system to enable anonymous interaction and tracks the true identities of participants in the event of malicious activity. It's important to note that the TCA is not responsible for generating public-private key pairs for nodes, nor does it participate in the data sharing process.

[0025] IoT devices: IoT devices participate in the data sharing process as blockchain nodes. Device types include, but are not limited to, in-vehicle computing devices, tablets, and laptops. They can provide data as data owners or initiate data access requests as data requesters. Each device must register to obtain a legitimate identity and use locally generated public and private keys to ensure the security of identity authentication and data encryption / decryption.

[0026] Blockchain: A blockchain consists of multiple IoT devices. By deploying registration and reputation contracts, the blockchain records device registration information and continuously updates node reputation. Through data sharing contracts, it stores and verifies access control policies and generates access tokens, effectively avoiding the centralized trust problem present in traditional access control.

[0027] IPFS: IPFS is used to store data collected by IoT devices. Only the data index and access control policies are recorded on the chain to ensure data security.

[0028] Figure 1 This is a flowchart illustrating the access control method based on smart contracts provided by the present invention, as shown below. Figure 1 As shown, the method includes the following: Step 101: Receive a data request packet via the blockchain and match it with at least one stored data index according to the requested data index. Identify the data-owning device that successfully matches the data as the matching device. Based on the identity management contract of the blockchain, check whether the current reputation value of the data requesting device is higher than the preset minimum reputation value of the matching device according to the pseudonym of the requesting device. The data requesting device is a registered IoT device that requests access to stored data. The data request packet includes: the pseudonym of the requesting device, the set of attributes of the requesting device, and the requested data index.

[0029] Step 102: If the current reputation value is higher than the preset minimum reputation value, verify whether the requested device attribute set conforms to the access control policy through the blockchain; if the requested device attribute set conforms to the access control policy, generate a one-time authorization token based on the data sharing contract.

[0030] Step 103: Send the extraction data packet to the data requesting device via the blockchain based on the one-time authorization token; wherein, the extraction data packet includes: the data storage address of the matching device, the one-time authorization token, and the device pseudonym of the matching device.

[0031] In steps 101 to 103 above, the data request packet is a data packet sent by the data requesting device to the blockchain.

[0032] Access control mechanisms are based on the ABAC model, which can achieve fine-grained access control through multiple attributes. ABAC typically includes four elements: These are represented as subject attributes, object attributes, access policies, and environment attributes, respectively. Data visitors are allowed to access resources based on attribute policy matching.

[0033] Assuming each entity Have a set of attributes The attributes include role, device type, domain, time constraints, and historical behavior. Among these, the attribute values... It can be mapped to a collision-resistant hash function. .Strategy This is a Boolean expression, defined by the data owner, that determines which attribute combinations have access permissions. In this embodiment of the invention, it is expressed as an attribute threshold access structure. For example, if the data accessor satisfies… The data can then be accessed, and the data owner can encode it as... Each constraint can be represented in mathematical form, as shown in Table 1.

[0034] Table 1 mathematical form Data requester Will Submitted to the blockchain, specific data is queried and retrieved through the QueryData() method of the data sharing contract. yes The attributes of the blockchain. After receiving a data request, the blockchain first... Check if there is stored data. If matching data is found, the blockchain... The smart contract verifies the creditworthiness of the entity. examine Current credit Is it higher than the minimum threshold? This further enhances the security of the sharing process. Then, the blockchain determines whether the data requester has access rights by verifying the equations. , , ,and . Is this valid? If all the above verifications pass, it means the data requester is a legitimate visitor and is not exposing attribute values. Under the premise of satisfying the strategy Finally, the contract records this access and generates a one-time authorization token. Finally, blockchain will Return to It is used to access off-chain data.

[0035] After receiving the information, according to Retrieve the corresponding ciphertext from IPFS and to submit To request the decryption key. Firstly, according to Search ,verify Check if it's true, then call the QueryDevice() method, based on... Query public key ,Will Send to . use Decryption and Key Acquisition Then through Obtain data .

[0036] To further enhance the flexibility and security control capabilities of data sharing in the Internet of Things (IoT) environment, this invention proposes a joint authorization mechanism that supports multiple data owners in jointly managing and authorizing access to the same data. The system supports... Data owner Together on a piece of encrypted data Publish the access policy and define the federated threshold authorization expression. .in, Indicates by the first Local access policies defined individually by each owner.

[0037] Optionally, the access control method based on smart contracts provided by the present invention further includes steps A1 to A2: Step A1: Each data-owning device encrypts and stores its own data in the InterPlanetary File System (IPS) to obtain the data storage address returned by the IPS; wherein, the data-owning device is a registered IoT device.

[0038] Step A2: The data-owning devices submit their respective device data packets to the blockchain according to the data sharing contract. The device data packets include: the device pseudonym of the data-owning device, the data storage index, the data storage address, the access control policy, and the preset minimum reputation value.

[0039] In steps A1 and A2 above, within an IoT environment, different devices or entities typically possess heterogeneous data resources and access needs. This invention presents an access control mechanism based on smart contracts. This mechanism not only supports granular management of access permissions by data owners but also enables auditing and incentive feedback of data access behavior without the need for a trusted third party.

[0040] This invention embodiment assumes that the data owner is The data requester is . and Secure and reliable data sharing can be achieved through encryption and smart contracts. The data sharing process is as follows: Figure 3 As shown.

[0041] Access control policies are set for data-owning devices based on an attribute-based access control model.

[0042] Local data Using symmetric keys After encryption And store it in IPFS, IPFS returns the data storage address (CID). Then, Call the AddData() method of the data sharing contract to... Submitted to the blockchain. Among them, It is a data index, yes The access control policy set It is the minimum reputation value set.

[0043] Optionally, multiple data-owning devices may simultaneously correspond to a single piece of stored data; step A2 includes steps A21 to A22: Step A21: Select one device from multiple data ownership devices according to preset rules as the selected device.

[0044] Step A22: Submit the joint device data packet to the blockchain through the selected device according to the data sharing contract; wherein, the joint device data packet includes: device pseudonyms of multiple data-owning devices, storage data index, data storage address, access control policies of multiple data-owning devices, and preset minimum reputation value; Meanwhile, step 102, which verifies whether the requested device attribute set conforms to the access control policy via blockchain, includes steps B1 to B2: Step B1: Match the requesting device attribute set with the access control policy of each data-owning device sequentially using the blockchain.

[0045] Step B2: If the requested device attribute set successfully matches the access control policy of each data-owning device, determine that the requested device attribute set conforms to the access control policy.

[0046] Optionally, when multiple data-owning devices simultaneously correspond to a single stored data, the smart contract-based access control method provided by this invention further includes steps C1 to C3: Step C1: Sign the access control policy and federated device data by each data ownership device.

[0047] Step C2: Verify the signature of each data-owning device through the blockchain, and generate a joint authorization identifier based on the access control policies of multiple data-owning devices and the preset minimum reputation value.

[0048] Step C3: Store the correspondence between the joint authorization identifier and the joint device data based on the on-chain contract.

[0049] In steps A21 to A22, B1 to B2, and C1 to C3 above, the joint data submission involves each data owner reaching an agreement on the encrypted data and randomly selecting one data owner to call the AddJointData() method to submit a joint access control request. Each owner must sign their local policy and submissions to ensure the authenticity and non-repudiation of the joint submission. After verifying all signatures, the blockchain records the policy set and corresponding reputation thresholds on the chain and generates a globally unique joint authorization identifier. .

[0050] Joint strategy storage and binding: On-chain contracts will With data index Bind the data, mark it as being in a "joint control" state, and store the identity of each data owner. and its corresponding strategies If a dispute arises among the joint owners (such as abuse of authorization, unclear policy revocation rights, etc.), the CheckJointData() method can be called to query the joint data. The bound policy signature set and timestamp can be used as evidence for liability determination.

[0051] Access Requests and Joint Decision-Making: Data Requesters When initiating an access request, the system needs to verify that the user's reputation score meets the set threshold. Then, the attributes submitted to it. Match each sub-strategy in turn The ciphertext position is returned only if all matching conditions are met. and authorization token .

[0052] This invention proposes a fine-grained access control and federated authorization mechanism for attributes. By enabling data owners to set access policies in Boolean expression form through smart contracts, it achieves permission management for both single and federated data. Combined with reputation threshold constraints, this lays a multi-dimensional security foundation for data sharing.

[0053] Optionally, the access control method based on smart contracts provided by the present invention further includes steps D1 to D3: Step D1: Generate public parameters through a trusted center, and obtain the system private key and system public key based on the public parameters.

[0054] Step D2: The trusted center generates credential information based on the system private key and the received device information of the device to be registered, and sends the credential information to the blockchain through the device to be registered; wherein, the device to be registered is the IoT device to be registered; the device information includes: the device's real identity and the device's public key; the credential information includes: the device's pseudonym and the device's identity credential.

[0055] Step D3: Verify and sign the credential information using the blockchain based on the device registration contract and the system public key to obtain the registered IoT device.

[0056] In steps D1 to D3 above, TCA selects safety parameters. Generate common parameters .in, It is a large prime number. cyclic group It is a group The generator. TCA randomly selects. As the system's private key, calculate and publish the system's public key. Then, TCA selected three one-way hash functions. and and Finally, TCA released the parameters. .

[0057] Before joining the blockchain system, IoT devices need to send a registration request to TCA to obtain a legitimate identity. Specifically, IoT devices... Select random number Use the private key to calculate the public key. .Then, Send to TCA in the secure channel Request registration. (The following is a list of steps / parts:) yes The true identity. TCA selects a random number. ,calculate and using the private key for Generate kana Then, TCA is... Generate identity credentials and will Send to .

[0058] Internet of Things (IoT) devices Verify the equation Is it valid? If the verification passes, Can As their pseudonym. When IoT devices When you wish to join a blockchain network, you first need to send your identity credentials to the blockchain. The blockchain calls the device registration contract, through... After verifying the signature, record it. The identity information forms a triple. .here, This is the node's initial reputation value. Once registration is successful, it will... It will be included in the next round of consensus voting and participate in the regular consensus process.

[0059] Optionally, the access control method based on smart contracts provided by the present invention further includes steps E1 to E2: Step E1: Using Bayesian inference and Beta distribution, determine the intermediate reputation value of registered IoT devices based on the historical success and failure counts.

[0060] Step E2: Determine the current reputation value of the registered IoT device based on the standard deviation of multiple intermediate reputation values, the stability adjustment factor, and the intermediate reputation value from the last historical task feedback.

[0061] In steps E1 and E2 above, in the IoT data sharing system, IoT devices are also known as nodes. Dynamic evaluation of node reputation is crucial. Due to the heterogeneity of device resources and the instability of their behavior, static reputation models are prone to over-reliance on historical behavior and cannot cope with changes in node state, such as the addition of new nodes. Therefore, this embodiment of the invention models reputation as a dynamic stochastic process based on behavioral feedback, with the goal of evaluating the reputation of each node... Build a reputation value that can evolve over time This allows for timely reflection of recent behavioral changes in nodes. Therefore, this embodiment of the invention employs a Bayesian inference and Beta distribution modeling strategy, combining node consensus success rate and behavioral stability, and invokes a reputation update smart contract to statistically learn and update node reputation.

[0062] In this embodiment of the invention, each time a node participates in a consensus task is considered a Bernoulli trial, that is... ,in Indicates the node at the 1st In this subtask, the behavior is considered trustworthy, with 0 indicating failure or no response. In this embodiment of the invention, a node is considered trustworthy when the following conditions are met: (1) the node completes the verification of the candidate block issued by the master node within a specified time and returns a valid signature; (2) the node's vote or signature is included in the threshold for reaching final consensus; and (3) the node does not experience communication failure or timeout. This embodiment of the invention defines the probability of a node's trustworthy behavior as follows: ,Right now Because the behavior of nodes is uncertain, this embodiment of the invention uses a Beta distribution. Establish prior modeling ,in and These represent the weighted statistics of the node's historical success and failure counts, respectively. The system receives feedback from each node after it executes a task. Then its posterior distribution is .in and These represent the number of successes and failures, respectively. For newly added nodes, this embodiment of the invention assumes that the initial Beta distribution parameters satisfy... Its reputation is initially set to .

[0063] To adapt to the characteristics of frequent device online / offline cycles and status fluctuations in IoT, this embodiment of the invention only retains the past... Sub-task feedback, and time weighting by adding historical feedback. .in, This is the decay factor. Assume the node is closest. The feedback was The time decay factor for each feedback is... Then the number of weighted successes is The number of weighted failures is .in, Let be the penalty coefficient. Then, the consensus reputation value of a node is calculated as the expected value of a Beta distribution. .

[0064] To prevent nodes from gaining false reputation through speculative behaviors such as short-term reputation boosting, this embodiment of the invention further introduces a behavior stability mechanism as a reputation adjustment factor. This embodiment of the invention records the most recent update after the task feedback sequence is updated. Intermediate credit rating And calculate its standard deviation. .in, This represents the average reputation. The smaller the fluctuation value, the more stable the node's behavior. The embodiment of this invention yields the following final current reputation value: .in, It serves as a stability regulator.

[0065] This invention proposes a dynamic reputation assessment and access control framework based on smart contracts. Three types of contracts—identity management, reputation update, and data sharing—are designed and deployed to achieve trusted verification of device registration and data sharing activities. A one-time authorization token enhances the system's auditability.

[0066] This invention presents a dynamic reputation evaluation method that integrates a Beta Bayesian model. Based on the historical contribution behavior of nodes, a Beta distribution is used to continuously update reputation. This method enhances sensitivity to abrupt changes while considering both positive and negative feedback, providing highly reliable scoring support for access control and consensus processes.

[0067] This invention provides an access control method based on smart contracts. It receives data request packets via blockchain and matches the requested data index with at least one stored data index, identifying the data-owning device as the matching device. The blockchain, based on an identity management contract, checks whether the current reputation value of the requesting device is higher than a preset minimum reputation value for the matching device. If the current reputation value is higher than the preset minimum reputation value, the blockchain verifies whether the requesting device's attribute set conforms to the access control policy. If the requesting device's attribute set conforms to the access control policy, a one-time authorization token is generated based on a data sharing contract. The blockchain then sends the extracted data packet to the requesting device based on the one-time authorization token. Compared to existing technologies with insufficiently granular access control and low security, this method achieves reliable verification of data sharing behavior through multiple smart contracts. Furthermore, the dual verification of checking the current reputation value of the requesting device and verifying whether the requesting device's attribute set conforms to the access control policy lays a multi-dimensional security foundation for data sharing.

[0068] The smart contract-based access control device provided by the present invention will be described below. The smart contract-based access control device described below and the smart contract-based access control method described above can be referred to in correspondence.

[0069] Figure 4 This is a flowchart illustrating the access control device based on smart contracts provided by the present invention, as shown below. Figure 4 As shown, the device includes the following: The reputation matching module 401 is used to match the requested data index with at least one stored data index using the blockchain, and to identify the data owner device that successfully matches as the matching device; it also uses the blockchain and an identity management contract to check whether the current reputation value of the data requesting device is higher than the preset minimum reputation value of the matching device based on the requesting device pseudonym; wherein, the data requesting device is a registered IoT device that requests access to stored data; the data request package includes: the requesting device pseudonym, the requesting device attribute set, and the request data index.

[0070] The attribute matching module 402 is used to verify whether the requested device attribute set conforms to the access control policy through the blockchain when the current reputation value is higher than the preset minimum reputation value; if the requested device attribute set conforms to the access control policy, a one-time authorization token is generated based on the data sharing contract.

[0071] The data extraction module 403 is used to send the extraction data packet to the data requesting device via the blockchain; wherein, the extraction data packet includes: the data storage address of the matching device, a one-time authorization token, and the device pseudonym of the matching device.

[0072] This invention provides an access control device based on smart contracts. It receives data request packets via blockchain and matches the requested data index with at least one stored data index, identifying the data-owning device as the matching device. Using an identity management contract on the blockchain, it checks whether the current reputation value of the requesting device is higher than a preset minimum reputation value for the matching device. If the current reputation value is higher than the preset minimum reputation value, the blockchain verifies whether the requesting device's attribute set conforms to the access control policy. If the requesting device's attribute set conforms to the access control policy, a one-time authorization token is generated based on a data sharing contract. The blockchain then sends the extracted data packet to the requesting device based on the one-time authorization token. Compared to existing technologies with insufficiently granular access control and low security, this invention achieves reliable verification of data sharing behavior through multiple smart contracts. Furthermore, by verifying both the current reputation value of the requesting device and the conformity of its attribute set to the access control policy, a multi-dimensional security foundation is established for data sharing.

[0073] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include a processor 810, a communications interface 820, a memory 830, and a communication bus 840. The processor 810, communications interface 820, and memory 830 communicate with each other via the communication bus 840. The processor 810 can invoke logical instructions from the memory 830 to execute smart contract-based access control methods.

[0074] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0075] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the access control method based on smart contracts provided by the above methods.

[0076] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the smart contract-based access control methods provided by the above methods.

[0077] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0078] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An access control method based on smart contracts, characterized in that, The smart contract-based access control method is executed through an access control framework, which includes: IoT devices, trusted central institutions, blockchain, and the InterPlanetary File System; including: The blockchain receives data request packets and matches them against at least one stored data index. The device owning the successfully matched data is identified as the matching device. The blockchain, based on an identity management contract, checks whether the current reputation value of the requesting device is higher than the preset minimum reputation value of the matching device, using the requesting device's pseudonym. The data requesting device is a registered IoT device requesting access to stored data. The data request packet includes: a requesting device pseudonym, a requesting device attribute set, and a request data index. If the current reputation value is higher than the preset minimum reputation value, the blockchain is used to verify whether the requested device attribute set conforms to the access control policy; if the requested device attribute set conforms to the access control policy, a one-time authorization token is generated based on the data sharing contract. The extraction data packet is sent to the data requesting device via the blockchain based on the one-time authorization token; wherein the extraction data packet includes: the data storage address of the matching device, the one-time authorization token, and the device pseudonym of the matching device.

2. The access control method based on smart contracts according to claim 1, characterized in that, Also includes: Each data-owning device encrypts and stores its own data in the InterPlanetary File System (IPS), and obtains the data storage address returned by the IPS; wherein, the data-owning device is a registered Internet of Things (IoT) device. According to the data sharing contract, each data-owning device submits its own device data packet to the blockchain. The device data packet includes: the device pseudonym of the data-owning device, the storage data index, the data storage address, the access control policy, and the preset minimum reputation value.

3. The access control method based on smart contracts according to claim 2, characterized in that, Multiple data-owning devices are simultaneously associated with a single stored data; the process of each data-owning device submitting its respective device data packet to the blockchain according to a data-sharing contract includes: Select one device from multiple data-owning devices according to preset rules; By selecting a device, a joint device data packet is submitted to the blockchain according to a data sharing contract; wherein, the joint device data packet includes: device pseudonyms of multiple data-owning devices, storage data index, data storage address, access control policies of multiple data-owning devices, and a preset minimum reputation value; The step of verifying whether the requesting device attribute set conforms to the access control policy via blockchain includes: The requesting device attribute set is matched sequentially with the access control policy of each data-owning device using the blockchain. If the requested device attribute set successfully matches the access control policy of each data-owning device, it is determined that the requested device attribute set conforms to the access control policy.

4. The access control method based on smart contracts according to claim 3, characterized in that, When multiple data-owning devices simultaneously correspond to a single stored data, the method further includes: Each data-owning device signs the access control policy and the data of the associated devices. The signature of each data-owning device is verified by blockchain, and a joint authorization identifier is generated based on the access control policy of multiple data-owning devices and the preset minimum reputation value. The on-chain contract stores the correspondence between the joint authorization identifier and the joint device data.

5. The access control method based on smart contracts according to claim 1, characterized in that, The method further includes: Public parameters are generated through a trusted central authority, and the system private key and system public key are obtained based on the public parameters. The trusted central authority generates credential information based on the system private key and the received device information of the device to be registered, and sends the credential information to the blockchain through the device to be registered; wherein, the device to be registered is an IoT device to be registered; the device information includes: the device's real identity and the device's public key; the credential information includes: the device's pseudonym and the device's identity credential; The registered device is obtained by verifying and signing the credential information based on the device registration contract and the system public key using the blockchain.

6. The access control method based on smart contracts according to claim 1, characterized in that, The method further includes: Bayesian inference and Beta distribution are used to determine the intermediate reputation value of registered IoT devices based on the historical success and failure counts of the registered IoT devices. The current reputation value of a registered IoT device is determined based on the standard deviation of multiple intermediate reputation values, a stability adjustment factor, and the intermediate reputation value from the last historical task feedback.

7. An access control device based on smart contracts, characterized in that, include: The reputation matching module is used to receive data request packets via the blockchain, match the requested data index with at least one stored data index, and identify the data-owning device that successfully matches as the matching device; and, based on a smart contract and the pseudonym of the requesting device, check whether the current reputation value of the data requesting device is higher than the preset minimum reputation value of the matching device; wherein, the data requesting device is a registered IoT device requesting access to stored data; the data request packet includes: the pseudonym of the requesting device, the set of attributes of the requesting device, and the requested data index; The attribute matching module is used to verify whether the requested device attribute set conforms to the access control policy through blockchain when the current reputation value is higher than the preset minimum reputation value; and to generate a one-time authorization token based on the data sharing contract when the requested device attribute set conforms to the access control policy. The data extraction module is used to send an extraction data packet to the data requesting device via the blockchain based on the one-time authorization token; wherein, the extraction data packet includes: the data storage address of the matching device, the one-time authorization token, and the device pseudonym of the matching device.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the smart contract-based access control method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the smart contract-based access control method as described in any one of claims 1 to 6.

Images