A blockchain-based data access management method and system

Abstract

This invention discloses a blockchain-based data access management method and system, relating to the field of data access management technology. It addresses the problem of reduced security in data access. Before a user initiates an access request, the method retrieves access logs, statistically analyzes historical access frequency, and constructs an initial scoring function based on the last access time and interval to quantify access activity and continuity. It also detects key call behavior and rotation cycles, extracts access path nodes, and generates a secondary score through normalization to evaluate key management and path trustworthiness. Based on the score, a trust level is determined, generating identity verification or permission adjustment signals. Permission adjustments trigger access data level filtering and marking, enabling dynamic data access. Simulated data is generated using marked data to detect field repetition counts and analyze field distribution, thereby correcting permission levels and achieving refined security control. This improves the system's ability to protect against abnormal access and its adaptability to legitimate access.

Description

Technical Field

[0001] This invention relates to the field of data access management technology, and more specifically, to a data access management method and system based on blockchain. Background Technology

[0002] With the widespread application of blockchain technology in data management, finance, healthcare and enterprise information systems, more and more systems are trying to use blockchain to achieve secure data storage, traceability and access record management. In practical applications, blockchain can not only ensure that data is immutable, but also record user access behavior, providing data support for subsequent access control and risk control.

[0003] The existing technology has the following shortcomings: Currently, existing technologies lack dynamic permission management mechanisms based on user history access records, key call behavior, and data field distribution. This leads to reduced data access security, insufficient risk control capabilities, and increased limitations on user access experience and data utilization efficiency. Traditional static permission management methods cannot be finely adjusted according to user behavior and trust levels, making it difficult to meet the security and efficiency requirements of complex business scenarios. Therefore, a data access management method and system based on blockchain is proposed.

[0004] The information disclosed in the background section is only intended to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a data access management method and system based on blockchain. This method and system address the problems mentioned in the background by employing user historical access record analysis, access frequency calculation, key call behavior monitoring, access path node statistics, trust level evaluation, and a dynamic permission adjustment mechanism based on data level weights and field distribution.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a data access management method and system based on blockchain, comprising the following steps: Step S1: Before a user requests access to data, retrieve historical access records and count the access frequency. Calculate the access frequency using the access frequency, obtain the last access time, and combine the access frequency to give the user an initial score. Step S2: Detect the user key invocation behavior, analyze the user key rotation cycle based on the invocation behavior, and generate a secondary score by combining the number of path nodes in the user's current access request; Step S3: Analyze the user's trust level based on the initial and secondary rating results, and select to generate an identity confirmation signal or a permission adjustment signal based on the trust level. When generating a permission adjustment signal, retrieve the level weight of the user's access data, and filter and mark the user's access data according to the level weight. Step S4: Generate corresponding simulated data based on the labeled data, detect the number of times different fields of the user access data are repeated, analyze the field distribution characteristics of the simulated data based on the number of repetitions, and adjust user permissions based on the field distribution characteristics.

[0007] In a preferred embodiment, in step S1, before the user initiates a data access request, the user's historical access records are retrieved through the access log. The access frequency is obtained by statistically processing the user's access behavior based on historical access records and accumulating the total number of successful accesses. The access frequency is obtained by dividing the access frequency by the duration of the preset time window. Get the user's last access time, subtract the last access time from the current access request time, and get the access request interval. By combining access frequency with access request interval, an initial scoring function based on a normalization function is established to obtain the initial score.

[0008] In a preferred embodiment, in step S2, the user key invocation behavior is obtained by calling consecutive key usage records based on the access log; Key usage records are sorted in ascending order by timestamp; The key usage record is identified by the change of key identifiers between two adjacent records, which is recorded as a key rotation event. Calculate the time interval between adjacent key switching events and construct a time interval sequence; The median of the time interval sequence is used as the user key rotation period.

[0009] In a preferred embodiment, in step S2, the number of different nodes that actually participated in forwarding or verifying the access request from the entry point to the completion of the access request is extracted from the route tracing metadata and used as the number of path nodes; Based on the preset baseline rotation period, the normalization factor of the user key rotation period is calculated to obtain the normalized rotation period. The number of path nodes is normalized to obtain the normalized number of path nodes. The product of the normalized rotation period and the number of normalized path nodes is used as the secondary score.

[0010] In a preferred embodiment, in step S3, the initial rating and the secondary rating distribution are standardized to obtain the initial rating coefficient and the secondary rating coefficient, which are then compared with a preset trust threshold to analyze the user's trust level. If both the initial rating coefficient and the secondary rating coefficient are lower than the preset trust threshold, the user is determined to be at the first trust level, and an identity confirmation signal is generated. If either the initial rating coefficient or the secondary rating coefficient is lower than the preset trust threshold, the user is determined to be at the second trust level, and a permission adjustment signal is generated. Otherwise, the user is determined to be at the third trust level.

[0011] In a preferred embodiment, in step S3, the user access data level weight is retrieved through the data hierarchical permission table; The user access data is sorted in descending order of level weights. The difference between adjacent level weights is calculated and combined into a difference sequence. The group of adjacent level weights with the largest difference is selected from the difference sequence, and the average value of the corresponding adjacent level weights is taken as the weight threshold. User access data is filtered, and user access data with a level weight higher than the weight threshold is identified as labeled data.

[0012] In a preferred embodiment, in step S4, simulated data of the labeled data is generated through the simulated data unit, and after the simulated data of the labeled data is generated, a preset monitoring time is set; During the monitoring period, the number of times different fields of user access data are repeated is detected. The sum of the number of times different fields are accessed is taken as the total number of times the field is accessed. The number of times each field is accessed is divided by the total number of times the field is accessed to obtain the field access ratio. The field distribution characteristics of the simulated data are obtained by summing the field access ratios of the corresponding fields and taking the reciprocal.

[0013] In a preferred embodiment, in step S4, the field distribution characteristics are compared with a preset distribution threshold: If the field distribution characteristics exceed the preset distribution threshold, then the user's permissions will be adjusted; otherwise, the simulated data will be replaced with labeled data. The methods for adjusting permissions include lowering the access permissions of the fields corresponding to the marked data and limiting the number of times they can be accessed.

[0014] A blockchain-based data access management system includes a behavior scoring module, a key path module, a trust management module, and a data simulation module. The functions of each module are as follows: Before a user requests access to data, the behavior scoring module retrieves historical access records and counts access frequency. It then uses the access frequency to calculate the access frequency, obtains the last access time, and combines the access frequency to give the user an initial score. The key path module detects the user's key calling behavior, analyzes the user's key rotation cycle based on the calling behavior, and generates a secondary score by combining the number of path nodes in the user's current access request. The trust management module analyzes the user's trust level based on the initial and secondary rating results. Based on the trust level, it selects to generate an identity confirmation signal or a permission adjustment signal. When generating a permission adjustment signal, it retrieves the level weight of the user's access data and filters and marks the user's access data according to the level weight. The data simulation module generates corresponding simulated data based on the labeled data, detects the number of times different fields of the user access data are repeated, analyzes the field distribution characteristics of the simulated data based on the number of repetitions, and adjusts user permissions based on the field distribution characteristics.

[0015] The technical effects and advantages of this invention are as follows: This invention retrieves access logs before a user initiates an access request, statistically analyzes the user's historical access frequency and frequency within a preset time window, and constructs an initial scoring function based on the previous access time and request interval. This quantifies the activity and continuity of user access behavior, detects user key invocation behavior, analyzes the rationality of key rotation cycles, and extracts the number of access request path nodes from routing trace metadata. A secondary score is generated through normalization operations to comprehensively evaluate the credibility of user key management behavior and request path characteristics. Based on the results of the initial and secondary scores, the user's trust level is determined, and an identity confirmation signal or permission adjustment signal is generated according to the trust level. The permission adjustment signal triggers the level weighting and marking of user access data, realizing dynamic adjustment of the data access scope. Simulated data is generated using the marked data to detect the repetition frequency of different fields, analyze field distribution characteristics, and further correct user permission levels accordingly. This achieves secure control and refined management of data access, effectively improving the system's ability to protect against abnormal access and its flexible adaptability to legitimate access, ensuring a balance between data security and access efficiency. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the implementation of a blockchain-based data access management method according to the present invention.

[0017] Figure 2 This is a module framework diagram of a blockchain-based data access management system according to the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] This invention retrieves access logs before a user initiates an access request, statistically analyzes the user's historical access frequency and frequency within a preset time window, and constructs an initial scoring function based on the previous access time and request interval. This quantifies the activity and continuity of user access behavior, detects user key invocation behavior, analyzes the rationality of key rotation cycles, and extracts the number of access request path nodes from routing trace metadata. A secondary score is generated through normalization operations to comprehensively evaluate the credibility of user key management behavior and request path characteristics. Based on the results of the initial and secondary scores, the user's trust level is determined, and an identity confirmation signal or permission adjustment signal is generated according to the trust level. The permission adjustment signal triggers the level weighting and marking of user access data, realizing dynamic adjustment of the data access scope. Simulated data is generated using the marked data to detect the repetition frequency of different fields, analyze field distribution characteristics, and further correct user permission levels accordingly. This achieves secure control and refined management of data access, effectively improving the system's ability to protect against abnormal access and its flexible adaptability to legitimate access.

[0020] Example 1: A blockchain-based data access management method, such as... Figure 1 As shown, it includes the following steps: Step S1: Before a user requests access to data, retrieve historical access records and count the access frequency. Calculate the access frequency using the access frequency, obtain the last access time, and combine the access frequency to give the user an initial score. Step S2: Detect the user key invocation behavior, analyze the user key rotation cycle based on the invocation behavior, and generate a secondary score by combining the number of path nodes in the user's current access request; Step S3: Analyze the user's trust level based on the initial and secondary rating results, and select to generate an identity confirmation signal or a permission adjustment signal based on the trust level. When generating a permission adjustment signal, retrieve the level weight of the user's access data, and filter and mark the user's access data according to the level weight. Step S4: Generate corresponding simulated data based on the labeled data, detect the number of times different fields of the user access data are repeated, analyze the field distribution characteristics of the simulated data based on the number of repetitions, and adjust user permissions based on the field distribution characteristics.

[0021] The specific implementation is as follows: In step S1, before the user initiates a data access request, the user's historical access records are retrieved through the access log. The historical access records include, but are not limited to, information such as various data items accessed by the user, access timestamps, access operation types, and access result status.

[0022] It should be noted that access logs are a structured collection of records that are automatically generated and stored when a user initiates an access operation on target data. They are continuously accumulated in chronological order and are used to fully reflect the user's access behavior characteristics in the system.

[0023] Based on historical access records, the user's access behavior is statistically processed, and the access frequency of the user within a preset time window is accumulated to calculate the total number of times the user successfully accesses data within the preset time window.

[0024] Based on this, the access frequency is calculated by dividing the access frequency by the duration of a preset time window. The access frequency represents the average intensity of a user's access behavior per unit of time, reflecting the user's active use of the data. The higher the access frequency, the more frequently the user accesses the data.

[0025] It should be noted that the preset time window refers to the time interval with a clear start and end boundary selected when performing access behavior statistics. It is a reference range used to limit the statistical access frequency and calculate the access frequency. For example, 1 hour, 24 hours or 7 days can be used as a complete statistical interval, and user access behavior can be independently counted within each window period.

[0026] At the same time, obtain the user's last access time, subtract the last access time from the current access request time, and get the access request interval. By combining access frequency with access request interval, an initial scoring function based on a normalized function is established to quantify the credibility of a user's access behavior. The specific calculation formula is as follows: ; in, This is the initial rating. For access frequency, For access request intervals, This is the time decay coefficient.

[0027] Map access frequency to To avoid the score increasing indefinitely due to frequent access, a range should be defined. The score is adjusted by decreasing the access interval. The time decay coefficient is a scaling factor introduced when calculating the impact of the user access request interval on the initial score. It is used to adjust the sensitivity of the access request interval to the initial score function, and meets the following conditions. The larger the value of k, the higher the sensitivity to the access request interval; when the access request interval approaches zero, this item is close to 1, that is, recent access can maintain a higher initial score, and when the access request interval increases, the initial score decreases proportionally.

[0028] In step S2, the user key call behavior is detected based on the access log. The user key call behavior consists of continuous key usage records, which include, but are not limited to, key identifier, call timestamp, call type, and call result status. Using the key usage records of the same user within a preset statistical period as input, after sorting them in ascending order by timestamp, we identify whether the key identifiers of two adjacent records have changed. If they have changed, it is determined to be a key rotation event and the occurrence time of the event is recorded. This yields a rotation event time series. We calculate the time interval between adjacent key rotation events, construct a time interval series, and use the median of the time interval series as the user key rotation period. When only one or no key rotation event is detected within the statistical period, the difference between the current access request time and the time of the most recent key rotation event is used as the user key rotation period to ensure that the user key rotation period is still calculable and consistent with the actual time scale when there are insufficient samples.

[0029] It should be noted that the preset statistical period refers to the time range used when detecting user key call behavior and calculating the key rotation period. It is used to limit the set of key usage records participating in the statistics and ensure that the calculation of the rotation period is stable and comparable. For example, 1 hour, 24 hours or 7 days can be used as a statistical period, and user key call behavior can be counted independently in each statistical period.

[0030] Extract the number of different nodes that actually participated in forwarding or verifying the request from the entry point to the completion of the current access request from the routing tracing metadata, and use it as the number of path nodes; Among them, route tracing metadata refers to the process record information generated and attached by each intermediate node during the transmission and processing of user access requests from the system entry node to the target data node. This information is used to fully describe the path characteristics of the access request within the system.

[0031] After obtaining the user key rotation cycle and the number of path nodes, a secondary score is generated to quantify the combined impact of key management behavior and request path characteristics on access trustworthiness. Based on a preset baseline rotation period, a normalization factor for the user key's rotation period is calculated to obtain the normalized rotation period. The specific calculation formula is as follows: ; in, For normalized rotation cycle, The user key rotation period. The baseline rotation period is derived from a preset key rotation system and is used to indicate the expected rotation frequency under normal and trusted operating conditions.

[0032] The number of path nodes is normalized to obtain the normalized number of path nodes. The specific calculation formula is as follows: ; in, To normalize the number of path nodes, This represents the number of path nodes. This is the path node number decay coefficient, used to characterize the additional reduction in score caused by each additional path node; The product of the normalized rotation period and the number of normalized path nodes is used as the secondary score; The normalized range of the secondary score values ​​is within the interval The larger the value, the more the user's key management behavior and path node characteristics conform to the trust standard.

[0033] In step S3, the initial rating and secondary rating distributions are standardized to obtain the initial rating coefficient and secondary rating coefficient, which are then compared with a preset trust threshold to analyze the user's trust level. If both the initial rating coefficient and the secondary rating coefficient are lower than the preset trust threshold, the user is judged to be at the first trust level. If only one of the initial rating coefficient and the secondary rating coefficient is lower than the preset trust threshold, the user is judged to be at the second trust level. Otherwise, the user is determined to be at the third trust level.

[0034] It should be explained that the standardization process includes, but is not limited to, standard linear transformation based on interval scaling, statistical Z-Score standardization, or normalization based on nonlinear mapping functions. The application of standardization will not be elaborated here. The preset trust threshold is used to measure whether the initial and secondary ratings of user ratings meet the safety and trust requirements. It is preset by professionals based on security strategies or user behavior statistics. For example, the trust threshold can be preset by collecting the mean or mean-weighted ratings of normal users under the same conditions.

[0035] If the user is at the first level of trust, an identity verification signal is generated; If the user is at the second trust level, a permission adjustment signal will be generated; If the user is at the third trust level, then the user is considered to be making a normal request to access data. When a user is at the first level of trust, it indicates that the user's rating is low and further identity verification is required. An identity verification signal is generated to trigger the identity verification process. When a user is at the second level of trust, it indicates that the user's rating is in the middle range. An access control signal is generated to restrict the scope of the user's data access, and further analysis is conducted to determine whether access control should be adjusted. When a user is at the third level of trust, it indicates that the user's rating is high and no identity verification or access control adjustment is required.

[0036] The user access data level weight is retrieved through the data hierarchical permission table. The level weight refers to the importance of the user access data in the blockchain data management. The higher the level weight, the higher the access permission requirements for the user access data.

[0037] It should be explained that the data hierarchical permission table is used to pre-set corresponding level weights for different data objects in the process of blockchain data access management, and to establish a mapping relationship with the corresponding access control policies. Through this permission table, the level weight of user access data can be quickly retrieved, and data with higher level weights can be marked. The higher the level weight, the higher the access control. The level weight is set by professionals according to the data type and business importance.

[0038] The user access data is sorted in descending order of level weights. The difference between adjacent level weights is calculated and combined into a difference sequence. The group of adjacent level weights with the largest difference is selected from the difference sequence, and the average value of the corresponding adjacent level weights is taken as the weight threshold. User access data is filtered, and user access data with a level weight higher than the weight threshold is identified as labeled data.

[0039] By combining a user's trust level with the weight of the user's access data, authentication can be triggered at low trust levels, the access scope can be dynamically narrowed at medium trust levels, and user access data with higher weight can be marked. This provides a basis for subsequent simulation data generation and behavioral analysis, ensuring the security of sensitive data while maintaining the timeliness and continuity of business processing.

[0040] In step S4, simulated data of the labeled data is generated through simulated data units. Simulated data refers to replacing the content of the labeled data with non-real data that has been de-identified or synthesized, while retaining the field structure and data type of the labeled data. For example, the content of the labeled data includes, but is not limited to, account identifiers, privacy document summaries attached off-chain, etc., to support normal interaction of user access requests and subsequent access behavior analysis without directly exposing important content.

[0041] It should be explained that a simulated data unit is a functional unit that performs content replacement processing on marked data. While retaining the field structure and field type of the marked data, the content is replaced with non-real data.

[0042] After the simulated data of the labeled data is generated, the user operates on the user access data in the current access request, and detects the number of times different fields of the user access data are repeated. A field refers to a data item in the user access data that carries specific information. The monitoring time is preset. During the monitoring time, the number of times different fields of user access data are repeated is detected. The sum of the number of times different fields are accessed is taken as the total number of times the field is accessed. The number of times each field is accessed is divided by the total number of times the field is accessed to obtain the field access ratio. It should be explained that the preset monitoring time is the duration range for collecting and analyzing user access behavior, such as 30 seconds, 1 minute, etc., which is specifically set by professionals; a field refers to the basic information unit in the user access data. It has an independent name and a fixed data type within the data and is used to store information of a specific category. For example, a user may request the "document summary" field multiple times during access.

[0043] The field distribution characteristics of the simulated data are obtained by summing the field access ratios of corresponding fields and taking the reciprocal. Field distribution characteristics reflect the degree of concentration of user access behavior on simulated data. In the process of blockchain data management, if it is detected that users have concentrated access to the fields corresponding to the simulated data within a preset period, it may cause data security management risks and require adjustment of user access permissions.

[0044] Compare the field distribution characteristics with a preset distribution threshold: If the field distribution characteristics exceed the preset distribution threshold, then the user's permissions will be adjusted; otherwise, the simulated data will be replaced with labeled data. The permission adjustment method is to reduce the access permission of the field corresponding to the marked data and limit the number of accesses. For example, it can be reduced from "readable raw data" to "readable processed data only", and an access limit can be set, such as allowing the same field to be accessed only 3 times within 5 minutes.

[0045] By comparing field distribution characteristics with preset distribution thresholds, the system dynamically quantifies and evaluates the degree of concentration of user access data. When users make abnormal concentrated accesses to fields of marked data, permission adjustments are triggered in a timely manner to prevent excessive centralized reading of data and potential security risks. If the access behavior is within the normal range, simulated data is replaced with marked data. This ensures data security while reducing interference with user business operations and improving the intelligence and security protection capabilities of the blockchain data management system.

[0046] It should be noted that the preset distribution threshold is a reference value used to determine whether user access data is within a safe range. It is preset by professionals based on the actual situation, for example, determined based on historical access logs, or set by statistically analyzing the average field distribution characteristics of a large number of normal users within the same monitoring period.

[0047] Example 2: A blockchain-based data access management system, such as... Figure 2 As shown, it includes a behavior scoring module, a key path module, a trust management module, and a data simulation module. The functions of each module are as follows: Before a user requests access to data, the behavior scoring module retrieves historical access records and counts access frequency. It then uses the access frequency to calculate the access frequency, obtains the last access time, and combines the access frequency to give the user an initial score. The key path module detects the user's key calling behavior, analyzes the user's key rotation cycle based on the calling behavior, and generates a secondary score by combining the number of path nodes in the user's current access request. The trust management module analyzes the user's trust level based on the initial and secondary rating results. Based on the trust level, it selects to generate an identity confirmation signal or a permission adjustment signal. When generating a permission adjustment signal, it retrieves the level weight of the user's access data and filters and marks the user's access data according to the level weight. The data simulation module generates corresponding simulated data based on the labeled data, detects the number of times different fields of the user access data are repeated, analyzes the field distribution characteristics of the simulated data based on the number of repetitions, and adjusts user permissions based on the field distribution characteristics.

[0048] Finally, it should be noted that in this paper, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0049] Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0050] In this document, the singular forms “a,” “an,” and “the” may also include the plural forms unless the context clearly indicates otherwise. It should also be understood that terms such as “comprising / including” or “having” specify the presence of the stated features, integrals, steps, operations, components, parts, or combinations thereof, but do not preclude the possibility of the presence or addition of one or more other features, integrals, steps, operations, components, parts, or combinations thereof. Meanwhile, the term “and / or” as used in this specification includes any and all combinations of the associated listed items.

[0051] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can be referred to each other.

[0052] The above description of the disclosed embodiments will enable those skilled in the art to make or use various modifications to these embodiments. It will be readily apparent to those skilled in the art that the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A blockchain-based data access management method, characterized in that: Includes the following steps: Step S1: Before a user requests access to data, retrieve historical access records and count the user's access frequency. Calculate the user's access frequency using the access frequency, obtain the last access time, and combine the access frequency to give the user an initial score. Step S2: Detect the user key invocation behavior, analyze the user key rotation cycle based on the invocation behavior, and generate a secondary score by combining the number of path nodes in the user's current access request; Step S3: Analyze the user's trust level based on the initial and secondary rating results, and select to generate an identity confirmation signal or a permission adjustment signal based on the trust level. When generating a permission adjustment signal, retrieve the level weight of the user's access data, and filter and mark the user's access data according to the level weight. Step S4: Generate corresponding simulated data based on the labeled data, detect the number of times different fields of the user access data are repeated, analyze the field distribution characteristics of the simulated data based on the number of repetitions, and adjust user permissions based on the field distribution characteristics; In step S4, simulated data refers to data in which the content of the marked data is replaced with non-real data that has been de-identified or synthesized, while retaining the field structure and data type of the marked data; the field distribution characteristics reflect the degree of concentration of user access behavior on the simulated data.

2. The data access management method based on blockchain according to claim 1, characterized in that: In step S1, before the user initiates a data access request, the user's historical access records are retrieved through the access log; The access frequency is obtained by statistically processing the user's access behavior based on historical access records and accumulating the total number of successful accesses. The access frequency is obtained by dividing the access frequency by the duration of the preset time window. Get the user's last access time, subtract the last access time from the current access request time, and get the access request interval. By combining access frequency with access request interval, an initial scoring function based on a normalization function is established to obtain the initial score.

3. The data access management method based on blockchain according to claim 1, characterized in that: In step S2, the user key usage behavior is obtained by calling consecutive key usage records based on the access log; Key usage records are sorted in ascending order by timestamp; The key usage record is identified by the change of key identifiers between two adjacent records, which is recorded as a key rotation event. Calculate the time interval between adjacent key switching events and construct a time interval sequence; The median of the time interval sequence is used as the user key rotation period.

4. The data access management method based on blockchain according to claim 3, characterized in that: In step S2, the number of different nodes that actually participated in forwarding or verifying the access request from the entry point to the completion of the access request is extracted from the route tracing metadata and used as the number of path nodes; Based on the preset baseline rotation period, the normalization factor of the user key rotation period is calculated to obtain the normalized rotation period. The number of path nodes is normalized to obtain the normalized number of path nodes. The product of the normalized rotation period and the number of normalized path nodes is used as the secondary score.

5. The data access management method based on blockchain according to claim 4, characterized in that: In step S3, the initial rating and secondary rating distributions are standardized to obtain the initial rating coefficient and secondary rating coefficient, which are then compared with a preset trust threshold to analyze the user's trust level. If both the initial rating coefficient and the secondary rating coefficient are lower than the preset trust threshold, the user is determined to be at the first trust level, and an identity confirmation signal is generated. If either the initial rating coefficient or the secondary rating coefficient is lower than the preset trust threshold, the user is determined to be at the second trust level, and a permission adjustment signal is generated. Otherwise, the user is determined to be at the third trust level.

6. The data access management method based on blockchain according to claim 5, characterized in that: In step S3, the user's access level weight is retrieved through the data hierarchy permission table; The user access data is sorted in descending order of level weights. The difference between adjacent level weights is calculated and combined into a difference sequence. The group of adjacent level weights with the largest difference is selected from the difference sequence, and the average value of the corresponding adjacent level weights is taken as the weight threshold. User access data is filtered, and user access data with a level weight higher than the weight threshold is identified as labeled data.

7. The data access management method based on blockchain according to claim 1, characterized in that: In step S4, the field distribution characteristics are compared with a preset distribution threshold: If the field distribution characteristics exceed the preset distribution threshold, then the user's permissions will be adjusted; otherwise, the simulated data will be replaced with labeled data. The methods for adjusting permissions include lowering the access permissions of the fields corresponding to the marked data and limiting the number of times they can be accessed.

8. A blockchain-based data access management system, used to implement the blockchain-based data access management method according to any one of claims 1-7, characterized in that: It includes a behavior scoring module, a key path module, a trust management module, and a data simulation module. The functions of each module are as follows: Before a user requests access to data, the behavior scoring module retrieves historical access records and counts the user's access frequency. It then uses the access frequency to calculate the user's access frequency, obtains the last access time, and combines the access frequency to give the user an initial score. The key path module detects the user's key calling behavior, analyzes the user's key rotation cycle based on the calling behavior, and generates a secondary score by combining the number of path nodes in the user's current access request. The trust management module analyzes the user's trust level based on the initial and secondary rating results. Based on the trust level, it selects to generate an identity confirmation signal or a permission adjustment signal. When generating a permission adjustment signal, it retrieves the level weight of the user's access data and filters and marks the user's access data according to the level weight. The data simulation module generates corresponding simulated data based on the labeled data, detects the number of times different fields of the user access data are repeated, analyzes the field distribution characteristics of the simulated data based on the number of repetitions, and adjusts user permissions based on the field distribution characteristics.

Images