Blockchain-based autonomous identity fine-grained access control method and related device

Abstract

The application discloses a blockchain-based autonomous identity fine-grained access control method and related equipment, and the method comprises the following steps: generating the autonomous identity information of a user by an identity management module and storing the autonomous identity information in a blockchain; generating an access control strategy according to a domain-specific language by an access control module, encapsulating the access control strategy in a smart contract, and deploying the smart contract encapsulating the access control strategy in the blockchain; receiving a resource access request of the user, calling the smart contract to perform identity authentication on the user according to the autonomous identity information by a strategy execution module; if the identity authentication is successful, performing fine-grained matching on the access authority of the user according to the access control strategy by the smart contract to obtain an authority check result; and executing a target response event according to the authority check result by the smart contract. The application can adapt to changing business requirements and security environments, enhance the flexibility of the system, improve the speed of access control decision-making, improve the security of the system, and can be widely applied to the technical field of data security.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a blockchain-based method and related equipment for fine-grained access control of autonomous identity. Background Technology

[0002] With the rapid development of information technology, blockchain technology is gradually being applied to various fields, especially in data security and identity management. Currently, blockchain-based decentralized identity (DID) systems have become an important technology for ensuring data privacy and access control. However, despite the progress made, many problems still exist in the area of ​​fine-grained access control.

[0003] However, current blockchain-based authentication systems suffer from insufficient flexibility in access control: traditional DID systems often employ static or predefined access control policies, which struggle to adapt to changing business needs or complex permission requirements. Secondly, current DID systems are inefficient in enforcing access control policies: due to the inherent characteristics of blockchain, any operation or data storage is constrained by the blockchain network's performance; especially when handling large numbers of user requests and complex permission rules, traditional DID systems may experience significant delays in authentication and permission checks, thus impacting user experience.

[0004] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the Invention

[0005] The embodiments of this application aim to at least partially address one of the technical problems in the related art. Therefore, the main objective of the embodiments of this application is to propose a blockchain-based autonomous identity fine-grained access control method and related devices, which can adapt to changing business needs and security environments, enhance system flexibility, significantly improve the speed of access control decisions, more effectively protect system resources, prevent unauthorized access and potential security threats, and significantly improve system security.

[0006] To achieve the above objectives, one aspect of this application proposes a blockchain-based autonomous identity fine-grained access control method, applied to an identity access control system. The identity access control system includes an identity management module, an access control module, and a policy execution module. The method includes the following steps: The system receives a user's identity registration request, generates the user's self-identity information through the identity management module, and stores the self-identity information on the blockchain. The system receives the user's policy configuration request, generates the user's access control policy based on the domain-specific language through the access control module, and encapsulates the access control policy in a smart contract to deploy the smart contract containing the access control policy on the blockchain. The system receives the user's resource access request, obtains the autonomous identity information from the blockchain through the policy execution module, and calls the smart contract to verify the user's identity based on the autonomous identity information. If the user's authentication is successful, the smart contract performs fine-grained matching of the user's access permissions according to the access control policy to obtain the permission check result. The target response event is executed by the smart contract based on the permission check result.

[0007] To achieve the above objectives, another aspect of this application proposes a blockchain-based autonomous identity fine-grained access control device, applied to an identity access control system. The identity access control system includes an identity management module, an access control module, and a policy execution module. The device includes the following modules: The self-identity information generation module is used to receive the user's identity registration request, generate the user's self-identity information through the identity management module, and store the self-identity information on the blockchain; An access control policy generation module is used to receive the user's policy configuration request, generate the user's access control policy according to the domain-specific language through the access control module, and encapsulate the access control policy in a smart contract so as to deploy the smart contract containing the access control policy on the blockchain. The user authentication module is used to receive the user's resource access request, obtain the autonomous identity information from the blockchain through the policy execution module, and call the smart contract to authenticate the user based on the autonomous identity information; The access permission matching module is used to perform fine-grained matching of the user's access permissions according to the access control policy through the smart contract if the user's authentication is successful, and obtain the permission check result. The target response event execution module is used to execute the target response event according to the permission check result through the smart contract.

[0008] To achieve the above objectives, another aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0009] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0010] To achieve the above objectives, another aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0011] The embodiments of this application include at least the following beneficial effects: This application provides a blockchain-based method and related equipment for fine-grained access control of autonomous identity. This solution is applied to an identity access control system, which includes an identity management module, an access control module, and a policy execution module. The method receives user registration requests, generates user autonomous identity information through the identity management module, and stores the autonomous identity information on the blockchain. It receives user policy configuration requests, generates user access control policies based on a domain-specific language through the access control module, and encapsulates the access control policies in a smart contract, deploying the smart contract containing the access control policies on the blockchain. It receives user resource access requests, retrieves autonomous identity information from the blockchain through the policy execution module, and calls the smart contract to authenticate the user based on the autonomous identity information. If the user's authentication is successful, the smart contract performs fine-grained matching of the user's access permissions according to the access control policy to obtain the permission check result. The smart contract executes the target response event based on the permission check result. This application's embodiments, through the use of domain-specific languages ​​and customized access control policies, make policy definitions more flexible, adaptable to changing business needs and security environments, and enhance system flexibility; through automated policy execution via smart contracts, the speed of access control decisions is significantly improved, thereby enhancing the overall efficiency of the system; through simplified policy definitions and automated policy execution, the complexity of access control management for users is reduced, providing a smoother and more convenient user experience; through fine-grained access control, system resources can be protected more effectively, preventing unauthorized access and potential security threats, significantly improving system security. Attached Figure Description

[0012] Figure 1 This is a flowchart of a blockchain-based fine-grained access control method for autonomous identity provided in an embodiment of this application; Figure 2 This is a schematic diagram of the framework of a blockchain-based autonomous identity fine-grained access control system provided in the embodiments of this application; Figure 3 This is a schematic diagram of the user request to create an identity provided in an embodiment of this application; Figure 4This is a flowchart illustrating the user-defined access control policy provided in an embodiment of this application; Figure 5 This is a flowchart illustrating the execution access control policy of a smart contract according to an embodiment of this application; Figure 6 This is a flowchart illustrating the abnormal behavior monitoring and analysis process provided in the embodiments of this application; Figure 7 This is a schematic diagram of the cross-chain interoperability process provided in the embodiments of this application; Figure 8 This is a schematic diagram of the structure of the blockchain-based autonomous identity fine-grained access control device provided in the embodiments of this application; Figure 9 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0014] It is understood that the terms “first,” “second,” etc., used in this application may be used herein to describe various concepts, but unless otherwise stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to a determination” as used herein may be interpreted as “when…” or “when…” or “in response to a determination.”

[0015] As used in this application, the terms "at least one", "multiple", "each", "any", etc., "at least one" includes one, two or more, "multiple" includes two or more, "each" refers to each of the corresponding multiples, and "any" refers to any one of the multiples.

[0016] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0017] With the rapid development of information technology, blockchain technology is gradually being applied to various fields, especially in data security and identity management. Currently, blockchain-based decentralized identity (DID) systems have become an important technology for ensuring data privacy and access control. However, despite the progress made, many problems still exist in the field of fine-grained access control. First, current blockchain-based authentication systems lack flexibility in permission management: traditional DID systems often use static or predefined access control policies, which are difficult to adapt flexibly to changing business needs or complex permission requirements; current systems typically lack the ability to dynamically adjust access permissions, especially when the environment or business scenario changes, making it impossible to update permissions in real time. Second, current DID systems are inefficient in executing access control policies: due to the inherent characteristics of blockchain, any operation or data storage is constrained by the performance of the blockchain network; especially when handling a large number of user requests and complex permission rules, traditional DID systems may experience significant delays in authentication and permission checks, thus affecting user experience; furthermore, frequent policy verification and execution operations may increase on-chain computational overhead, thereby affecting the efficiency and response speed of the entire system. Secondly, the lack of real-time security monitoring and response capabilities is also a weakness of current technologies: while blockchain technology can guarantee the immutability of data, it lacks effective real-time monitoring and response mechanisms when the system encounters potential security threats; current DID systems often lack the ability to quickly detect and handle malicious behavior that violates access control policies, resulting in security incidents not being stopped in time. Finally, with the diversification of blockchain platforms, cross-chain interoperability issues are becoming increasingly prominent: due to differences in underlying architecture, consensus mechanisms, and data formats, different blockchain systems face many challenges in cross-chain operations, and current technologies do not yet fully support cross-chain data mutual recognition and access control.

[0018] Although DID provides a decentralized authentication method, it still faces challenges in fine-grained permission management, execution efficiency, real-time security monitoring, and cross-chain interoperability. Specific problems include: (1) Insufficient flexibility of access control policies: the current system is difficult to adjust permissions according to dynamic needs and lacks support for fine-grained permission management; (2) Low policy execution efficiency: the DID system is inefficient when performing complex permission verification, affecting user experience; (3) Limited real-time monitoring and response capabilities: the current system lacks an effective real-time monitoring and response mechanism and cannot respond to security threats in a timely manner; (4) Cross-chain interoperability issues: poor interoperability between different blockchain platforms limits the widespread application of the DID system.

[0019] In view of this, this application provides a blockchain-based method and related equipment for fine-grained access control of autonomous identity. This solution is applied to an identity access control system, which includes an identity management module, an access control module, and a policy execution module. The system receives user registration requests, generates user autonomous identity information through the identity management module, and stores the autonomous identity information on the blockchain. It also receives user policy configuration requests, generates user access control policies based on a domain-specific language through the access control module, encapsulates the access control policies in a smart contract, and deploys the smart contract containing the access control policies on the blockchain. Furthermore, it receives user resource access requests, retrieves autonomous identity information from the blockchain through the policy execution module, and calls the smart contract to authenticate the user based on the autonomous identity information. If the user's authentication is successful, the smart contract performs fine-grained matching of the user's access permissions according to the access control policies to obtain the permission check result. Finally, the smart contract executes the target response event based on the permission check result. This application's embodiments, through the use of domain-specific languages ​​and customized access control policies, make policy definitions more flexible, adaptable to changing business needs and security environments, and enhance system flexibility; through automated policy execution via smart contracts, the speed of access control decisions is significantly improved, thereby enhancing the overall efficiency of the system; through simplified policy definitions and automated policy execution, the complexity of access control management for users is reduced, providing a smoother and more convenient user experience; through fine-grained access control, system resources can be protected more effectively, preventing unauthorized access and potential security threats, significantly improving system security.

[0020] The blockchain-based fine-grained access control method for autonomous identity provided in this application relates to the field of data security technology. This blockchain-based fine-grained access control method can be applied to terminals, servers, or software running on either terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or in-vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the blockchain-based fine-grained access control method for autonomous identity, but is not limited to the above forms.

[0021] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0022] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the proper functioning of these embodiments acquired.

[0023] Please see Figure 1 , Figure 1 This is an optional flowchart of the blockchain-based fine-grained access control method for autonomous identity provided in the embodiments of this application. Figure 1 The method described above is applied to an identity access control system, which includes an identity management module, an access control module, and a policy enforcement module. Figure 1 The method may include, but is not limited to, steps S101 to S105.

[0024] Step S101: Receive the user's identity registration request, generate the user's self-identity information through the identity management module, and store the self-identity information on the blockchain; Please see Figure 2 , Figure 2 This is a schematic diagram of the framework of a blockchain-based autonomous identity fine-grained access control system provided in the embodiments of this application, as shown below. Figure 2As shown, the core modules of the system include an identity management module, an access control module, a policy execution module, a real-time monitoring module, and a cross-chain interoperability module. Through the collaborative work of these modules, the system achieves fine-grained access control based on blockchain technology, aiming to achieve flexible and effective access control while improving the system's security and efficiency.

[0025] The identity management module is responsible for generating and managing self-identified identities (DIDs). Users first generate a public-private key pair through the system, then create their self-identified identity (DID) based on the public key, and store the DID information on the blockchain to ensure the uniqueness and security of the identity. Users can update and manage their identity information, including their personal profile, permissions, and roles, through an interface.

[0026] The access control module allows users to define access control policies based on roles and permissions. Users can set access rules for resources in the system (such as files, database records, smart contracts, etc.) by defining different roles and permissions. This module also supports fine-grained permission assignment, ensuring that different users receive appropriate permissions according to their roles.

[0027] The policy enforcement module encapsulates access control policies in smart contracts and deploys these smart contracts on the blockchain. When a user requests access to a resource, the system calls the smart contract to perform authentication and permission checks, ensuring that the user's actions comply with the predefined access control policies.

[0028] The real-time monitoring module continuously monitors user behavior and system activity to detect potential security threats or abnormal behavior in real time. Once a violation of access control policies is detected, the system will trigger the corresponding security response mechanism.

[0029] The cross-chain interoperability module supports mutual recognition and data exchange of Distributed Identity (DID) information between different blockchain platforms, solving the problems of identity authentication and data transmission in cross-chain operations. By employing cross-chain protocols and encrypted communication channels, the system ensures the security and integrity of data transmitted between different blockchain platforms.

[0030] Please see Figure 3 , Figure 3 This is a schematic diagram of the user request to create an identity provided in an embodiment of this application, such as... Figure 3As shown, the generation process of Self-Determined Identity (DID) information is as follows: First, the user creates their own public-private key pair using a key pair generation tool and initiates an identity registration request to the system to create an identity. The system's identity management module receives the identity registration request. Then, the identity management module registers the basic identity identifier and public key information of the DID onto the blockchain, forming the user's Self-Determined Identity (DID) information, i.e., forming an identity credential that can be recognized by the system. Simultaneously, the private key is stored in the user's device to ensure the user's complete control over their identity. Recording Self-Determined Identity (DID) information through the blockchain ensures the immutability and security of the identity.

[0031] Step S102: Receive the user's policy configuration request, generate the user's access control policy according to the domain-specific language through the access control module, and encapsulate the access control policy in a smart contract to deploy the smart contract containing the access control policy on the blockchain; Please see Figure 4 , Figure 4 This is a flowchart illustrating the user-defined access control policy provided in an embodiment of this application, such as... Figure 4 As shown, the process of defining access control policies is as follows: First, the system receives a policy configuration request from a user who needs to define roles and permissions. Then, the access control module generates the user's access control policy based on the domain-specific language (DSL) and encapsulates the access control policy in a smart contract. Finally, the smart contract containing the access control policy is deployed on the blockchain.

[0032] Step S103: Receive the user's resource access request, obtain the autonomous identity information from the blockchain through the policy execution module, and call the smart contract to verify the user's identity based on the autonomous identity information; In some embodiments, step S103 may include: receiving a user's resource access request; wherein the resource access request includes a digital signature; calculating the user's unique identity identifier based on the resource access request through a policy execution module, and obtaining self-identity information corresponding to the unique identity identifier from the blockchain; wherein the self-identity information includes public key information; and calling a smart contract through the policy execution module to read the public key information in the self-identity information, and verifying the digital signature in the resource access request based on the public key information.

[0033] Please see Figure 5 , Figure 5 This is a flowchart illustrating the smart contract execution access control policy provided in an embodiment of this application, such as... Figure 5As shown, the overall implementation process of smart contract execution includes an identity verification stage, a permission determination stage, and a data processing stage. In step S103, the specific implementation process of the identity verification stage is as follows: When a user initiates a resource access request, the system receives the user's resource access request through the strategy execution module and calls the smart contract for identity verification based on the user's Distributed Identity (DID) information. Specifically, the strategy execution module first calculates the unique identifier of the user's Distributed Identity (DID) information using a hash algorithm and retrieves the user's identity registration information corresponding to the unique identifier from the blockchain; then, the smart contract reads the user's public key information from the user's identity registration information and verifies the digital signature in the access request based on the public key information to ensure the authenticity and integrity of the request source. After successful identity verification, the system maps the user's identity to the corresponding role and its permission set through the strategy execution module, that is, loads the role and permissions bound to the user's identity, providing a basis for subsequent permission checks.

[0034] Step S104: If the user's authentication is successful, the smart contract performs fine-grained matching of the user's access permissions according to the access control policy to obtain the permission check result. In some embodiments, step S104 may include: if the user's authentication is successful, the policy execution module maps the user's self-identity to the corresponding role and permission set to determine the user's access permissions based on the user's corresponding role and permission set; and the smart contract performs fine-grained matching of the user's access permissions according to the access control policy to obtain the permission check result.

[0035] like Figure 5 As shown, the overall implementation process of smart contract execution includes an identity verification stage, a permission determination stage, and a data processing stage. In step S104, the specific implementation process of the permission determination stage is as follows: the smart contract performs fine-grained matching of user access permissions according to the pre-deployed access control policy. Specifically, the access control policy is defined using a domain-specific language (DSL), and the policy content is organized in the form of an on-chain stored structure, including resource type (ResourceType), operation type (ActionType), and corresponding authorization conditions. During execution, the smart contract parses the policy table sequentially and determines the user's role permissions: if the match is successful, the smart contract returns an "access allowed" flag; if the permissions are insufficient, the request is rejected and a rejection event log is generated, which records the reason for rejection and the relevant resource flag.

[0036] Step S105: Execute the target response event through the smart contract based on the permission check result.

[0037] In some embodiments, step S105 may include: if the permission check result determines that the user's access permission is successfully matched, then the smart contract returns an access permission identifier to the user to allow the user to perform the access behavior, and writes the target element information carried in the resource access request into the blockchain; if the permission check result determines that the user's access permission is not successfully matched, then the smart contract rejects the resource access request and generates a rejection event log, and records the security event through the smart contract to synchronize the security event to the real-time monitoring module to trigger the security response mechanism.

[0038] In step S105, if the permission check result determines that the user's access permissions match successfully, the smart contract returns an "access allowed" flag; if the permission check result determines that the user's access permissions do not match successfully or the permissions are insufficient, the request is rejected and a rejection event log is generated, which records the reason for rejection and the relevant resource identifier.

[0039] like Figure 5 As shown, the overall implementation process of smart contract execution includes the identity verification stage, the permission determination stage, and the data processing stage. The data processing stage process is as follows: Once authentication and authorization checks are complete, the system triggers the on-chain data processing module via an event mechanism: For access requests that pass verification, the system will encapsulate the target element information (which includes request parameters, operation timestamp, resource identifier, and user DID hash) into a transaction and write it into a block to achieve traceability of access behavior. For any abnormal or unauthorized access detected, the system will immediately record the security event and synchronize it to the real-time monitoring module to trigger a response mechanism, such as freezing the relevant DID, suspending suspicious smart contract calls, or notifying the administrator.

[0040] The policy execution module, through the coordinated operation of the three stages—authentication, permission determination, and data processing—achieves a complete closed-loop process for access requests, from verification and authorization to data upload to the blockchain, ensuring the security, auditability, and execution efficiency of access control. This process implements scalable data processing logic at the smart contract layer, offering stronger real-time performance compared to traditional DID access control systems. Furthermore, the encapsulation, automated execution, and security upgrade mechanisms of smart contracts enhance contract security and simplify maintenance and update processes.

[0041] In some embodiments, the method may further include: dynamically monitoring the user's access operation behavior through a real-time monitoring module, and performing anomaly analysis on the access operation behavior using pattern matching technology to obtain anomaly analysis results; if the anomaly analysis results determine that the access operation behavior is characterized as abnormal behavior, then automatically invoking a security response contract to suspend the user's access permissions and recording the security event.

[0042] The real-time monitoring module continuously monitors user behavior and system activity to detect potential security threats or abnormal behavior. Once a violation of access control policies is detected, the system will trigger the corresponding security response mechanism. Violations of access control policies may include, but are not limited to: 1) repeatedly or frequently submitting the same sensitive requests after being denied access; 2) forging self-identity (DID) information or modifying signature information; 3) forging requests to access resources through unauthorized interfaces or cross-chain methods.

[0043] Specifically, the monitoring and response process is as follows: First, the system analyzes on-chain data and network traffic through a real-time monitoring module to monitor user behavior in real time. Then, the real-time monitoring module uses pattern matching technology to identify abnormal behavior or potential attack behavior. When abnormal behavior is detected, the system can immediately take preventive measures, such as revoking the violation, locking the violating account, or sending a security alert to the administrator. At the same time, the monitoring data is recorded and stored for post-event auditing and analysis. This data can be used to analyze the root cause of security incidents and improve the system's protection capabilities.

[0044] The monitoring data may include, but is not limited to: user access behavior logs (access time, resource identifier, operation type, etc.); system events (permission verification failure, frequent requests, policy changes, etc.); anomaly detection results (anomaly type, threshold exceedance records, risk scores, etc.); and security response operations (account freezing, policy adjustment, alarm triggering records, etc.).

[0045] Please see Figure 6 , Figure 6 This is a flowchart illustrating the abnormal behavior monitoring and analysis process provided in this application embodiment, such as... Figure 6 As shown, the overall implementation process of real-time monitoring and abnormal behavior detection includes four main stages: behavior pattern analysis, abnormal detection analysis, trigger condition judgment, and continuous monitoring and data processing. The specific implementation process is as follows: 1) Behavioral pattern analysis phase: First, the system constructs a user behavior vector based on user operation records, access time, resource type, and interaction frequency through a real-time monitoring module. Then, the behavior analysis module in the real-time monitoring module uses multi-dimensional feature extraction and clustering algorithms (such as K-Means or DBSCAN) to perform clustering analysis on historical behaviors, thereby forming standardized user behavior profiles. These profile data are stored in the state table of the blockchain using a hash index to ensure traceability and consistency during subsequent detection.

[0046] When a new behavior occurs, the system calculates the similarity between its feature vector and historical behavior patterns (such as cosine similarity or Euclidean distance) to determine whether the behavior is within the normal range.

[0047] 2) Abnormal behavior detection and analysis stage: The anomaly detection module within the real-time monitoring module utilizes a hybrid detection mechanism combining thresholds and models for anomaly behavior detection and analysis. Specifically, the threshold detection component monitors key indicators (access frequency, request interval, data volume, etc.) in real time, marking any behavior exceeding a set safety range as suspicious. The model detection component uses machine learning classifiers (such as Isolation Forest or One-Class SVM) to predict and judge behavioral sequences, identifying potential anomalies from a probabilistic perspective. Detection results are recorded on the blockchain as events, storing anomaly feature values ​​and contextual information to provide a basis for subsequent analysis.

[0048] 3) Trigger condition judgment: Specifically, the system triggers an exception response when any of the following conditions are met: a. The similarity between the user's access behavior and its historical behavior characteristics is lower than a preset threshold; b. The number of accesses within a unit of time exceeds the system's set limit; c. The user request involves highly sensitive resources that are not included in the whitelist policy; d. Multiple permission verifications failed or tampering with the request signature was detected.

[0049] Upon confirming that abnormal behavior has triggered an abnormal response, the system automatically invokes the Security Response Contract to suspend the user's access permissions, record the security event, and notify the administrator. If necessary, cross-chain synchronization can be triggered to update the security status of other nodes.

[0050] 4) Continuous monitoring and data processing stage: In this embodiment, the real-time monitoring module continuously analyzes on-chain behavioral data using a sliding window mechanism.

[0051] The data processing submodule in the real-time monitoring module is responsible for encrypting and encapsulating the monitored behavior logs and anomaly detection results, and storing them in a Merkle tree structure for subsequent auditing and verification.

[0052] The system also periodically aggregates and analyzes abnormal events, automatically generates risk reports, and feeds them back to the policy management module for dynamic adjustment of access control policies, achieving closed-loop management of "monitoring-response-optimization".

[0053] Through the synergistic effect of the four stages described above in the real-time monitoring module, the real-time monitoring mechanism of this application can not only provide immediate protection at the access control level, but also predictively detect potential security threats. Its advantage lies in combining the design concepts of "behavioral modeling + intelligent detection + on-chain auditing + policy adaptive optimization," enabling the system to have self-learning and dynamic defense capabilities.

[0054] In some embodiments, the method may further include: receiving a user's cross-chain identity authentication request; verifying the user's identity using a cross-chain protocol via a cross-chain interoperability module; if the user passes the identity verification, encrypting the user's data to be transmitted via the cross-chain interoperability module to obtain encrypted transmission data, and sending the encrypted transmission data from the user's main blockchain to the target blockchain; performing hash verification on the encrypted transmission data via the target blockchain, and distributing and storing key data fragments of the hash-verified encrypted transmission data across different blockchains using distributed storage technology; wherein, different blockchains synchronize data states through a consensus algorithm; when data on any blockchain is updated, a synchronization instruction is automatically broadcast via the cross-chain interoperability module, and each different blockchain performs data verification and state updates according to the synchronization instruction.

[0055] The cross-chain interoperability module supports mutual recognition and data exchange of Distributed Identity (DID) information between different blockchain platforms, solving the problems of identity authentication and data transmission in cross-chain operations. By employing cross-chain protocols and encrypted communication channels, the system ensures the security and integrity of data transmitted between different blockchain platforms.

[0056] In the embodiments of this application, please refer to Figure 7 , Figure 7 This is a schematic diagram of the cross-chain interoperability process provided in the embodiments of this application, such as... Figure 7 As shown, the cross-chain operation process is as follows: First, the system receives the user's cross-chain identity authentication request; then, the cross-chain interoperability module verifies the user's identity using a cross-chain protocol; if the user passes the identity verification, the cross-chain interoperability module encrypts the user's data to be transmitted, obtaining encrypted transmission data, and sends the encrypted transmission data from the user's main blockchain to the target blockchain; next, the target blockchain performs hash verification on the encrypted transmission data, and uses distributed storage technology to distribute and store key data fragments of the hash-verified encrypted transmission data across different blockchains; different blockchains synchronize data states through a consensus algorithm; when data on any blockchain is updated, the cross-chain interoperability module automatically broadcasts a synchronization command, and each different blockchain performs data verification and state updates according to the synchronization command, thereby achieving cross-chain data exchange.

[0057] The specific implementation scheme for cross-chain operations is as follows: When users operate across different blockchain platforms, the system verifies the user's DID through a cross-chain protocol to ensure consistency of identity across different platforms. Simultaneously, data transmission uses an encrypted communication channel to prevent data tampering or theft during transmission. Data storage employs distributed storage technology (IPFS or sharded block storage) to distribute key data fragments across multiple nodes, with nodes synchronizing data states through a consensus algorithm. Through encryption and distributed storage technologies, the system ensures data integrity and confidentiality, guaranteeing seamless operation in multi-blockchain environments.

[0058] Specifically, in a multi-blockchain environment, the system first establishes an encrypted communication channel between the main chain and sub-chains through a cross-chain protocol. When data is transmitted between the main chain and other blockchains, the system uses an asymmetric encryption algorithm to sign and encrypt the data packets. The encrypted data is sent to the target chain through the cross-chain communication module and is hashed and verified by the verification nodes on the target chain to ensure the integrity and tamper-proof nature of the data during transmission. At the same time, the system uses distributed storage technology (IPFS or sharded block storage) to distribute and store key data fragments across multiple nodes, and the nodes synchronize the data state through a consensus algorithm. When data on any chain is updated, the cross-chain interoperability module automatically broadcasts a synchronization command, triggering each chain node to perform data verification and state update, thereby realizing a closed-loop process of encryption, verification, synchronization, and traceability between multiple blockchains.

[0059] Through the above process, the system implements a three-layer protection mechanism of encrypted data transmission, distributed storage, and hash verification in cross-chain operations, ensuring the security and consistency of data in a multi-blockchain environment.

[0060] In some embodiments, the identity access control system deploys a multi-level caching mechanism, which may further include: when the identity access control system receives a user's resource access request, determining whether the target resource data is in a preset multi-level cache based on the cache priority through the target filter in the multi-level caching mechanism; if the target resource data is in the preset multi-level cache, then retrieving the target resource data from the preset multi-level cache; if the target resource data is not in the preset multi-level cache, then retrieving the target resource data from the blockchain through the policy execution module.

[0061] In this embodiment, the identity access control system establishes a multi-level caching mechanism between on-chain and off-chain operations to reduce the frequency of smart contracts accessing the blockchain state. This multi-level caching mechanism includes a multi-level cache and a Bloom filter structure.

[0062] Multi-level caching includes three levels of caching, specifically: The first-level cache (local cache) sets up a memory cache module in the node's runtime environment to temporarily store the most recent authentication, policy matching, and permission results for direct access by repeated requests within a short period of time; Level 2 cache (off-chain database cache): The system maintains a lightweight database off-chain and periodically synchronizes the policy state and user DID mapping table on the blockchain; Level 3 cache (on-chain state reference cache): The smart contract stores the hash index of key states. When the strategy or identity information is updated, only the hash consistency is checked instead of a full query, thus significantly reducing gas consumption.

[0063] The cache priority refers to the system first retrieving the target resource data from the first-level cache. If the target resource data is not found in the first-level cache, it is then retrieved from the second-level cache. If the data is not found in the second-level cache, it is then retrieved from the third-level cache. If the target resource data is still not found in the third-level cache, the system initiates a blockchain read request.

[0064] During the query and retrieval process, the system utilizes a Bloom filter structure to quickly determine whether the target resource data exists in the three-level cache set, avoiding unnecessary on-chain access. Only when the Bloom filter fails to hit all three levels of the cache set does the system initiate a blockchain read request and synchronize the result back to the cache layer, achieving a dynamic balance between cache hits and data consistency.

[0065] Through this multi-level caching mechanism that combines multi-level caching with Bloom filters, the system achieves optimization effects such as reduced state read latency, improved query performance, and reduced on-chain access frequency.

[0066] Steps S101 to S105 as illustrated in this embodiment involve: receiving a user's identity registration request; generating the user's self-identity information through the identity management module and storing the self-identity information on the blockchain; receiving a user's policy configuration request; generating the user's access control policy according to a domain-specific language through the access control module; encapsulating the access control policy in a smart contract; deploying the smart contract containing the access control policy on the blockchain; receiving a user's resource access request; obtaining the self-identity information from the blockchain through the policy execution module; and calling the smart contract to authenticate the user based on the self-identity information; if the user's authentication is successful, performing fine-grained matching of the user's access permissions according to the access control policy through the smart contract to obtain the permission check result; and executing the target response event through the smart contract based on the permission check result. This application's embodiments, through the use of domain-specific languages ​​and customized access control policies, make policy definitions more flexible, adaptable to changing business needs and security environments, and enhance system flexibility; through automated policy execution via smart contracts, the speed of access control decisions is significantly improved, thereby enhancing the overall efficiency of the system; through simplified policy definitions and automated policy execution, the complexity of access control management for users is reduced, providing a smoother and more convenient user experience; through fine-grained access control, system resources can be protected more effectively, preventing unauthorized access and potential security threats, significantly improving system security.

[0067] To explain in detail the principle of the technical solution of the present invention, the overall process of the present invention will be described below with reference to some specific embodiments. It is easy to understand that the following is an explanation of the technical principle of the present invention and should not be regarded as a limitation of the present invention.

[0068] like Figure 2 As shown, the operation process of the blockchain-based autonomous identity fine-grained access control system is divided into the following five stages: The first phase, identity registration and management: Users first generate key pairs to create DIDs and put their identity information on the blockchain to ensure the uniqueness and security of their identities; The second phase involves policy definition and management: Users define access control policies based on roles and permissions through the system interface, binding roles to specific permissions, and defining the access rules for resources based on permissions. The policies are written in a domain-specific language (DSL), encapsulated, and deployed on the blockchain. Users can view and manage the defined policies at any time. In addition, the access control policies are deployed on the blockchain in the form of smart contracts, which contain the logic for authentication and permission checks. The third stage is the access control process: When a user requests access to a resource, the system calls the smart contract to verify the user's identity and permissions. The contract performs the corresponding permission checks according to the policy and decides whether to allow the user to access the resource. The fourth stage is security monitoring and response: The system monitors user behavior in real time and immediately triggers a response mechanism upon detecting abnormal behavior, such as revoking the violation, locking the account, or notifying the administrator. The fifth stage is cross-chain interoperability: the system supports DID mutual recognition and data transmission between different blockchain platforms, and ensures data security and integrity through cross-chain protocols.

[0069] Specifically, the implementation flow of each module of the system corresponding to the blockchain-based autonomous identity fine-grained access control method provided in this application embodiment is as follows: (1) Identity Management Module: The identity management module is responsible for generating and managing self-defined identities (DIDs). Users first generate a public-private key pair through the system, then create a self-defined identity (DID) based on the public key, and store the DID information on the blockchain to ensure the uniqueness and security of the identity. Users can update and manage their identity information, including their personal profile, permissions, roles, etc., through an interface.

[0070] Here, "interface" refers to the data communication interface between various modules and external devices in the system, including API calls and blockchain RPC interactions. Besides the identity management module, the access control module, policy enforcement module, real-time monitoring module, and cross-chain interoperability module are also connected through internal interfaces to transmit identity information, policy data, and monitoring results. The identity management module connects to user devices via interfaces; user devices only interact with the access control system through the identity management module or the system entry interface and do not directly connect to other modules.

[0071] Specifically, the process for generating a User Self-Identified Identity (DID) is as follows: First, the user creates their own public-private key pair using a key pair generation tool. After generating the public-private key pair, the identity management module registers the basic identity identifier and public key information of the DID on the blockchain, forming the user's DID information, which is an identity credential that can be recognized by the system. Simultaneously, the private key is stored on the user's device to ensure the user has complete control over their identity. Recording the DID information on the blockchain ensures the immutability and security of the identity.

[0072] (2) Access control module: The access control module allows users to define access control policies based on roles and permissions. Users can set access rules for resources in the system (such as files, database records, smart contracts, etc.) by defining different roles and permissions. This module also supports fine-grained permission assignment, ensuring that different users receive appropriate permissions according to their roles.

[0073] For defining access control policies: A Domain-Specific Language (DSL) is used. DSLs have a concise and clear syntax, allowing users to define complex permission rules through simple declarations. For example, a user can define "role Admin { permission: [read, write, delete]}" and assign these permissions to specific resources. Resource access rules are also defined using the DSL, such as "resource File { owner: Admin access:[User]}", describing which roles have permission to access which resources.

[0074] Optionally, the access control policy includes role definition, permission allocation, and resource access rules. Resources may include, but are not limited to, files, database records, and smart contracts.

[0075] In the specific implementation, when a user initiates a resource access request, the access control module can read the corresponding DID information from the blockchain through an interface to initially verify the user's identity and load the bound roles and permissions for the policy execution module to perform identity verification and permission checks. That is, when the access control module verifies the user's access request, it calls the identity and policy data from the blockchain for matching.

[0076] (3) Strategy Execution Module: The policy enforcement module encapsulates access control policies in smart contracts and deploys these smart contracts on the blockchain. When a user requests access to a resource, the system calls the smart contract to perform authentication and permission checks, ensuring that the user's actions comply with the predefined access control policies.

[0077] Specifically, the execution flow of the smart contract is as follows: After a user initiates a resource access request, the system uses the policy execution module to call the smart contract to verify the user's identity based on their Distributed Identity (DID) information. After successful authentication, the smart contract checks whether the user has permission to access the resource according to a predefined access control policy. If the permissions match, the smart contract returns permission to the user and allows them to access the system; otherwise, it denies the user access. By encapsulating the policy logic into the smart contract, the policy is automatically executed, reducing manual intervention and improving the efficiency of policy execution.

[0078] like Figure 5 As shown, Figure 5 This application describes the overall implementation process of smart contract execution, which includes an identity verification stage, a permission determination stage, and a data processing stage. The specific implementation process is as follows: 1) Identity verification phase: When a user initiates a resource access request, the system uses the policy execution module to invoke a smart contract for authentication based on the user's Distributed Identity (DID) information. Specifically, the policy execution module first calculates a unique identifier for the user's DID using a hash algorithm and retrieves the corresponding user registration information from the blockchain. Then, the smart contract reads the user's public key information from the registration information and verifies the digital signature in the access request based on the public key information to ensure the authenticity and integrity of the request source. After successful authentication, the system uses the policy execution module to map the user's identity to the corresponding role and permission set, i.e., loading the roles and permissions bound to the user's identity, providing a basis for subsequent permission checks.

[0079] 2) Permission determination stage: The smart contract performs fine-grained matching of user access permissions based on pre-deployed access control policies. Specifically, the access control policies are defined using a domain-specific language (DSL), and the policy content is organized in the form of an on-chain stored structure, including resource type (ResourceType), operation type (ActionType), and corresponding authorization conditions. During execution, the smart contract parses the policy table sequentially and determines the user's role permissions: if a match is successful, the smart contract returns an "access allowed" flag; if permissions are insufficient, the request is rejected and a rejection event log is generated, recording the reason for rejection and the relevant resource identifier.

[0080] 3) Data processing and result return stage: Once authentication and authorization checks are complete, the system triggers the on-chain data processing module via an event mechanism: For access requests that pass verification, the system will encapsulate the request parameters, operation timestamp, resource identifier, and user DID hash into a transaction and write it into a block to achieve traceability of access behavior; For any abnormal or unauthorized access detected, the system will immediately record the security event and synchronize it to the real-time monitoring module to trigger a response mechanism, such as freezing the relevant DID, suspending suspicious smart contract calls, or notifying the administrator.

[0081] Through the coordinated work of the three stages described above, the policy execution module achieves a complete closed-loop process for access requests, from verification and authorization to data uploading to the blockchain, ensuring the security, auditability, and execution efficiency of access control. This process implements scalable data processing logic at the smart contract layer, offering stronger real-time performance compared to traditional DID access control systems. Furthermore, the encapsulation, automated execution, and security upgrade mechanisms of smart contracts enhance contract security and simplify maintenance and update processes.

[0082] (4) Real-time monitoring module: The real-time monitoring module continuously monitors user behavior and system activity to detect potential security threats or abnormal behavior in real time. Once a violation of access control policies is detected, the system will trigger the corresponding security response mechanism.

[0083] Violations of access control policies may include, but are not limited to: 1) repeatedly or frequently submitting the same sensitive requests after being denied access; 2) forging self-identity (DID) information or modifying signature information; 3) forging requests to access resources through unauthorized interfaces or cross-chain forgery.

[0084] Specifically, the monitoring and response process is as follows: First, the system analyzes on-chain data and network traffic through a real-time monitoring module to monitor user behavior in real time. Then, the real-time monitoring module uses pattern matching technology to identify abnormal behavior or potential attack behavior. When abnormal behavior is detected, the system can immediately take preventive measures, such as revoking the violation, locking the violating account, or sending a security alert to the administrator. At the same time, the monitoring data is recorded and stored for post-event auditing and analysis. This data can be used to analyze the root cause of security incidents and improve the system's protection capabilities.

[0085] The monitoring data may include, but is not limited to: user access behavior logs (access time, resource identifier, operation type, etc.); system events (permission verification failure, frequent requests, policy changes, etc.); anomaly detection results (anomaly type, threshold exceedance records, risk scores, etc.); and security response operations (account freezing, policy adjustment, alarm triggering records, etc.).

[0086] like Figure 6 As shown, Figure 6 The overall implementation process for real-time monitoring and abnormal behavior detection includes four main stages: behavior pattern analysis, abnormal detection analysis, trigger condition judgment, and continuous monitoring and data processing. The specific implementation process is as follows: 1) Behavioral pattern analysis phase: First, the system constructs a user behavior vector based on user operation records, access time, resource type, and interaction frequency through a real-time monitoring module. Then, the behavior analysis module in the real-time monitoring module uses multi-dimensional feature extraction and clustering algorithms (such as K-Means or DBSCAN) to perform clustering analysis on historical behaviors, thereby forming standardized user behavior profiles. These profile data are stored in the state table of the blockchain using a hash index to ensure traceability and consistency during subsequent detection.

[0087] When a new behavior occurs, the system calculates the similarity between its feature vector and historical behavior patterns (such as cosine similarity or Euclidean distance) to determine whether the behavior is within the normal range.

[0088] 2) Abnormal behavior detection and analysis stage: The anomaly detection module within the real-time monitoring module utilizes a hybrid detection mechanism combining thresholds and models for anomaly behavior detection and analysis. Specifically, the threshold detection component monitors key indicators (access frequency, request interval, data volume, etc.) in real time, marking any behavior exceeding a set safety range as suspicious. The model detection component uses machine learning classifiers (such as Isolation Forest or One-Class SVM) to predict and judge behavioral sequences, identifying potential anomalies from a probabilistic perspective. Detection results are recorded on the blockchain as events, storing anomaly feature values ​​and contextual information to provide a basis for subsequent analysis.

[0089] 3) Trigger condition judgment: Specifically, the system triggers an exception response when any of the following conditions are met: a. The similarity between the user's access behavior and its historical behavior characteristics is lower than a preset threshold; b. The number of accesses within a unit of time exceeds the system's set limit; c. The user request involves highly sensitive resources that are not included in the whitelist policy; d. Multiple permission verifications failed or tampering with the request signature was detected.

[0090] Upon confirming that abnormal behavior has triggered an abnormal response, the system automatically invokes the Security Response Contract to suspend the user's access permissions, record the security event, and notify the administrator. If necessary, cross-chain synchronization can be triggered to update the security status of other nodes.

[0091] 4) Continuous monitoring and data processing stage: In this embodiment, the real-time monitoring module continuously analyzes on-chain behavioral data using a sliding window mechanism.

[0092] The data processing submodule in the real-time monitoring module is responsible for encrypting and encapsulating the monitored behavior logs and anomaly detection results, and storing them in a Merkle tree structure for subsequent auditing and verification.

[0093] The system also periodically aggregates and analyzes abnormal events, automatically generates risk reports, and feeds them back to the policy management module for dynamic adjustment of access control policies, achieving closed-loop management of "monitoring-response-optimization".

[0094] Through the synergistic effect of the four stages described above in the real-time monitoring module, the real-time monitoring mechanism of this application can not only provide immediate protection at the access control level, but also predictively detect potential security threats. Its advantage lies in combining the design concepts of "behavioral modeling + intelligent detection + on-chain auditing + policy adaptive optimization," enabling the system to have self-learning and dynamic defense capabilities.

[0095] (5) Cross-chain interoperability module: The cross-chain interoperability module supports mutual recognition and data exchange of Distributed Identity (DID) information between different blockchain platforms, solving the problems of identity authentication and data transmission in cross-chain operations. By employing cross-chain protocols and encrypted communication channels, the system ensures the security and integrity of data transmitted between different blockchain platforms.

[0096] The specific implementation scheme for cross-chain operations is as follows: When users operate across different blockchain platforms, the system verifies the user's DID through a cross-chain protocol to ensure consistency of identity across different platforms. Simultaneously, data transmission uses an encrypted communication channel to prevent data tampering or theft during transmission. Data storage employs distributed storage technology (IPFS or sharded block storage) to distribute key data fragments across multiple nodes, with nodes synchronizing data states through a consensus algorithm. Through encryption and distributed storage technologies, the system ensures data integrity and confidentiality, guaranteeing seamless operation in multi-blockchain environments.

[0097] Specifically, in a multi-blockchain environment, the system first establishes an encrypted communication channel between the main chain and sub-chains through a cross-chain protocol. When data is transmitted between the main chain and other blockchains, the system uses an asymmetric encryption algorithm to sign and encrypt the data packets. The encrypted data is sent to the target chain through the cross-chain communication module and is hashed and verified by the verification nodes on the target chain to ensure the integrity and tamper-proof nature of the data during transmission. At the same time, the system uses distributed storage technology (IPFS or sharded block storage) to distribute and store key data fragments across multiple nodes, and the nodes synchronize the data state through a consensus algorithm. When data on any chain is updated, the cross-chain interoperability module automatically broadcasts a synchronization command, triggering each chain node to perform data verification and state update, thereby realizing a closed-loop process of encryption, verification, synchronization, and traceability between multiple blockchains.

[0098] Through the above process, the system implements a three-layer protection mechanism of encrypted data transmission, distributed storage, and hash verification in cross-chain operations, ensuring the security and consistency of data in a multi-blockchain environment.

[0099] It should be noted that this embodiment is only a brief illustrative description of the overall process of the blockchain-based autonomous identity fine-grained access control method. Detailed descriptions of each step can be found in the relevant content of the foregoing embodiments, and will not be repeated here. It is understood that the present invention does not impose any limitations on this.

[0100] In summary, to address the problems of traditional solutions, this application proposes a blockchain-based method for fine-grained access control of autonomous identity, specifically including the following: (1) Fine-grained access control policy: Access control policies are defined using a Domain-Specific Language (DSL), allowing users to flexibly define complex permission management rules. This approach allows for fine-grained permission allocation for different resources and roles, enhancing the flexibility and adaptability of the policy. The use of DSL also makes it easy for non-technical users to write and manage access policies.

[0101] (2) Automatic execution mechanism based on smart contracts: Access control policies are encapsulated in smart contracts. When a user initiates an access request, the system calls the smart contract to verify the user's identity and permissions. The smart contract automatically executes the access control policy without manual intervention, improving system efficiency. By optimizing the smart contract execution logic, a multi-stage caching mechanism using multi-level caching and efficient data structures (such as Bloom filters and interval trees) is introduced. Based on multi-level caching, the frequency of querying the blockchain state is effectively reduced, improving the efficiency of policy execution and further enhancing system performance. This ensures that user requests can still be responded to quickly under high concurrency. Based on efficient data structures such as Bloom filters, storage and query performance are optimized. By adopting efficient data structures and smart contract algorithm optimization, the computational and storage overhead of access control operations is reduced, improving the system's processing power and response speed.

[0102] (3) Real-time monitoring and security response mechanism: The system introduces a real-time monitoring module to continuously monitor user behavior and system activities, and detect potential security threats or abnormal behaviors in real time. Once abnormal behavior is detected, the system immediately triggers the security response mechanism, such as revoking the violation, locking the account, or sending an alarm notification to ensure the security of the system.

[0103] (4) Cross-chain interoperability: To solve the interoperability problem between different blockchain platforms, a cross-chain protocol is adopted to support DID mutual recognition and data exchange between different blockchain platforms. Through encrypted communication and cross-chain protocol, the system ensures secure and reliable data transmission between different platforms, expanding the application scenarios of the DID system.

[0104] The blockchain-based fine-grained access control method for autonomous identity provided in this application has the following advantages compared with traditional methods: First, by employing fine-grained access control policies and real-time security monitoring mechanisms, system resources can be protected more effectively, preventing unauthorized access and potential security threats, thus significantly improving system security.

[0105] Secondly, the use of customized access control policies and domain-specific languages ​​(DSLs) makes policy definition more flexible, adaptable to changing business needs and security environments, and enhances system flexibility. In particular, the design of DSLs allows non-professional users to easily define and manage access control policies, lowering the technical barrier and increasing the accessibility of policy management.

[0106] Furthermore, the automated execution of smart contracts and the introduction of multi-stage caching mechanisms significantly improve the speed of access control decisions and reduce the frequency of blockchain state queries, thereby enhancing the overall efficiency of the system. Additionally, simplified policy definitions and automated policy execution reduce the complexity of access control management for users, providing a smoother and more convenient user experience.

[0107] Furthermore, by combining real-time detection and prevention technologies, it is possible to quickly identify and respond to behaviors that violate access control policies, take timely preventive measures, reduce the impact of security incidents, demonstrate the system's real-time response capabilities, and improve the system's defense capabilities.

[0108] Furthermore, the system in this application supports DID interoperability between different blockchain platforms, enabling users to seamlessly use their identities in multiple blockchain environments and expanding the scope of access control applications.

[0109] Please see Figure 8 This application also provides a blockchain-based autonomous identity fine-grained access control device 800, applied to an identity access control system. The identity access control system includes an identity management module, an access control module, and a policy execution module, which can implement the above-mentioned method. The device includes the following modules: The self-identity information generation module 801 is used to receive a user's identity registration request, generate the user's self-identity information through the identity management module, and store the self-identity information on the blockchain; Access control policy generation module 802 is used to receive the user's policy configuration request, generate the user's access control policy according to the domain-specific language through the access control module, and encapsulate the access control policy in a smart contract so as to deploy the smart contract containing the access control policy on the blockchain. User authentication module 803 is used to receive the user's resource access request, obtain the autonomous identity information from the blockchain through the policy execution module, and call the smart contract to authenticate the user based on the autonomous identity information; The access permission matching module 804 is used to perform fine-grained matching of the user's access permissions according to the access control policy through the smart contract if the user's authentication is successful, and obtain the permission check result. The target response event execution module 805 is used to execute the target response event according to the permission check result through the smart contract.

[0110] It is understood that the content of the above method embodiments is applicable to the present device embodiments. The specific functions implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0111] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0112] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0113] Please see Figure 9 , Figure 9 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 902 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 902 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901 using the methods described in the embodiments of this application. The input / output interface 903 is used to implement information input and output; The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904); The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0114] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0115] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0116] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0117] It is understood that the content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0118] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0119] The blockchain-based self-identity fine-grained access control method, device, electronic device, storage medium, and program product provided in this application embodiment receive user identity registration requests, generate user self-identity information through an identity management module, and store the self-identity information on the blockchain; receive user policy configuration requests, generate user access control policies according to domain-specific languages ​​through an access control module, and encapsulate the access control policies in smart contracts to deploy the smart contracts containing the access control policies on the blockchain; receive user resource access requests, obtain self-identity information from the blockchain through a policy execution module, and call the smart contract to verify the user's identity based on the self-identity information; if the user's identity verification is successful, perform fine-grained matching of the user's access permissions according to the access control policies through the smart contract to obtain permission check results; and execute target response events through the smart contract based on the permission check results. This application's embodiments, through the use of domain-specific languages ​​and customized access control policies, make policy definitions more flexible, adaptable to changing business needs and security environments, and enhance system flexibility; through automated policy execution via smart contracts, the speed of access control decisions is significantly improved, thereby enhancing the overall efficiency of the system; through simplified policy definitions and automated policy execution, the complexity of access control management for users is reduced, providing a smoother and more convenient user experience; through fine-grained access control, system resources can be protected more effectively, preventing unauthorized access and potential security threats, significantly improving system security.

[0120] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A blockchain-based method for fine-grained access control of autonomous identity, characterized in that: The method, applied to an identity access control system including an identity management module, an access control module, and a policy enforcement module, includes the following steps: The system receives a user's identity registration request, generates the user's self-identity information through the identity management module, and stores the self-identity information on the blockchain. The system receives the user's policy configuration request, generates the user's access control policy based on the domain-specific language through the access control module, and encapsulates the access control policy in a smart contract to deploy the smart contract containing the access control policy on the blockchain. The system receives the user's resource access request, obtains the autonomous identity information from the blockchain through the policy execution module, and calls the smart contract to verify the user's identity based on the autonomous identity information. If the user's authentication is successful, the smart contract performs fine-grained matching of the user's access permissions according to the access control policy to obtain the permission check result. The target response event is executed through the smart contract based on the permission check result; The identity access control system further includes a real-time monitoring module and a cross-chain interoperability module; the method further includes: periodically aggregating and analyzing abnormal user behavior through the real-time monitoring module, automatically generating risk reports and feeding them back to the access control module for dynamically adjusting the access control policy; The method further includes: Receive the user's cross-chain identity authentication request; The cross-chain interoperability module uses a cross-chain protocol to perform mutual identity verification for the user. If the user passes the identity mutual recognition verification, the cross-chain interoperability module will encrypt the user's data to be transmitted to obtain encrypted transmission data, and then send the encrypted transmission data from the user's main blockchain to the target blockchain. The encrypted transmission data is hash-verified using the target blockchain, and key data fragments of the hash-verified encrypted transmission data are distributed and stored on different blockchains using distributed storage technology; wherein, the data status is synchronized between different blockchains through a consensus algorithm. When data on any blockchain is updated, a synchronization command is automatically broadcast through the cross-chain interoperability module, and each different blockchain performs data verification and status update according to the synchronization command.

2. The method according to claim 1, characterized in that, The method further includes: The real-time monitoring module dynamically monitors the user's access behavior and uses pattern matching technology to perform anomaly analysis on the access behavior to obtain anomaly analysis results. If the anomaly analysis results determine that the access operation behavior is characterized as abnormal behavior, the security response contract will be automatically invoked to suspend the user's access permissions and record the security event.

3. The method according to claim 1, characterized in that, The identity access control system is deployed with a multi-level caching mechanism, and the method further includes: When the identity access control system receives the user's resource access request, it determines whether the target resource data is in the preset multi-level cache based on the cache priority through the target filter in the multi-level caching mechanism. If the target resource data is in the preset multi-level cache, then the target resource data is retrieved from the preset multi-level cache; If the target resource data is not in the preset multi-level cache, the target resource data is obtained from the blockchain through the strategy execution module.

4. The method according to claim 1, characterized in that, The process of receiving the user's resource access request, obtaining the autonomous identity information from the blockchain through the policy execution module, and calling the smart contract to verify the user's identity based on the autonomous identity information includes: Receive the resource access request from the user; wherein the resource access request includes a digital signature; The strategy execution module calculates the user's unique identifier based on the resource access request and obtains the self-identity information corresponding to the unique identifier from the blockchain; wherein, the self-identity information includes public key information. The strategy execution module calls the smart contract to read the public key information from the autonomous identity information and verifies the digital signature in the resource access request based on the public key information.

5. The method according to claim 1, characterized in that, If the user's authentication is successful, the smart contract performs fine-grained matching of the user's access permissions according to the access control policy to obtain the permission check result, including: If the user's authentication is successful, the policy execution module maps the user's self-identity to the corresponding set of roles and permissions, so as to determine the user's access permissions based on the set of roles and permissions corresponding to the user. The smart contract performs fine-grained matching of the user's access permissions according to the access control policy to obtain the permission check result.

6. The method according to claim 1, characterized in that, The execution of the target response event through the smart contract based on the permission check result includes: If the permission check result determines that the user's access permission is successfully matched, the smart contract returns an access permission identifier to the user, allowing the user to perform the access behavior, and the target element information carried by the resource access request is written into the blockchain; If the permission check result determines that the user's access permissions do not match, the resource access request is rejected through the smart contract and a rejection event log is generated. The security event is also recorded through the smart contract, and the security event is synchronized to the real-time monitoring module to trigger the security response mechanism.

7. A blockchain-based fine-grained access control device for autonomous identity, characterized in that, An applicable device for an identity access control system, the identity access control system including an identity management module, an access control module, and a policy enforcement module, the device including the following modules: The self-identity information generation module is used to receive the user's identity registration request, generate the user's self-identity information through the identity management module, and store the self-identity information on the blockchain; An access control policy generation module is used to receive the user's policy configuration request, generate the user's access control policy according to the domain-specific language through the access control module, and encapsulate the access control policy in a smart contract so as to deploy the smart contract containing the access control policy on the blockchain. The user authentication module is used to receive the user's resource access request, obtain the autonomous identity information from the blockchain through the policy execution module, and call the smart contract to authenticate the user based on the autonomous identity information; The access permission matching module is used to perform fine-grained matching of the user's access permissions according to the access control policy through the smart contract if the user's authentication is successful, and obtain the permission check result. The target response event execution module is used to execute the target response event according to the permission check result through the smart contract; The identity access control system further includes a real-time monitoring module and a cross-chain interoperability module; the device is also used to: periodically aggregate and analyze abnormal user behavior through the real-time monitoring module, automatically generate risk reports and feed them back to the access control module for dynamically adjusting the access control policy; The device is also used for: Receive the user's cross-chain identity authentication request; The cross-chain interoperability module uses a cross-chain protocol to perform mutual identity verification for the user. If the user passes the identity mutual recognition verification, the cross-chain interoperability module will encrypt the user's data to be transmitted to obtain encrypted transmission data, and then send the encrypted transmission data from the user's main blockchain to the target blockchain. The encrypted transmission data is hash-verified using the target blockchain, and key data fragments of the hash-verified encrypted transmission data are distributed and stored on different blockchains using distributed storage technology; wherein, the data status is synchronized between different blockchains through a consensus algorithm. When data on any blockchain is updated, a synchronization command is automatically broadcast through the cross-chain interoperability module, and each different blockchain performs data verification and status update according to the synchronization command.

8. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 6.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.

Images