Internet of Things data fine-grained access control system and method based on block chain cross-chain and IPFS

Abstract

The invention relates to an internet of things data fine-grained access control system and method based on block chain cross-chain and IPFS, and aims to solve the problems of data isolation and data security sharing between different trust domains in the field of internet of things. The system comprises a source block chain, a target block chain, a relay chain and an interstellar file system IPFS. A data owner (DO) is located in a source block chain and is responsible for generating a system public key and a master key, encrypting original data, uploading the original data to an IPFS, storing encrypted data access information to the source block chain and issuing the encrypted data access information through a relay chain. And the data user DU is located in the target block chain, requests data through the relay chain, obtains the encrypted data access information after verification is passed, and decrypts the encrypted data access information to obtain the original data. According to the system, the CP-ABE technology is adopted to encrypt and decrypt data access, the access permission of a single user is flexibly specified through an access strategy, and only the user with the attribute meeting the access strategy can successfully access the data. The relay chain realizes cross-chain data sharing, and solves the problem of data isolation among different trust domains of the traditional Internet of Things. And meanwhile, the IPFS realizes distributed storage of the shared data, so that the risk of centralized storage is avoided.

Description

Technical Field

[0001] This application relates to the field of IoT data sharing technology, and in particular to an IoT data fine-grained access control system and method based on blockchain cross-chain and IPFS. Background Technology

[0002] With the rapid development of technologies such as 5G, IoT, big data, and artificial intelligence, especially with the increasing intelligence and deployment scale of IoT, massive amounts of data have been generated. This data needs to be stored, processed, and analyzed to create value. However, the underlying differences between different trust domains in IoT result in varying degrees of data isolation. Therefore, a method for cross-domain interaction is needed to bridge these "information silos" and achieve cross-domain data sharing. Simultaneously, secure data sharing places high demands on the privacy and confidentiality of transmitted content and the security of data storage. Traditional cloud-based access control schemes cannot prevent malicious cloud servers from leaking user data, thus compromising the privacy of stored data. Furthermore, traditional cloud storage models operate in a centralized manner, making single points of failure prone to preventing users from successfully accessing their data. To facilitate the flow of valuable data, fine-grained access control has become a crucial means of protecting user data privacy and ensuring efficient and secure sharing.

[0003] IPFS, or InterPlanetary File System, is a network transmission protocol designed to create persistent and distributed storage and sharing of files. As a distributed storage solution, it features low cost, high efficiency, and high security, effectively solving the single point of failure problem brought about by cloud storage.

[0004] Blockchain, as a transparent, immutable, and traceable emerging decentralized network, is widely used in various fields. Distributed blockchain networks effectively address the shortcomings of centralized server access control; the exit of any ledger node in a blockchain does not affect the stability of the entire system. Finally, using blockchain's programmable smart contracts enables encrypted data sharing, automating user data access requests while effectively preventing the leakage of sensitive information due to the transparent nature of blockchain. Currently, there is an urgent need for a technical solution that applies IPFS and blockchain technology to internet data access control. Summary of the Invention

[0005] To address the aforementioned issues, embodiments of the present invention provide a fine-grained access control system and method for IoT data based on blockchain cross-chain and IPFS.

[0006] This invention provides a fine-grained access control system for IoT data based on blockchain cross-chain and IPFS, comprising:

[0007] The source blockchain is used to store the registration information of the data owner (DO), the system public key, the system master key, and encrypted data access information;

[0008] The target blockchain is used to store the registration information of data users (DUs).

[0009] The relay chain is used to connect the source blockchain and the target blockchain to achieve cross-chain data sharing, store data publication information and public keys and attribute set information of data users, including relay node A for interacting with the data owner DO and relay node B for interacting with the data user DU.

[0010] The InterPlanetary File System (IPFS) is used for distributed storage of encrypted raw data and generates a unique Content Identifier (CID) for each piece of data.

[0011] The data owner (DO), located on the source blockchain, is responsible for generating the system public key and master key, encrypting the original data and uploading it to IPFS, storing the encrypted data access information on the source blockchain and publishing it through the relay chain.

[0012] Data user DU, located on the target blockchain, is responsible for sending data requests to the relay chain, receiving and decrypting data access information, and obtaining raw data through IPFS.

[0013] In some embodiments, the data owner (DO) is able to perform the following steps:

[0014] Send a registration request to relay node A and receive the digital certificate Cer1 returned by relay node A after successful verification;

[0015] Generate the system public key PK and the system master key MK;

[0016] Generate a symmetric key Key for encrypting the original data, use the key to encrypt the original data to obtain the ciphertext of the original data, upload the ciphertext to IPFS and receive the returned CID;

[0017] The system public key and access policy T are used to encrypt the CID and symmetric key Key to obtain ciphertext C. After associating ciphertext C with access policy T, it is uploaded to the source blockchain for evidence storage.

[0018] The digital certificate Cer1, data identifier Seq, ciphertext C, and access policy T are sent to relay node A, which then publishes the data to the relay chain.

[0019] In some embodiments, the data user DU can perform the following steps:

[0020] Send a registration request to relay node B and receive the digital certificate Cer2 returned by relay node B after successful verification;

[0021] Send a data request to relay node B, and relay node B verifies the request and searches for the relevant data on the relay chain through the lookup contract;

[0022] If the search is successful and the attribute set U of the verified data user DU conforms to the access policy T, then the public key PU, attribute set U, CID, ciphertext C, and attribute private key ciphertext sent by relay node B are received.

[0023] Use your private key to decrypt the attribute private key ciphertext to obtain the attribute private key. If the attribute satisfies access policy T, use the attribute private key to decrypt the ciphertext C to obtain the CID and symmetric key Key. Finally, use the CID to search for and retrieve the original data ciphertext on IPFS, and use the symmetric key Key to decrypt and retrieve the original data.

[0024] In some embodiments, the data publishing and lookup process on the relay chain includes:

[0025] Relay node A receives the digital certificate Cer1, data identifier Seq, ciphertext C, and access policy T sent by the data owner DO, publishes the data to the relay chain, and stores it in the data list on the relay chain.

[0026] Relay node B receives a data request sent by data user DU, verifies the request, and searches for the relevant data on the relay chain based on the data identifier Seq through the lookup contract.

[0027] If the search is successful and the attribute set U of the data user DU is verified to conform to the access policy T, then the public key PU, attribute set U, CID and ciphertext C of the data user DU are broadcast to the relay chain. After receiving the data, the relay node A sends the public key PU and attribute set U of the data user (DU) to the data owner DO.

[0028] Data owner DO generates an attribute private key based on attribute set U and system master key MK, and encrypts the attribute private key using data user DU's public key PU to obtain attribute private key ciphertext. The attribute private key ciphertext is then sent to relay node A, which broadcasts it to the relay chain. Relay node B receives the broadcast and sends the CID, ciphertext C, and attribute private key ciphertext together to data user DU.

[0029] In some embodiments, the system employs CP-ABE technology to encrypt and decrypt data access, and flexibly specifies access permissions for individual users through access policy T. Only users whose attributes meet the access policy can successfully access the data.

[0030] This invention provides a fine-grained access control method for IoT data based on blockchain cross-chain and IPFS, employing the fine-grained access control system for IoT data based on blockchain cross-chain and IPFS as described in any of the above embodiments. The method includes:

[0031] System initialization: Data owner DO and data user DU send registration requests to relay node A and relay node B respectively. After successful verification, relay node A and relay node B issue digital certificates to them respectively. Data owner DO generates system public key and system master key.

[0032] Data Release: After encrypting the original data with key Key, the data owner DO uploads the encrypted original data to the InterPlanetary File System and receives the Content Identifier (CID) that uniquely corresponds to the data. Then, using the system public key and access policy T, DO encrypts Key and CID to obtain ciphertext. This ciphertext is associated with the access policy. Only when the owned attributes meet the access policy in the ciphertext can the ciphertext be decrypted. After the ciphertext is uploaded to the source blockchain for notarization, it is then published to the relay chain through relay node A.

[0033] Data Request and Search: Data user DU on the target blockchain initiates a data request to relay node B. Relay node B verifies data user DU's certificate. After successful verification, it invokes the search contract to retrieve the relevant data. If the search is successful and data user DU's attribute set is verified to conform to the access policy, relay node B broadcasts data user DU's public key and attribute set to the relay chain. Relay node A receives this and sends it to data owner DO. Data owner DO generates an attribute private key and encrypts it using data user DU's public key to obtain the attribute private key ciphertext. Data owner DO sends the attribute private key ciphertext to relay node A. Relay node A broadcasts the attribute private key ciphertext to the relay chain. Relay node B receives this and sends the ciphertext of CID and key Key, along with the attribute private key ciphertext, to data user DU.

[0034] Data Acquisition: After obtaining the ciphertext of CID and Key, as well as the ciphertext of attribute private key, data user DU uses its own private key to decrypt the attribute private key ciphertext to obtain the attribute private key. Finally, data user DU uses CID to search for and obtain the original data ciphertext on the InterPlanetary File System, and then uses Key to decrypt and obtain the original data.

[0035] Compared with existing technical solutions, this solution uses the InterPlanetary File System (IPFS) to achieve distributed storage of shared data, avoiding the risks of centralized storage; it uses blockchain to achieve on-chain notarization of shared data, and uses a relay chain to achieve cross-chain data sharing, solving the problem of data isolation between different trust domains in traditional IoT; it applies CP-ABE technology to encrypt keys, which can flexibly specify access permissions for individual users. Access can only be successful if the attributes meet the access policy, solving the problem of fine-grained access control for shared data. Attached Figure Description

[0036] The accompanying drawings illustrate, by way of example and not limitation, the various embodiments discussed herein.

[0037] Figure 1 This is a schematic diagram of an IoT data fine-grained access control system model based on blockchain cross-chain and IPFS, according to an embodiment of the present invention.

[0038] Figure 2 This is a schematic diagram of the interaction process of a control method for a fine-grained access control system for IoT data based on blockchain cross-chain and IPFS, according to an embodiment of the present invention. Detailed Implementation

[0039] In order to gain a more detailed understanding of the features and technical content of the embodiments of this application, the implementation of the embodiments of this application will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for reference and illustration only and are not intended to limit the embodiments of this application.

[0040] In the embodiments described in this application, it should be noted that, unless otherwise stated and limited, the term "connection" should be interpreted broadly. For example, it can be an electrical connection, or a connection between two internal components. It can be a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can understand the specific meaning of the above term according to the specific circumstances.

[0041] It should be noted that the terms "first," "second," and "third" used in the embodiments of this application are merely used to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first," "second," and "third" can be interchanged in a specific order or sequence where permitted. It should be understood that the objects distinguished by "first," "second," and "third" can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in an order other than those illustrated or described herein.

[0042] The proposed data sharing scheme based on IPFS and blockchain cross-chain technology includes four entities: source blockchain, target blockchain, relay chain, and InterPlanetary File System (IPFS), such as... Figure 1 As shown in the diagram, the data owner DO is located on the source blockchain, possesses the data to be shared, and can interact with the relay chain by calling the source blockchain. Similarly, the data user DU is located on the target blockchain, possesses the data to be shared, and can interact with the relay chain by calling the target blockchain.

[0043] (1) Data owner DO sends a registration request Reg1 = (ID1,PK1,N1,Sig(SK1,N1)) to relay node A. Relay node A verifies the registration request. If the verification is successful, it generates a digital certificate Cer1 = (ID1,PK1,L1) and returns Cer1 to data owner DO. Data user DU sends a registration request Reg2 = (ID2,PK2,N2,Sig(SK1,N2)) to relay node B. Relay node B verifies the registration request. If the verification is successful, it generates a digital certificate Cer2 = (ID2,PK2,L2) and returns Cer2 to data user DU. Data owner DO generates the system public key PK. CP_ABE and system master key MK CP_ABE .

[0044] (2) The data owner DO generates a symmetric key Key to encrypt the original data, and uses Key to encrypt the original data to obtain the original data ciphertext CT. data CT scan data Upload to IPFS and receive the Content Identifier (CID) returned by IPFS. The data owner (DO) uses the system public key (PK). CP_ABE Access policy T encrypts CID and Key to obtain ciphertext CT CID,Key CT CID,Key Associated with the access policy, the ciphertext can only be decrypted if the owned attributes satisfy the access policy in the ciphertext. The data owner (DO) uploads the ciphertext to the source blockchain for notarization, and then uses the certificate Cer1, data identifier Seq, and CT... CID,Key The access policy T is sent to relay node A, and relay node A sends the data {Seq,CT}. CID,Key The data is published to the relay chain and stored in the data list on the relay chain.

[0045] (3) Data user DU sends a data request {Cer2, U, Seq} to relay node B. Relay node B verifies the request. After successful verification, it calls the lookup contract on the relay chain to search for relevant data based on Seq. If the search is successful and the attribute set U of data user DU is successfully verified to conform to access policy T, then relay node B broadcasts the public key PK2 and attribute set U of data user DU to the relay chain. After receiving the broadcast, relay node A sends the public key PK2 and attribute set U of data user DU to data owner DO. Data owner DO then uses the attribute set U and the system master key MK to search for relevant data. CP_ABE Generate attribute private key SK CP_ABE And use PK1 to encrypt SK CP_ABEGenerate the attribute private key ciphertext, then forward it to relay node A. Relay node A broadcasts the attribute private key to the relay chain. Relay node B receives the broadcast and then transmits the ciphertext CT of the CID and key. CID,Key The attribute private key ciphertext is sent to the data user DU.

[0046] (4) After obtaining the ciphertext CT containing the CID and key, CID,Key After decrypting the attribute private key ciphertext, data user DU uses their own private key SK1 to decrypt the attribute private key ciphertext and obtain the attribute private key SK. CP_ABE If the attributes of the data user DU satisfy the access policy T, then SK can be used. CP_ABE Decoding CT CID,Key Obtain the CID and key, (CID, Key) = Dec(CT) CID,Key SK CP_ABE Finally, the data user DU uses the CID to locate and retrieve the original encrypted data CT on the InterPlanetary File System. data Then, use the key Key to decrypt and obtain the original data, data = Dec(CT) data ,Key).

[0047] System flowchart as follows Figure 2 As shown.

[0048] 1. System Initialization: Data owner DO and data user DU send registration requests to relay node A and relay node B respectively. After successful verification, relay nodes A and B issue digital certificates to each. Data owner DO generates the system public key and system master key.

[0049] 2. Data Publication: After encrypting the original data using the key Key, the data owner DO uploads the encrypted original data to the InterPlanetary File System and receives the Content Identifier (CID) that uniquely corresponds to the data. Then, using the system public key and access policy T, DO encrypts the Key and CID to obtain the ciphertext. This ciphertext is associated with the access policy, and only those whose attributes meet the access policy in the ciphertext can decrypt it. After uploading the ciphertext to the source blockchain for notarization, the data is published to the relay chain through relay node A.

[0050] 3. Data Request and Search: Data user DU on the target blockchain initiates a data request to relay node B. Relay node B verifies data user DU's certificate. After successful verification, it invokes the search contract to retrieve the relevant data. If the search is successful and data user DU's attribute set is verified to conform to the access policy, relay node B broadcasts data user DU's public key and attribute set to the relay chain. Relay node A receives this and sends it to data owner DO. Data owner DO generates an attribute private key and encrypts it using data user DU's public key to obtain the attribute private key ciphertext. Data owner DO sends the attribute private key ciphertext to relay node A. Relay node A broadcasts the attribute private key ciphertext to the relay chain. Relay node B receives this and sends the ciphertext of CID and key Key, along with the attribute private key ciphertext, to data user DU.

[0051] 4. Data Acquisition: After obtaining the ciphertext of the CID and Key, as well as the ciphertext of the attribute private key, data user DU uses their private key SK1 to decrypt the attribute private key ciphertext to obtain the attribute private key. The ciphertext of the CID and Key is associated with the access policy defined by the data owner; only attributes that meet the access policy can be decrypted. Therefore, if data user DU's attributes meet the access policy, they can use the attribute private key to decrypt and obtain the CID and Key. Finally, data user DU uses the CID to search for and retrieve the original data ciphertext CT on the InterPlanetary File System. data Then, use the key Key to decrypt and obtain the original data.

[0052] This invention provides a fine-grained access control system for IoT data based on blockchain cross-chain and IPFS, such as... Figure 1 As shown, it includes:

[0053] The source blockchain is used to store the registration information of the data owner (DO), the system public key, the system master key, and encrypted data access information.

[0054] The target blockchain is used to store the registration information of data users (DU).

[0055] The relay chain is used to connect the source blockchain and the target blockchain to enable cross-chain data sharing, store data publication information, and public keys and attribute set information of data users. It includes relay node A for interacting with the data owner DO and relay node B for interacting with the data user DU.

[0056] The InterPlanetary File System (IPFS) is used for distributed storage of encrypted raw data and generates a unique Content Identifier (CID) for each piece of data.

[0057] The data owner (DO), located on the source blockchain, is responsible for generating the system public key and master key, encrypting the original data and uploading it to IPFS, storing the encrypted data access information on the source blockchain and publishing it through the relay chain.

[0058] Data user DU, located on the target blockchain, is responsible for sending data requests to the relay chain, receiving and decrypting data access information, and obtaining raw data through IPFS.

[0059] In some embodiments, the data owner (DO) can perform the following steps:

[0060] Send a registration request to relay node A and receive the digital certificate Cer1 returned by relay node A after successful verification.

[0061] Generate the system public key PK and the system master key MK.

[0062] Generate a symmetric key Key for encrypting the original data, use the key to encrypt the original data to obtain the ciphertext of the original data, upload the ciphertext to IPFS and receive the returned CID.

[0063] The system public key and access policy T are used to encrypt the CID and symmetric key Key to obtain ciphertext C. After associating ciphertext C with access policy T, it is uploaded to the source blockchain for evidence storage.

[0064] The digital certificate Cer1, data identifier Seq, ciphertext C, and access policy T are sent to relay node A, which then publishes the data to the relay chain.

[0065] In some embodiments, the data user DU can perform the following steps:

[0066] Send a registration request to relay node B and receive the digital certificate Cer2 returned by relay node B after successful verification.

[0067] A data request is sent to relay node B, which verifies the request and searches for the relevant data on the relay chain through the lookup contract.

[0068] If the search is successful and the attribute set U of the verified data user DU conforms to the access policy T, then the public key PU, attribute set U, CID, ciphertext C, and attribute private key ciphertext sent by relay node B are received.

[0069] Use your private key to decrypt the attribute private key ciphertext to obtain the attribute private key. If the attribute satisfies access policy T, use the attribute private key to decrypt the ciphertext C to obtain the CID and symmetric key Key. Finally, use the CID to search for and retrieve the original data ciphertext on IPFS, and use the symmetric key Key to decrypt and retrieve the original data.

[0070] In some embodiments, the data publishing and retrieval process on the relay chain includes:

[0071] Relay node A receives the digital certificate Cer1, data identifier Seq, ciphertext C, and access policy T sent by the data owner DO, publishes the data to the relay chain, and stores it in the data list on the relay chain.

[0072] Relay node B receives data requests sent by data user DU, verifies the requests, and searches for relevant data on the relay chain based on the data identifier Seq through the lookup contract.

[0073] If the search is successful and the attribute set U of the data user DU is verified to conform to the access policy T, then the public key PU, attribute set U, CID and ciphertext C of the data user DU are broadcast to the relay chain. After receiving the data, the relay node A sends the public key PU and attribute set U of the data user (DU) to the data owner DO.

[0074] Data owner DO generates an attribute private key based on attribute set U and system master key MK, and encrypts the attribute private key using data user DU's public key PU to obtain attribute private key ciphertext. The attribute private key ciphertext is then sent to relay node A, which broadcasts it to the relay chain. Relay node B receives the broadcast and sends the CID, ciphertext C, and attribute private key ciphertext together to data user DU.

[0075] The system in the above embodiment uses CP-ABE technology to encrypt and decrypt data access. It flexibly specifies the access permissions of individual users through access policy T, and only users whose attributes meet the access policy can successfully access the data.

[0076] The InterPlanetary File System (IPFS) enables distributed storage of shared data, avoiding the risks of centralized storage; the blockchain enables on-chain notarization of shared data, and the relay chain enables cross-chain data sharing, solving the problem of data isolation between different trust domains in the traditional Internet of Things.

[0077] This invention provides a fine-grained access control method for IoT data based on blockchain cross-chain and IPFS, employing a fine-grained access control system for IoT data based on blockchain cross-chain and IPFS as described in any of the above embodiments. Figure 2 As shown, the control methods include:

[0078] System initialization: Data owner DO and data user DU send registration requests to relay node A and relay node B respectively. After successful verification, relay node A and relay node B issue digital certificates to them respectively. Data owner DO generates the system public key and system master key.

[0079] Data Release: After encrypting the original data using the key Key, the data owner DO uploads the encrypted original data to the InterPlanetary File System and receives the Content Identifier (CID) that uniquely corresponds to the data. Then, using the system public key and access policy T, DO encrypts the Key and CID to obtain the ciphertext. This ciphertext is associated with the access policy, and the ciphertext can only be decrypted if the owner's attributes meet the access policy in the ciphertext. After uploading the ciphertext to the source blockchain for notarization, the data is then published to the relay chain through relay node A.

[0080] Data Request and Search: Data user DU on the target blockchain initiates a data request to relay node B. Relay node B verifies data user DU's certificate. Upon successful verification, it invokes the search contract to retrieve the relevant data. If the search is successful and data user DU's attribute set is verified to conform to the access policy, relay node B broadcasts data user DU's public key and attribute set to the relay chain. Relay node A receives this and sends it to data owner DO. Data owner DO generates an attribute private key and encrypts it using data user DU's public key to obtain the attribute private key ciphertext. Data owner DO sends the attribute private key ciphertext to relay node A. Relay node A broadcasts the attribute private key ciphertext to the relay chain. Relay node B receives this and sends the ciphertext of CID and key Key, along with the attribute private key ciphertext, to data user DU.

[0081] Data Acquisition: After obtaining the ciphertext of CID and Key, as well as the ciphertext of attribute private key, data user DU uses its own private key to decrypt the attribute private key ciphertext to obtain the attribute private key. Finally, data user DU uses CID to search for and obtain the original data ciphertext on the InterPlanetary File System, and then uses Key to decrypt and obtain the original data.

[0082] Compared to existing solutions, this approach utilizes the InterPlanetary File System (IPFS) for distributed storage of shared data, avoiding the risks of centralized storage. It employs blockchain for on-chain data notarization and a relay chain for cross-chain data sharing, resolving the data isolation issue between different trust domains in traditional IoT. By applying CP-ABE encryption keys, it allows for flexible specification of individual user access permissions; access is only successful if attributes meet the specified policy, thus addressing the issue of fine-grained access control for shared data.

[0083] The technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0084] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A fine-grained access control system for IoT data based on blockchain cross-chain and IPFS, characterized in that, include: The source blockchain is used to store the registration information of the data owner (DO), the system public key, the system master key, and encrypted data access information; The target blockchain is used to store the registration information of data users (DUs). The relay chain is used to connect the source blockchain and the target blockchain to achieve cross-chain data sharing, store data publication information and public keys and attribute set information of data users, including relay node A for interacting with the data owner DO and relay node B for interacting with the data user DU. The InterPlanetary File System (IPFS) is used for distributed storage of encrypted raw data and generates a unique Content Identifier (CID) for each piece of data. The data owner (DO), located on the source blockchain, is responsible for generating the system public key and master key, encrypting the original data and uploading it to IPFS, storing the encrypted data access information on the source blockchain and publishing it through the relay chain. Data user DU, located on the target blockchain, is responsible for sending data requests to the relay chain, receiving and decrypting data access information, and obtaining raw data through IPFS.

2. The IoT data fine-grained access control system based on blockchain cross-chain and IPFS according to claim 1, characterized in that, The data owner (DO) is able to perform the following steps: Send a registration request to relay node A and receive the digital certificate Cer1 returned by relay node A after successful verification; Generate the system public key PK and the system master key MK; Generate a symmetric key Key for encrypting the original data, use the key to encrypt the original data to obtain the ciphertext of the original data, upload the ciphertext to IPFS and receive the returned CID; The system public key and access policy T are used to encrypt the CID and symmetric key Key to obtain ciphertext C. After associating ciphertext C with access policy T, it is uploaded to the source blockchain for evidence storage. The digital certificate Cer1, data identifier Seq, ciphertext C, and access policy T are sent to relay node A, which then publishes the data to the relay chain.

3. The IoT data fine-grained access control system based on blockchain cross-chain and IPFS according to claim 1, characterized in that, The data user DU is able to perform the following steps: Send a registration request to relay node B and receive the digital certificate Cer2 returned by relay node B after successful verification; Send a data request to relay node B, and relay node B verifies the request and searches for the relevant data on the relay chain through the lookup contract; If the search is successful and the attribute set U of the verified data user DU conforms to the access policy T, then the public key PU, attribute set U, CID, ciphertext C, and attribute private key ciphertext sent by relay node B are received. Use your private key to decrypt the attribute private key ciphertext to obtain the attribute private key. If the attribute satisfies access policy T, use the attribute private key to decrypt the ciphertext C to obtain the CID and symmetric key Key. Finally, use the CID to search for and retrieve the original data ciphertext on IPFS, and use the symmetric key Key to decrypt and retrieve the original data.

4. The IoT data fine-grained access control system based on blockchain cross-chain and IPFS according to claim 1, characterized in that, The data publishing and retrieval process on the relay chain includes: Relay node A receives the digital certificate Cer1, data identifier Seq, ciphertext C, and access policy T sent by the data owner DO, publishes the data to the relay chain, and stores it in the data list on the relay chain. Relay node B receives a data request sent by data user DU, verifies the request, and searches for the relevant data on the relay chain based on the data identifier Seq through the lookup contract. If the search is successful and the attribute set U of the data user DU is verified to conform to the access policy T, then the public key PU, attribute set U, CID and ciphertext C of the data user DU are broadcast to the relay chain. After receiving the data, the relay node A sends the public key PU and attribute set U of the data user (DU) to the data owner DO. Data owner DO generates an attribute private key based on attribute set U and system master key MK, and encrypts the attribute private key using data user DU's public key PU to obtain attribute private key ciphertext. The attribute private key ciphertext is then sent to relay node A, which broadcasts it to the relay chain. Relay node B receives the broadcast and sends the CID, ciphertext C, and attribute private key ciphertext together to data user DU.

5. The IoT data fine-grained access control system based on blockchain cross-chain and IPFS according to claim 1, characterized in that, The system uses CP-ABE technology to encrypt and decrypt data access. It flexibly specifies access permissions for individual users through access policy T, and only users whose attributes meet the access policy can successfully access the data.

6. A method for fine-grained access control of IoT data based on blockchain cross-chain and IPFS, employing the fine-grained access control system for IoT data based on blockchain cross-chain and IPFS as described in any one of claims 1 to 5, characterized in that, The method includes: System initialization: Data owner DO and data user DU send registration requests to relay node A and relay node B respectively. After successful verification, relay node A and relay node B issue digital certificates to them respectively. Data owner DO generates system public key and system master key. Data Release: After encrypting the original data with key Key, the data owner DO uploads the encrypted original data to the InterPlanetary File System and receives the Content Identifier (CID) that uniquely corresponds to the data. Then, using the system public key and access policy T, DO encrypts Key and CID to obtain ciphertext. This ciphertext is associated with the access policy. Only when the owned attributes meet the access policy in the ciphertext can the ciphertext be decrypted. After the ciphertext is uploaded to the source blockchain for notarization, it is then published to the relay chain through relay node A. Data Request and Search: Data user DU on the target blockchain initiates a data request to relay node B. Relay node B verifies data user DU's certificate. After successful verification, it invokes the search contract to retrieve the relevant data. If the search is successful and data user DU's attribute set is verified to conform to the access policy, relay node B broadcasts data user DU's public key and attribute set to the relay chain. Relay node A receives this and sends it to data owner DO. Data owner DO generates an attribute private key and encrypts it using data user DU's public key to obtain the attribute private key ciphertext. Data owner DO sends the attribute private key ciphertext to relay node A. Relay node A broadcasts the attribute private key ciphertext to the relay chain. Relay node B receives this and sends the ciphertext of CID and key Key, along with the attribute private key ciphertext, to data user DU. Data Acquisition: After obtaining the ciphertext of CID and Key, as well as the ciphertext of attribute private key, data user DU uses its own private key to decrypt the attribute private key ciphertext to obtain the attribute private key. Finally, data user DU uses CID to search for and obtain the original data ciphertext on the InterPlanetary File System, and then uses Key to decrypt and obtain the original data.

Images