Big data identity verification and access control method and system based on block chain

Abstract

The invention provides a block chain-based big data identity verification and access control method and system. According to the method, the smart contract is deployed in the block chain network, and when a big data platform receives an access request of a user for a distributed data file, a user digital certificate and a resource identifier of the distributed data file are analyzed from the access request; taking the user digital certificate and the resource identifier as input parameters to call an intelligent contract in the block chain network, executing an access control strategy bound with the user identity in the intelligent contract, performing permission judgment on the user digital certificate and the resource identifier to generate an authorization instruction, receiving the authorization instruction through the big data platform, and sending the authorization instruction to the block chain network. And controlling the access state of the distributed data file based on the authorization instruction. According to the technical scheme provided by the invention, the granularity of data protection is improved, the auditing tracking capability of the whole access control process is enhanced, and a solid guarantee is provided for data security in a big data environment.

Description

A blockchain-based big data authentication and access control method and system Technical Field

[0001] This application relates to the fields of computer security technology and data management technology, and in particular to a blockchain-based big data authentication and access control method and system. Background Technology

[0002] As enterprises accelerate their digital transformation, the volume of data stored in various distributed systems and cloud platforms continues to grow, and the demand for data asset transfer and sharing among different entities is becoming increasingly prominent. Against this backdrop, how to achieve fine-grained access control over distributed data files and ensure the security, traceability, and compliance of data during the sharing process has become a pressing technical challenge. In particular, in cross-organizational collaboration scenarios, the traditional model based on a single centralized permission server is difficult to meet the needs of mutual trust among multiple parties, and there is an urgent need to establish a decentralized, tamper-proof, and automatically executed access control mechanism.

[0003] Currently, existing technical solutions mainly adopt the attribute-based encryption (ABE) access control model. In this scheme, the data owner defines an access policy based on user attributes and uses the policy to encrypt the data and store it in a distributed file system. When a user requests access to the data, they need to apply for an attribute key from the attribute authorization center and use the key to try to decrypt the data. If the user attributes meet the access policy, the data can be successfully decrypted and obtained. At the same time, the access log is recorded in a centralized audit server.

[0004] However, the existing solution has obvious limitations. As the core permission management institution, the attribute authorization center still has the risk of single point of failure. Once a failure occurs, the authorization service of the entire system will be paralyzed. The access policy for encrypted data is difficult to adjust flexibly after it is set, and policy updates will trigger a large number of data re-encryption operations, resulting in huge system overhead. In addition, the access logs stored in a centralized manner are at risk of being tampered with or deleted, which is difficult to meet the needs of scenarios with strict requirements for the credibility of audit records. Summary of the Invention

[0005] This application provides a blockchain-based big data identity verification and access control method and system to solve the problems in the prior art, such as the risk of single point of failure due to reliance on centralized permission servers, the difficulty in adjusting access policies leading to high system overhead, and the lack of credibility due to the susceptibility of centralized audit logs to tampering.

[0006] In a first aspect, this application provides a blockchain-based big data identity verification and access control method, comprising: deploying a smart contract in a blockchain network, wherein the smart contract encapsulates an access control policy bound to a user's identity; when a big data platform receives a user's access request for a distributed data file, parsing the user's digital credentials and the resource identifier of the distributed data file from the access request; calling the smart contract in the blockchain network using the user's digital credentials and the resource identifier as input parameters; performing permission determination on the user's digital credentials and the resource identifier by executing the access control policy bound to the user's identity in the smart contract to generate an authorization instruction; receiving the authorization instruction through the big data platform, and controlling the access status of the distributed data file based on the authorization instruction.

[0007] Optionally, a smart contract is deployed in the blockchain network, wherein the smart contract encapsulates an access control policy bound to a user identity, including: defining an access control policy bound to a user identity, wherein the access control policy contains a permission relationship between at least one user identity identifier and at least one resource identifier of a distributed data file; encoding the defined access control policy into a set of computer instructions that can be executed by the blockchain network to form a smart contract; publishing the smart contract to the blockchain network and generating a corresponding contract address in the blockchain network to complete the deployment of the smart contract.

[0008] Optionally, the defined access control policy is encoded into a set of computer instructions executable by the blockchain network to form a smart contract, including: constructing a data structure for storing the correspondence between user identity identifiers, resource identifiers, and operation permissions based on the permission relationships defined in the access control policy; writing a smart contract function configured to receive input user identity identifiers and resource identifiers; receiving the input user identity identifiers and resource identifiers, querying the data structure to determine permissions, and outputting the corresponding authorization instructions using the smart contract function based on the permission determination result; compiling the code containing the data structure and the smart contract function for generating the authorization instructions into bytecode executable by the blockchain network to form a smart contract capable of generating the authorization instructions.

[0009] Optionally, when the big data platform receives a user's access request for a distributed data file, it parses the user's digital credential and the resource identifier of the distributed data file from the access request, including: receiving the access request from the user terminal through the big data platform; extracting a unique string representing the user's identity from the header information of the access request as the user's digital credential; and extracting a unique identifier for locating the distributed data file from the path information of the access request as the resource identifier.

[0010] Optionally, invoking the smart contract in the blockchain network using the user digital credential and the resource identifier as input parameters includes: constructing a blockchain transaction pointing to the smart contract, wherein the data payload portion of the blockchain transaction includes the user digital credential and the resource identifier; signing the blockchain transaction using a cryptographic key associated with the big data platform; transmitting the signed blockchain transaction to the blockchain network; and when a node in the blockchain network verifies the validity of the signature of the blockchain transaction, executing the smart contract and transmitting the user digital credential and the resource identifier as input parameters to the smart contract.

[0011] Optionally, by executing the access control policy bound to the user's identity in the smart contract, permission determination is performed on the user's digital credentials and the resource identifier to generate an authorization instruction. This includes: accessing the access control policy stored internally by the smart contract, the access control policy containing a predefined list of permission relationships that associates the user's digital credentials, the resource identifier, and operation permissions; matching the user's digital credentials and the resource identifier with entries in the predefined list of permission relationships; when an entry completely corresponding to the user's digital credentials and the resource identifier is found in the list of permission relationships, generating an authorization instruction that allows access based on the operation permission associated with the entry completely corresponding to the user's digital credentials and the resource identifier; when no entry completely corresponding to the user's digital credentials and the resource identifier is found in the list of permission relationships, generating an authorization instruction that denies access.

[0012] Optionally, receiving the authorization instruction through the big data platform and controlling the access status of the distributed data file based on the authorization instruction includes: monitoring event logs related to the smart contract call in the blockchain network through the big data platform; when a transaction completion record containing the authorization instruction is captured from the event log, parsing out the specific content of the authorization instruction; sending a corresponding access control command to the file system storing the distributed data file according to the parsed specific content of the authorization instruction; and executing the access control command to open or block the read / write channel to the distributed data file to control the access status of the distributed data file.

[0013] Secondly, this application provides a blockchain-based big data identity verification and access control system, comprising: a deployment module for deploying a smart contract in a blockchain network, wherein the smart contract encapsulates an access control policy bound to a user's identity; a parsing module for parsing a user's digital credential and a resource identifier of the distributed data file from the access request when the big data platform receives such a request; a calling module for calling the smart contract in the blockchain network using the user's digital credential and the resource identifier as input parameters; a permission determination module for determining the permissions of the user's digital credential and the resource identifier by executing the access control policy bound to the user's identity in the smart contract, thereby generating an authorization instruction; and a control module for receiving the authorization instruction through the big data platform and controlling the access status of the distributed data file based on the authorization instruction.

[0014] Thirdly, this application provides a computing device, including a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are invoked and executed by the processing component to implement a blockchain-based big data authentication and access control method as described in the first aspect above.

[0015] Fourthly, this application provides a computer storage medium storing a computer program, which, when executed by a computer, implements a blockchain-based big data authentication and access control method as described in the first aspect.

[0016] This application implements a decentralized permission management mechanism by constructing a complete identity verification and access control process integrated with blockchain smart contracts. This method encapsulates access control policies in smart contracts and utilizes the distributed nature of blockchain to ensure the immutability and transparency of policy execution, thereby effectively avoiding the single point of failure risk of traditional centralized permission servers. Through an automated permission determination process, the system can quickly respond to access requests and generate reliable authorization instructions, significantly improving the security and efficiency of big data platforms when handling distributed data file access.

[0017] Furthermore, the reliability and real-time performance of access control are enhanced. This step utilizes a blockchain event log monitoring mechanism to ensure the complete capture and verification of authorization instructions, thereby guaranteeing the accurate triggering of access control commands. By directly manipulating the read and write channels of the file system, the system achieves fine-grained control over the access status of distributed data files. This not only improves the granularity of data protection but also enhances the audit and traceability capabilities of the entire access control process, providing a solid guarantee for data security in a big data environment.

[0018] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 shows a flowchart of a blockchain-based big data authentication and access control method provided in this application; Figure 2 shows a structural diagram of a blockchain-based big data authentication and access control system provided in this application; Figure 3 shows a structural diagram of a computing device provided in this application. Detailed Implementation

[0021] To enable those skilled in the art to better understand the present application, the technical solution of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0022] In some of the processes described in the specification, claims, and accompanying drawings of this application, multiple operations appearing in a specific order are included. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not themselves represent any execution order. Furthermore, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first," "second," etc., in this document are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0023] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0024] Figure 1 is a flowchart of a blockchain-based big data authentication and access control method provided in this application. As shown in Figure 1, the method includes: Step 101, deploying a smart contract in a blockchain network, wherein the smart contract encapsulates an access control policy bound to the user's identity.

[0025] Optionally, step 101 may specifically include the following steps: Step 1011, defining an access control policy bound to a user identity, wherein the access control policy includes a permission relationship between at least one user identity identifier and at least one resource identifier of a distributed data file; Step 1012, encoding the defined access control policy into a set of computer instructions executable by the blockchain network to form a smart contract; wherein, step 1012 may specifically include the following steps: based on the permission relationship defined in the access control policy, constructing a data structure for storing the correspondence between user identity identifiers, resource identifiers, and operation permissions; writing a smart contract function, wherein the smart contract function is configured to receive input user identity identifiers and resource identifiers; receiving input user identity identifiers and resource identifiers, querying the data structure to perform permission determination, and outputting corresponding authorization instructions using the smart contract function according to the permission determination result; compiling the code containing the data structure and the smart contract function used to generate authorization instructions into bytecode executable by the blockchain network to form a smart contract capable of generating the authorization instructions.

[0026] Step 1013: Publish the smart contract to the blockchain network and generate a corresponding contract address in the blockchain network to complete the deployment of the smart contract.

[0027] In the above steps, the access control policy is a set of rules formulated by the data owner to specify which user identities can access which data resources and what operation permissions they have; the permission determination is a decision-making process that compares the user identity with the preset policy to determine whether access is allowed; the authorization instruction is a control command generated by the smart contract based on the permission determination result to allow or deny access; the blockchain network is a distributed system composed of multiple nodes, used to store smart contracts and perform verification operations.

[0028] In this embodiment, the data owner first defines a specific access control policy, clarifying the correspondence and operation permissions between each user's identity identifier and the distributed data file resource identifier. Then, the defined access control policy is converted into executable code: first, a data structure for storage mapping is constructed based on the permission relationships in the policy; then, a smart contract function that can receive user identity identifiers and resource identifiers is written. This function completes permission determination by querying the data structure and outputs authorization instructions. The complete code is compiled into blockchain-executable bytecode. Finally, the compiled smart contract code is published to the blockchain network, and the network automatically generates a unique contract address to complete the deployment.

[0029] For example, Company A needs to implement access control for its customer data file B stored on a distributed platform. The data administrator first defines an access policy that stipulates that only users with user identifiers "VIP001" and "VIP002" can read file B. Then, the policy is converted into smart contract code, which includes a data structure that stores the correspondence between user identifiers and file B, as well as a function for permission determination. Finally, the contract is published to the blockchain network, generating the contract address "0x1234" to complete the deployment.

[0030] This step transforms the access policy into a blockchain smart contract, enabling decentralized storage and automatic execution of permission management rules. This avoids the risk of single points of failure and ensures the immutability of the policy, providing a reliable foundation for subsequent permission verification.

[0031] Step 102: When the big data platform receives a user's access request for a distributed data file, it parses the user's digital credentials and the resource identifier of the distributed data file from the access request.

[0032] Optionally, step 102 may specifically include the following steps: step 1021, receiving an access request from a user terminal through the big data platform; step 1022, extracting a unique string representing the user's identity from the header information of the access request as a user digital credential; step 1023, extracting a unique identifier for locating the distributed data file from the path information of the access request as a resource identifier.

[0033] In the above steps, the user digital credential is a unique string identifier used to verify the user's identity, which usually contains user identity code or digital certificate information; the resource identifier is a string encoding used to uniquely identify and locate distributed data files, which can accurately point to a specific data resource.

[0034] In this embodiment, the big data platform first receives the access request data packet sent from the user terminal through the network interface. Then, the platform parses the header information of the access request and extracts the specific field content containing user authentication information as the user digital credential. Then, the platform parses the path information of the access request and extracts the unique code used to identify the target data file as the resource identifier from the request path.

[0035] Following the implementation example from the previous step, in Company A's data management platform, user C requests access to distributed data file B through a terminal. After receiving the access request, the platform extracts user C's digital credential "USER_C_TOKEN_2024" from the Authorization field in the request header, and at the same time parses the resource identifier "RES_FILE_B_001" of file B from the request path " / api / data / file_B". This parsed information will be used for subsequent smart contract calls.

[0036] This step accurately parses the key information in the access request, providing the necessary input parameters for subsequent permission verification, ensuring the accurate identification of user identity and target resources, and laying the foundation for the smooth execution of the entire access control process.

[0037] Step 103: Use the user digital credential and the resource identifier as input parameters to call the smart contract in the blockchain network.

[0038] Optionally, step 103 may specifically include the following steps: Step 1031, constructing a blockchain transaction pointing to the smart contract, wherein the data payload of the blockchain transaction includes the user digital credential and the resource identifier; Step 1032, signing the blockchain transaction using a cryptographic key associated with the big data platform; Step 1033, transmitting the signed blockchain transaction to the blockchain network; Step 1034, when a node in the blockchain network verifies the validity of the signature of the blockchain transaction, executing the smart contract and transmitting the user digital credential and the resource identifier as input parameters to the smart contract.

[0039] In the above steps, a blockchain transaction is the basic operational unit in the blockchain network, which includes elements such as sender, receiver, and data payload, and is used to record and transmit operational information; a cryptographic key is a pair of mathematically related digital codes, including a private key used to generate digital signatures and a public key used to verify signatures; the blockchain network is a database system jointly maintained by multiple distributed nodes, which ensures data consistency and security through a consensus mechanism.

[0040] In this embodiment, the big data platform first constructs a blockchain transaction pointing to the smart contract address, encapsulating the user digital credential and resource identifier obtained in step 102 as data payloads into the transaction. Next, the platform uses its private key to perform a digital signature operation on the transaction data, generating an unforgeable electronic signature. Then, the signed blockchain transaction is broadcast to various nodes in the blockchain network. Finally, the network nodes use the platform's public key to verify the validity of the transaction signature. After confirming that there are no errors, the smart contract code is executed, and the user digital credential and resource identifier in the transaction data are passed as parameters to the smart contract for processing.

[0041] Following the implementation example from the previous step, in Company A's data management platform, the platform uses the digital credential "USER_C_TOKEN_2024" parsed from user C's access request and the resource identifier "RES_FILE_B_001" of file B to construct a blockchain transaction pointing to contract address "0x1234". The platform signs the transaction using its private key and sends it to the blockchain network. After the network node verifies the validity of the signature, it executes the smart contract and passes these two parameters into the contract for permission determination.

[0042] This step utilizes the secure transmission and verification mechanism of blockchain transactions to ensure the reliable transmission of permission verification requests, guaranteeing the immutability of the calling process and the authenticity of the identity, thus providing secure and reliable input parameters for the accurate execution of smart contracts.

[0043] Step 104: By executing the access control policy in the smart contract that is bound to the user's identity, the user's digital credential and the resource identifier are judged for permissions to generate an authorization instruction.

[0044] Optionally, step 104 may specifically include the following steps: Step 1041, accessing the access control policy stored internally by the smart contract, the access control policy containing a predefined list of permission relationships that associates user digital credentials, resource identifiers, and operation permissions; Step 1042, matching the user digital credentials and the resource identifier with entries in the predefined list of permission relationships; Step 1043, when an entry completely corresponding to the user digital credentials and the resource identifier is found in the list of permission relationships, generating an access permission authorization instruction based on the operation permission associated with the entry completely corresponding to the user digital credentials and the resource identifier; Step 1044, when no entry completely corresponding to the user digital credentials and the resource identifier is found in the list of permission relationships, generating an access denial authorization instruction.

[0045] In the above steps, the access control policy is a set of permission rules predefined in the smart contract, which is used to specify the access permissions of different users to data resources; the permission relationship list is the specific manifestation of the access control policy, which is a set of correspondences between user digital credentials, resource identifiers and operation permissions stored in tabular form.

[0046] In this embodiment, the smart contract first accesses its internally stored access control policy and reads a predefined list of permission relationships. Then, it compares the received user digital credentials and resource identifiers with the entries in the list one by one. Next, when a completely matching entry is found in the list, the smart contract generates an authorization instruction to allow access based on the operation permission content associated with that entry. Finally, when no matching entry is found in the list, the smart contract generates an authorization instruction to deny access.

[0047] Following the implementation example from the previous step, during the execution of Company A's smart contract, the contract receives user C's digital credential "USER_C_TOKEN_2024" and file B's resource identifier "RES_FILE_B_001". The smart contract accesses the permission relationship list in its internal storage and finds a corresponding entry: user C is allowed to read file B. Based on this matching result, the smart contract generates an authorization instruction to allow reading.

[0048] This step automatically executes the permission determination logic through smart contracts, ensuring the accuracy and immutability of the permission verification process. At the same time, the automated instruction generation mechanism improves access control efficiency and provides a reliable decision-making basis for subsequent access control operations.

[0049] Step 105: Receive the authorization instruction through the big data platform, and control the access status of the distributed data file based on the authorization instruction.

[0050] Optionally, step 105 may specifically include the following steps: Step 1051, monitoring event logs related to the smart contract call in the blockchain network through the big data platform; Step 1052, when a transaction completion record containing the authorization instruction is captured from the event log, parsing out the specific content of the authorization instruction; Step 1053, sending a corresponding access control command to the file system storing the distributed data file according to the parsed specific content of the authorization instruction; Step 1054, executing the access control command to open or block the read / write channel to the distributed data file, thereby controlling the access status to the distributed data file.

[0051] In the above steps, the event log is a detailed record of smart contract calls and transaction completion in the blockchain network, used to track operation history; the access control command is a specific operation instruction sent by the big data platform to the file system according to the authorization instruction, used to manage user access permissions; the read-write channel is the transmission path in the file system used for data reading and writing, which can be opened or closed by commands; the access status is the user's current access permissions to the distributed data file, including the status of allowed access or denied access.

[0052] In this embodiment, firstly, the big data platform continuously monitors event logs related to smart contract calls in the blockchain network; then, when a transaction completion record containing authorization instructions is captured from the event logs, the platform immediately parses out the specific content of the authorization instructions; then, based on the parsed instruction content, the platform sends corresponding access control commands to the file system storing the distributed data files; finally, the file system executes the received access control commands, controlling the access status to the distributed data files by opening or blocking read / write channels.

[0053] Following the previous implementation case, in Company A's data management system, after the smart contract generates an authorization instruction for user C, the big data platform captures the instruction by listening to the blockchain event log, parses out the "allow read" authorization content, and then sends a command to the file system to open a read-only channel for file B. After the file system executes the command, user C obtains read-only access to file B.

[0054] This step, by listening to blockchain events and executing access control commands, achieves a reliable conversion from authorization instructions to specific access controls, ensuring the accurate implementation of permission management policies while guaranteeing the security and controllability of the data access process.

[0055] Figure 2 is a schematic diagram of the structure of a blockchain-based big data identity verification and access control system provided in this application. As shown in Figure 2, the system includes: a deployment module 21, which deploys a smart contract in the blockchain network, wherein the smart contract encapsulates an access control policy bound to the user's identity; a parsing module 22, which, when the big data platform receives a user's access request for a distributed data file, parses the user's digital credentials and the resource identifier of the distributed data file from the access request; a calling module 23, which calls the smart contract in the blockchain network using the user's digital credentials and the resource identifier as input parameters; a permission determination module 24, which performs permission determination on the user's digital credentials and the resource identifier by executing the access control policy bound to the user's identity in the smart contract, so as to generate an authorization instruction; and a control module 25, which receives the authorization instruction through the big data platform and controls the access status of the distributed data file based on the authorization instruction.

[0056] The blockchain-based big data authentication and access control system shown in Figure 2 can execute the blockchain-based big data authentication and access control method described in the embodiment shown in Figure 1. Its implementation principle and technical effects will not be elaborated further. The specific methods by which each module and unit of the blockchain-based big data authentication and access control system in the above embodiments perform operations have been described in detail in the embodiments related to this method, and will not be elaborated upon here.

[0057] In one possible design, the blockchain-based big data authentication and access control system of the embodiment shown in Figure 2 can be implemented as a computing device, as shown in Figure 3. The computing device may include a storage component 31 and a processing component 32; the storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32.

[0058] The processing component 32 is used in a blockchain-based big data authentication and access control method according to the embodiment of FIG1 above.

[0059] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above-described method. Alternatively, the processing component may be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above-described method.

[0060] Storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0061] Of course, computing devices may also include other components, such as input / output interfaces, display components, communication components, etc.

[0062] Input / output interfaces provide interfaces between processing components and peripheral interface modules, which can be output devices, input devices, etc.

[0063] The communication components are configured to facilitate wired or wireless communication between computing devices and other devices.

[0064] The computing device can be a physical device or an elastic computing host provided by a cloud computing platform. In this case, the computing device can refer to a cloud server, and the aforementioned processing components, storage components, etc., can be basic server resources rented or purchased from the cloud computing platform.

[0065] This application also provides a computer storage medium storing a computer program, which, when executed by a computer, can implement a blockchain-based big data authentication and access control method according to the embodiment shown in FIG1 above.

[0066] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0067] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0068] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0069] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A blockchain-based big data authentication and access control method, characterized in that, include: A smart contract is deployed in a blockchain network, wherein the smart contract encapsulates an access control policy bound to a user's identity. When a big data platform receives a user's access request for a distributed data file, it parses the user's digital credentials and the resource identifier of the distributed data file from the access request. The user's digital credentials and the resource identifier are used as input parameters to call the smart contract in the blockchain network. By executing the access control policy bound to the user's identity in the smart contract, the user's digital credentials and the resource identifier are used to determine permissions, thereby generating an authorization instruction. The big data platform receives the authorization instruction and controls the access status of the distributed data file based on the authorization instruction.

2. The method according to claim 1, characterized in that, Deploying a smart contract in a blockchain network, wherein the smart contract encapsulates an access control policy bound to a user identity, including: defining an access control policy bound to a user identity, the access control policy containing a permission relationship between at least one user identity identifier and at least one resource identifier of a distributed data file; encoding the defined access control policy into a set of computer instructions executable by the blockchain network to form a smart contract; publishing the smart contract to the blockchain network and generating a corresponding contract address in the blockchain network to complete the deployment of the smart contract.

3. The method according to claim 2, characterized in that, Encoding the defined access control policy into a set of computer instructions executable by the blockchain network to form a smart contract includes: constructing a data structure for storing the correspondence between user identity identifiers, resource identifiers, and operation permissions based on the permission relationships defined in the access control policy; writing a smart contract function configured to receive input user identity identifiers and resource identifiers; receiving the input user identity identifiers and resource identifiers, querying the data structure to determine permissions, and outputting the corresponding authorization instructions using the smart contract function based on the permission determination result; and compiling the code containing the data structure and the smart contract function for generating the authorization instructions into bytecode executable by the blockchain network to form a smart contract capable of generating the authorization instructions.

4. The method according to claim 1, characterized in that, When the big data platform receives a user's access request for a distributed data file, it parses the user's digital credential and the resource identifier of the distributed data file from the access request, including: receiving the access request from the user's terminal through the big data platform; extracting a unique string representing the user's identity from the header information of the access request as the user's digital credential; and extracting a unique identifier for locating the distributed data file from the path information of the access request as the resource identifier.

5. The method according to claim 1, characterized in that, Calling the smart contract in the blockchain network using the user digital credential and the resource identifier as input parameters includes: constructing a blockchain transaction pointing to the smart contract, wherein the data payload of the blockchain transaction includes the user digital credential and the resource identifier; signing the blockchain transaction using a cryptographic key associated with the big data platform; transmitting the signed blockchain transaction to the blockchain network; and when a node in the blockchain network verifies the validity of the signature of the blockchain transaction, executing the smart contract and transmitting the user digital credential and the resource identifier as input parameters to the smart contract.

6. The method according to claim 1, characterized in that, By executing the access control policy bound to the user's identity in the smart contract, the user's digital credentials and the resource identifier are assessed for permissions to generate an authorization instruction. This includes: accessing the access control policy stored internally by the smart contract, whereby the access control policy contains a predefined list of permission relationships that associates user digital credentials, resource identifiers, and operation permissions; matching the user digital credentials and the resource identifier with entries in the predefined list of permission relationships; when an entry that perfectly matches the user digital credentials and the resource identifier is found in the list of permission relationships, generating an authorization instruction that allows access based on the operation permission associated with the entry that perfectly matches the user digital credentials and the resource identifier; and when no entry that perfectly matches the user digital credentials and the resource identifier is found in the list of permission relationships, generating an authorization instruction that denies access.

7. The method according to claim 1, characterized in that, Receiving the authorization instruction through the big data platform and controlling the access status of the distributed data file based on the authorization instruction includes: monitoring event logs related to the smart contract call in the blockchain network through the big data platform; when a transaction completion record containing the authorization instruction is captured from the event log, parsing out the specific content of the authorization instruction; sending a corresponding access control command to the file system storing the distributed data file according to the parsed specific content of the authorization instruction; and executing the access control command to open or block the read / write channel of the distributed data file to control the access status of the distributed data file.

8. A blockchain-based big data authentication and access control system, characterized in that, include: The system comprises the following modules: a deployment module, which deploys a smart contract in the blockchain network, wherein the smart contract encapsulates an access control policy bound to the user's identity; a parsing module, which, when the big data platform receives a user's access request for a distributed data file, parses the user's digital credentials and the resource identifier of the distributed data file from the access request; a calling module, which uses the user's digital credentials and the resource identifier as input parameters to call the smart contract in the blockchain network; an authorization determination module, which, by executing the access control policy bound to the user's identity in the smart contract, determines the permissions of the user's digital credentials and the resource identifier to generate an authorization instruction; and a control module, which receives the authorization instruction through the big data platform and controls the access status of the distributed data file based on the authorization instruction.

9. A computing device, characterized in that, It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are invoked and executed by the processing component to implement a blockchain-based big data authentication and access control method as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that, The device contains a computer program that, when executed by a computer, implements a blockchain-based big data authentication and access control method as described in any one of claims 1 to 7.

Images