An access control method and apparatus

Abstract

This application provides an access control method and device that, in response to a user's data access request, determines at least one target encrypted data group from multiple encrypted data groups in a consortium blockchain, for which the user has access rights. The access request includes a user role identifier and access credentials; the access role identifier in the target encrypted data group includes the user role identifier, and the access credentials satisfy the access policy associated with the target encrypted data group. For each target encrypted data group, a target ciphertext fragment obtained from the target encrypted data group is decrypted to obtain the target fragment data. The security of the target fragment data is verified based on the current hash value of the target fragment data and the original hash value in the target encrypted data group. Once the security verification is successful, the user is allowed to access the target fragment data. This method employs multiple access verifications to achieve fine-grained access control and tamper-proof protection for telecommunications industry data, significantly improving data access security.

Description

Technical Field

[0001] This invention relates to the field of data security, and in particular to an access control method and device. Background Technology

[0002] With the development of information technology, the telecommunications industry generates a huge amount of data every day, covering user communication details, SMS content, Internet behavior logs, network operation status, billing and settlement records, etc., and involves a large amount of personal privacy and sensitive information. Once it is tampered with, leaked or lost, it will cause serious problems. Therefore, the security of data access is of paramount importance. To improve the security of data access, existing technologies typically use fixed information / single-dimensional information verification to determine the reliability of accessing users during the data access control process. However, telecommunications data is characterized by high frequency of generation, large volume, and diverse sources, and existing access verification methods are prone to data leakage and have security deficiencies. Summary of the Invention

[0003] This application provides an access control method and device to solve the problem of insufficient security caused by the single data access verification method in the prior art.

[0004] Firstly, this application provides an access control method, including: In response to a user's data access request, at least one target encrypted data group that the user has access to is determined from multiple encrypted data groups in the consortium blockchain. The access request includes a user role identifier and access credentials. The access role identifier in the target encrypted data group includes the user role identifier, and the access credentials satisfy the access policy associated with the target encrypted data group. For each target encrypted data group, the target ciphertext fragment obtained based on the target encrypted data group is decrypted to obtain the target fragment data; the security of the target fragment data is verified based on the current hash value of the target fragment data and the original hash value in the target encrypted data group. Once the security verification is successful, the user is allowed to access the target fragment data.

[0005] In one possible implementation, verifying the security of the target fragment data based on the current hash value of the target fragment data and the original hash value in the target encrypted data group includes: If the current hash value of the target fragment data is the same as the original hash value in the target encrypted data group, then the target fragment data is determined to be secure. If the current hash value of the target fragment data is different from the original hash value in the target encrypted data group, the security of the target fragment data is verified based on the tampering index of the initial data to which the target fragment data belongs. The tampering index represents the proportion of abnormal fragment data in the initial data, and the abnormal fragment data is fragment data whose current hash value is different from the original hash value.

[0006] In one possible implementation, verifying the security of the target shard data based on the tampering index of the initial data to which the target shard data belongs includes: If the tampering index is less than a preset threshold, then the target fragment data is determined to be secure. If the tampering index is greater than or equal to the preset threshold, the security of the target shard data is verified based on the Merkle root hash corresponding to the target shard data, wherein the Merkle root hash is generated based on the current hash value.

[0007] In one possible implementation, verifying the security of the target shard data based on the Merkle root hash corresponding to the target shard data includes: If the Merkle root hash is the same as the original Merkle root hash of the target shard data, then the security of the target shard data is determined. The original Merkle root hash is generated based on the original hash value.

[0008] In one possible implementation, the tampering index is determined through the following steps: Obtain multiple data fragments corresponding to the initial data; Based on the current hash value of each data shard and the original hash value of each data shard, abnormal data shards among the multiple data shards are determined; The tampering index is determined based on the number of abnormal fragment data and the total number of fragment data corresponding to the initial data.

[0009] In one possible implementation, the step of decrypting the target ciphertext fragment corresponding to the target encrypted data group to obtain the target fragment data includes: Obtain the encryption key from the target encrypted data group; The encryption key is decrypted using a preset asymmetric user private key to obtain a symmetric fragmentation key; The target ciphertext fragments are decrypted using the symmetric fragmentation key to obtain the target fragment data.

[0010] In one possible implementation, the encrypted data group includes at least one access role identifier and at least one access policy identifier corresponding to each access role identifier, wherein the access role identifier and the access policy identifier are configured for each data segment based on the security level, data type, and preset permission rules of the data segment corresponding to the encrypted data group; The step of determining at least one target encrypted data group that the user has access to from multiple encrypted data groups in the consortium blockchain includes: The user role identifier is matched with each access role identifier to determine the target access role identifier; Match the access credentials with each access policy identifier corresponding to the target access role identifier; The encrypted data group that satisfies the preset matching result is taken as the target encrypted data group, wherein the preset matching result is that the access credential satisfies the access policy corresponding to each access policy identifier.

[0011] Secondly, this application provides an access control device, comprising: The response module is used to respond to a user's data access request and determine at least one target encrypted data group that the user has access to from multiple encrypted data groups in the consortium blockchain. The access request includes a user role identifier and access credentials. The access role identifier in the target encrypted data group includes the user role identifier, and the access credentials satisfy the access policy associated with the target encrypted data group. The verification module is used to decrypt the target ciphertext fragments obtained based on the target encrypted data group for each target encrypted data group to obtain target fragment data; and to verify the security of the target fragment data based on the current hash value of the target fragment data and the original hash value in the target encrypted data group. The control module is used to allow the user to access the target fragment data after the security verification is passed.

[0012] Thirdly, this application provides an electronic device, comprising: Memory, used to store computer programs; A processor is configured to invoke program instructions stored in the memory and execute the steps included in the method as described in any one of the first aspects, according to the obtained program instructions.

[0013] Fourthly, this application provides a computer-readable storage medium storing a computer program, the computer program including program instructions that, when executed by a computer, cause the computer to perform the method as described in any one of the first aspects.

[0014] The beneficial effects of this application are as follows: This application provides an access control method and device that, in response to a user's data access request, determines at least one target encrypted data group from multiple encrypted data groups in a consortium blockchain, for which the user has access rights. The access request includes a user role identifier and access credentials. The access role identifier in the target encrypted data group includes the user role identifier, and the access credentials satisfy the access policy associated with the target encrypted data group. For each target encrypted data group, the target ciphertext fragment obtained from the target encrypted data group is decrypted to obtain the target fragment data. The security of the target fragment data is verified based on the current hash value of the target fragment data and the original hash value in the target encrypted data group. Once the security verification is successful, the user is allowed to access the target fragment data. This method achieves fine-grained permission verification and control at the fragment level through dual verification of the user role identifier and access credentials, combined with the access role identifier and access policy in the encrypted data group. Simultaneously, by comparing the current hash value of the target fragment data with the original hash value, it ensures data integrity and anti-tampering capabilities, effectively solving the risks of over-authorization and data tampering in data access in the telecommunications industry, and significantly improving the overall security of data access. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This application provides a schematic diagram of a process for generating encrypted data groups in an embodiment. Figure 2 A flowchart illustrating an access control method provided in an embodiment of this application; Figure 3 This is a schematic diagram of the overall flow of an access control method provided in an embodiment of this application; Figure 4 This application provides a schematic diagram of the structure of an access control system according to an embodiment of the present application. Figure 5 This is a schematic diagram of the structure of an access control device provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0018] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this invention. Rather, they are merely examples of apparatuses and circuits consistent with some aspects of the invention as detailed in the appended claims.

[0019] To better understand the embodiments of this application, the technical terms involved in the embodiments of this application will be explained below.

[0020] Blockchain: A decentralized, distributed ledger technology that uses cryptographic methods to link data blocks into a chain. Each data block contains the hash value of the previous data block to ensure the integrity and immutability of the data.

[0021] Decentralization: Instead of relying on a single central authority for control and management, it improves the robustness and resistance to attacks by having multiple nodes in a distributed network jointly maintain and verify data.

[0022] Role-Based Access Control (RBAC): An access control model that simplifies access management and improves security by assigning roles to users to manage their access permissions to system resources.

[0023] Smart Contract: Program code deployed on a blockchain that can be executed automatically to automate business processes such as data verification, storage, and access control.

[0024] Hash value: A hash value is a variable that maps data of arbitrary length to a fixed-length output value using a hash algorithm. It is unique and irreversible, and is often used to verify data integrity. Any tiny change to the data will cause a significant change in the hash value.

[0025] Merkle tree: A tree-like data structure that uses a hash algorithm to calculate the hash value of each leaf node upwards, ultimately obtaining a unique root hash value, the Merkle root. Only the Merkle root needs to be stored and verified to efficiently verify the integrity of large amounts of data. Any tampering with any data block will cause a change in the Merkle root, thus allowing for rapid detection.

[0026] Shamir Threshold Sharing Algorithm: A secret-sharing technique used to divide a secret into multiple shares (or fragments) and distribute them to different participants. Its core principle is that the original secret can only be reconstructed when at least a threshold number of shares have been collected.

[0027] The technical solutions provided in this application can be applied to various data access control scenarios, and are particularly suitable for the telecommunications industry. The following description uses data access in the telecommunications industry as an example, but it is not intended to limit the scope of this application.

[0028] With the development of information technology, the telecommunications industry generates massive amounts of data daily, covering user communication details, SMS content, internet activity logs, network operation status, billing and settlement records, and involving a large amount of personal privacy and sensitive information. This business data is characterized by high frequency of generation, massive volume, and diverse sources. If it is tampered with, leaked, or lost, it will trigger serious legal, security, and social trust issues. Therefore, the security of data access is of paramount importance.

[0029] Currently, mainstream telecommunications data management systems are still based on traditional centralized database architectures, which expose multiple shortcomings in telecommunications scenarios characterized by high concurrency, high sensitivity, and multi-entity access: high risk of data tampering (centralized nodes are vulnerable to attacks), lack of transparent and verifiable mechanisms, severe impact of single points of failure, high data barriers between systems, and significant pressure on privacy protection and compliance. Although some solutions have introduced blockchain technology for data notarization and tamper-proofing, such as encrypting communication data in a hierarchical manner on the blockchain, most existing solutions still rely on fixed information or single-dimensional information (e.g., based solely on roles or attributes) to determine the reliability of accessing users when conducting data access control.

[0030] However, telecommunications data is characterized by high frequency of generation, massive volume, and diverse sources. A single verification dimension is insufficient to meet the fine-grained authorization needs of multiple roles and scenarios, easily leading to over-authorization or insufficient permissions, which in turn causes data leakage or business disruption. At the same time, existing blockchain evidence storage solutions often put complete data or simple hashes on the chain without fully considering the "high frequency, massive volume, multiple sources, and heterogeneous" characteristics of telecommunications data. This results in problems such as transaction throughput bottlenecks, on-chain data bloat, and leakage of sensitive information, and lacks a real-time integrity verification mechanism that is deeply integrated with access control.

[0031] To address the aforementioned problems, embodiments of this application provide an access control method and device. For ease of understanding, the access control method and device provided in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0032] First, the process of generating and storing encrypted data groups in the embodiments of this application will be described with reference to the accompanying drawings.

[0033] Specifically, such as Figure 1 The diagram shown is a flowchart illustrating a process for generating encrypted data groups according to an embodiment of this application. The encrypted data groups are generated and stored in the consortium blockchain in the following manner: S101: Receive multiple initial data.

[0034] Specifically, in telecommunications service scenarios, devices such as base stations, core network servers, and user terminals generate a large amount of initial data for various services, such as call logs, SMS content, user internet access logs, location information, terminal device access information, roaming handover data, and operator operation policy logs. To collect this initial data, this application uses a distributed data collection agent deployed at the edge of the telecommunications network to interface with signaling gateways, business support systems (BSS), operations support systems (OSS), and the core network of 5G mobile communication technology within the communication network.

[0035] Because the initial data in the telecommunications industry is characterized by high frequency of generation, large volume, and diverse sources, in order to ensure that the data acquisition process is real-time and complete, this application adopts a distributed message queue to implement an asynchronous acquisition channel, and combines a data extraction-transform-load (ETL) component to process the initial data.

[0036] Optionally, to address the mismatch between data acquisition speed and subsequent processing speed and to avoid system overload, the initial acquired data is first stored in a cache queue and preprocessed. The combined effect of caching and preprocessing smooths data flow and filters out invalid data in advance, thereby improving the reliability of subsequent steps and overall processing efficiency. Preprocessing includes at least one of the following operations: Cache control: Set upper and lower thresholds for the initial cache data volume. When the cache data volume exceeds the upper threshold, reduce the sampling frequency; when the cache data volume is less than or equal to the lower threshold, restore the normal sampling frequency.

[0037] Sampling and Filtering: The received initial data is evaluated from multiple dimensions according to a pre-defined filtering rule base (e.g., a JSON-formatted rule file). Optionally, filtering can be done by data type, identifying data packet header information to retain only pre-defined initial data types such as "call logs," "SMS content," and "browsing logs." Alternatively, sensitivity can be categorized, based on the initial data's classification label (e.g., "Top Secret," "Confidential," "Internal," "Public"), triggering subsequent processes only for data at the "Confidential" level or higher, while low-sensitivity data is either stored locally or discarded.

[0038] Anomaly Validation: Optionally, perform format and syntax validation, such as using regular expressions to verify that the phone number is 11 digits or that the timestamp is in standard Unix format. Optionally, perform integrity validation, such as using Cyclic Redundancy Check 32 (CRC32) or Message-Digest Algorithm 5 (MD5) to verify whether bit flipping or other issues occurred during the initial data transmission. If validation fails, the initial data is placed in an anomaly isolation area, an alarm log is generated and the anomaly type is recorded (e.g., "format error" or "missing field"), and maintenance personnel are notified for subsequent manual repair or re-entry, rather than being directly discarded.

[0039] Timestamp standardization: At the moment the data is collected (or enters the cache queue), the collection agent configures the initial data with a standard timestamp in the current Coordinated Universal Time (UTC), and converts all timestamps to the International Organization for Standardization 8601 format (e.g., "2023-10-25T12:00:00Z"), eliminating the differences caused by local time zones (e.g., Beijing time UTC+8), and providing unified and irrefutable time evidence for data uploading to the blockchain.

[0040] S102: For each initial data, the initial data is fragmented to generate multiple fragment data; based on the multiple fragment data, a corresponding encrypted data group is generated.

[0041] Specifically, for each initial data set, the Shamir threshold secret sharing algorithm is used for fragmentation. First, the initial data is encoded as a decimal integer, and then an N-1 degree polynomial is constructed, as shown in the following formula:

[0042] Where S represents the initial data, N represents the minimum number of data fragments required to reconstruct the original data (i.e., the threshold value), and a0, a1, ..., a N-1For a randomly selected integer, a0 is set to the decimal integer value of the initial data S.

[0043] Randomly select M distinct x-coordinates from the curve of this polynomial. j (j=1, 2, ..., M), calculate the corresponding ordinate f(x) respectively. j ), each coordinate pair (x j f(x) j This constitutes a data segment, where M ≥ N.

[0044] The method for generating fragmented data used in this application can select any number of fragmented data (i.e., N different coordinate pairs) and uniquely determine the original polynomial using the Lagrange interpolation method, thereby accurately reconstructing the initial data. Even if some fragmented data is lost or destroyed, as long as at least N correct fragmented data are collected, the complete data can be recovered, thus enabling the system to have high fault tolerance.

[0045] After generating multiple data shards of the initial data, perform the following operations for each data shard: First, the SM4 symmetric encryption algorithm is used to generate a random symmetric fragmentation key. This symmetric fragmentation key is used to encrypt the fragmented data, generating ciphertext fragments. At the same time, the hash value corresponding to the fragmented data before encryption is calculated, and this hash value is used as the original hash value of the fragmented data.

[0046] Then, the symmetric fragment key is encrypted using the SM2 asymmetric encryption algorithm and the system public key to generate an encryption key; Secondly, based on the security level (e.g., "Top Secret", "Confidential", "Internal", "Public"), data type (e.g., "SMS", "Location", "Data Traffic"), and preset permission rules (e.g., access permission policies for different roles to different types and security levels of data), configure one or more access role identifiers and at least one access policy tag corresponding to each access role identifier for the segmented data. Each access policy tag corresponds to a specific access policy.

[0047] Specifically, security level identifies the sensitivity of data, data type identifies the business category of data, and preset permission rules define the operation permissions of different roles on various types of data under different conditions. Based on the combination of the above three dimensions, access role identifiers and access policy tags can be finely assigned to each data shard, thereby achieving shard-level differentiated access control.

[0048] For example, for a data segment containing location information, with a security level of "Confidential" and a data type of "Location-based," and a preset access rule requiring access only by the "Police" role during case handling, the access role identifier for this data segment would be configured as "Police," and the access policy label would be "Valid During Case Handling." Thus, in subsequent access control processes, only users with the "Police" role identifier and whose access credentials meet the "During Case Handling" policy can successfully access the data segment.

[0049] Finally, the encrypted fragments, encryption keys, original hash values, access role identifiers, access policy tags, and other metadata (such as timestamps and data source information) are packaged together into a data structure (such as JSON or Protocol Buffers format) to form the encrypted data group corresponding to the fragment data.

[0050] In another embodiment, if the data volume of the fragment is greater than or equal to a preset threshold (e.g., a large audio call record), the encrypted fragment of the data is stored off-chain in an auxiliary storage system. For example, the auxiliary storage system is the InterPlanetary File System (IPFS).

[0051] Specifically, after storing the ciphertext fragments in the auxiliary storage system, a storage location identifier corresponding to each ciphertext fragment is generated. Then, the storage location identifier, encryption key, original hash value, access role identifier, access policy tag, and other metadata are packaged together into a data structure to form the encrypted data group corresponding to the fragment data.

[0052] S103: Store encrypted data sets of multiple initial data into the consortium blockchain.

[0053] During storage, a Merkle tree can be constructed based on the original hash values ​​in each encrypted data group, the Merkle root hash value can be calculated, and the root hash value can be stored in the block header for subsequent batch integrity verification of the initial data.

[0054] Based on the encrypted data group stored in the consortium blockchain, this application also provides an access control method, which is described in detail below: like Figure 2 The diagram shown is a flowchart illustrating an access control method provided in an embodiment of this application. Specifically: S201: In response to a user's data access request, determine at least one target encrypted data group from multiple encrypted data groups in the consortium blockchain that the user has access to, wherein the access request includes a user role identifier and access credentials, the access role identifier in the target encrypted data group includes a user role identifier, and the access credentials satisfy the access policy associated with the target encrypted data group. S202: For each target encrypted data group, decrypt the target ciphertext fragment obtained based on the target encrypted data group to obtain the target fragment data; verify the security of the target fragment data based on the current hash value of the target fragment data and the original hash value in the target encrypted data group. S203: Once the security verification is passed, the user is allowed to access the target fragment data.

[0055] The access control method of this application first responds to a user's data access request and determines at least one target encrypted data group from multiple encrypted data groups in the consortium blockchain to which the user has access rights. The access request includes a user role identifier and access credentials. The access role identifier in the target encrypted data group includes the user role identifier, and the access credentials satisfy the access policy associated with the target encrypted data group. Second, for each target encrypted data group, the target ciphertext fragment obtained from the target encrypted data group is decrypted to obtain the target fragment data. The security of the target fragment data is verified based on the current hash value of the target fragment data and the original hash value in the target encrypted data group. Finally, when the security verification passes, the user is allowed to access the target fragment data. This method achieves fine-grained permission verification and control at the fragment level through dual verification of the user role identifier and access credentials, combined with the access role identifier and access policy in the encrypted data group. Simultaneously, by comparing the current hash value of the target fragment data with the original hash value, it ensures data integrity and anti-tampering capabilities, effectively solving the risks of over-authorization and data tampering in data access in the telecommunications industry, and significantly improving the overall security of data access.

[0056] The steps described above in this application will be explained in detail below with reference to specific embodiments.

[0057] During the execution of step S201, when a user's data access request is received, this application adopts a composite access control model based on role-based access control (RBAC) and attribute-based access control (ABAC) to determine at least one target encrypted data group that the user has access to from multiple encrypted data groups in the consortium blockchain.

[0058] The RBAC section assigns roles to each user type (e.g., user, customer service, public security, regulator), and each role maps to a set of permissions (e.g., viewing metadata, viewing summaries, decryption access, audit recovery, etc.). The ABAC section uses user attributes, resource attributes, access time, device IP, etc., as criteria to achieve finer-grained control, such as allowing users to access specific types of data within a specific time period and under a specific network environment.

[0059] In practice, the aforementioned permission determination process is executed automatically by calling a smart contract. The smart contract embeds an access policy, requiring a call to the contract function to determine authorization before each access request. Specifically, the target encrypted data group is determined using the following method: First, obtain the user role identifier and access credentials carried in the data access request.

[0060] Then, for each encrypted data group stored in the consortium blockchain, read the multiple access role identifiers pre-configured in the encrypted data group and the multiple access policy identifiers corresponding to each access role identifier (each access policy identifier corresponds to an attribute-based condition, such as access time, device address, access content range, etc.).

[0061] The user role identifier is matched with each access role identifier. If an access role identifier exists that matches the user role identifier, that access role identifier is used as the target access role identifier. All access policy identifiers corresponding to the target access role identifier are obtained, and the access credentials are matched one by one with the access policy corresponding to each access policy identifier.

[0062] If the access credentials satisfy the access policy corresponding to each access policy identifier (i.e., all policies are verified), then the encrypted data group is determined to satisfy the preset matching result, and the encrypted data group is identified as a target encrypted data group that the user has access to.

[0063] Repeat the above process until all encrypted data groups involved in the user data access request have been traversed, and finally at least one target encrypted data group that the user has access to is obtained.

[0064] For example, suppose a telecom operator's consortium blockchain stores multiple encrypted data groups. One of these encrypted data groups is configured with the following access role identifiers, access policy identifiers corresponding to each access role identifier, and access policies defined by each policy identifier, as shown in Table 1:

[0065] Table 1

[0066] An existing user sends a data access request, carrying a user role identifier of "Public Security" in the request. The access credentials contain the following information: Current time: 14:30:00, May 20, 2025; Device C address: AA:BB:CC:DD:EE:FF (assuming this address is already whitelisted) Requested access data types: call logs and location information Upon receiving the data access request, the user role identifier "Public Security" is first matched against multiple access role identifiers {Public Security, Customer Service} in the encrypted data group. Since "Public Security" exists among multiple access role identifiers, the match is successful, and "Public Security" is identified as the target access role identifier.

[0067] Then, obtain all access policy identifiers and policies corresponding to the target access role identifier "Public Security", and match the user's access credentials with each access policy corresponding to the target access role identifier: the current time 14:30:00 meets any time of day (access policy corresponding to access time is approved); the device address AA:BB:CC:DD:EE:FF is in the whitelist (i.e., access policy corresponding to device address is approved); the call records and location information requested by the user are within the scope allowed by Public Security (i.e., access policy corresponding to access content is approved).

[0068] Since all three policies are satisfied (the default matching result is "access credentials satisfy the access policy corresponding to each access policy identifier"), this encrypted data group is determined to be the target encrypted data group that the user has access to.

[0069] This application achieves fine-grained access control at the fragmented level for telecommunications data through a progressive matching mechanism based on the aforementioned RBAC and ABAC composite models. At the role level, by assigning explicit roles to users and matching the set of role permissions with the access role identifiers in the encrypted data group, rapid role-based authorization is achieved, simplifying the permission management logic and enabling efficient passage of regular access requests. At the attribute level, multiple attribute-based access policies (such as access time, device address, and scope of accessed content) are further configured for each role, and real-time credentials are carried in the access request for one-by-one matching. Access is granted only when all policy conditions are met, thus achieving context-based dynamic authorization and effectively preventing data leakage due to overly broad role permissions. The role and attribute layers work together to form a progressive verification: first, candidate encrypted data groups are quickly filtered by role identifiers, and then precise determination is made through attribute policies. This avoids both over-authorization caused by overly coarse role division and permission management explosion caused by overly fine role division. Meanwhile, by independently configuring roles and policies at the fragment level, different fragments of the same initial data can have different access control rules. For example, location information fragments can only be accessed by the public security department, while call duration fragments can be accessed by customer service, thus achieving on-demand authorization. In summary, this application, through the deep integration of the RBAC+ABAC composite model and the fragment-level data structure, significantly improves the security, flexibility, and granularity of telecommunications data access control while ensuring system simplicity, effectively solving the problems of over-authorization or insufficient permissions caused by the single-dimensional verification method in existing technologies.

[0070] Furthermore, after determining at least one target encrypted data group that the user has access to, the method in step S202 can be used to perform security verification on each target encrypted data group. Specifically, this may include the following steps: S202-1: Obtain the target ciphertext fragment corresponding to the target encrypted data group, and decrypt the target ciphertext fragment.

[0071] Specifically, for a given target encrypted data group, the data content contained within the encrypted data group is first parsed; based on the different compositions of the target encrypted data group, corresponding methods are used to obtain the target ciphertext fragments: If the target encrypted data group includes the target ciphertext fragment, encryption key, original hash value, access role identifier, access policy label and other metadata (i.e. the data volume of the fragment corresponding to the target ciphertext fragment is less than the preset threshold and no auxiliary storage system is used), then the target ciphertext fragment is directly obtained.

[0072] If the target encrypted data group includes a storage location identifier, encryption key, original hash value, access role identifier, access policy label and other metadata (i.e., the data volume of the fragment corresponding to the target ciphertext fragment is greater than or equal to a preset threshold, and its ciphertext fragment is stored in the auxiliary storage system), then the corresponding target ciphertext fragment is obtained from the auxiliary storage system according to the storage location identifier.

[0073] After obtaining the target ciphertext fragment, the encryption key is read from the target encrypted data group, and the encryption key is decrypted using the asymmetric encryption algorithm (such as the SM2 asymmetric encryption algorithm) and the asymmetric user private key corresponding to the generation time to obtain the symmetric fragment key.

[0074] Then, using the symmetric fragment key and the corresponding symmetric encryption algorithm (such as SM4 symmetric encryption algorithm) generated at the time, the target ciphertext fragment is decrypted to finally obtain the target fragment data.

[0075] The method provided in this application, after successfully decrypting the target encrypted fragment, provides a reliable target fragment data for subsequent verification and access. First, the Shamir threshold secret sharing algorithm splits the initial data into multiple fragments, combining SM4 symmetric encryption and SM2 asymmetric encryption for dual protection, ensuring data confidentiality and integrity. Even if some fragments are maliciously stolen or tampered with, attackers cannot restore the complete data or pass subsequent hash verification, effectively mitigating the risk of data leakage and tampering. Second, based on the security level, data type, and preset permission rules of the fragmented data, each fragment is independently configured with an access role identifier and access policy label, achieving fine-grained permission control at the fragment level. Access requests are subject to dual matching of user role identifiers and access credentials, requiring access credentials to meet all policies corresponding to the target role. This avoids the over-authorization or insufficient permission problems caused by traditional single-dimensional verification, significantly improving the security of access control. Furthermore, for large file data, an auxiliary storage system is used for off-chain storage, retaining only the storage location identifier within the consortium blockchain. This reduces the storage pressure on the blockchain while ensuring the immutability of on-chain information, balancing system performance and data reliability. In summary, the embodiments of this application effectively solve the challenges of secure access and fine-grained management of telecommunications industry data in high-frequency, massive, and multi-source scenarios, significantly improving the overall security, flexibility, and scalability of data access.

[0076] S202-2: Verify the security of the target fragment data based on the current hash value of the target fragment data and the original hash value in the target encrypted data group; After obtaining the target fragment data, calculate the current hash value of the target fragment data (using the same hash algorithm as when it was generated), and read the pre-stored original hash value from the target encrypted data group. Compare the current hash value with the original hash value: If the current hash value of the target fragment data is the same as the original hash value in the target encrypted data group, it means that the target fragment data has not been tampered with since it was stored, thus confirming its security and allowing subsequent access.

[0077] If the current hash value of the target fragment data is different from the original hash value in the target encrypted data group, it indicates that the fragment data may have been tampered with. In this case, instead of rejecting it immediately, a further global health check is performed, and step S202-3 is executed.

[0078] S202-3: Verify the security of the target fragment data based on the tampering index of the initial data to which the target fragment data belongs; Specifically, the tampered index is determined through the following steps: First, obtain all the fragment data (including the target fragment data itself and other fragment data) corresponding to the initial data to which the target fragment data belongs. For each fragment data, calculate its current hash value and read the original hash value stored in its encrypted data group.

[0079] Then, count the number of shards whose current hash value is not equal to the original hash value among all shards, and define these shards as abnormal shards.

[0080] Finally, the tampering index is calculated using the following formula:

[0081] Where TamperIndex is the tampering index, M represents the total number of fragments contained in the initial data; S' j H(S') represents the j-th data segment; j ) represents the current hash value calculated for the j-th data segment; h j Let be the original hash value of the j-th data segment; 1[ ] is an indicator function, which takes the value of 1 when the condition in parentheses is true, and takes the value of 0 otherwise. Therefore, this formula calculates the proportion of data segments whose current hash value is inconsistent with the original hash value, that is, it calculates the ratio of the number of abnormal data segments to the total number of initial data segments, and uses this ratio as the tampering index, which takes the value range from 0 to 1. The larger the value, the wider the range of data tampering.

[0082] After determining the tampering index, it is compared with a preset threshold (e.g., 0.1, which can be dynamically configured according to the security policy): If the tampering index is less than the preset threshold, it means that although the target fragment data itself has inconsistent hashes, the proportion of abnormal fragments in the overall data is small. It may be an accidental transmission error or local noise interference. At this time, it can be determined that the target fragment data is safe.

[0083] If the tampering index is greater than or equal to the preset threshold, it indicates that there is a large-scale tampering in the overall data, and the data reliability is seriously reduced. At this time, the system needs to perform more rigorous verification and execute step S202-4.

[0084] S202-4: Verify the security of the target shard data based on the Merkle root hash corresponding to the target shard data.

[0085] When the tampering index exceeds the threshold, Merkle root hash verification is enabled. This verification is based on the original Merkle root hash constructed and stored in the block header of the consortium blockchain during the aforementioned storage (this root hash is calculated by hashing the original hash values ​​of each shard data level by level).

[0086] The specific verification process is as follows: Obtain the current hash value of all current shard data, and recalculate a current Merkle tree root hash using the same Merkle tree construction method as when storing (e.g., using each current hash value as a leaf node and hashing upwards level by level). Then, compare this current root hash with the original Merkle tree root hash read from the block header: If the Merkle root hash is the same as the original Merkle root hash of the target shard data, it means that the current hash value of all shard data is consistent with the original hash value as a whole (although the previous individual shard hash comparison failed, it may be due to a temporary error in the calculation or reading process, and the data integrity is confirmed after global reconstruction). At this time, the target shard data is determined to be safe.

[0087] If the Merkle root hash is different from the original Merkle root hash of the target shard data, it is confirmed that the initial data has been massively tampered with, the target shard data is insecure, the current data access request is rejected, and an audit process (such as logging, generating alarms, notifying the administrator, etc.) can be triggered.

[0088] Through the aforementioned progressive verification mechanism (hash value corresponding to sharded data → tampering index → ​​Merkle root hash), using the hash value corresponding to the sharded data as the verification factor, verification can be completed quickly in most normal access scenarios without traversing all shards, effectively reducing computational overhead and ensuring the system's high concurrency response capability. When the hash value comparison corresponding to the sharded data fails, a tampering index is introduced to assess the overall health of the data. If the tampering index is below a preset threshold, small-scale occasional errors (such as transmission noise or local storage media damage) are tolerated, avoiding direct rejection of access to the entire data due to individual shard anomalies, thereby improving data availability while ensuring security. When the tampering index exceeds the threshold, Merkle root hash is enabled for global precise verification, reliably confirming whether the data has been tampered with on a large scale, and decisively blocking access when the root hash is inconsistent. At the same time, the Merkle tree structure can be used to quickly locate the tampered shards, providing accurate support for subsequent auditing and repair. In summary, this application achieves a good balance between verification efficiency, system robustness, and data security through a progressive verification strategy that moves from partial to overall and from lightweight to rigorous verification. It is particularly suitable for complex scenarios involving high-frequency, massive, and multi-source telecommunications data.

[0089] The following will combine Figure 3 The overall workflow of this application is illustrated by way of example. Figure 3 This application provides an overall flowchart of an access control method, which specifically includes the following steps: S301: In response to a user's data access request, determine at least one target encrypted data group from multiple encrypted data groups in the consortium blockchain that the user has access to.

[0090] S302: For each target encrypted data group, decrypt the target ciphertext fragment obtained based on the target encrypted data group to obtain the target fragment data.

[0091] S303: Determine whether the current hash value of the target fragment data is the same as the original hash value in the target encrypted data group. If they are the same, proceed to step S308; if they are not the same, proceed to step S304.

[0092] S304: Calculate the tampering index of the initial data to which the target fragment data belongs; S305: Determine whether the tampering index is less than a preset threshold. If it is less than, proceed to step S308; if it is greater than or equal to the preset threshold, proceed to step S306.

[0093] S306: Calculate the current Merkle root hash of the initial data. S307: Determine whether the Merkle root hash is the same as the original Merkle root hash of the target shard data. If they are the same, proceed to step S308; otherwise, proceed to step S309.

[0094] S308: Determine the security of the target fragment data and allow user access.

[0095] S309: Data access request denied.

[0096] Through the above process, this application embodiment first performs permission filtering based on user role identifiers and access credentials to obtain the target encrypted data group; then, it adopts a progressive integrity verification strategy—sequentially performing single-shard hash comparison, tampering index determination, and Merkle root hash verification. This mechanism can quickly complete verification in normal scenarios, flexibly decide based on the overall degree of tampering when hash inconsistencies occur, and decisively refuse access when large-scale tampering is confirmed, thus providing a highly efficient, robust, and secure access control scheme for telecommunications data.

[0097] Based on the same inventive concept, this application also provides an access control system. The principle of this system in solving the technical problem is the same as that of the access control method described above. Its implementation can be referred to the method embodiment, and repeated parts will not be described again.

[0098] like Figure 4 The diagram shown is a structural schematic of an access control system provided in an embodiment of this application. The access control system includes: Data acquisition layer 41 is used to receive multiple initial data; Encryption fragmentation layer 42 is used to generate multiple corresponding encrypted data groups for each initial data; The consortium blockchain storage layer 43 is used to store all encrypted data groups corresponding to multiple initial data; Access control layer 44 is used to respond to user data access requests, determine at least one target encrypted data group from multiple encrypted data groups in the consortium blockchain to which the user has access rights, wherein the access request includes a user role identifier and access credentials, the access role identifier in the target encrypted data group includes the user role identifier, and the access credentials satisfy the access policy associated with the target encrypted data group; for each target encrypted data group, the target ciphertext fragment obtained based on the target encrypted data group is decrypted to obtain target fragment data; the security of the target fragment data is verified based on the current hash value of the target fragment data and the original hash value in the target encrypted data group; when the security verification is successful, the user is allowed to access the target fragment data.

[0099] It should be noted that in actual telecommunications network environments, to cope with the characteristics of "high concurrency and massive data" and to ensure system security and efficiency, the five layers of the access control system are usually distributed across different physical nodes or network areas. For example, the data acquisition layer 41 can be deployed on data-generating devices such as communication base stations and gateway devices, or on nearby edge servers; the consortium blockchain storage layer 43 is a distributed network that can be distributed across servers of different institutions (such as operators, regulatory agencies, and trusted third parties) to ensure the immutability of data. Of course, in specific scenarios (such as laboratory testing or small private networks), all of the above layers can also be deployed as a single physical device, and this application does not limit this.

[0100] Based on the same inventive concept, this application also provides an access control device. The principle of the access control device in solving the technical problem is similar to that of the access control method described above. The implementation of the access control device can refer to the implementation of the access control method, and the repeated parts will not be described again.

[0101] Specifically, such as Figure 5 The diagram shown is a structural schematic of an access control device provided in an embodiment of this application. The access control device includes: The response module 51 is used to respond to a user's data access request and determine at least one target encrypted data group that the user has access to from multiple encrypted data groups in the consortium blockchain. The access request includes a user role identifier and an access credential. The access role identifier in the target encrypted data group includes the user role identifier, and the access credential satisfies the access policy associated with the target encrypted data group. The verification module 52 is used to decrypt the target ciphertext fragment obtained based on the target encrypted data group for each target encrypted data group to obtain target fragment data; and to verify the security of the target fragment data based on the current hash value of the target fragment data and the original hash value in the target encrypted data group. The control module 53 is used to allow the user to access the target fragment data after the security verification is passed.

[0102] Based on the same inventive concept, this application also provides an electronic device. The principle of the electronic device in solving the technical problem is similar to that of the access control method described above. The implementation of the electronic device can refer to the implementation of the access control method, and the repeated parts will not be described again.

[0103] Specifically, such as Figure 6 The diagram shown is a structural schematic of an electronic device provided in an embodiment of this application. The electronic device includes: Memory 61 is used to store computer programs; Processor 62 is configured to call program instructions stored in the memory and execute the steps included in any of the above methods according to the obtained program instructions.

[0104] Based on the same inventive concept, this application also provides a computer-readable storage medium. The principle of the computer-readable storage medium in solving the technical problem is similar to that of the access control method described above. The implementation of the computer-readable storage medium can refer to the implementation of the access control method, and the repeated parts will not be described again.

[0105] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0106] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0107] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0108] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0109] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. An access control method, characterized in that, include: In response to a user's data access request, at least one target encrypted data group that the user has access to is determined from multiple encrypted data groups in the consortium blockchain. The access request includes a user role identifier and access credentials. The access role identifier in the target encrypted data group includes the user role identifier, and the access credentials satisfy the access policy associated with the target encrypted data group. For each target encrypted data group, the target ciphertext fragment obtained based on the target encrypted data group is decrypted to obtain the target fragment data; the security of the target fragment data is verified based on the current hash value of the target fragment data and the original hash value in the target encrypted data group. Once the security verification is successful, the user is allowed to access the target fragment data.

2. The method according to claim 1, characterized in that, The verification of the security of the target fragment data based on the current hash value of the target fragment data and the original hash value in the target encrypted data group includes: If the current hash value of the target fragment data is the same as the original hash value in the target encrypted data group, then the target fragment data is determined to be secure. If the current hash value of the target fragment data is different from the original hash value in the target encrypted data group, the security of the target fragment data is verified based on the tampering index of the initial data to which the target fragment data belongs. The tampering index represents the proportion of abnormal fragment data in the initial data, and the abnormal fragment data is fragment data whose current hash value is different from the original hash value.

3. The method according to claim 2, characterized in that, The verification of the security of the target shard data based on the tampering index of the initial data to which the target shard data belongs includes: If the tampering index is less than a preset threshold, then the target fragment data is determined to be secure. If the tampering index is greater than or equal to the preset threshold, the security of the target shard data is verified based on the Merkle root hash corresponding to the target shard data, wherein the Merkle root hash is generated based on the current hash value.

4. The method according to claim 3, characterized in that, The verification of the security of the target shard data based on the Merkle root hash corresponding to the target shard data includes: If the Merkle root hash is the same as the original Merkle root hash of the target shard data, then the security of the target shard data is determined. The original Merkle root hash is generated based on the original hash value.

5. The method according to claim 3, characterized in that, The tampering index is determined through the following steps: Obtain multiple data fragments corresponding to the initial data; Based on the current hash value of each data shard and the original hash value of each data shard, abnormal data shards among the multiple data shards are determined; The tampering index is determined based on the number of abnormal fragment data and the total number of fragment data corresponding to the initial data.

6. The method according to any one of claims 1 to 5, characterized in that, The step of decrypting the target ciphertext fragment corresponding to the target encrypted data group to obtain the target fragment data includes: Obtain the encryption key from the target encrypted data group; The encryption key is decrypted using a preset asymmetric user private key to obtain a symmetric fragmentation key; The target ciphertext fragments are decrypted using the symmetric fragmentation key to obtain the target fragment data.

7. The method according to claim 6, characterized in that, The encrypted data group includes at least one access role identifier and at least one access policy identifier corresponding to each access role identifier, wherein the access role identifier and the access policy identifier are configured for each data segment based on the security level, data type and preset permission rules of the data segment corresponding to the encrypted data group; The step of determining at least one target encrypted data group that the user has access to from multiple encrypted data groups in the consortium blockchain includes: The user role identifier is matched with each access role identifier to determine the target access role identifier; Match the access credentials with each access policy identifier corresponding to the target access role identifier; The encrypted data group that satisfies the preset matching result is taken as the target encrypted data group, wherein the preset matching result is that the access credential satisfies the access policy corresponding to each access policy identifier.

8. An access control device, characterized in that, include: The response module is used to respond to a user's data access request and determine at least one target encrypted data group that the user has access to from multiple encrypted data groups in the consortium blockchain. The access request includes a user role identifier and access credentials. The access role identifier in the target encrypted data group includes the user role identifier, and the access credentials satisfy the access policy associated with the target encrypted data group. The verification module is used to decrypt the target ciphertext fragments obtained based on the target encrypted data group for each target encrypted data group to obtain target fragment data; and to verify the security of the target fragment data based on the current hash value of the target fragment data and the original hash value in the target encrypted data group. The control module is used to allow the user to access the target fragment data after the security verification is passed.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, the computer program including program instructions that, when executed by a computer, cause the computer to perform the method as described in any one of claims 1-7.

Images