CN117896130A - Industrial Internet data access control method, device, equipment and medium - Google Patents

Abstract

The invention discloses an industrial Internet data access control method, a device, equipment and a medium, which are characterized in that a data access request sent by a client is received, an access control strategy is matched according to an access client identifier and an accessed resource identifier, when no matched access control strategy is judged, an error of access refusing is directly returned, and when the matched access control strategy is judged, a URL link of an accessed resource is obtained from a state database according to the accessed resource identifier. The invention realizes fine-grained access control, data isolation and integrity protection, real-time communication and extensible access management.

Description

Industrial Internet data access control method, device, equipment and medium

Technical Field

The present invention relates to the field of industrial data security, and in particular, to a method, an apparatus, a device, and a medium for controlling industrial internet data access.

Background

The industrial Internet is an information technology foundation facility and platform based on an industrial system, and the deep fusion of the industrial system and the Internet is realized. In an industrial internet environment, a large amount of industrial equipment and the whole production and manufacturing process can generate massive data. These data are related to many enterprise core intellectual property and sensitive information, and security and privacy protection of the data are of paramount importance.

The existing industrial Internet data access control and data privacy protection methods mostly depend on a centralized server, have single-point fault problems, have thicker control granularity of industrial Internet data access authorities in the prior art, cannot realize fine granularity and dynamic access control of different data topics and different roles, and are difficult to adapt to the requirements of industrial Internet security supervision.

Disclosure of Invention

In view of the above, the invention provides an industrial internet data access control method, which solves the technical problems that the control granularity of the industrial internet data access authority is thicker and the fine granularity dynamic access control of different data topics and different roles cannot be realized in the prior art.

According to a first aspect of the present invention, there is provided an industrial internet data access control method comprising:

receiving a data access request sent by a client, wherein the data access request carries an access client identifier and an accessed resource identifier;

matching an access control strategy according to the access client identifier and the accessed resource identifier;

when judging that the access control strategy is not matched, directly returning an error of refusing access;

and when judging that the matched access control strategy exists, acquiring the URL link of the accessed resource from the state database according to the accessed resource identifier.

According to a second aspect of the present invention, there is provided an industrial internet data access control apparatus comprising:

the receiving module is used for receiving a data access request sent by a client, wherein the data access request carries an access client identifier and an accessed resource identifier;

the matching module is used for matching the access control strategy according to the access client identifier and the accessed resource identifier;

the execution module is used for directly returning an error of refusing access when judging that the access control strategy is not matched; and when judging that the matched access control strategy exists, acquiring the URL link of the accessed resource from the state database according to the accessed resource identifier.

According to a third aspect of the present invention there is provided a computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, the processor implementing the steps of the industrial internet data access control method described above when the computer program is executed.

According to a fourth aspect of the present invention there is provided a computer readable storage medium storing a computer program which when executed by a processor performs the steps of the industrial internet data access control method described above.

By means of the technical scheme, the industrial Internet data access control method, the device, the equipment and the medium provided by the invention are used for receiving the data access request sent by the client, matching the access control strategy according to the access client identification and the accessed resource identification, directly returning an error of refusing access when judging that the access control strategy is not matched, and acquiring the URL link of the accessed resource from the state database according to the accessed resource identification when judging that the matched access control strategy is present. The invention realizes fine-grained access control, data isolation and integrity protection, real-time communication and extensible access management.

The foregoing description is only an overview of the present invention, and is intended to provide a better understanding of the technical means of the present invention, and is to be construed as being a complete description of the present invention, as well as the following detailed description of the present invention, in order to provide further understanding of the present invention with the aid of the appended claims.

Drawings

The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the invention and do not constitute a limitation on the invention. In the drawings:

fig. 1 shows an application scenario schematic diagram of an industrial internet data access control provided in an embodiment of the present invention;

fig. 2 is a schematic flow chart of an industrial internet data access control method according to an embodiment of the present invention;

fig. 3 is a schematic structural diagram of an industrial internet data access control device according to an embodiment of the present invention.

Detailed Description

Hereinafter, a specific embodiment of the present invention will be described in detail with reference to the accompanying drawings in combination with examples. It should be noted that, without conflict, the embodiments of the present invention and features of the embodiments may be combined with each other.

The embodiment of the invention provides an industrial internet data access control method, which can be applied to a Hyperledger Fabric blockchain scene as shown in fig. 1, wherein sensors 1 to 3 generate schematic representations of sources for industrial data (in practical application, the sensors can be accessed by systems such as enterprise MES, ERPs and the like, and the generated data can comprise production data, equipment data, sensor data and the like), the sensors 1 to 3 can also be accessed through intelligent gateways, subscription clients 1 to 3 correspond to access clients of different institutions or organizations, and the access control policy verification is performed on rights of access control policies on different channel channels (channels in Hyperledger Fabric blockchains are private sub-networks and allow a plurality of parties to safely and confidentially transact with each other, and the channels allow different users/participants (organizations) to be connected through anchor nodes to form a alliance.

In Hyperledger Fabric blockchain networks, the ledger consists of two distinct but related parts, namely a world State (world State) and a blockchain ledger (ledger), wherein the world State refers to a Database (such as a level db or CouchDB) that holds a set of current values, the access control policy may be stored in a State Database (SDB) of the blockchain, the blockchain ledger records each transaction that generates a State change, and instead of just one blockchain in the super ledger, a blocknetwork may include multiple channels, a channel is a sub-network (sub-ledger) in a blocknetwork, and the smart contracts (chancode) loaded in the sub-ledger have a world State, and the data in the same code are located in the same namespace. Hyperledger Fabric uses Public Key Infrastructure (PKI) to verify the behaviour of all network participants, and each node, network administrator and user submitted transactions need to have public certificates and private keys to verify their identities, which must have a valid root of trust, issued by the CA as an authorising server in the network. In practical application, the transaction proposal is sent to an endorsement Peer, the Peer simulates the transaction and verifies its correctness according to the intelligent contract, if an endorsement is obtained, the endorsement Peer signs it and sends it back to the client, the transaction of obtaining the endorsement is combined into a block and then sent to the ordering service. The ordering service receives endorsed transactions from peer nodes and orders them into chunks (creates chunks) and then broadcasts them to all peer nodes in the network (transacts chunks to each peer node), the ordering service using a consensus algorithm to ensure that all nodes in the network agree on the chunk order. The method can ensure the consistency of the account book among all nodes, the nodes check the validity of the digital signature and endorsement strategy of the block and the transaction contained in the block, if the block is valid, the transaction is submitted to the account book, the data integrity is ensured by utilizing the block chain of the hash block to be decentralised, the reliability of the data is enhanced by configuring the industrial Internet equipment as a direct block chain node, the manual intervention and the external system dependence are eliminated, and the method enhances the data integrity of the industrial Internet of things and constructs a safe and credible environment. Hyperledger Fabric separates transaction execution from transactions, which improves scalability and performance, reducing node workload. Unlike other blockchain designs, hyperledger Fabric introduces parallel transaction processing, solving the non-deterministic problem of smart contracts, which results in higher throughput and lower latency. The method promotes privacy, trust, expandability and access control in the safe Internet of things data system, and lays a foundation for realizing safe information exchange while keeping privacy and trust.

In the scenario as in fig. 1, according to the industrial internet data access control method executed by the Hyperledger Fabric blockchain network, a data access request sent by a client is received, wherein the data access request carries an access client identifier and an accessed resource identifier; matching an access control strategy according to the access client identifier and the accessed resource identifier; when judging that the access control strategy is not matched, directly returning an error of refusing access; when the matched access control strategy is judged to exist, the URL link of the accessed resource is obtained from the state database according to the accessed resource identification, the URL link of the accessed resource is equivalent to the subscription theme of the MQTT, and the accessed resource can be industrial Internet of things equipment such as a sensor and the like. The embodiment of the invention realizes fine-grained access control, data isolation and integrity protection, real-time communication and extensible access management. The block chain solution based on Hyperledger Fabric and MQTT solves the technical problems by combining technical means such as certificate mechanism, channel isolation, intelligent contract and the like, and achieves fine-grained access control, data isolation and integrity protection, real-time communication and extensible access management.

The present invention will be described in detail with reference to specific examples.

Example 1

As shown in fig. 2, the method for controlling the industrial internet data access according to the embodiment of the present invention includes:

step 201, receiving a data access request sent by a client;

the data access request carries an access client identifier and an accessed resource identifier;

step 202, matching an access control strategy according to an access client identifier and an accessed resource identifier;

step 202 may include:

step 202-1, calling an intelligent contract chain code through a chain code interface, and acquiring a client role and an accessed resource attribute according to a queried client identifier and an accessed resource identifier;

202-2, checking authority against the access control strategy according to the role of the client and the attribute of the accessed resource, and judging whether the client has the access authority;

in each interface of the chain code, authority checking is performed against access control policy definition to determine whether the caller has access authority, for example:

function auth(user，device，topic){

policy＝getPolicyForDevice(device)

if！matchRole(user，policy.roles)){

return false

}

if！matchTopic(topic，policy.topics)){

return false

}

return true

}

in addition, when the link code interface is called, the caller certificate needs to be transferred, the link code judges the caller identity according to the content of the certificate, the certificate and the user identity are bound in the Fabric network, and before step 202-2, the method needs to include:

and authenticating the digital certificate (such as an X.509 certificate) provided by the client, wherein the digital certificate is issued by a certificate management center of the organization according to the root certificate of the organization, an organization is arranged for each type of participating subject, each organization distributes a root certificate, and the digital certificate is automatically updated and maintained through an enterprise certificate management center.

Step 202-3, when the client has access rights, matching the access control policy

Step 203, directly returning an error of refusing access when judging that the access control strategy is not matched;

and 204, when the matched access control strategy is judged to exist, acquiring the URL link of the accessed resource from the state database according to the accessed resource identifier.

In order to implement the embodiment of the present invention, an initialization construction of the Hyperledger Fabric blockchain network needs to be performed in advance, and before step 201, the method includes:

step 201-A, generating a certificate and key pair, constructing a Hyperledger Fabric blockchain network, and setting channels and nodes;

step 201-B, registering industrial Internet equipment in a Hyperledger Fabric blockchain network and distributing certificates for the equipment to finish equipment identity management;

step 201-C, generating an access control strategy and uploading the access control strategy to a Hyperledger Fabric blockchain network;

the access control policy is defined in JSON format and stored in world state (world state) of the blockchain. The access control policy may specify access control rules of devices, topics, roles, etc., where the access control policy is exemplified as follows:

{

"device1":{

"topics":["temp"，"humidity"]，

"roles":["operator"，"manager"]

}

}

step 201-D, deploying an intelligent contract chain code to a common node in a Hyperledger Fabric blockchain network, wherein the intelligent contract chain code is provided with a matching relationship among industrial Internet equipment, a theme, roles and an access control strategy;

the intelligent contract chain code defines service logic of access control, including interfaces of equipment registration, subscription theme authorization and the like. These interfaces will check the identity of the caller and determine if there is access rights according to predefined policies.

Step 201-E, setting an MQTT server to integrate the Hyperledger Fabric block chain network and the MQTT server;

and step 201-F, publishing data to the MQTT server according to the URL link of the set accessed resource, wherein the accessed resource is an MQTT message queue publisher, and publishing data to the MQTT server according to the URL link of the set accessed resource.

The data privacy protection implementation is realized by using Channel channels and organization isolation, the URL links of the accessed resources correspond to different channels, namely different topics, of the Hyperledger Fabric blockchain network, the data isolation is effectively realized, the MQTT server is bound with a specific organization or access control strategy through the Fabric Channel, and publishers, subscribers and release topics need to be added into the corresponding channels to construct a topic-based isolation model.

Embodiment two:

existing Hyperledger Fabric blockchain networks lack standard management and sharing mechanisms for smart contracts, making it difficult for developers to search for and reuse smart contracts, resulting in inefficiency. The command line operation of the existing Hyperledger Fabric blockchain network is complex and unfriendly to users, the use difficulty and the deployment complexity of the intelligent contract are increased, the Hyperledger Fabric blockchain network lacks a general interface similar to a REST API to call and execute chain codes, the integration with external applications is limited, the internal asset structure of the intelligent contract cannot be effectively compared and reused, customization and secondary development cannot be conveniently carried out, in order to realize the reusability, manageability and usability of the intelligent contract, a server for managing the intelligent contract chain codes is newly added in the embodiment of the invention, and the operations of responding to the inquiry, modification, update and the like of the user by the API interface are provided, so that the step of deploying the intelligent contract chain codes to common nodes in the Hyperledger Fabric blockchain network in the step 201-D for solving the technical problem comprises:

step 201-41, obtaining tags of all intelligent contract chain codes in Hyperledger Fabric blockchain networks and storing the tags to an intelligent contract server, wherein the tags of the intelligent contract chain codes comprise intelligent contract identifiers, names, owners, descriptions, platform types and basic identity verification specifications;

the tag of the intelligent contract chain code can adopt the following JSON form, as follows:

{

"id":"1",

"name": "ContractA"// chain code name

"author": "AuthorA",// chain code developer

"supported": 2021-04-18",// chain code upload time

"description": ","// chain code description

"platform": "Hyperledger Fabric",// platform default designation Hyperledger Fabric

Policy of "signature_policy": "MAJORITY",// signature

"chain_languages": [..]// development language Go or Nodejs

"app_languages": [.]// application development language

"versions":[...]Version// ^{Number (number)}

}

The developer, namely the user can search the matched similar intelligent contract chain codes by searching the information of the fields, so that the developer can conveniently perform multiplexing development and then can deploy the intelligent contract chain codes to the Hyperledger Fabric blockchain network by one key, and the development efficiency and the deployment speed of the intelligent contract chain codes are greatly improved.

Step 201-42, obtaining an inquiry request of an intelligent contract chain code, and inquiring the corresponding intelligent contract chain code in an intelligent contract server, wherein the inquiry request of the intelligent contract chain code carries a keyword in a label of the intelligent contract chain code;

step 201-43, generating a reusable intelligent contract chain code according to the queried intelligent contract chain code, and deploying the intelligent contract chain code to a common node in a Hyperledger Fabric block chain network.

The steps 201 to 43 may specifically include:

201-431, generating a reusable intelligent contract chain code according to the queried intelligent contract chain code;

201-432, generating a first intelligent contract chain code according to the reusable intelligent contract chain code and a user modification instruction;

steps 201-433 automatically install and instantiate the first smart contract chain code onto Hyperledger Fabric blockchain nodes through an API interface.

The embodiment constructs an intelligent contract management system, and records metadata information of the intelligent contract by using a label. Developing a control interface, a user can search, compare, upload, and deploy intelligent contracts. The REST API interface is developed to connect to the blockchain network, such as querying and invoking intelligent contracts. The user may search for similar smart contracts in the control interface, multiplexed or customized for deployment to the blockchain.

Further, as a specific implementation of the method of fig. 1, an embodiment of the present invention provides an industrial internet data access control device, as shown in fig. 3, where the device includes:

a receiving module 310, configured to receive a data access request sent by a client, where the data access request carries an access client identifier and an accessed resource identifier;

a matching module 320, configured to match an access control policy according to the access client identifier and the accessed resource identifier;

an execution module 330, configured to directly return an error of rejecting access when it is determined that there is no matching access control policy; and when judging that the matched access control strategy exists, acquiring the URL link of the accessed resource from the state database according to the accessed resource identifier.

The embodiment of the invention provides a computer device, which comprises a memory, a processor and a computer program stored on the memory and capable of running on the processor, wherein the processor realizes the following steps when executing the computer program:

receiving a data access request sent by a client, wherein the data access request carries an access client identifier and an accessed resource identifier;

matching an access control strategy according to the access client identifier and the accessed resource identifier;

when judging that the access control strategy is not matched, directly returning an error of refusing access;

and when judging that the matched access control strategy exists, acquiring the URL link of the accessed resource from the state database according to the accessed resource identifier.

In an embodiment of the present invention, there is provided a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, performs the steps of:

receiving a data access request sent by a client, wherein the data access request carries an access client identifier and an accessed resource identifier;

matching an access control strategy according to the access client identifier and the accessed resource identifier;

when judging that the access control strategy is not matched, directly returning an error of refusing access;

and when judging that the matched access control strategy exists, acquiring the URL link of the accessed resource from the state database according to the accessed resource identifier.

It should be noted that, the functions or steps implemented by the computer readable storage medium or the computer device may correspond to the relevant descriptions of the server side and the client side in the foregoing method embodiments, and are not described herein for avoiding repetition.

Those skilled in the art will appreciate that implementing all or part of the above described methods may be accomplished by way of a computer program stored on a non-transitory computer readable storage medium, which when executed, may comprise the steps of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in embodiments provided herein may include non-volatile and/or volatile memory. The nonvolatile memory can include Read Only Memory (ROM), programmable ROM (PROM), electrically Programmable ROM (EPROM), electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double Data Rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous Link DRAM (SLDRAM), memory bus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), among others.

It will be apparent to those skilled in the art that, for convenience and brevity of description, only the above-described division of the functional units and modules is illustrated, and in practical application, the above-described functional distribution may be performed by different functional units and modules according to needs, i.e. the internal structure of the apparatus is divided into different functional units or modules to perform all or part of the above-described functions.

The above embodiments are only for illustrating the technical solution of the present invention, and not for limiting the same; although the invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention, and are intended to be included in the scope of the present invention.

Claims (10)

1. An industrial internet data access control method, comprising:

receiving a data access request sent by a client, wherein the data access request carries an access client identifier and an accessed resource identifier;

matching an access control strategy according to the access client identifier and the accessed resource identifier;

when judging that the access control strategy is not matched, directly returning an error of refusing access;

and when judging that the matched access control strategy exists, acquiring the URL link of the accessed resource from the state database according to the accessed resource identifier.

2. The method for controlling access to industrial internet data according to claim 1, wherein the step of matching the access control policy according to the access client identifier and the accessed resource identifier comprises:

calling an intelligent contract chain code through a chain code interface, and acquiring a client role and an accessed resource attribute according to the access client identifier and the accessed resource identifier;

checking authority according to the client role and the accessed resource attribute and comparing the access control strategy to judge whether the client has the access authority;

and when the client has access rights, matching the access control strategy.

3. The industrial internet data access control method according to claim 1 or 2, characterized by comprising, before the step of receiving a data access request sent by a client:

generating a certificate and key pair, constructing a Hyperledger Fabric blockchain network, and setting a channel and a node;

registering industrial Internet equipment in a Hyperledger Fabric blockchain network and distributing certificates for the equipment to finish equipment identity management;

generating an access control policy and uploading the access control policy to a Hyperledger Fabric blockchain network;

deploying an intelligent contract chain code to a common node in a Hyperledger Fabric blockchain network, wherein the intelligent contract chain code is provided with a matching relationship among industrial internet equipment, a theme, roles and an access control strategy;

setting an MQTT server to realize integration of the Hyperledger Fabric block chain network and the MQTT server;

and according to the URL link of the set accessed resource, releasing data to the MQTT server, wherein the accessed resource is an MQTT message queue publisher.

4. The method of claim 2, wherein the step of deploying intelligent contractual chaining codes to common nodes in a Hyperledger Fabric blockchain network comprises:

obtaining tags of all intelligent contract chain codes in the Hyperledger Fabric blockchain network and storing the tags to an intelligent contract server, wherein the tags of the intelligent contract chain codes comprise intelligent contract identifiers, names, owners, descriptions, platform types and basic identity verification specifications;

acquiring an inquiry request of an intelligent contract link code, and inquiring the corresponding intelligent contract link code in an intelligent contract server, wherein the inquiry request of the intelligent contract link code carries a keyword in a label of the intelligent contract link code;

and generating a reusable intelligent contract chain code according to the inquired intelligent contract chain code, and deploying the reusable intelligent contract chain code to a common node in the Hyperledger Fabric blockchain network.

5. The method according to claim 4, wherein before the step of checking the access control policy for the rights according to the client role and the accessed resource attribute, the method further comprises:

and authenticating the digital certificate provided by the client, wherein the digital certificate is issued by a certificate management center of an organization according to a root certificate of the organization, an organization is arranged for each type of participating subject, each organization is distributed with a root certificate, and the digital certificate is automatically updated and maintained through an enterprise certificate management center.

6. The industrial internet data access control method of claim 2, wherein the URL links of the accessed resource correspond to channels of a Hyperledger Fabric blockchain network.

7. The industrial internet data access control method according to claim 2, wherein the step of generating a reusable intelligent contract chain code according to the queried intelligent contract chain code and deploying the reusable intelligent contract chain code to a common node in the Hyperledger Fabric blockchain network comprises the following steps:

generating a reusable intelligent contract chain code according to the inquired intelligent contract chain code;

generating a first intelligent contract chain code according to the reusable intelligent contract chain code and a user modification instruction;

the first smart contract chain code is automatically installed and instantiated onto the Hyperledger Fabric blockchain node through an API interface.

8. An industrial internet data access control device, comprising:

the receiving module is used for receiving a data access request sent by a client, wherein the data access request carries an access client identifier and an accessed resource identifier;

the matching module is used for matching the access control strategy according to the access client identifier and the accessed resource identifier;

the execution module is used for directly returning an error of refusing access when judging that the access control strategy is not matched; and when judging that the matched access control strategy exists, acquiring the URL link of the accessed resource from the state database according to the accessed resource identifier.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that the processor implements the steps of the industrial internet data access control method according to any of claims 1 to 7 when the computer program is executed.

10. A computer readable storage medium storing a computer program, characterized in that the computer program when executed by a processor implements the steps of the industrial internet data access control method according to any one of claims 1 to 7.