CN110807189A

CN110807189A - Authority segmentation method in block chain access control

Info

Publication number: CN110807189A
Application number: CN201911115805.XA
Authority: CN
Inventors: 李茹; 史锦山; 张新; 张晓东; 张江徽
Original assignee: Inner Mongolia University
Current assignee: Inner Mongolia University
Priority date: 2019-11-15
Filing date: 2019-11-15
Publication date: 2020-02-18
Anticipated expiration: 2039-11-15
Also published as: CN110807189B

Abstract

The invention discloses a permission segmentation method in block chain access control, wherein resource permissions in the access control are abstracted into non-homogeneous authorization permits which are stored in a block chain, and one permit can represent a plurality of permissions. For example, partitioning the rights in the time dimension. And the safety of the permission division is ensured through an intelligent contract. When a resource visitor wants to transfer a certain authority in the existing permit to another user, the permit is divided into a required number by using the authority division intelligent contract arranged on the blockchain. The permission segmentation method in the application enables the controllable minimum granularity in the access control based on the block chain to be accurate to a certain dimension of a certain permission of a resource.

Description

Authority segmentation method in block chain access control

Technical Field

The invention relates to the field of access control based on a block chain, in particular to a permission segmentation method in block chain access control.

Background

The access control based on the block chain solves the problems of safety and trust among multiple organizations and single point of failure in the original centralized access control model due to the introduction of the block chain. The blockchain has the characteristics of decentralization, non-tampering, traceability and intelligent contract, and a trusted environment can be constructed among nodes which are not trusted with each other, so that the blockchain is used as a trusted entity to construct the access control model.

The block chain-based access control abstracts the authority of the object resource into certificates which are non-homogeneous, one certificate only represents one authority or a group of authorities of one resource, and the authority grant in the access control is completed through transaction or intelligent contracts. Therefore, the pass certificate and the authority are bound together, so that the user cannot control the authority with finer granularity and can only transfer the pass certificate as a unit. At present, no division method for the authority under the access control environment exists, and the authority in the general certificate is divided. At present, how to divide one or more permissions in a permit to form a new permit, even dividing the permissions according to different dimensions is a challenge of fine-grained application in the field of block chain access control.

Disclosure of Invention

Aiming at the defects of the prior art, the invention provides an authority segmentation method in block chain access control, which not only improves the flexibility of authority management and control in the access control, but also enables the minimum granularity of the access control to reach the authority level. Meanwhile, the block chain intelligent contract is used to avoid the safety problem of the authority in the segmentation process.

The purpose of the invention is realized by the following technical scheme: a method for dividing authority in block chain access control includes two parts, one is to use one or a group of authority of one resource in access control expressed by general certificate, to use intelligent contract to divide the general certificate, to realize the division of authority in general certificate by intelligent contract, to divide one or several authorities in general certificate to form new general certificate; the other is to use an intelligent contract-based approach to split a single right into multiple rights, split the rights from different dimensions, and then compose the split rights into new certificates.

The method for the evidence-based segmentation of the intelligent contract in the block chain access control divides one or more required authorities from the original evidence to form a plurality of new evidences, and the original evidence is invalid. The method completes the segmentation of the certificate according to the following steps:

the first step is as follows: the rights owner a who owns the access rights of the resource s negotiates with the resource visitor B (or with a plurality of resource visitors B, C …), decides to split a part of the rights from a set of access rights of the resource s owned by a, and passes it to the resource visitor B, C …. In the real environment, some resources can be divided, and some resources can not be divided, and only the divisible resources are considered here. Meanwhile, the authority owner A can not violate the authorization pass T_SAnd on the basis of the existing constraint, adding a new constraint condition to the authorization certificate.

The second step is that: the authority owner A sends a partition request message generated by the negotiation result to a certification-based partition contract in the blockchain network, wherein the content of the partition request message is to authorize a certification T_SThe set of owned permissions is split into multiple shares and the split permissions are passed to resource accessor B, C …. The division request message specifies which rights are divided and to whom the divided rights belong. There is a need to ensure that a right is not split and granted to multiple users.

The third step: resource accessor B, C sends a request for validation information to the rights segmentation contract.

The fourth step: the authority partitioning contract is validated by the A, B, C … and the access control contract for the resource s being agreed upon by multiple parties, so the authority partitioning contract sends information authorizing the transfer of the warranty to the access control contract for the resource s.

The fifth step: the access control policy in the access control contract for a resource s requires a decision to be made whether to grant the transfer of an authorization pass, first of all a pass T needs to be verified_SThen verifies that the rights split is legitimate, and then obtains B, C … relevant information from the PIP to verify B, C … is legitimate.

And a sixth step: and making a decision according to the collected information by the access control contract of the resource s, if the verification is passed, generating a corresponding authorization pass for the divided authority, and then returning the authorization pass to the authority division contract. If the verification fails, rejection information is returned.

The seventh step: if yes, the authority division contract sends the newly generated authorization pass to the corresponding nodes; if the authority division contract is rejected, the authority division contract returns rejection information to each node.

In order to manage the authority with finer granularity, the invention also provides a method for dividing the single authority.

A permission division method based on an intelligent contract in block chain access control is characterized in that for a certain permission in a certificate, the permission is divided into two permissions in a certain dimension, and the key of permission division is that the permission has the property of being divided at a certain angle. For example, the traffic police control authority of the traffic lights, the traffic police A has the control authority of 8:00-12:00, and if the traffic police A has a temporary accident at 10:00, the authority of 10:00-12:00 can be divided and handed to the traffic police B. The examples are given for illustrative purposes only and are not intended to limit the invention.

The method is applied to access control based on the block chain, so that the access control system can manage authority with finer granularity, and the function of dividing a certificate into a plurality of certificates is realized by the certificate-passing dividing method based on the intelligent contract; the authority division method based on the intelligent contract realizes the function of dividing one authority into a plurality of authorities according to a certain dimension.

Drawings

FIG. 1 is a block chain access control-based evidence-based segmentation flow diagram in the method of the present invention;

FIG. 2 is a diagram illustrating smart contract-based rights partitioning in the method of the present invention;

FIG. 3 is a schematic diagram of an embodiment of the permission division method in blockchain access control according to the present invention;

Detailed Description

It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. The terms used in this application are explained below:

(1) the token is an entity representing access control authority in a block chain, and the token in the present invention refers to a non-homogeneous token.

(2) A Policy Enforcement Point (PEP) is an entity that performs access control in a specific application environment.

(3) Policy Information Point (PIP) refers to an entity that provides access control system Information through which attribute Information of a subject, a resource, and an environment can be acquired.

As shown in fig. 1, fig. 1 is a schematic diagram of a certification splitting process based on blockchain access control according to an embodiment of the present invention. The method uses intelligent contracts for forensic segmentation. The method embodiment completes the segmentation of the certificate according to the following steps:

the first step is as follows: the authority owner a who owns the access authority of the resource s negotiates with the resource accessor B (or with a plurality of resource accessors B, C …), decides to divide the access authority of the resource s owned by a into parts, and transfers the parts to the resource accessor B, C …. Some resources in the internet of things can be divided, and some resources are not divided, so that the authority division requires that the authorization token has a divisible attribute. At the same time, the authority owner A can not violate the authorization token T_SAnd adding new constraint conditions to the authorization token on the basis of the existing constraint.

The second step is that: the authority owner A sends the division request message generated by the negotiation result to the block chain network, and the division contract SC is certified_ABCIs to authorize the token T_SThe owned permissions are split and the split permissions are passed to resource accessor B, C …. Intelligent contract SC_ABCSpecifies which rights are split and to whom they are delivered.

The third step: resource accessor B, C sends intelligent contract SC_ABCA request for acknowledgement information is sent.

The fourth step: intelligent contract SC_ABCNeed A, B, C … and the access control contract SCS of the resource s to agree with each other, so that the SCABC is to send the information passed by the authorization token to the SC_S。

The fifth step: SC (Single chip computer)_SThe access control policy in (1) needs to make a decision whether to approve the passing of the authorization token, and therefore, it is necessary to verify whether the attributes and constraints of the authorization token TS are legal first, then verify whether the authority partition is legal, and then obtain B, C … relevant information from the PIP to verify whether B, C … is legal.

And a sixth step: SC (Single chip computer)_SMaking a decision according to the collected information, if the verification is passed, generating a corresponding authorization token for the divided authority, and then returning the authorization token to the SC_ABC. If the verification fails, rejection information is returned.

The seventh step: if yes, SC_ABCSending the newly generated authorization token to the respective corresponding node; and if the node is rejected, returning rejection information to each node by the SCABC.

Further, embodiments of rights segmentation in the present invention are presented.

Referring to fig. 2, fig. 2 is a schematic diagram of authority segmentation based on an intelligent contract in the method of the present invention, and the embodiment of the method completes the segmentation of the certificate according to the following steps:

the first step is as follows: the authority owner sends a partition authority message to the blockchain, and the request needs to be accompanied with the identity of the principal, the corresponding certificate of the authority, and the partition scheme.

The second step is that: and after receiving the message, the intelligent contract for authority division in the block chain firstly verifies whether the message is correct, and the verified content comprises verification of the identity of a sender of the division request message and verification of whether the authority belongs to the sender of the message.

The third step: and searching an access control strategy corresponding to the authority after the verification is passed, and judging whether the authority can be divided and whether the authority division scheme is legal.

The fourth step: if the division and combination rule executes the authority division according to the scheme required by the division request message, new pass is generated for the divided authority, the owner of the pass is set as the authority owner, and the old pass is cancelled.

The fifth step: and returning the authority segmentation result to the authority owner.

The embodiment of the authority partition is different from the embodiment of the certification-passing partition in that the certification-passing partition refers to the partition of the certification-passing representing a plurality of authorities into a plurality of certificates, wherein the authorities are not changed; and the division of the right means that one right is divided into a plurality of available rights.

It will be understood by those skilled in the art that the foregoing is only a preferred embodiment of the present invention, and is not intended to limit the invention, and although the invention has been described in detail with reference to the foregoing examples, it will be apparent to those skilled in the art that various changes in the form and details of the embodiments may be made and equivalents may be substituted for elements thereof. All modifications, equivalents and the like which come within the spirit and principle of the invention are intended to be included within the scope of the invention.

Claims

1. A method for authority partition in block chain access control is characterized by comprising the following steps: the method is characterized in that controllable minimum granularity in access control based on a block chain is accurate to the authority of each resource, and intelligent contracts are used for completing the division of the authority; when the authority division is started, the intelligent contract verifies whether the user initiating the authority division is legal or not, the access control strategy corresponding to the authority is inquired by the intelligent contract, then whether the authority analysis is legal or not is judged, if the authority analysis is legal, a new authority permit is generated by the intelligent contract according to the division requirement, and the divided permit is cancelled.

2. The method as claimed in claim 1, wherein when mapping one or a group of rights of a resource to a pass (also called token, authorization token, etc.) in the access control system, the pass is divided using an intelligent contract, the intelligent contract is used to divide the rights in the pass, and one or more rights in the pass can be divided to form a new pass; the divided certificates may fail after the division is successful.

3. The method as claimed in claim 1, wherein the partition of the right in the block chain access control is performed by using an intelligent contract, the partition of the right in the certificate is realized by the intelligent contract, and one right is partitioned into a plurality of available rights.

4. As claimed in claim 1, the segmentation of the voucher and the segmentation of the rights can be performed simultaneously.