KR20230135490A - Detailed access control system in cloud and permissioned blockchain environment and the method thereof - Google Patents

Abstract

A detailed access control system in a cloud and permissioned blockchain environment according to an embodiment of the present invention generates a consensus vector for the permissioned blockchain network and generates and provides a public key to the authentication registered entity servers. integrated system management server; A user terminal that registers for authentication with the integrated system management server, specifies a user data disclosure scope, labels the data, and then encrypts and transmits the user attribute data from which the connection keyword is extracted; A trapdoor for registering authentication with the integrated system management server, storing user attribute data transmitted from the user terminal through data acquisition-based keyword authentication, and verifying the validity of the data access service from the data connection keyword of the user terminal. A cloud operating server that generates and provides the user attribute data; and a service providing server that registers authentication with the integrated system management server and the cloud operation server, submits a trapdoor to the cloud operation server, and then requests a search query for user data. .

Description

Detailed access control system in cloud and permissioned blockchain environment and the method thereof}

The present invention relates to a detailed access control system and method for cloud and permissioned blockchain environments. In particular, for providing data services by accessing the cloud based on permissioned blockchain, the service provider server is encrypted on the cloud operator server. Cloud and permissioned blockchain environments that can provide information protection and an efficient data framework by applying the P-FIPS (Privacy-enhanced Federated Identity Provider System) protocol, which provides and manages access rights to selectively use user data. It relates to a detailed access control system and method.

With the explosive increase in IoT devices in everyday environments, many global services are creating innovative changes centered on user data by discovering hidden data insights through the 'digitization' process and intelligent big data analysis, and the speed of these changes is It continues to increase. However, the problem is that the amount of raw data generated every day is truly enormous, and the most obvious problem is managing and optimizing various complex systems. A centralized approach can maximize processing efficiency, but is difficult to apply to legacy systems. Data silos make it difficult to integrate the data needed for advanced analytics, and data limitations have a significant impact on the quality of data used by artificial intelligence (AI) and the reliability of model predictions. New technologies such as distributed learning provide a way forward, but lack of transparency undermines trust in the data used for analysis. In addition, even if the data consists of personal information or produced content, there is a problem in that control of the data by the service user is monopolized by the service provider.

Korean Patent Application No. 10- 2013-0082745

In order to solve the above problems, the present invention provides access to the cloud based on permissioned blockchain to provide data services, and provides access rights for the service provider server to selectively use encrypted user data on the cloud operator server. The purpose is to provide a detailed access control system and method for cloud and permissioned blockchain environments that can provide information protection and an efficient data framework by applying the managed P-FIPS (Privacy-enhanced Federated Identity Provider System) protocol. Do it as

However, the technical challenge that this embodiment aims to achieve is not limited to the technical challenges described above, and other technical challenges may exist.

As a technical means for achieving the above-described technical problem, a detailed access control system in a cloud and permissioned blockchain environment, including according to an embodiment of the present invention, generates a consensus vector for a permissioned blockchain network and provides authentication. an integrated system management server that generates and provides public keys to registered entity servers; A user terminal that registers for authentication with the integrated system management server, specifies a user data disclosure scope, labels the data, and then encrypts and transmits the user attribute data from which the connection keyword is extracted; A trapdoor for registering authentication with the integrated system management server, storing user attribute data transmitted from the user terminal through data acquisition-based keyword authentication, and verifying the validity of the data access service from the data connection keyword of the user terminal. A cloud operating server that generates and provides the user attribute data; and a service providing server that registers authentication with the integrated system management server and the cloud operation server, submits a trapdoor to the cloud operation server, and then requests a search query for user data. .

Here, the user terminal is particularly characterized in that it transmits user attribute data including the user connection keyword, index, and cryptographic signature.

Here, in particular, the cloud operation server generates and provides encrypted data including a trap door for the service providing server to perform a data access service, and verifies the validity of data search according to the search query request of the service providing server. An outsourced server that generates and provides data access tokens; and a resource server that stores user attribute data transmitted from the user terminal and returns resources requested by the outsourcing server.

Here, the integrated system management server is particularly characterized in that it generates a public key/private key pair through the public parameters and integers of the entity.

Here, the service providing server is particularly characterized in that it transmits a data connection token when the cloud operation server approves the data access service request.

In addition, as a technical means for achieving the above-described technical problem, a detailed access control method in the cloud and permissioned blockchain environment according to an embodiment of the present invention is a consensus vector for the permissioned blockchain network in the integrated system management server. generating and providing a public key to entity servers registered for authentication; Registering the user terminal for authentication with the integrated system management server, specifying a user data disclosure range, labeling the data, and then encrypting the user attribute data from which the connection keyword is extracted; A cloud operation server registering authentication with the integrated system management server and storing user attribute data transmitted from the user terminal through data acquisition-based keyword authentication; A cloud operation server providing the user attribute data by creating a trapdoor for verifying the validity of a data access service from the data connection keyword of the user terminal; The service providing server registers for authentication with the integrated system management server and the cloud operation server, submits a trapdoor to the cloud operation server, and then requests a search query for user data; And the cloud operation server is characterized in that it includes a step of verifying the validity of the search query requested by the service providing server.

Here, in particular, in the step of generating and providing a public key to the entity servers registered for authentication, a feature is that a public key/private key pair is generated and provided through the public parameters and integers of the entity.

Here, in particular, in the step of encrypting the user attribute data, the user terminal is characterized in that it encrypts the user attribute data including the user connection keyword, index, and cryptographic signature.

Here, especially in the step of providing the user attribute data, the service providing server generates and provides encrypted data including a trap door for performing a data access service, and retrieves data according to a search query request from the service providing server. Its characteristic is that it generates and provides a data access token for validation.

Here, in particular, in the step of verifying the validity of the search query, if the cloud operation server verifies the validity and approves the data access service request for the search query, the service providing server transmits a data connection token. there is.

According to one of the above-described means of solving the problem of the present invention, in relation to providing data services by accessing the cloud based on a permissioned blockchain, the service provider selectively uses the encrypted data in the cloud for various purposes such as intelligent big data analysis. In a federated outsourced cloud P-FIPS, data owners first label each encrypted data in the cloud with the scope of its use (e.g., user connection, user disconnection, user tracking) to enable services for encrypted data in the cloud. Provider access rights can be managed.

Second, by selectively providing information about the data owner to the service provider. The label also contains attributes related to the identity of the data owner, which allows service providers to find the target data through cryptographic calculations based on usage scope on cloud outsourced servers.

Third, the Decentralized Audit and Ordering (DAO) chain mechanism integrated with P-FIPS from the cloud to the service provider, which not only provides the service provider with the accuracy of the acquired data, but also ensures that the owner's data is used only for authorized purposes. guarantees, and the framework can be provided more efficiently.

Figure 1 is a diagram schematically showing the configuration of a detailed access control system in a cloud and permissioned blockchain environment according to an embodiment of the present invention.
Figure 2 is a conceptual diagram schematically showing the overall components of the detailed access control system in the cloud and permissioned blockchain environment of the present invention.
Figure 3 is a flowchart of a detailed access control method in a cloud and permissioned blockchain environment according to an embodiment of the present invention.
Figure 4 is a conceptual diagram schematically showing the workflow of the detailed access control method in the cloud and permissioned blockchain environment of the present invention.

Below, with reference to the attached drawings, embodiments of the present invention will be described in detail so that those skilled in the art can easily implement the present invention. However, the present invention may be implemented in many different forms and is not limited to the embodiments described herein. In order to clearly explain the present invention, parts unrelated to the description have been omitted from the drawings, and similar parts have been assigned similar reference numerals throughout the specification. In addition, while explaining with reference to the drawings, even if the configuration is shown with the same name, the drawing number may vary depending on the drawing, and the drawing number is merely written for convenience of explanation, and the concept, feature, and function of each component are determined by the drawing number. Alternatively, the effect is not interpreted as limited.

Throughout the specification, when a part is said to be "connected" to another part, this includes not only the case where it is "directly connected," but also the case where it is "electrically connected" with another element in between. . In addition, when a part is said to "include" a certain component, this does not mean excluding other components unless specifically stated to the contrary, but may further include other components, and means that it may further include one or more other components. It should be understood that this does not exclude in advance the possibility of the presence or addition of features, numbers, steps, operations, components, parts, or combinations thereof.

In this specification, 'part' or 'module' includes a unit realized by hardware or software, and a unit realized using both, and one unit is realized using two or more hardware. This may be possible, or two or more units may be realized by one hardware.

Figure 1 is a diagram schematically showing the configuration of a detailed access control system in a cloud and permissioned blockchain environment according to an embodiment of the present invention, and Figure 2 is a detailed access control system in a cloud and permissioned blockchain environment according to an embodiment of the present invention. This is a conceptual diagram that schematically shows the overall components of the system.

As shown in Figures 1 and 2, the detailed access control system of the cloud and permissioned blockchain environment in the present invention includes an integrated system management server 100, a user terminal 200, a cloud operation server 300, and a service. It is configured to include a provision server 400.

The integrated system management server 100 generates a consensus vector for the permissioned blockchain network and generates and provides a public key to the entity servers registered for authentication.

More specifically, the integrated system management server 100 manages all object servers, and each object server registers and manages all user servers, cloud operation servers, and service provision servers.

The integrated system management server 100 performs global settings and key generation, generates a public/private key pair through public parameters and integers, and maintains public keys for all objects. It also creates a consensus vector for a permissioned blockchain network, and existing blockchain systems can include all environmental factors such as permissioning peers and block generation leaders.

The user terminal 200 registers for authentication with the integrated system management server 100, specifies a user data disclosure scope, performs data labeling, extracts a connection keyword, and encrypts the data including the index. Then, the index and cryptographic signature are transmitted to the cloud operation server 300. That is, user attribute data is encrypted and transmitted to the cloud operation server 300.

Additionally, as a participant in the blockchain network, it only has the header of the block. The specific algorithm used to encrypt each data may be a general public key encryption algorithm.

In other words, the user terminal 200, as a data owner and service consumer, transmits user attribute data including the user connection keyword, index, and cryptographic signature to the cloud operation server (CO) 300, and through this, the service provider Data is provided to the in-service provision server 400.

The cloud operation server (CO) 300 registers authentication with the integrated system management server 100, stores user attribute data transmitted from the user terminal 200 through data acquisition-based keyword authentication, and stores user attribute data transmitted from the user terminal 200 through data acquisition-based keyword authentication. A trapdoor is created to verify the validity of the data access service from the data connection keyword of the terminal 200, and the user attribute data is provided.

More specifically, the cloud operation server 300 can be divided into an outsourcing server and a resource server, and provides data storage and resource access services to authorized cloud clients (users and service providers) through data acquisition-based keyword authentication. can be provided. It is possible to infer available sensitive information and return false searchers with various motivations. It operates as a cryptographic operation and its performance details can be recorded and shared within the blockchain network.

The outsourcing server generates and provides encrypted data including a trapdoor of the service providing server generated from the data connection keyword of the user terminal in order for the service providing server 400 to perform the data access service, and the service providing server ( A data access token is generated and provided to verify the validity of data search according to the search query request (400). Here, the outsourcing server may correspond to a provisioning system of a cloud operation server that performs data access tasks between the user terminal and the service providing server.

Additionally, the resource server stores user attribute data transmitted from the user terminal 200 and returns resources requested from the outsourcing server. In other words, the resource server is a provisioning system for the cloud operation server that stores the user index, password, and data connection keyword as attribute data of the user terminal, and stores the data connection password generated by the outsourcing server. Additionally, resources are returned as requested by the outsourcing server.

The service providing server 400 registers authentication with the integrated system management server 100 and the cloud operation server 300, submits a trapdoor to the cloud operation server 300, and then executes a search query for user data. is requested.

At this time, the service providing server 400 may transmit a data connection token when the cloud operating server 300 approves the data access service request.

That is, after receiving permission to access user data of the user terminal through the cloud operation server 300, a trapdoor is submitted to the cloud operation server 300 to request a search query for user data of interest, and then user data can be used.

In addition, Figure 3 is a flowchart of a detailed access control method in a cloud and permissioned blockchain environment according to an embodiment of the present invention, and Figure 4 is a work diagram of a detailed access control method in a cloud and permissioned blockchain environment of the present invention. This is a conceptual diagram that schematically shows the flow.

As shown in Figures 3 and 4, the detailed access control method of the cloud and permissioned blockchain environment according to an embodiment of the present invention first involves reaching an agreement on the permissioned blockchain network in the integrated system management server 100. Steps are performed to generate a vector and generate and provide a public key to the entity servers registered for authentication (S310).

More specifically, the integrated system management server 100 generates and provides a public key/private key pair through the public parameters and integers of the entity.

At this time, the integrated system management server 100 outputs the public parameter pp when the security parameter k and the integer n are given. And, the bilinear map system You will choose .

Then, the two hash functions Select .

Afterwards, the public parameter pp It is set to .

And, each user terminal About , is selected randomly.

Two elements of the cloud operating server Select first, Calculate the issuer's public/private key pair. provides.

of the service providing server select an element, , which is then the public/private key pair of a specific user. Set .

Meanwhile, Table 1 below shows a summary of the definitions of each term, so please refer to it.

[Table 1]

Next, the user terminal 200 registers for authentication in the integrated system management server 100, specifies a user data disclosure range, labels the data, and then encrypts the user attribute data from which the connection keyword is extracted (S320) ).

More specifically, the user terminal encrypts user attribute data including the user connection keyword, index, and cryptographic signature.

First, the user terminal 200 and size of Data connection keywords denoted by You will choose .

The user terminal encrypts the keyword so that the cloud operation server can retrieve the ID to be used later. The data connection keyword field is denoted by KW with size n. Each data has associated data connection keywords associated with it. data , keyword If , is given, the user terminal Select and calculate the encrypted data EN as follows.

<Equation 1>

and, Each identity with For each user terminal is his signature , and the user terminal sets the generated signature as shown in Equation 2 below.

<Equation 2>

Subsequently, the cloud operation server 300 registers authentication with the integrated system management server 100 and stores user attribute data transmitted from the user terminal 200 through data acquisition-based keyword authentication. (S330).

Then, the cloud operation server creates a trapdoor to verify the validity of the data access service from the data connection keyword of the user terminal and provides the user attribute data (S340).

Here, the service providing server generates and provides encrypted data including a trap door for performing a data access service, and generates a data access token to verify the validity of data retrieval according to the search query request of the service providing server. can be provided.

Next, the service providing server registers for authentication with the integrated system management server and the cloud operation server, submits a trapdoor to the cloud operation server, and then requests a search query for user data (S350).

More specifically, the cloud operating server Keyword field for transmit.

the following equation An m-order polynomial is created using . is the m root of the equation. As shown in Equation 3 below: Is select is selected and evaluated.

<Equation 3>

Cloud operating server Set it as your signature and save it, Set up the index, encrypted data on the outsourced server Save it. here, am.

Approved keyword sets , keyword , public key Given a cloud operating server has a private key as select token and Proof: Calculate as shown in Equation 4 below.

<Equation 4>

tuple and public key If is given, the service providing server can be confirmed as shown in Equation 5 below. If both equations are satisfied, the user terminal accepts the received keyword token. and or It can be displayed as .

<Equation 5>

And, the cloud operation server is connected to the service provision server. and If you provide a trapdoor with the following equation 6: Calculate the cloud operation server trapdoor is returned to the service providing server.

<Equation 6>

The serving server sets the queried keywords Given, first two elements select is set.

The service providing server follows Equation 7: Calculate the data access token is transmitted to the cloud operation server.

<Equation 7>

Next, the cloud operating server performs a step of verifying the validity of the search query requested by the service providing server (S360).

Here, when the cloud operation server verifies validity and approves the data access service request for the search query, the service provision server transmits a data connection token.

data access token After obtaining the , the service providing server Calculates and cloud operation servers retrieve data and ID Search for DAO, otherwise returns as

trap door at first and each record index to Given, the issuer preprocesses the search query by performing m exponentiation.

를 반환하게 된다. Afterwards, the cloud operating server (CO) indexes the submitted trapdoor. Check to see if it matches. The cloud operation server stores the encrypted data returns . Otherwise

is returned.

를 DAO로 반환하게 된다. Finally, the cloud operating server stores the entire relevant encrypted data set. and corresponding ID sets or

is returned to DAO.

In reality, the value of m is very small, so the verification calculation does not impose much computational burden on the DAO.

Therefore, the above-described search algorithm becomes feasible and practical.

The description of the present invention described above is for illustrative purposes, and those skilled in the art will understand that the present invention can be easily modified into other specific forms without changing the technical idea or essential features of the present invention. will be. Therefore, the embodiments described above should be understood in all respects as illustrative and not restrictive. For example, each component described as unitary may be implemented in a distributed manner, and similarly, components described as distributed may also be implemented in a combined form.

The scope of the present invention is indicated by the claims described below rather than the detailed description above, and all changes or modified forms derived from the meaning and scope of the claims and their equivalent concepts should be construed as being included in the scope of the present invention. do.

100: Integrated system management server
200: user terminal
300: Cloud operation server
400: Service provision server

Claims (10)

An integrated system management server that generates a consensus vector for the permissioned blockchain network and generates and provides public keys to authentication registered entity servers;
A user terminal that registers for authentication with the integrated system management server, specifies a user data disclosure scope, labels the data, and then encrypts and transmits the user attribute data from which the connection keyword is extracted;
A trapdoor for registering authentication with the integrated system management server, storing user attribute data transmitted from the user terminal through data acquisition-based keyword authentication, and verifying the validity of the data access service from the data connection keyword of the user terminal. A cloud operating server that generates and provides the user attribute data; and
A cloud and permissioned blockchain environment that includes a service providing server that registers authentication with the integrated system management server and the cloud operation server, submits a trapdoor to the cloud operation server, and then requests a search query for user data. Detailed access control system.
According to paragraph 1,
A detailed access control system in a cloud and permissioned blockchain environment, wherein the user terminal transmits user attribute data including the user connection keyword, index, and cryptographic signature.
According to paragraph 1,
The cloud operation server is,
The service providing server generates and provides encrypted data including a trap door for performing the data access service, and generates and provides a data access token to verify the validity of data search according to the search query request of the service providing server. Outsourcing servers; and
A detailed access control system in a cloud and permissioned blockchain environment, comprising a resource server that stores user attribute data transmitted from the user terminal and returns resources requested by the outsourcing server.
According to paragraph 1,
The integrated system management server is a detailed access control system in a cloud and permissioned blockchain environment, characterized in that it generates a public key/private key pair through the public parameters and integers of the object.
According to paragraph 1,
The service providing server is
A detailed access control system in the cloud and permissioned blockchain environment, characterized in that a data connection token is transmitted when the cloud operation server approves the data access service request.
Generating a consensus vector for a permissioned blockchain network in an integrated system management server and generating and providing a public key to authentication registered entity servers;
Registering the user terminal for authentication with the integrated system management server, specifying a user data disclosure range, labeling the data, and then encrypting the user attribute data from which the connection keyword is extracted;
A cloud operation server registering authentication with the integrated system management server and storing user attribute data transmitted from the user terminal through data acquisition-based keyword authentication;
A cloud operation server providing the user attribute data by creating a trapdoor for verifying the validity of a data access service from the data connection keyword of the user terminal;
The service providing server registers for authentication with the integrated system management server and the cloud operation server, submits a trapdoor to the cloud operation server, and then requests a search query for user data; and
A detailed access control method in a cloud and permissioned blockchain environment including the step of the cloud operating server verifying the validity of a search query requested by the service providing server.
In article 6,
In the step of generating and providing a public key to the authentication registered entity servers, details of the cloud and permissioned blockchain environment are characterized in that a public key/private key pair is generated and provided through the public parameters and integers of the entity. Access control methods.
In article 6,
In the step of encrypting the user attribute data, the user terminal encrypts the user attribute data including the user connection keyword, index, and cryptographic signature. A detailed access control method in a cloud and permissioned blockchain environment.
In article 6,
In the step of providing the user attribute data,
The service providing server generates and provides encrypted data including a trap door for performing the data access service, and generates and provides a data access token to verify the validity of data search according to the search query request of the service providing server. Detailed access control method in cloud and permissioned blockchain environments, characterized by:
In article 6,
In the step of verifying the validity of the search query, if the cloud operation server verifies the validity and approves the data access service request for the search query, the service providing server transmits a data connection token. Detailed access control method in blockchain environment.