Data resource authorization and authentication method, device and system based on Hash tree

Abstract

The invention at least relates to a data resource authorization and authentication method, device and system based on a hash tree. The data resource authorization method based on the hash tree comprises the following steps: constructing the hash tree based on each permission record in a plurality of permission records of a plurality of data resources; and forming an authorization certificate, wherein the authorization certificate at least comprises a root node value of the constructed hash tree.

Description

technical field [0001] The invention relates to the field of network technology and security, and more specifically to the authorization and authentication of digital resources. Background technique [0002] Authorization refers to using a criterion to determine the operations that the subject can perform on the object, and its essence is the description of the relationship between the subject, object and authority. A relatively common method is to implement authorization management through the maintenance of authorization records (also called authorization information or authority records). Authorization records describe the users (or user groups, roles) who are allowed to access a certain resource, and finally calculate whether a certain user can access the resource based on the user ID (and the user group, role to which they belong). This method is easy to implement, but there is a risk of tampering with the authorization record, and its security depends on how the autho...

AI Technical Summary

Problems solved by technology

[0004] 1) There may be third parties such as figure 2 The data executor shown makes the authorized access mechanism more complicated;

[0005] 2) The amount of data owned by the authorized owner is relatively large, and the independent authorization of each data will result in a multiplied increase in authorized information; and

[0006] 3) When authenticating permissions, the data to be authenticated may be submitted by the data executor, which may expose too much authorization information

Therefore, authorization information other than the authorization information to be authenticated has to be provided to the data executor, resulting in unnecessary exposure of excessive authorization information

Images