摘要： 随着工业物联网数据持续向云端汇聚，如何在保证数据机密性的同时实现动态可信的数据访问控制，成为云数据共享场景中的关键问题。现有访问控制方案虽然能够依据用户属性实现细粒度授权，但通常将属性满足结果直接转换为数据获取能力，导致授权过程与数据获取过程高度耦合。当用户状态发生变化、访问策略更新或授权关系失效时，历史授权材料仍可能被继续使用，从而引发失效授权风险。此外，现有方案主要依赖静态授权结果进行访问控制，难以持续感知用户状态、策略状态以及数据状态变化，无法保证数据访问过程中的持续可信性。针对上述问题，提出一种授权与数据获取解耦的云数据访问控制方案。首先，构造一种授权与数据获取解耦访问控制结构，将属性满足结果限定为数据加密种子恢复资格，而非直接赋予数据获取能力，使授权判定与实际数据恢复过程相互分离。通过控制数据加密种子的恢复过程，使用户状态变化和访问策略变化能够持续影响后续数据获取结果，从而降低历史授权材料长期有效导致的安全风险。其次，设计一种面向数据获取的双阶段持续验证机制，在授权阶段结合用户身份、属性策略以及链上状态信息完成访问条件验证，在数据获取阶段通过部分解密结果生成和数据加密种子验收过程，对授权状态、策略版本以及数据完整性进行进一步验证，实现对访问过程的持续约束。同时，针对云环境中用户匿名访问与异常责任追踪之间的矛盾，构建一种与访问过程绑定的匿名责任追踪机制，通过伪名凭证、请求签名以及链上访问记录，在隐藏正常用户真实身份的同时，实现异常访问行为追踪和责任用户撤销。性能分析实验结果表明，与同类访问控制方案相比，所提方案的密文生成时间和数据解密时间分别降低68.9%和84.3%，访问控制附加存储开销保持在KB级范围内，链上基础操作平均时延低于56 ms，能够满足云数据访问场景中的效率需求。在安全性方面，首先通过安全分析对所提方案进行了理论验证，并进一步通过基于综合攻击阻断率的消融实验验证所提安全机制的有效性。针对失效授权、策略版本异常、密文替换以及绑定异常等多类攻击，消融实验结果表明，分别移除授权与数据获取解耦机制、动态链上状态验证机制以及BKD绑定机制后，综合攻击阻断率分别下降至91.70%、66.15%和75.50%。为了区分各机制的安全边界，独立模块实验表明，仅包含授权解耦机制、动态链上状态验证机制以及BKD绑定机制的方案综合攻击阻断率分别为33.33%、66.97%和58.51%，说明三类机制分别在访问流程约束、动态状态保持以及密钥—数据绑定方面具有独立防护作用，而完整方案通过多机制协同实现更加全面的安全防护。综上，所提方案通过将授权过程与数据获取过程解耦，并结合动态链上状态验证和密钥—数据绑定机制，实现了面向云端数据共享场景的持续可信访问控制。

Abstract: With the continuous migration of Industrial Internet of Things (IIoT) data to cloud platforms, achieving dynamic and trustworthy data access control while ensuring data confidentiality has become a critical issue in cloud data sharing scenarios. Existing access control schemes can provide fine-grained authorization based on user attributes, but they usually directly transform attribute satisfaction into data acquisition capability, resulting in strong coupling between authorization and data acquisition. When user states change, access policies are updated, or authorization relationships become invalid, previously issued authorization materials may still remain usable, thereby causing invalid authorization risks. In addition, existing schemes mainly rely on static authorization results and have difficulty continuously perceiving changes in user states, policy states, and data states, making it difficult to ensure trustworthy access throughout the data access process. To address these problems, an authorization and data acquisition decoupled cloud data access control scheme is proposed. First, an authorization and data acquisition decoupled access control structure is constructed. Attribute satisfaction is restricted to the qualification for recovering the data encryption seed rather than directly granting data acquisition capability, thereby separating authorization decisions from the actual data recovery process. By controlling the recovery of the data encryption seed, changes in user states and access policies can continuously affect subsequent data acquisition, thus reducing the security risks caused by the long-term validity of historical authorization materials. Second, a two-stage continuous verification mechanism oriented to data acquisition is designed. During the authorization stage, access conditions are verified by combining user identity, attribute policies, and on-chain state information. During the data acquisition stage, the authorization state, policy version, and data integrity are further verified through the generation of partial decryption results and the validation of the data encryption seed, thereby continuously constraining the access process. Furthermore, to address the conflict between anonymous user access and accountability for abnormal behaviors in cloud environments, an anonymous accountability tracing mechanism bound to the access process is constructed. Pseudonymous credentials, request signatures, and on-chain access records are used to hide the real identities of legitimate users while supporting abnormal access tracing and responsible-user revocation. Performance evaluation results show that, compared with similar access control schemes, the proposed scheme reduces ciphertext generation time and data decryption time by 68.9% and 84.3%, respectively. The additional storage overhead introduced by access control remains at the KB level, and the average latency of basic on-chain operations is below 56 ms, demonstrating that the proposed scheme can satisfy the efficiency requirements of cloud data access scenarios. In terms of security, theoretical security analysis is first conducted, followed by ablation experiments based on the Comprehensive Attack Blocking Rate (CABR) to evaluate the effectiveness of the proposed security mechanisms. For multiple attacks, including invalid authorization, policy version anomalies, ciphertext replacement, and binding anomalies, the ablation results show that removing the authorization and data acquisition decoupling mechanism, dynamic on-chain state verification mechanism, and BKD binding mechanism reduces the CABR to 91.70%, 66.15%, and 75.50%, respectively. To further distinguish the security boundaries of individual mechanisms, independent-module experiments show that the schemes containing only the authorization decoupling mechanism, dynamic on-chain state verification mechanism, and BKD binding mechanism achieve CABRs of 33.33%, 66.97%, and 58.51%, respectively. These results indicate that the three mechanisms provide independent protection in access-process constraint, dynamic state maintenance, and key-data binding, respectively, while the complete scheme achieves more comprehensive security protection through their cooperation. In conclusion, the proposed scheme realizes continuously trustworthy access control for cloud data sharing by decoupling authorization from data acquisition and integrating dynamic on-chain state verification with key-data binding.