Digital identity trusted management method for cross-domain data sharing
Through multihash algorithm and container virtualization technology combined with trusted server environment, the security and trustworthiness problems of identity management in cross-domain data sharing are solved, and the secure sharing and legal use of data are realized.
Patent Information
- Application Number
- CN202510400446.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-01
- Publication Date
- 2025-08-01
AI Technical Summary
In a cross-domain environment, existing identity management methods are difficult to meet the security and credibility needs of data sharing, especially in the process of data sharing, such as identity forgery, complex permission management, and difficult data abuse to trace.
A multi-hash algorithm is used to generate a hash digest of the user's identity and verify it before the user applies for data use; similar verification is performed on the data to ensure consistency; data and operations are encapsulated using container virtualization technology, and digital authentication and data consistency verification are performed inside the container; secondary verification is performed based on a trusted server environment.
Improves security and credibility in a cross-domain data sharing environment, prevents illegal access and tampering, and ensures the legal use and consistency of data.
Smart Images
Figure CN120415772A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of data security assurance, and particularly relates to a digital identity trusted management method for cross-domain data sharing. Background Art
[0002] In the digital age, data has become a key driver of the global economy, serving as both an important basis for decision-making and a foundation for value innovation. However, the application of data is restricted by security issues. Especially in a cross-domain environment, data sharing and usage face huge challenges. How to achieve secure data sharing and efficient utilization while protecting the rights and interests of data owners has become an urgent problem to be solved. Data open sharing is regarded as an important way to release the value of data resources and is also the core task of promoting the national big data strategy. However, in actual operation, ensuring data security and quality is a huge challenge. Data faces the risks of being stolen, misused, and tampered with, and there is a lack of a convenient and efficient data sharing method suitable for the cross-domain environment, resulting in data owners being trapped in the dilemma of "unwilling, afraid, and unable to open and share".
[0003] In a digital environment, trusted identity management is the key to ensuring data security and compliant use. Traditional identity management methods mainly include authentication based on account passwords, access control lists, centralized identity authentication systems, and role-based access control. The account password method is simple and easy to use, but it is vulnerable to leakage and attacks; the access control list controls access through a static permission list, but it is difficult to adapt to cross-domain sharing; the centralized identity authentication system uses a ticket mechanism to improve security, but it is complex to manage in a distributed environment; role-based access control assigns permissions through roles, reducing management costs, but it is difficult to meet dynamic cross-organization requirements. These methods ensure identity security to a certain extent, but in the scenario of cross-domain data sharing, they still face problems such as identity forgery, complex permission management, and difficulty in tracing data abuse, and are difficult to meet the needs of modern data security sharing. In recent years, technologies such as decentralized identity (DID), CA authentication, public key infrastructure (PKI), and blockchain have gradually developed, providing solutions for enhancing the security and credibility of identity management.
[0004] The present invention proposes a digital identity trusted management method for cross-domain data sharing based on a data box. This method uses a multi-hash algorithm to generate a hash digest of the user identity and verifies the hash digest before the user applies to use the data; at the same time, a similar verification method is also adopted for the data to ensure data consistency. During the implementation process, container virtualization technology is used to encapsulate the data and operations, and digital identity verification and data consistency checking are performed inside the container. In addition, relying on a trusted server environment, the user identity is verified twice to enhance the security of the digital identity trusted management device. Summary of the Invention
[0005] The object of the present invention is to provide a digital identity trusted management method for cross - domain data sharing, so as to enhance the security and trustworthiness in the cross - domain data sharing environment and ensure that data is not illegally accessed or tampered with.
[0006] The digital identity trusted management method for cross - domain data sharing provided by the present invention uses multiple hash algorithms to generate hash digests of user identities and verifies the hash digests before the user applies to use the data; at the same time, a similar verification method is also adopted for the data to ensure data consistency; in the implementation process, container virtualization technology is used to encapsulate the data and operations, and digital identity verification and data consistency check are carried out inside the container. In addition, relying on a trusted server environment, the user identity is verified twice to enhance the security of the digital identity trusted management device. The specific steps are as follows:
[0007] s1. Creation of a data box;
[0008] The data box is created by the data owner and data rights are confirmed.
[0009] (1) Inject data into the data box;
[0010] First, the data owner can select the data to be put into the data box and split it (including horizontal splitting and vertical splitting), that is, select the database, data table, and data fields to be injected into the data box through splitting. Among them, the database and data table granularities are used as the basis for horizontal splitting; the data field granularity is used as the basis for vertical splitting, so as to improve the availability of the data. After splitting, the data owner injects the split data into the data box, configures the privacy level of each data field, and selects whether to perform data obfuscation on the field (such as the privacy level of the data field, etc.); then the data is encapsulated into a Docker image and the data box is deployed in the form of a Docker container. During the deployment process, the data box server system will use multiple hash algorithms to generate hash digests of the data and store these digests in the corresponding data box containers. It should be noted that when the data volume is large, the process of generating hash digests will consume a large amount of memory. To avoid the challenge of memory limitations, the data box server system will adopt a chunking strategy to generate digests block by block.
[0011] (2) Data identification;
[0012] That is, the data owner identifies the data ownership; the identification includes the detailed information of the data owner, the scope of data usage rights, and permission conditions, etc., so as to construct a data ownership identification system with the data box as the core, realize the tight binding of data ownership and specific data objects, and clearly define the protection object, level, and granularity of data rights.
[0013] s2. Application for the data box;
[0014] The data user applies to the data box server system for using the data box and provides specific information for the data box application, including the required data fields, reasons for the application, and requirements of the application, etc.;
[0015] s3. Approval of the application;
[0016] The data box server system returns the above application record of the data user to the data owner, i.e., the data box creator; meanwhile, the system calculates the data leakage risk level of this application according to the specific information (including application fields, etc.) applied by the data user and the field privacy level configured when the data owner injects data into the data box, and returns it to the data owner together; the data owner conducts approval according to this information; if the approval fails, the system will return a notice of failed review and attach the specific reasons provided by the data owner; if the approval passes, it means that the data user has obtained the right to use the data box, and its identity information will be further processed and used as a credential for subsequent identity authentication.
[0017] s4. Recording of the data user's identity information;
[0018] When the application of the data user passes the review, the data box server system automatically extracts the detailed information of the user, including the user ID and user name, and converts this information into string format. Subsequently, a multi-hash algorithm is used to process this string information to generate the corresponding hash digest. The following key operations are performed on the generated hash digest: First, multiple hash digests are securely stored in the data box container; Second, in a trusted server environment, the hash digest is encrypted again and securely stored.
[0019] The storage in the data box container adopts a decentralized method, hashes the user information and stores it in the corresponding data box, and performs verification in the box to avoid the risk of user information being tampered with. The trusted server environment, as a centralized secondary guarantee, encrypts and stores the hash digest, thus providing an additional security layer. By combining the centralized and decentralized storage methods, it not only ensures the flexibility of data sharing but also enhances the security of data, providing a more robust solution for cross-domain identity management.
[0020] s5. The data user uses the data box;
[0021] Before the data user accesses the data box, the data box server system regenerates the hash digest of its identity using the same method and compares it with the hash digest recorded in the data box, i.e., performs the comparison and verification within the data box to confirm the user's identity and permissions and ensure that the identity information has not been tampered with. In addition, this hash digest also needs to be secondarily verified in a trusted server environment. If the comparison results are consistent, it means that the data has passed the consistency check, confirming that the data has not been tampered with and can be used normally. Only after both of these verification steps are passed can the data user formally access the data box and carry out data analysis and utilization. At the same time, the data box server system also generates a corresponding data hash digest based on the data stored in the data box and compares it with the data digest recorded in the s1 stage to ensure data consistency and prevent data from being tampered with during transmission or storage. This dual verification mechanism ensures the security and legal use of the data, providing trust guarantees for data owners and users.
[0022] The method of the present invention is divided into two stages: one is the user identity verification stage, whose function is to ensure the authenticity and legality of the user's identity and prevent unauthorized access; the other is the data consistency verification stage, whose function is to ensure the consistency and integrity of the data during sharing and use and prevent the data from being tampered with or damaged. The coordinated action of these two stages significantly improves the security and credibility of cross-domain data sharing. Brief Description of the Drawings
[0023] Figure 1 Flowchart for creating a data box for the data owner.
[0024] Figure 2 Flowchart for a data user to apply for a data box.
[0025] Figure 3 Flowchart for a data user to use a data box.
[0026] Figure 4 Illustration for interrupting at a breakpoint and modifying the user's ID during a data user's attempt to use a data box.
[0027] Figure 5 Illustration for the front-end return result.
[0028] Figure 6 Illustration for modifying data inside the data box container.
[0029] Figure 7 Illustration for the front-end return result. Detailed Implementation Manner
[0030] 1. The data owner creates a data box
[0031] The data owner selects the data source, provides the data source connection information, which can be MySQL, MongoDB, PostgreSQL or CSV files, and selects the data tables and data fields in the data source that they want to inject into the data box to complete the data segmentation; for the created data box, configure its name, domain category, and the required CPU and memory resources. The data box server system will automatically add corresponding data operation interfaces according to the above data configuration information and data box configuration information, create corresponding Docker images, and run them as Docker containers. After the data box container starts, the data box server system obtains the just-injected data from the container, performs chunking processing, generates hash digests for each chunk using multiple hash algorithms respectively, and stores the finally generated hash digests in the data box container.
[0032] For the hash algorithms used to generate data digests, this method adopts SHA-256, SHA3, and BLAKE2b. Calculating with these three algorithms respectively improves reliability; specifically, SHA-256 is implemented using the java.security.MessageDigest class in the Java standard library; for SHA-3 and BLAKE2 algorithms, the Bouncy Castle dependency is introduced, and the Security Provider provided by Bouncy Castle is registered before use. In the Java environment, multi-threaded parallel processing is used to generate data hash digests. Asynchronous tasks are created through CompletableFuture, and with the support of ExecutorService, these tasks can be executed in parallel, effectively utilizing the performance of multi-core processors, greatly improving the efficiency of large-scale data processing, and reducing the time overhead caused by single-threaded execution.
[0033] 2. The data user applies for a data box
[0034] The data user selects the data box they need in the data box repository for application, and attaches the usage and required fields as application information. The data box server will calculate the risk level for this application based on the privacy protection levels of each field of the data box, and return it to the owner of the data box together with the application information. The owner makes an approval based on the above information. If the approval fails, the reason for the failure needs to be returned to the applicant; if the approval passes, it enters the subsequent process. Next, according to the username of the user ID, a user identity hash digest is generated using multiple hash algorithms; here, four hash algorithms, namely SHA-256, SHA3, BLAKE2b, and Bcrypt, are adopted. The four generated hash digests are concatenated and stored inside the data box container; at the same time, the digest will be encrypted and stored again in a trusted environment.
[0035] For the hash algorithms used to generate user identity digests, the implementations of SHA-256, SHA3, and BLAKE2b are the same as the above data digests. For the BCrypt algorithm, it is implemented by introducing the jBCrypt dependency. The dynamic link library for encrypted storage and verification within a trusted environment is written in C language, providing functions such as encrypted storage and verification of user hash digests; the data box server system calls the dynamic link library through Java Native Access (JNA) to achieve cross-language operation.
[0036] 3. Data users use the data box
[0037] After the data box application is approved, the data user can use the data box for data development and utilization. Before using the data box, two modules need to be verified: user identity verification and data consistency verification.
[0038] For user identity verification, the user hash digest is generated for the current user using the same method as before, and verification is performed respectively inside the data box container and within the trusted environment; inside the data box container, the digests are directly compared; within the trusted environment, the digests need to be encrypted and compared. Only when both the inside of the data box and the trusted environment pass the verification does it mean that the user identity verification is successful. Next, data consistency verification is required, that is, the hash digest of the current data is obtained using the same block division method and hash algorithm as when obtaining the data digest, and compared with the digest previously stored in the data box. If they are the same, it means the data has not been tampered with, and data consistency is ensured.
[0039] If both user identity verification and data consistency verification pass, it means the data box is in a safe state and can be used by the data user.
[0040] The present invention has tested the above method. The test scenario is the operation of the data box module by the data user, because creating and applying for the data box both belong to the final usage service. Since users cannot directly view data boxes they do not own at the front end, during the test, the user ID was modified through debug, and data was tampered with inside the data box container to simulate illegal access behavior.
[0041] First, a breakpoint was set during the data user's attempt to use the data box, and the user ID was modified, as Figure 4 shown, changing the incoming user ID parameter from 68 to 99; user number 68 has the ownership of this data box, while user number 99 does not.
[0042] The front-end returned results as Figure 5 shown. Since user number 99 does not own this data box, the front end will prompt the user that they do not have the ownership of this data box and cannot perform data operations on it.
[0043] Modify data inside the data cartridge container, such as Figure 6 As shown, manually modify the data in the data cartridge, and modify the original numerical record to "change value".
[0044] The result returned by the front end is as Figure 7 shown. Since the data in the data cartridge has been tampered with, the front end will prompt that the data consistency check has failed and data operations cannot be performed on it.
[0045] References:
[0046] [1] Codd E F. A relational model of data for large shared data banks[J]. Communications of the ACM, 1970, 13(6): 377 - 387.
[0047] [2] Jeffrey Ullman: First course in database systems, Prentice–HallInc., Simon&Schuster[M]. ISBN 0 - 13 - 861337 - 0, 1997.
[0048] [3] Kemper A., Eickler A. Object - Oriented Database Management: Applications in Engineering and Computer Science. Prentice Hall, 1993.
[0049] [4] Inmon W.H. Building the Data Warehouse. Wiley, 2005.
[0050] [5] Strauch C. NoSQL Databases. Stuttgart Media University, 2011.
[0051] [6]Pavlo A., Aslett M., et al. What's Really New with NewSQL?ACM SIGMOD Record, 2016. [7]Fang H., Ma M. Data Lake: An Emerging Architecture and Methodology for Big Data. International Conference on Intelligent Computing, 2015.
[0052] [8]Rittinghouse J.W., Ransome J.F. Cloud Computing: Implementation, Management, and Security. CRC Press, 2017.
[0053] [9] M.T., Valduriez P. Principles of Distributed Database Systems. Springer, 2020.
[0054]
[10] Stankovic J.A., Son S.H. Real-Time Database Systems: Architecture and Techniques. Springer, 1999.
[0055]
[11] Buterin V. A Next-Generation Smart Contract and Decentralized Application Platform. White Paper, 2014.
[0056]
[12] National Institute of Standards and Technology. Secure Hash Standard (SHS). Federal Information Processing Standards Publication 180-4, 2015.
[0057]
[13] National Institute of Standards and Technology.SHA-3 Standard:Permutation-Based Hash and Extendable-Output Functions.Federal Information Processing Standards Publication 202,2015.
[0058]
[14] Aumasson,Jean-Philippe,Samuel Neves,Zooko Wilcox-O'Hearn,and Christian Winnerlein.BLAKE2:simpler,smaller,fast as MD5.Cryptology ePrint Archive,Report 2012 / 526,2012.
[0059]
[15] Provos,Niels,and David Mazières.A Future-Adaptable Password Scheme.Proceedings of the USENIX Annual Technical Conference,USENIX Association,1999,pp.81-91。
Claims
1. A digital identity trusted management method for cross - domain data sharing, characterized in that, Generate a hash digest of the user identity using multiple hash algorithms and verify the hash digest before the user applies to use the data; at the same time, a similar verification method is also adopted for the data to ensure data consistency; among them, container virtualization technology is used to encapsulate the data and operations, and digital identity authentication and data consistency verification are carried out inside the container; in addition, relying on a trusted server environment, the user identity is verified twice to enhance the security of the digital identity trusted management device; the specific steps are as follows: S1. Creation of a data box; The data owner creates a data box and conducts data right confirmation; specifically including: (1) Inject data into the data box; First, the data owner selects the data to be put into the data box and splits it; after splitting, the data owner injects the split data into the data box, configures the privacy level of each data field, and selects whether to perform data obfuscation on the field; then the data is encapsulated into a Docker image, and the data box is deployed in the form of a Docker container; during the deployment process, the data box server system uses multiple hash algorithms to generate a hash digest of the data and stores these digests in the corresponding data box container; (2) Data identification; That is, the data owner identifies the data ownership; the identification includes the detailed information of the data owner, the scope of data usage rights and licensing conditions, so as to construct a data ownership identification system with the data box as the core, realize the tight binding of data ownership and specific data objects, and clearly define the protection object, level and granularity of data rights and interests; S2. Application for a data box; The data user applies to the data box server system to use the data box and provides the specific information of the data box application, including the required data fields, the reason for the application and the application requirements; S3. Approval of the application; The data box server system returns the above application record of the data user to the data owner, that is, the data box creator; at the same time, the system calculates the data leakage risk level of this application according to the specific information applied by the data user and the field privacy level configured when the data owner injects data into the data box, and returns it to the data owner together; the data owner approves according to this information; if the approval fails, the system will return a notice of failed review and attach the specific reason provided by the data owner; if the approval passes, it means that the data user has obtained the right to use the data box, and its identity information will be further processed and used as a credential for subsequent identity authentication; S4. Recording of data user identity information; When the application of the data user passes the review, the data box server system will automatically extract the detailed information of the user, including the user ID and user name, and convert these information into string format; then, multiple hash algorithms are used to process these string information to generate the corresponding hash digest; the following operations are performed on the generated hash digest: first, multiple hash digests are securely stored in the data box container; second, in a trusted server environment, the hash digest is encrypted twice and securely stored; S5. The data user uses the data box; Before the data user accesses the data box, the data box server system regenerates the hash digest of its identity using the same method and compares it with the hash digest recorded in the data box, that is, performs the comparison and verification within the data box to confirm the user's identity and permissions and ensure that the identity information has not been tampered with; subsequently, this hash digest also needs to be secondarily verified in the trusted server environment. If the comparison results are consistent, it means that the data has passed the consistency check and it is confirmed that the data has not been tampered with and can be used normally; only when both of these verification steps are passed can the data user officially access the data box and carry out data analysis and utilization; at the same time, the data box server system also generates a corresponding data hash digest based on the data stored in the data box and compares it with the data digest recorded in the s1 stage to ensure the consistency of the data and prevent the data from being tampered with during transmission or storage.
2. The digital identity trusted management method for cross-domain data sharing according to claim 1, wherein The data segmentation includes horizontal segmentation and vertical segmentation, that is, the database, data table, and data field to be injected into the data box are selected through segmentation; among them, the database and data table granularity are used as the basis for horizontal segmentation; the data field granularity is used as the basis for vertical segmentation, so as to improve the usability of the data.
3. The digital identity trusted management method for cross-domain data sharing according to claim 1, wherein The storage within the data box container adopts a decentralized method. The user information is hashed and stored in the corresponding data box, and verification is performed within the box to avoid the risk of user information being tampered with; the trusted server environment serves as a centralized secondary guarantee to encrypt and store the hash digest, thus providing an additional security layer; by combining the centralized and decentralized storage methods, it not only ensures the flexibility of data sharing but also enhances the security of the data, providing a more robust solution for cross-domain identity management.