Trusted data sharing system based on identification analysis and data circulation method

Abstract

The invention belongs to the technical field of data processing, and particularly relates to a trusted data sharing system based on identification analysis and a data circulation method, and the method comprises the steps: receiving an identification analysis request submitted by a data requester; dynamically analyzing the identifier into bound metadata through a distributed node network, analyzing an authority strategy, and generating an access control decision in combination with the dynamic attribute of a data requester; if the decision result is refusal, refusal response is returned to the requester, and block chain evidence storage is triggered; if the decision result is permission, the data request is routed to an external data source deployed by a data provider according to a data source address and a protocol type; returning the response of the data source to the data requester; recording an operation log; and displaying the data flow direction and the block chain evidence storage record through a visual auditing interface. Flexible access control based on dynamic attributes, efficient data routing and complete operation log records are realized, and the security and compliance of data sharing are guaranteed.

Description

Technical Field

[0001] The present invention belongs to the field of data processing technology, and specifically relates to a trusted data sharing system and data flow method based on identity resolution. Background Art

[0002] With the rapid development of the Industrial Internet, data sharing is becoming increasingly important in cross-organizational and cross-industry business collaboration. However, existing data sharing technologies have the following major problems: Existing data sharing technologies often rely on manual negotiation of data interfaces, making it impossible to dynamically discover data sources. For example, in cross-border logistics scenarios, data requesters must negotiate interfaces with multiple data providers one by one, resulting in lengthy data locating times and low efficiency. Most data sharing solutions utilize static permission configurations, making them difficult to adapt to dynamic business needs. Static permission rules cannot be dynamically adjusted based on real-time business scenarios (such as user roles, geographic location, and timestamps), easily leading to permission abuse or insufficient permissions.

[0003] During data circulation, insufficient verification of data source credibility makes data susceptible to tampering or falsification. Existing technologies lack effective mechanisms to ensure data integrity and source authenticity during transmission and storage. Identification protocols across heterogeneous systems are inconsistent, resulting in poor interoperability. Different organizations and industries use varying identification systems, hindering efficient data flow and creating data silos. Summary of the Invention

[0004] In response to the above technical problems, the present invention proposes a trusted data sharing system and data flow method based on identity resolution to solve the shortcomings of the existing technology.

[0005] In a first aspect, the technical solution of the present invention provides a trusted data sharing system based on identity resolution, comprising: The identity resolution layer is used to receive identity resolution requests submitted by data requesters, dynamically resolve the identity into bound metadata through a distributed node network, and return the metadata to the trusted sharing layer; the metadata includes the data source address, protocol type, and permission policy; Trusted sharing layer, including dynamic authorization module, intelligent routing module and blockchain evidence storage module; The dynamic authorization module is used to parse the permission policy and generate access control decisions based on the dynamic attributes of the data requester. If the decision result is a rejection, a rejection response is returned to the requester and the blockchain evidence is triggered. The intelligent routing module is used to route the data request to the external data source deployed by the data provider based on the data source address and protocol type when the decision result is permission; and return the response of the data source to the data requester; The blockchain evidence storage module is used to record operation logs; the operation logs include the identity of the requester, data identifier, operation type, timestamp, decision result and routing path; The application service layer provides a data sharing interface and a visual audit interface to display data flow and blockchain evidence records.

[0006] Dynamic identity resolution is achieved through the identity resolution layer. Combined with a distributed node network, this improves the efficiency and accuracy of data identification, avoids single-point failure risks, and enhances system reliability and scalability. The dynamic authorization module, intelligent routing module, and blockchain evidence storage module in the trusted sharing layer work together to implement flexible access control based on dynamic attributes, efficient data routing, and complete operation logging, ensuring the security and compliance of data sharing. The application service layer provides a data sharing interface and a visual audit interface, facilitating data sharing operations and audits, enhancing the user experience.

[0007] As a further limitation of the technical solution of the present invention, the identity resolution layer is also used to receive a data entity registration request from a data provider, assign a unique identifier to the data entity and bind metadata to store it in a distributed node network; the data entity includes at least one of industrial equipment, products, orders or data service interfaces.

[0008] The identity resolution layer receives data entity registration requests from data providers, assigns unique identifiers to data entities, and binds metadata for storage in a distributed node network. This enables unified management and identification of data entities, providing a foundation for subsequent data sharing. It supports a variety of data entities, such as industrial equipment, products, orders, or data service interfaces, meeting the data sharing needs of different industries and scenarios.

[0009] As a further limitation of the technical solution of the present invention, the identity resolution layer includes: Request preprocessing module, verifies the identifier format, and performs URI encoding conversion on non-standard identifiers; The distributed recursive query module first queries the metadata corresponding to the identifier from the cache of the local node; if a valid record exists and has not expired, the cached metadata is directly returned to the trusted shared layer; if the query fails or the cache expires, the corresponding metadata is obtained by recursive parsing through the distributed node network according to the hierarchical path; the hierarchical path is root node-industry node-enterprise node; The metadata verification module verifies the integrity, timeliness, and grammatical validity of the obtained metadata and the permission policy; and returns the verified metadata to the trusted sharing layer and updates the cache of the local node.

[0010] The identity resolution layer includes a request preprocessing module, a distributed recursive query module, and a metadata verification module. Each module has a clear division of labor, which improves the efficiency and accuracy of identity resolution. The request preprocessing module converts non-standard identifiers into URI encoding to ensure the consistency of the identifier format. The distributed recursive query module prioritizes querying metadata from the local node cache, which improves the query speed; when the cache fails, it recursively resolves the hierarchical path through the distributed node network to ensure the accurate acquisition of metadata. The metadata verification module verifies the integrity, timeliness, and grammatical validity of the permission policy of the obtained metadata to ensure the quality and security of the metadata, and returns the verified metadata to the trusted sharing layer, while updating the cache of the local node, improving the efficiency of subsequent queries.

[0011] As a further limitation of the technical solution of the present invention, the process of recursive resolution performed by the distributed recursive query module is as follows: Decompose the identifier into prefix and suffix according to standard protocol rules; Determine the query path through the node routing table maintained by the blockchain; According to the query path, query the root node for the identity prefix; Based on the routing information returned by the root node, recursively query the industry node and enterprise node; Get metadata from enterprise nodes and inject privacy parameters and compliance statements.

[0012] The distributed recursive query module clarifies the specific process of recursive parsing. By decomposing the identifier into prefixes and suffixes, the node routing table maintained by the blockchain is used to determine the query path. Recursive queries are performed along the hierarchical path of root node-industry node-enterprise node. Finally, metadata is obtained from the enterprise node and privacy parameters and compliance statements are injected, ensuring the accuracy and security of data parsing while meeting data privacy and compliance requirements.

[0013] As a further limitation of the technical solution of the present invention, the dynamic authorization module includes a rule extraction unit, a dynamic attribute acquisition unit, a matching processing unit and a decision generation unit; The rule extraction unit is used to extract the access rules in the permission policy, including the allowed roles, operation types and effective time range; A dynamic attribute acquisition unit is used to obtain dynamic attributes from the request context of the data requester, including: user role, request timestamp, geographic location mapped by IP address, and device security level extracted from the request header; A matching processing unit, used to match dynamic attributes with access rules in permission policies in real time based on the attribute-based access control model; The decision generating unit is used to generate a permission decision if all access rules are satisfied; otherwise, it generates a rejection decision and transmits the decision result to the intelligent routing module or directly returns a rejection response.

[0014] The dynamic authorization module includes a rule extraction unit, a dynamic attribute acquisition unit, a matching processing unit, and a decision generation unit. These units work together to implement flexible access control based on dynamic attributes. The rule extraction unit extracts access rules from the permission policy, providing a basis for subsequent matching. The dynamic attribute acquisition unit obtains multiple dynamic attributes from the request context of the data requester, ensuring real-time and accurate access control. The matching processing unit, based on the attribute-based access control model, matches dynamic attributes with access rules in real time, improving matching efficiency and accuracy. The decision generation unit generates a grant or deny decision based on the matching results, ensuring the security of data sharing.

[0015] As a further limitation of the technical solution of the present invention, the matching processing unit is specifically used to convert the dynamic attributes of the requester into a unified attribute vector; expand the nested rules in the permission policy into a flattened rule condition list; use SIMD instructions to compare the attribute vector and the rule condition list in parallel; when multiple rules conflict, select the highest priority match; and store the matching results in Redis, where the key is the attribute vector hash value and the TTL is aligned with the validity period of the permission policy.

[0016] The matching processing unit converts the requester's dynamic attributes into a unified attribute vector, expands the nested rules in the permission policy into a flattened list of rule conditions, and uses SIMD instructions to compare the attribute vector with the rule condition list in parallel, improving matching speed and efficiency. When multiple rules conflict, the highest priority match is selected to ensure the rationality of the decision. The matching results are stored in Redis, with the key being the attribute vector hash value. The TTL is aligned with the permission policy validity period, facilitating subsequent queries and verification, improving system performance and maintainability.

[0017] As a further limitation of the technical solution of the present invention, when the routing request fails, the intelligent routing module requests the identity resolution layer to update the data source address.

[0018] When a routing request fails, the intelligent routing module requests an update from the identity resolution layer, ensuring the reliability and continuity of data routing. When the data source address changes, the module can obtain the latest address information in a timely manner, avoiding routing failures and improving data sharing efficiency.

[0019] In a second aspect, the technical solution of the present invention further provides a data flow method for a trusted data sharing system based on identity resolution, comprising the following steps: Receive an identity resolution request submitted by a data requester; dynamically resolve the identity into bound metadata through a distributed node network, including the data source address, protocol type, and permission policy; and return the metadata to the trusted sharing layer; Parse the permission policy and generate access control decisions based on the dynamic attributes of the data requester. If the decision result is a rejection, return a rejection response to the requester and trigger blockchain evidence storage. If the decision result is permission, the data request is routed to the external data source deployed by the data provider based on the data source address and protocol type; the data source response is returned to the data requester; Record operation logs, including requester identity, data identifier, operation type, timestamp, decision result, and routing path; The data flow and blockchain evidence records are displayed through a visual audit interface.

[0020] This method fully describes the data flow of a trusted data sharing system based on identity resolution, from receiving identity resolution requests to returning data source responses, to recording operation logs and displaying audit records, thus enabling full-process management of data sharing. This method ensures the security, reliability, and traceability of data sharing, meeting the data sharing needs of different industries and scenarios.

[0021] As a further limitation of the technical solution of the present invention, before the step of receiving the identity resolution request submitted by the data requester, the method includes: Receive a data entity registration request from a data provider; assign a unique identifier to the data entity and bind metadata to store it in a distributed node network; the data entity includes at least one of industrial equipment, products, orders, or data service interfaces.

[0022] Before receiving the identity resolution request submitted by the data requester, it receives the data entity registration request from the data provider, assigns a unique identifier to the data entity and binds the metadata to the distributed node network, providing basic data support for data sharing and ensuring the accuracy and reliability of data sharing.

[0023] As a further limitation of the technical solution of the present invention, the steps of receiving an identifier resolution request submitted by a data requester and dynamically resolving the identifier into bound metadata through a distributed node network specifically include: Receive the identifier resolution request submitted by the data requester, verify the identifier format, and perform URI encoding conversion on non-standard identifiers; Prioritize querying the metadata corresponding to the identifier from the local node's cache; if a valid record exists and has not expired, directly return the cached metadata; If the query fails or the cache expires, the corresponding metadata is obtained through recursive parsing along the hierarchical path through the distributed node network; the hierarchical path is root node-industry node-enterprise node; Verify the integrity, timeliness, and grammatical validity of the obtained metadata; Return the verified metadata to the trusted shared layer and update the cache of the local node.

[0024] As a further limitation of the technical solution of the present invention, the process of recursive parsing includes: Decompose the identifier into prefix and suffix according to standard protocol rules; Determine the query path through the node routing table maintained by the blockchain; Query the root node for the ownership of the identifier prefix; Based on the routing information returned by the root node, recursively query the industry node and enterprise node; Get metadata from enterprise nodes and inject privacy parameters and compliance statements.

[0025] As a further limitation of the technical solution of the present invention, the dynamic authorization step specifically includes: Extract access rules from permission policies, including allowed roles, operation types, and valid time ranges; Obtain dynamic attributes from the request context of the data requester, including user role, request timestamp, geographic location, and device security level; Based on the attribute-based access control model, dynamic attributes are matched with access rules in real time; If all access rules are satisfied, an allow decision is generated; otherwise, a deny decision is generated.

[0026] As a further limitation of the technical solution of the present invention, the real-time matching process includes: Convert dynamic attributes to a uniform attribute vector; Expand nested rules in permission policies into a flat list of rule conditions; Use SIMD instructions to compare the attribute vector and the rule condition list in parallel; When multiple rules conflict, the one with the highest priority is selected; The matching results are stored in Redis, with the key being the attribute vector hash value, and the TTL being aligned with the validity period of the permission policy.

[0027] As a further limitation of the technical solution of the present invention, the method further includes: If the request routing fails, request the identity resolution layer to update the data source address; Enable an alternate data source address for retry.

[0028] The beneficial effect of the present invention is that by dynamically resolving identifiers into metadata through the identity resolution layer, the data source can be quickly located, the waiting time for data requests can be reduced, and the efficiency of data sharing can be improved. The dynamic authorization module generates access control decisions based on the dynamic attributes of the data requester, and can flexibly adjust permissions according to real-time conditions, support fine-grained permission management, and meet the needs of complex business scenarios. The blockchain evidence storage module records operation logs, including detailed information such as the identity of the requester, data identification, and operation type, to ensure the traceability of data operations and enhance the credibility of the data sharing process. The application service layer provides a visual audit interface to facilitate users to intuitively understand the data flow and operation records, and facilitate the management and supervision of the data sharing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0030] Figure 1 A schematic block diagram of a system according to an embodiment of the present invention.

[0031] Figure 2 A schematic flow chart of a method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to make the purpose, features, and advantages of the present invention more obvious and easy to understand, the technical solutions of the present invention will be clearly and completely described below in conjunction with the drawings in the specific embodiments. Obviously, the embodiments described below are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0033] like Figure 1 As shown, an embodiment of the present invention provides a trusted data sharing system based on identity resolution, including: The identity resolution layer is used to receive identity resolution requests submitted by data requesters, dynamically resolve the identity into bound metadata through a distributed node network, and return the metadata to the trusted sharing layer; the metadata includes the data source address, protocol type, and permission policy; In this embodiment of the present invention, the data source address, in the context of identity resolution, refers to the accessible interface address dynamically mapped by the identity resolution service. Protocol types include HTTP, MQTT, and Industrial Internet of Things protocols. The permission policy uses JSON format and includes fields for the role allowed access, the valid time range, and the permitted operation type.

[0034] The metadata data source address is dynamically generated and includes load balancing information. The specific format is: {protocol}: / / {cluster_id}.{company}.com / {endpoint}, where cluster_id is assigned by the identity resolution layer based on real-time load conditions. The permission policy is encoded in a smart contract and automatically executes the contract to verify the basic permissions of the requester during identity resolution. The permission policy uses JSON-LD format and contains the following fields: allowedActions: the types of operations allowed (such as read, write); validPeriod: policy validity period (ISO 8601 format); contextConstraints: Environmental constraints (such as internal network access only).

[0035] Trusted sharing layer, including dynamic authorization module, intelligent routing module and blockchain evidence storage module; The dynamic authorization module is used to parse the permission policy and generate access control decisions based on the dynamic attributes of the data requester. If the decision result is a rejection, a rejection response is returned to the requester and the blockchain evidence is triggered. The intelligent routing module is used to route the data request to the external data source deployed by the data provider based on the data source address and protocol type when the decision result is permission; and return the response of the data source to the data requester; The blockchain evidence storage module is used to record operation logs; the operation logs include the identity of the requester, data identifier, operation type, timestamp, decision result and routing path; The application service layer provides a data sharing interface and a visual audit interface to display data flow and blockchain evidence records.

[0036] Dynamic identity resolution is achieved through the identity resolution layer. Combined with a distributed node network, this improves the efficiency and accuracy of data identification, avoids single-point failure risks, and enhances system reliability and scalability. The dynamic authorization module, intelligent routing module, and blockchain evidence storage module in the trusted sharing layer work together to implement flexible access control based on dynamic attributes, efficient data routing, and complete operation logging, ensuring the security and compliance of data sharing. The application service layer provides a data sharing interface and a visual audit interface, facilitating data sharing operations and audits, enhancing the user experience.

[0037] In some embodiments, the identity resolution layer is further used to receive a data entity registration request from a data provider, assign a unique identifier to the data entity, and bind metadata to store it in a distributed node network; the data entity includes at least one of industrial equipment, products, orders, or data service interfaces.

[0038] The identity resolution layer receives data entity registration requests from data providers, assigns unique identifiers to data entities, and binds metadata for storage in a distributed node network. This enables unified management and identification of data entities, providing a foundation for subsequent data sharing. It supports a variety of data entities, such as industrial equipment, products, orders, or data service interfaces, meeting the data sharing needs of different industries and scenarios.

[0039] In some embodiments, the identity resolution layer dynamically resolves the identity through the following steps: Identity verification: Verify whether the requested identity conforms to the standard protocol format (Handle / OID / VAA / MA); Node query: Resolve the identity ownership step by step from enterprise node → industry node → top node through the recursive query mechanism of the distributed node network; Metadata retrieval: Obtain metadata bound to the identity from the target enterprise node, including the data source address, protocol type and permission policy; Time validity verification: Check the validity period field in the metadata and return an error response if it is expired; Result return: Return the valid metadata to the trusted sharing layer. Specifically, the identity resolution layer includes: Request preprocessing module, verifies the identifier format, and performs URI encoding conversion on non-standard identifiers; The distributed recursive query module preferentially queries the metadata corresponding to the identifier from the cache of the local node; if a valid record exists and has not expired, the cached metadata is directly returned to the trusted shared layer; if the query fails or the cache expires, the corresponding metadata is obtained by recursive resolution through the distributed node network according to the hierarchical path; wherein the hierarchical path is root node-industry node-enterprise node; when the distributed recursive query module does not hit the local cache: it queries the preconfigured root node (such as hdl-root.example.com) for the ownership of the identifier prefix; based on the routing information returned by the root node, it recursively queries the industry node and enterprise node; the local node caches the query results and regularly synchronizes routing table updates to the root node.

[0040] The metadata verification module verifies the integrity, timeliness, and grammatical validity of the obtained metadata and the permission policy; and returns the verified metadata to the trusted sharing layer and updates the cache of the local node.

[0041] The identity resolution layer includes a request preprocessing module, a distributed recursive query module, and a metadata verification module. Each module has a clear division of labor, which improves the efficiency and accuracy of identity resolution. The request preprocessing module converts non-standard identifiers into URI encoding to ensure the consistency of the identifier format. The distributed recursive query module prioritizes querying metadata from the local node cache, which improves the query speed; when the cache fails, it recursively resolves the hierarchical path through the distributed node network to ensure the accurate acquisition of metadata. The metadata verification module verifies the integrity, timeliness, and grammatical validity of the permission policy of the obtained metadata to ensure the quality and security of the metadata, and returns the verified metadata to the trusted sharing layer, while updating the cache of the local node, improving the efficiency of subsequent queries.

[0042] In some embodiments, the distributed recursive query module performs recursive resolution as follows: Decompose the identifier into prefix and suffix according to standard protocol rules; Determine the query path through the node routing table maintained by the blockchain; According to the query path, query the root node for the identity prefix; Based on the routing information returned by the root node, recursively query the industry node and enterprise node; Get metadata from enterprise nodes and inject privacy parameters and compliance statements.

[0043] The distributed recursive query module clarifies the specific process of recursive parsing. By decomposing the identifier into prefixes and suffixes, the node routing table maintained by the blockchain is used to determine the query path. Recursive queries are performed along the hierarchical path of root node-industry node-enterprise node. Finally, metadata is obtained from the enterprise node and privacy parameters and compliance statements are injected, ensuring the accuracy and security of data parsing while meeting data privacy and compliance requirements.

[0044] In an embodiment of the present invention, the distributed recursive resolution process for obtaining metadata is as follows: decomposing the identifier into a prefix and a suffix according to standard protocol rules (e.g., decomposing hdl:10.1234 / product001 into the prefix 10.1234 and the suffix product001); querying the preconfigured root node routing table to determine the top-level resolution node corresponding to the prefix (e.g., the prefix 10. points to hdl-root.example.com); querying downward through the recursive nodes step by step, the path is: top-level node → industry node → enterprise node; verifying at the final enterprise node whether the requester is authorized to obtain the metadata of the suffix; obtaining basic metadata from the enterprise node and appending current network status information (e.g., a list of available mirror nodes).

[0045] Hierarchical routing includes: a) each intermediate node maintains a priority list of next-hop nodes (based on real-time latency measurements); b) uses the EDNS Client Subnet protocol to transmit the requester's network location information; c) blockchain-based proof of the query path forms an unalterable resolution chain.

[0046] When recursive resolution times out (>2 seconds): automatically switch to the backup root node list; use UDP fast retransmission mechanism (retry every 200ms); if failure occurs, return the most recently known cached data (marked as expired but temporarily usable STALE state).

[0047] In some embodiments, the dynamic authorization module includes a rule extraction unit, a dynamic attribute acquisition unit, a matching processing unit, and a decision generation unit; The rule extraction unit is used to extract the access rules in the permission policy, including the allowed roles, operation types and effective time range; A dynamic attribute acquisition unit is used to obtain dynamic attributes from the request context of the data requester, including: user role, request timestamp, geographic location mapped by IP address, and device security level extracted from the request header; A matching processing unit, used to match dynamic attributes with access rules in permission policies in real time based on the attribute-based access control model; The decision generating unit is used to generate a permission decision if all access rules are satisfied; otherwise, it generates a rejection decision and transmits the decision result to the intelligent routing module or directly returns a rejection response.

[0048] The decision execution step further includes: when the decision is to allow, injecting an access token (including permission scope and time limit) into the request header; and executing routing after the intelligent routing module verifies the token.

[0049] In some embodiments, the matching processing unit is specifically used to convert the dynamic attributes of the requester into a unified attribute vector; expand the nested rules in the permission policy into a flattened rule condition list; use SIMD instructions to compare the attribute vector and the rule condition list in parallel; when multiple rules conflict, select the highest priority match; store the matching results in Redis, where the key is the attribute vector hash value and the TTL is aligned with the validity period of the permission policy.

[0050] The matching processing unit converts the requester's dynamic attributes into a unified attribute vector, expands the nested rules in the permission policy into a flattened list of rule conditions, and uses SIMD instructions to compare the attribute vector with the rule condition list in parallel, improving matching speed and efficiency. When multiple rules conflict, the highest priority match is selected to ensure the rationality of the decision. The matching results are stored in Redis, with the key being the attribute vector hash value. The TTL is aligned with the permission policy validity period, facilitating subsequent queries and verification, improving system performance and maintainability.

[0051] In some embodiments, when the routing request fails, the intelligent routing module requests the identity resolution layer to update the data source address.

[0052] When a routing request fails, the intelligent routing module requests an update from the identity resolution layer, ensuring the reliability and continuity of data routing. When the data source address changes, the module can obtain the latest address information in a timely manner, avoiding routing failures and improving data sharing efficiency.

[0053] The specific working process is as follows: The data provider submits a registration request through the REST API: the system generates a Handle format identifier (such as hdl:10.1234 / device001); the metadata is signed and stored in the enterprise node, and the system records the registration event through the blockchain.

[0054] Receive the request from the requesting party for identity resolution (e.g. hdl:10.1234 / device001). Local cache query process; Recursive parsing process; Decompose the prefix 10.1234 and the suffix device001; Query the blockchain routing table to obtain the root node address (such as hdl-root.org); The root node returns the node address of the manufacturing industry; The industry node returns the enterprise node address; The enterprise node returns the signed metadata.

[0055] Parse the permission policy JSON; Attribute vectorization; Python user_roles = one_hot_encode(request.roles, ["admin", "maintenance"]) time_vec = [request.hour, request.minute] SIMD parallel alignment (Intel AVX-512 instruction set); Protocol adapter selection; go func Route(request) { switch request.Protocol { case "HTTP": return httpClient.Do(request) case "MQTT": return mqtt.Publish(request.Topic, request.Data) } } Failure handling, exponential backoff retry (1s, 2s, 4s interval); send update request to the identity resolution layer.

[0056] like Figure 2 As shown, an embodiment of the present invention further provides a data flow method of a trusted data sharing system based on identity resolution, comprising the following steps: S1. Receive an identity resolution request submitted by a data requester; dynamically resolve the identity into bound metadata through a distributed node network, including the data source address, protocol type, and permission policy; and return the metadata to the trusted sharing layer; S2. Parse the permission policy and generate an access control decision based on the dynamic attributes of the data requester. If the decision result is a rejection, return a rejection response to the requester and trigger blockchain evidence storage. S3. If the decision result is permission, the data request is routed to the external data source deployed by the data provider based on the data source address and protocol type; the data source response is returned to the data requester; S4. Record the operation log, including the requester identity, data identifier, operation type, timestamp, decision result and routing path; S5. Display data flow and blockchain evidence records through a visual audit interface.

[0057] This method fully describes the data flow of a trusted data sharing system based on identity resolution, from receiving identity resolution requests to returning data source responses, to recording operation logs and displaying audit records, thus enabling full-process management of data sharing. This method ensures the security, reliability, and traceability of data sharing, meeting the data sharing needs of different industries and scenarios.

[0058] In some embodiments, the step of receiving an identity resolution request submitted by a data requester includes: Receive a data entity registration request from a data provider; assign a unique identifier to the data entity and bind metadata to store it in a distributed node network; the data entity includes at least one of industrial equipment, products, orders, or data service interfaces.

[0059] Before receiving the identity resolution request submitted by the data requester, it receives the data entity registration request from the data provider, assigns a unique identifier to the data entity and binds the metadata to the distributed node network, providing basic data support for data sharing and ensuring the accuracy and reliability of data sharing.

[0060] In some embodiments, the steps of receiving an identity resolution request submitted by a data requester and dynamically resolving the identity into bound metadata through a distributed node network specifically include: Receive the identifier resolution request submitted by the data requester, verify the identifier format, and perform URI encoding conversion on non-standard identifiers; Prioritize querying the metadata corresponding to the identifier from the local node's cache; if a valid record exists and has not expired, directly return the cached metadata; If the query fails or the cache expires, the corresponding metadata is obtained through recursive parsing along the hierarchical path through the distributed node network; the hierarchical path is root node-industry node-enterprise node; Verify the integrity, timeliness, and grammatical validity of the obtained metadata; Return the verified metadata to the trusted shared layer and update the cache of the local node.

[0061] In some embodiments, the recursive parsing process includes: Decompose the identifier into prefix and suffix according to standard protocol rules; Determine the query path through the node routing table maintained by the blockchain; Query the root node for the ownership of the identifier prefix; Based on the routing information returned by the root node, recursively query the industry node and enterprise node; Get metadata from enterprise nodes and inject privacy parameters and compliance statements.

[0062] In some embodiments, the dynamic authorization step specifically includes: Extract access rules from permission policies, including allowed roles, operation types, and valid time ranges; Obtain dynamic attributes from the request context of the data requester, including user role, request timestamp, geographic location, and device security level; Based on the attribute-based access control model, dynamic attributes are matched with access rules in real time; If all access rules are satisfied, an allow decision is generated; otherwise, a deny decision is generated.

[0063] In some embodiments, the real-time matching process includes: Convert dynamic attributes to a uniform attribute vector; Expand nested rules in permission policies into a flat list of rule conditions; Use SIMD instructions to compare the attribute vector and the rule condition list in parallel; When multiple rules conflict, the one with the highest priority is selected; The matching results are stored in Redis, with the key being the attribute vector hash value, and the TTL being aligned with the validity period of the permission policy.

[0064] In some embodiments, the method further comprises: If the request routing fails, request the identity resolution layer to update the data source address; Enable an alternate data source address for retry.

[0065] Although the present invention has been described in detail with reference to the accompanying drawings and in conjunction with preferred embodiments, the present invention is not limited thereto. Without departing from the spirit and essence of the present invention, persons of ordinary skill in the art may make various equivalent modifications or substitutions to the embodiments of the present invention, and such modifications or substitutions shall be within the scope of the present invention. Any changes or substitutions that can be easily conceived by persons skilled in the art within the technical scope disclosed in the present invention shall be within the scope of protection of the present invention.

Claims

1. A trusted data sharing system based on identity resolution, characterized in that: include: The identity resolution layer is used to receive identity resolution requests submitted by data requesters, dynamically resolve the identity into bound metadata through a distributed node network, and return the metadata to the trusted sharing layer; the metadata includes the data source address, protocol type, and permission policy; Trusted sharing layer, including dynamic authorization module, intelligent routing module and blockchain evidence storage module; The dynamic authorization module is used to parse the permission policy and generate access control decisions based on the dynamic attributes of the data requester. If the decision result is a rejection, a rejection response is returned to the requester and the blockchain evidence is triggered. The intelligent routing module is used to route the data request to the external data source deployed by the data provider based on the data source address and protocol type when the decision result is permission; And return the response of the data source to the data requester; The blockchain evidence storage module is used to record operation logs; the operation logs include the identity of the requester, data identifier, operation type, timestamp, decision result and routing path; The application service layer provides a data sharing interface and a visual audit interface to display data flow and blockchain evidence records.

2. The trusted data sharing system based on identity resolution according to claim 1, characterized in that: The identity resolution layer is also used to receive a data entity registration request from a data provider, assign a unique identifier to the data entity, and bind metadata to store it in a distributed node network; the data entity includes at least one of industrial equipment, products, orders, or data service interfaces.

3. The trusted data sharing system based on identity resolution according to claim 2, characterized in that: The identity resolution layer includes: Request preprocessing module, verifies the identifier format, and performs URI encoding conversion on non-standard identifiers; The distributed recursive query module first queries the metadata corresponding to the identifier from the cache of the local node; if a valid record exists and has not expired, the cached metadata is directly returned to the trusted shared layer; if the query fails or the cache expires, the corresponding metadata is obtained by recursive parsing through the distributed node network according to the hierarchical path; the hierarchical path is root node-industry node-enterprise node; The metadata verification module verifies the integrity, timeliness, and grammatical validity of the obtained metadata and the permission policy; and returns the verified metadata to the trusted sharing layer and updates the cache of the local node.

4. The trusted data sharing system based on identity resolution according to claim 3 is characterized in that: The process of recursive parsing by the distributed recursive query module is as follows: Decompose the identifier into prefix and suffix according to standard protocol rules; Determine the query path through the node routing table maintained by the blockchain; According to the query path, query the root node for the identifier prefix; Based on the routing information returned by the root node, recursively query the industry node and enterprise node; Get metadata from enterprise nodes and inject privacy parameters and compliance statements.

5. The trusted data sharing system based on identity resolution according to claim 4 is characterized in that: The dynamic authorization module includes a rule extraction unit, a dynamic attribute acquisition unit, a matching processing unit, and a decision generation unit; The rule extraction unit is used to extract the access rules in the permission policy, including the allowed roles, operation types and effective time range; A dynamic attribute acquisition unit is used to obtain dynamic attributes from the request context of the data requester, including: user role, request timestamp, geographic location mapped by IP address, and device security level extracted from the request header; A matching processing unit, used to match dynamic attributes with access rules in permission policies in real time based on the attribute-based access control model; The decision generating unit is used to generate a permission decision if all access rules are satisfied; otherwise, it generates a rejection decision and transmits the decision result to the intelligent routing module or directly returns a rejection response.

6. The trusted data sharing system based on identity resolution according to claim 5, characterized in that: A matching processing unit is specifically used to convert the dynamic attributes of the requester into a unified attribute vector; expand the nested rules in the permission policy into a flattened rule condition list; and use SIMD instructions to compare the attribute vector with the rule condition list in parallel; When multiple rules conflict, the one with the highest priority is selected; the matching result is stored in Redis, where the key is the attribute vector hash value and the TTL is aligned with the validity period of the permission policy.

7. The trusted data sharing system based on identity resolution according to claim 5, characterized in that: When the routing request fails, the intelligent routing module requests the identity resolution layer to update the data source address.

8. A data transfer method for a trusted data sharing system based on identity resolution, characterized in that: The following steps are involved: Receive the identity resolution request submitted by the data requester; Dynamically resolve the identifier into binding metadata through a distributed node network, including the data source address, protocol type, and permission policy; and returns metadata to the trusted sharing layer; Parse the permission policy and generate access control decisions based on the dynamic attributes of the data requester. If the decision result is a rejection, return a rejection response to the requester and trigger blockchain evidence storage. If the decision result is permission, the data request is routed to the external data source deployed by the data provider based on the data source address and protocol type; Return the data source's response to the data requester; Record operation logs, including requester identity, data identifier, operation type, timestamp, decision result, and routing path; The data flow and blockchain evidence records are displayed through a visual audit interface.

9. The data transfer method of the trusted data sharing system based on identity resolution according to claim 8, characterized in that: The steps of receiving the identity resolution request submitted by the data requester include: Receive a data entity registration request from a data provider; assign a unique identifier to the data entity and bind metadata to store it in a distributed node network; the data entity includes at least one of industrial equipment, products, orders, or data service interfaces.

10. The data transfer method of the trusted data sharing system based on identity resolution according to claim 9, characterized in that: Receive the identity resolution request submitted by the data requester; The steps for dynamically resolving an identity into binding metadata through a distributed node network include: Receive the identifier resolution request submitted by the data requester, verify the identifier format, and perform URI encoding conversion on non-standard identifiers; Prioritize querying the metadata corresponding to the identifier from the local node's cache; if a valid record exists and has not expired, directly return the cached metadata; If the query fails or the cache expires, the corresponding metadata is obtained through recursive parsing along the hierarchical path through the distributed node network; the hierarchical path is root node-industry node-enterprise node; Verify the integrity, timeliness, and grammatical validity of the obtained metadata; The verified metadata is returned to the trusted sharing layer and the cache of the local node is updated.

Images