Trusted data permission matching access method and system for digital copies

Abstract

The invention relates to a credible data permission matching access method and system for a digital avatar, and relates to the field of credible certification, a DID digital identity containing a verifiable certificate is registered through a block chain, a frequent verification factor attribute combination is mined by using a historical verification record for a user to select, and then a preset verifiable expression is constructed; and when the verifier demand coincides with the selected combination, the corresponding expression is automatically called for identity verification, so that the technical problems of high user operation frequency and low verification efficiency during digital identity verification are solved, and the technical effects of reducing the user operation frequency, improving the DID digital identity verification efficiency and ensuring identity credibility and accurate permission matching are achieved.

Description

Technical Field

[0001] The present invention relates to the field of trusted authentication, and in particular to a trusted data authority matching access method and system for a digital avatar. Background Art

[0002] In the digital age, with the rapid development of information technology and the widespread adoption of internet applications, distributed digital identity (DID), a new form of identity management, is becoming a key technology for addressing issues such as personal and corporate identity authentication, data privacy protection, and secure access control. DID allows users to create and manage their own digital identities in a decentralized manner, eliminating the need for traditional centralized identity authentication institutions. This improves the flexibility and security of identity management.

[0003] However, when performing identity authentication with verifiable credentials, existing DID digital identities generally adopt a method of selectively omitting or assertively omitting some of the information that needs to be verified for verification by the identity-relying party. This method has significant limitations. On the one hand, each verification requires the user to manually select and omit specific identity attribute information, which not only increases the user's operational burden and reduces the user experience, but may also lead to the disclosure of unnecessary personal information due to operational errors or negligence; on the other hand, because the verification process requires checking the selected identity attribute information one by one, the verification efficiency is low and cannot meet the high concurrency and low latency requirements of modern applications. In addition, with the explosive growth of data volume and the continuous advancement of data processing technology, how to ensure the security of data access and the accuracy of permission allocation has become an important issue that needs to be solved urgently. Existing authentication and permission management methods are often difficult to adapt to this rapidly changing environment, and are prone to security risks such as permission abuse and data leakage. Summary of the Invention

[0004] The present invention aims to solve the technical problems of high user operation frequency and low verification efficiency in digital identity verification in the existing technology, and provides a trusted data authority matching access method and system for digital avatars to solve the problem.

[0005] The technical solution of the present invention to solve the above technical problems is as follows:

[0006] In a first aspect, the present invention provides a trusted data authority matching access method for a digital avatar, comprising: registering a DID digital identity through a blockchain, wherein the DID digital identity includes a verifiable credential, and the verifiable credential includes an initial verification factor; whenever a number of new verification factors are received from a number of issuing parties, frequent attribute combination mining is performed based on historical verification records according to the verification factor attribute sets of the number of new verification factors and the initial verification factor to obtain a plurality of frequent verification factor attribute combinations; after the plurality of frequent verification factor attribute combinations are sent to a user end for selection, a plurality of selected verification factor attribute combinations are obtained; based on the plurality of selected verification factor attribute combinations, the number of new verification factors and the initial verification factor are combined to construct a plurality of preset verifiable expressions; when the required verification attribute of the verifier coincides with any one of the plurality of selected verification factor attribute combinations, the corresponding preset verifiable expression is retrieved from the plurality of preset verifiable expressions and sent to the verifier for trusted identity authentication.

[0007] In a second aspect, the present invention provides a trusted data authority matching access system for a digital avatar, the system comprising: an identity registration module for registering a DID digital identity through a blockchain, wherein the DID digital identity includes a verifiable credential, and the verifiable credential includes an initial verification factor; an attribute mining module for, whenever receiving a number of newly added verification factors from a number of issuing parties, performing frequent attribute combination mining based on the verification factor attribute sets of the several newly added verification factors and the initial verification factor and based on historical verification records, to obtain a plurality of frequent verification factor attribute combinations; an attribute selection module for sending the plurality of frequent verification factor attribute combinations to a user end for selection, and obtaining a plurality of selected verification factor attribute combinations; a new combination module for combining the several newly added verification factors and the initial verification factor based on the plurality of selected verification factor attribute combinations to construct a plurality of preset verifiable expressions; an identity authentication module for, when the verification attribute required by the verifier coincides with any one of the plurality of selected verification factor attribute combinations, retrieving the corresponding preset verifiable expression from the plurality of preset verifiable expressions and sending it to the verifier for trusted identity authentication.

[0008] The beneficial effects of the present invention are: registering a DID digital identity containing verifiable credentials (including initial verification factors) through the blockchain, using historical verification records to mine frequent verification factor attribute combinations for users to select, and then constructing a preset verifiable expression. When the verifier's needs coincide with the selected combination, the corresponding expression is automatically called for identity authentication, which reduces the frequency of user operations, improves the verification efficiency of the DID digital identity, and ensures that the identity is trustworthy and the authority is accurately matched. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1A flowchart of a trusted data authority matching access method for a digital avatar provided by the present invention.

[0010] Figure 2 A structural diagram of a trusted data authority matching access system for a digital avatar provided by the present invention.

[0011] Explanation of the accompanying symbols: identity registration module 11, attribute mining module 12, attribute selection module 13, new combination module 14, identity authentication module 15. DETAILED DESCRIPTION

[0012] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present invention.

[0013] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first" or "second" may explicitly or implicitly include one or more of the specified features. In the description of the present invention, "plurality" means two or more, unless otherwise specifically defined.

[0014] In the description of the present invention, the term "for example" is used to mean "used as an example, illustration or illustration". Any embodiment of the present invention described as "for example" is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any person skilled in the art to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes are not elaborated in detail to avoid obscuring the description of the present invention with unnecessary details. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed herein.

[0015] Example 1:

[0016] like Figure 1 As shown, an embodiment of the present invention provides a method for matching trusted data permissions for accessing a digital avatar, including:

[0017] S10: Registering a DID digital identity through a blockchain, wherein the DID digital identity includes a verifiable credential, and the verifiable credential includes an initial verification factor.

[0018] A distributed digital identity (DID) is a decentralized digital identity identifier that is managed and controlled by the user. It uses technologies such as blockchain to ensure the uniqueness, authenticity, and verifiability of the identity. A digital avatar is a virtual identity representation created by the user based on their DID. It can generate specific permission tags based on roles and business needs, and is used for identity authentication and permission matching during data access. In specific distributed digital identity (DID) usage scenarios, users create a unique digital avatar through a digital identity (such as a DID), and generate permission tags based on roles and business needs. When accessing data, the digital avatar is automatically matched with the permission tags of the data resource, combined with multi-factor authentication, such as biometrics and device fingerprints, to verify the identity and dynamically allocate access rights according to the principle of minimum necessary. After the access ends, the permissions are immediately revoked to ensure that the identity is trustworthy and the permissions are accurately matched.

[0019] For example, in this solution, a distributed digital identity (DID) is first registered through the blockchain. This process not only establishes the user's unique identification in cyberspace, but also gives their digital identity a verifiable credential (Verifiable Credential). Among them, the verifiable credential, as a key component of the DID digital identity, integrates the initial verification factors, which form the basis of identity authentication. For example, when a user registers a DID, his verifiable credential may contain initial biometric data (such as fingerprints, facial recognition information) or device fingerprint information as the initial verification factor, which will play an important role in the subsequent identity authentication process. The immutability and decentralization of the blockchain ensure the uniqueness, authenticity and traceability of the DID digital identity, laying the foundation for subsequent data permission matching and access.

[0020] S20: Whenever a number of newly added verification factors are received from a number of issuing parties, frequent attribute combination mining is performed based on the verification factor attribute sets of the newly added verification factors and the initial verification factor and on historical verification records to obtain a plurality of frequent verification factor attribute combinations.

[0021] Optionally, whenever the system receives new verification factors from multiple issuers, these new factors will be taken into consideration together with the initial verification factors to form a verification factor attribute set. The verification factor attribute set brings together all factor attribute information that can be used for identity authentication. Subsequently, based on historical verification records, data mining technology is used to perform frequent attribute combination mining on the verification factor attribute set. This process aims to identify verification factor attribute combinations that frequently appear together in past verifications. These combinations are considered to have high practical value due to their high occurrence rate in the verification process. For example, if historical data shows that a user's biometric data (such as fingerprints) and device fingerprint information are often used for identity authentication at the same time, the combination of the two may be mined as a frequent verification factor attribute combination. Through this type of mining, the system can obtain multiple such combinations to provide more efficient and accurate support for subsequent identity authentication processes.

[0022] S30: After sending the multiple frequent verification factor attribute combinations to the user terminal for selection, multiple selected verification factor attribute combinations are obtained.

[0023] Furthermore, multiple frequently used authentication factor attribute combinations obtained through data mining are pushed to the user. After receiving these combinations, the user can filter and select them based on their needs and business scenarios. This step ensures that the user has active control over the authentication factor attributes, making the identity verification process more tailored to the user's actual needs. For example, if a user primarily operates on a specific device, they may be inclined to select an authentication factor attribute combination that includes the fingerprint information of that device. After the user completes their selection, the system will record and integrate these selection results, ultimately obtaining multiple selected authentication factor attribute combinations, which will serve as the basis for the subsequent construction of preset verifiable expressions.

[0024] S40: Based on the multiple selected verification factor attribute combinations, the multiple newly added verification factors and the initial verification factors are combined to construct multiple preset verifiable expressions.

[0025] Subsequently, a combination operation is performed on the received newly added verification factors and initial verification factors based on the multiple verification factor attribute combinations selected by the user end, aiming to combine the selected verification factor attributes with all available verification factors to construct multiple preset verifiable expressions. Specifically, for each selected verification factor attribute combination, the corresponding verification factor is selected from the newly added verification factor and the initial verification factor, and these verification factors are combined into a preset verifiable expression through a specific logic or encryption algorithm. The preset verifiable expression may include a hash value, a digital signature, or other forms of encrypted data for subsequent identity authentication processes. For example, if the user selects a verification factor attribute combination that includes fingerprint information and device fingerprint, the system may combine the user's fingerprint data with the device fingerprint information to generate a unique preset verifiable expression, which will be used to verify the user's true identity in subsequent identity authentication. By constructing multiple such preset verifiable expressions, users can be provided with a flexible and efficient means of identity authentication.

[0026] S50: When the required verification attribute of the verifier coincides with any one of the plurality of selected verification factor attribute combinations, a corresponding preset verifiable expression is retrieved from the plurality of preset verifiable expressions and sent to the verifier for trusted identity authentication.

[0027] Specifically, when the verifier initiates an identity authentication request and specifies its required verification attributes, the matching retrieval mechanism will be activated. The matching retrieval mechanism determines whether there is any attribute overlap by comparing the verifier's required verification attributes with multiple verification factor attribute combinations pre-selected by the user. If the verifier's required verification attributes match any selected verification factor attribute combination, the preset verifiable expression corresponding to the matching combination will be automatically retrieved from the multiple preset verifiable expressions that have been constructed. For example, if the verifier needs to verify the user's professional identity and device binding information, and the user has selected a verification factor attribute combination that includes the professional certificate number and the device unique identifier, the system will extract the preset verifiable expression corresponding to the combination (which may be the joint encrypted data of the professional certificate digital signature and the device fingerprint). Subsequently, the system will send the preset verifiable expression to the verifier through a secure channel. The verifier will parse and verify the expression according to the preset rules to complete the trusted identity authentication of the user's digital avatar. Through the automated connection between attribute matching and preset expression retrieval, the identity authentication process is accurately triggered and efficiently executed.

[0028] In a preferred embodiment, whenever several newly added verification factors are received from several issuing parties, frequent attribute combination mining is performed based on the verification factor attribute sets of the several newly added verification factors and the initial verification factor based on historical verification records to obtain multiple frequent verification factor attribute combinations, including: based on the historical verification records, traversing the verification factor attribute set to perform statistics on the proportion of trigger records to obtain a verification factor attribute frequent coefficient set; based on the verification factor attribute frequent coefficient set, screening from the verification factor attribute set a verification factor frequent attribute set whose verification factor attribute frequent coefficient is greater than or equal to a single frequent coefficient threshold; based on the historical verification records, performing frequent attribute combination mining on the verification factor frequent attribute set to obtain multiple frequent verification factor attribute combinations.

[0029] Preferably, when processing newly added verification factors received from multiple issuers, the newly added verification factors are first integrated with the initial verification factors to form a complete verification factor attribute set. To improve the efficiency of verification factor combination mining and avoid indiscriminate combination analysis of all attributes, a two-stage screening and mining process will be carried out based on historical verification records. Specifically, first, for each attribute in the verification factor attribute set, the historical verification records are traversed to count the proportion of records that serve as verification trigger conditions, and a verification factor attribute frequency coefficient set is generated. For example, if a fingerprint feature attribute is triggered 300 times in 1,000 historical verifications, its frequency coefficient is 0.3; and if the device IMEI number attribute is triggered 800 times, its frequency coefficient is 0.8. In addition, a single frequency coefficient threshold (such as 0.5) is set in advance, and attributes with frequency coefficients higher than the threshold are screened from the verification factor attribute set to form a verification factor frequent attribute set. Taking the 0.5 threshold as an example, the aforementioned device IMEI number attribute will be selected, while the fingerprint feature attribute will be excluded because it does not reach the threshold. Finally, we focus on the high-frequency attributes in the set and use association rule mining algorithms (such as the Apriori algorithm) to analyze historical verification records, extracting high-frequency co-occurrence patterns between attributes and generating multiple frequent verification factor attribute combinations. For example, if the combination of "device IMEI number + user facial features" frequently appears in high-confidence verification scenarios in historical data, this combination will be included in the result set. Through this process, we prioritize high-frequency verification attributes, significantly narrowing the scope of combination analysis, ensuring the validity of the mining results while significantly reducing computing resource consumption.

[0030] In a preferred embodiment, based on the historical verification records, frequent attribute combination mining is performed on the verification factor frequent attribute set to obtain multiple frequent verification factor attribute combinations, including: performing k-item enumeration combinations on the verification factor frequent attribute set to obtain multiple k-item frequent attribute combinations of verification factors; based on the historical verification records, traversing the multiple k-item frequent attribute combinations of verification factors to perform trigger record ratio statistics to obtain multiple k-item frequent attribute combination frequency coefficients; based on the multiple k-item frequent attribute combination frequency coefficients, sorting from the multiple k-item frequent attribute combinations of verification factors a k-item frequent attribute combination set whose k-item frequent attribute combination frequency coefficient is greater than or equal to a k-item frequent coefficient threshold, where the initial value of k is equal to 2, k is an integer, N≥k≥2, N represents the number of attributes in the verification factor frequent attribute set, and a single frequent coefficient threshold < k-item frequent coefficient threshold < k-1-item frequent coefficient threshold; adding the k-item frequent attribute combination set to the multiple frequent verification factor attribute combinations, and if k<N, k is increased by one, and the frequent attribute combination mining is continued; if k=N, the multiple frequent verification factor attribute combinations are output.

[0031] Specifically, when constructing frequent verification factor attribute combinations, the system first focuses on the frequent attribute set of verification factors and employs a layer-by-layer progressive strategy to perform combination mining. Specifically, the system initiates the enumeration process with an initial value of k = 2, combining attributes in the frequent attribute set of verification factors pairwise to generate multiple frequent attribute combinations of two verification factors. For example, if the set includes the device IMEI number, user facial features, and geolocation information, the system generates three combinations: "Device IMEI number + user facial features," "Device IMEI number + geolocation information," and "User facial features + geolocation information." Subsequently, based on historical verification records, the system iterates through these two-attribute combinations, counting the percentage of records in which each combination served as a trigger condition during verification. This calculation yields the frequency coefficients for multiple frequent attribute combinations of two attributes. For example, if the "Device IMEI number + user facial features" combination triggered 200 times out of 1,000 historical verifications, its frequency coefficient is 0.2.

[0032] On this basis, a two-item frequent coefficient threshold is set, which is higher than the single-item frequent coefficient threshold to ensure the reliability of combination verification. Then, combinations with frequent coefficients greater than or equal to the threshold are screened out from all two-item combinations to form a two-item attribute frequent combination set.

[0033] After completing the two-item combination mining, the decision to continue the iteration is made through conditional judgment: if the current k value is less than the number of attributes N in the frequent attribute set of the verification factor, the k value is increased by one, and the next round of enumeration is entered (for example, when k = 3, all combinations of three attributes are generated), and the frequent coefficient statistics and screening operations are repeated; if the k value has reached N, the iteration is terminated.

[0034] In each iteration, the set of k frequent attribute combinations selected is added to the final result set, that is, multiple frequent verification factor attribute combinations. At the same time, to ensure the layer-by-layer rigor of combination verification, the k-item frequent coefficient threshold increases as the k value increases, that is, the k-item frequent coefficient threshold is less than the k-1-item frequent coefficient threshold, to prevent low-order invalid combinations from interfering with the mining of high-order valid combinations. For example, when k = 3, the threshold may be raised to 0.4, retaining only combinations with a trigger ratio of more than 40% among "device IMEI number + user facial features + geographic location information." Through this process, multi-level attribute combinations with high verification value can be hierarchically screened, providing support for the subsequent construction of flexible and reliable verification rules.

[0035] In a preferred embodiment, based on the multiple selected verification factor attribute combinations, the several newly added verification factors and the initial verification factor are combined to construct multiple preset verifiable expressions, including: extracting a first selected verification factor attribute of a first selected verification factor attribute combination of the multiple selected verification factor attribute combinations until the Qth selected verification factor attribute; randomly generating a candidate scrambling code set for the first selected verification factor attribute; retrieving a historical configuration scrambling code set of the first selected verification factor attribute from an on-chain database; performing outlier analysis on the candidate scrambling code set based on the historical configuration scrambling code set to obtain an outlier factor set; performing maximum value sorting on the candidate scrambling code set based on the outlier factor set to obtain a target scrambling code; performing zero-knowledge processing on the first selected verification factor of the first selected verification factor attribute according to the target scrambling code to obtain a first selected updated verification factor; until the Qth selected updated verification factor is obtained; constructing a first preset verifiable expression based on the first selected updated verification factor until the Qth selected updated verification factor, and adding it to the multiple preset verifiable expressions.

[0036] Furthermore, in the process of constructing a preset verifiable expression, a dynamic encryption strategy is adopted for each attribute combination of verification factors selected by the user to improve the security of the verification factors.

[0037] Specifically, each attribute in the first selected authentication factor attribute combination (referred to as the first selected authentication factor attribute combination) is first extracted. For example, the attributes "user biometrics - fingerprint" and "device identification - IMEI number" are included, and each attribute is encrypted. For the first selected authentication factor attribute (e.g., fingerprint), a set of candidate scrambling codes is randomly generated, for example, a set of 10 hexadecimal random strings.

[0038] Subsequently, the historical configuration perturbation code set corresponding to the attribute is retrieved from the on-chain database. The set records the perturbation codes that have been used in past verifications for this attribute, for example, including 5 groups of historical perturbation codes. Furthermore, based on the historical configuration perturbation code set, outlier analysis is performed on the candidate perturbation code set. By calculating indicators such as the Hamming distance and cosine similarity between each candidate perturbation code and the historical perturbation code, a set of outlier factors that deviate from the historical distribution is screened out. For example, 3 groups of candidate perturbation codes whose similarity to the historical perturbation codes is lower than a threshold are identified. Further, maximum value sorting is performed on the outlier factor set, such as selecting the perturbation code with the highest score as the target perturbation code based on the outlier score. Assuming that a group of outlier perturbation codes has the highest score due to the largest difference from the historical perturbation code, it is selected as the target perturbation code. Furthermore, zero-knowledge processing technology is used to append the target perturbation code as a prefix to the original value of the first selected verification factor (such as a fingerprint feature). For example, the "fingerprint feature value 123456" and the target perturbation code "A7F3" are concatenated into "A7F3123456", and the concatenated data is encrypted through a zero-knowledge proof protocol (such as zk-SNARKs) to generate the first selected update verification factor, ensuring that during the verification process, it is only necessary to prove that the factor satisfies a specific attribute relationship without leaking the original value.

[0039] The above process is then repeated for the remaining Q-1 selected verification factor attributes (such as the IMEI number) until all Q selected updated verification factors are generated. Finally, the Q updated verification factors are combined according to preset rules, such as generating a fixed-length digest value through a hash function or constructing a hierarchical verification expression using a Merkle tree structure, to form a first preset verifiable expression, which is then added to a set of multiple preset verifiable expressions. For example, if the first selected updated verification factor is "A7F3123456" (fingerprint feature) and the second selected updated verification factor is "B9E2IMEI1234567890" (IMEI number), the concatenation of the two might be hashed using the SHA-256 algorithm to generate a preset verifiable expression such as "0x3F8A..." This process maintains the verifiability of the verification factors while achieving privacy protection of the attribute values ​​through dynamic perturbation codes and zero-knowledge processing technology, effectively defending against replay attacks and data leakage risks.

[0040] In a preferred embodiment, based on the historical configuration scrambling code set, outlier analysis is performed on each of the candidate scrambling code sets to obtain an outlier factor set, including: extracting a first candidate scrambling code from the candidate scrambling code set; adding the first candidate scrambling code to the historical configuration scrambling code set to obtain a historical configuration update scrambling code set; performing pairwise Hamming distance calculation on the historical configuration update scrambling code set to obtain multiple scrambling code Hamming distances; and performing LOF outlier factor analysis on the first candidate scrambling code based on the multiple scrambling code Hamming distances to obtain a first outlier factor, which is added to the outlier factor set.

[0041] Exemplarily, in the process of generating the outlier factor set, dynamic outlier detection is performed on each scrambling code in the set of candidate scrambling codes to quantify the degree of difference between the scrambling code and the historically configured scrambling code.

[0042] Specifically, the first scrambling code in the set of candidate scrambling codes (denoted as the first candidate scrambling code) is first extracted. For example, this scrambling code is the 16-bit binary string "1011001101011100." This scrambling code is then temporarily added to the set of historically configured scrambling codes to form an updated set of historically configured scrambling codes. For example, the set of historically configured scrambling codes originally contained five scrambling codes, but this addition expands the set to six. Next, pairwise Hamming distances are calculated for the updated set of scrambling codes. The number of bits that differ between each pair of scrambling codes is counted using a bit-by-bit exclusive-OR operation. For example, the Hamming distance between the first candidate scrambling code and the historical scrambling code "1100001101011100" is calculated to be 2 (only the first and second bits differ), while the Hamming distance between the first candidate scrambling code and another historical scrambling code "1011001100011100" is calculated to be 4 (the eighth and twelfth bits differ). Consequently, multiple scrambling code Hamming distance values ​​are generated.

[0043] Furthermore, based on the Hamming distance matrix, the local outlier factor algorithm (LOF) is used to perform outlier analysis on the first candidate scrambling code. First, the local reachability density (LRD) of the scrambling code is calculated, that is, the inverse of the average reachable distance of the scrambling codes in its neighborhood. For example, if the mean Hamming distance of the scrambling codes in its neighborhood is 3, the reachable distance is 3 and the LRD is 1 / 3. Then, the mean LRD of all scrambling codes in its neighborhood is calculated. For example, the mean LRD of 5 scrambling codes in the neighborhood is calculated to be 0.4. Finally, the outlier factor (LOF value) of the scrambling code is obtained by comparing its LRD with the mean LRD of the neighborhood. For example, if the LRD of the scrambling code is 0.2 and the average LRD of the neighborhood is 0.4, then its LOF value is 0.5 (lower than the threshold of 1, indicating low outlier); if the LRD of another scrambling code is 0.1 and the average LRD of the neighborhood is 0.4, then its LOF value is 0.25 (if the threshold is set to 0.3, then the scrambling code is judged as an outlier). Finally, the calculated first outlier factor is added to the outlier factor set. If the LOF value of the first candidate scrambling code is 0.25 (lower than the threshold), then this value is recorded, but it may not be adopted in subsequent processing because it does not meet the outlier judgment standard.

[0044] Through the above process, the local similarity between each candidate scrambling code and the historically configured scrambling code can be dynamically quantified, providing a basis for the subsequent selection of scrambling codes with high outliers, thereby ensuring the privacy protection effect of the target scrambling code in zero-knowledge processing. For example, if a candidate scrambling code is judged as an outlier due to a high LOF value, it is more likely to be selected as the target scrambling code to enhance the unlinkability of the verification factor.

[0045] In a preferred embodiment, a first preset verifiable expression is constructed based on the first selected update verification factor up to the Qth selected update verification factor, and added to the multiple preset verifiable expressions, including: whenever a number of new verification factors are received from a number of issuers, the verifiable credential is updated to obtain an updated Merkle tree; based on the first selected update verification factor up to the Qth selected update verification factor, the updated Merkle tree is configured with leaky nodes to obtain a set of leaky nodes; and the node information corresponding to the set of leaky nodes is added to the first preset verifiable expression.

[0046] Optionally, in the process of building and integrating preset verifiable expressions, dynamic updates of verifiable credentials are triggered for newly added verification factors, and vulnerability nodes are configured based on the updated data structure to support selective disclosure verification.

[0047] Specifically, whenever the system receives new verification factors from different issuers (such as new biometrics, device identification, or behavioral pattern data), it first integrates these verification factors with the original verification factors to generate an updated Verifiable Credential (VC), which is then organized using a Merkle Tree structure. For example, if the original credential contains three verification factors: fingerprint, IMEI number, and login time, and the new verification factor is facial features, a new Merkle Tree is constructed with the four verification factors as leaf nodes, generating an updated Merkle Tree with a four-layer structure. The hash values ​​of each pair of leaf nodes are aggregated upward layer by layer to ultimately form a root hash value.

[0048] Subsequently, based on the first selected update verification factor to the Qth selected update verification factor (such as fingerprint features, IMEI number and facial features), the update Merkle tree is configured with a reveal node (RevealNode). Specifically, the reveal node configuration is achieved through the following steps: First, the system determines the verification factors that need to be disclosed according to the preset verification rules (for example, if the verification rules require proof of "user identity and device binding", the Merkle tree path corresponding to the fingerprint features and IMEI number needs to be disclosed); then, through the hash path backtracking algorithm, the leaf nodes containing these verification factors are located from the updated Merkle tree, and all intermediate nodes in the root node path are traced back upward to form a reveal node set. For example, if the fingerprint feature is located at the first leaf node of the left subtree of the Merkle tree, its reveal node set includes the leaf node, its parent node (generated by hashing the fingerprint feature and another verification factor), and all intermediate nodes on the root node path. Finally, the node information corresponding to the reveal node set (such as node hash value, path index) is added to the first preset verifiable expression to form a verification structure that includes zero-knowledge proof capabilities. For example, in the constructed preset verifiable expression, in addition to the zero-knowledge processing result of the updated verification factor (such as the encrypted value of the "A7F3 fingerprint feature prefix"), a Merkle path proof of the set of leaked nodes is also attached, so that the verifier can verify the existence of a specific verification factor by checking the consistency of the path hash value and the root hash value without obtaining other undisclosed verification factors.

[0049] The above process enables the dynamic integration and selective disclosure of verification factors, protecting user privacy (only necessary verification factors are disclosed) while ensuring the integrity and immutability of verification credentials through the Merkle tree structure. For example, in a cross-domain identity authentication scenario, a user can disclose only the leaked nodes of their facial features and IMEI number to prove the binding relationship between their device and identity, without exposing other sensitive verification factors.

[0050] In a preferred embodiment, the updated Merkle tree is configured with leaky nodes according to the first selected update verification factor up to the Qth selected update verification factor to obtain a leaky node set, including: setting an initial leaky node based on the first selected update verification factor up to the Qth selected update verification factor; taking the hash generation of the root node of the updated Merkle tree as the goal, based on the initial leaky node, in combination with the updated Merkle tree, enumerating leaky node combinations, and configuring multiple leaky node combinations; extracting a combination with a minimum number of nodes from the multiple leaky node combinations, and setting it as the leaky node set.

[0051] Specifically, in the process of generating the set of leaky nodes, a minimized path configuration is implemented based on the selected updated verification factor for the updated Merkle tree structure to optimize the efficiency of information disclosure in the verification process.

[0052] First, based on the first selected update verification factor to the Qth selected update verification factor, the leaf node position of the verification factor to be disclosed in the update Merkle tree is determined, and the initial vulnerability node is set accordingly. For example, if the first selected update verification factor is "fingerprint feature prefix", it is located at the first leaf node of the left subtree in the update Merkle tree, and this node is marked as the initial vulnerability node. If the Qth selected update verification factor is "IMEI number prefix", it is located at the second leaf node of the right subtree, and this node is also marked as the initial vulnerability node.

[0053] Subsequently, with the goal of generating the hash of the root node of the updated Merkle tree, based on the initial leaky node, the updated Merkle tree structure is combined to enumerate leaky node combinations. The enumeration process is implemented using a backtracking algorithm. Specifically, starting from the initial leaky node, all possible intermediate node combinations are enumerated along the path traced back to the root node to form multiple leaky node combinations. For example, if the initial leaky node is a fingerprint feature leaf node, and its path upwards includes a parent node (generated by hashing the fingerprint feature and another verification factor) and a grandparent node (generated by hashing the parent node and another subtree node), then possible leaky node combinations include "fingerprint feature leaf node + parent node," "fingerprint feature leaf node + grandparent node," and "fingerprint feature leaf node + parent node + grandparent node," etc. The combination with the minimum number of nodes among the multiple leaky node combinations obtained by enumeration is further extracted as the leaky node set. The basis for determining the minimum number of node combinations is to select the combination with the least number of nodes, while ensuring that the root node can be verified through the hash path backtracking, so as to reduce the amount of information disclosed during the verification process. For example, among the above enumerated leak node combinations, if the "fingerprint feature leaf node + parent node" combination can be traced back to the root node through the hash path, and its number of nodes is less than the "fingerprint feature leaf node + parent node + grandparent node" combination, then the former is selected as the leak node set.

[0054] Through the above process, the minimum configuration of the set of leaky nodes is achieved, which not only ensures the integrity and verifiability of the verification credentials, but also improves the level of user privacy protection by reducing the amount of information disclosed. For example, in a cross-institutional identity authentication scenario, the user only needs to disclose the minimum set of leaky nodes corresponding to the fingerprint characteristics and IMEI number to complete the verification of the identity binding relationship without exposing other verification factors or intermediate node information.

[0055] The embodiment of the present invention provides a method for matching trusted data permissions for accessing a digital avatar, which has at least the following technical effects:

[0056] 1. By mining frequent attribute combinations based on historical verification records, we automatically extract frequently occurring verification factor attribute combinations, and introduce dynamic perturbation code generation and outlier analysis mechanisms to enable verification factors to have adaptive encryption capabilities before zero-knowledge processing. For example, when adding a new biometric verification factor, we screen high-frequency attribute combinations (such as fingerprint + IMEI number) by analyzing historical verification records, and generate outlier perturbation codes that are significantly different from historical perturbation codes. Using zero-knowledge proof technology, we use the perturbation code as a prefix for the verification factor. This not only ensures the verifiability of the verification factor, but also prevents the verification factor from being reverse-engineered through the dynamic perturbation mechanism, significantly improving privacy protection.

[0057] 2. By updating the leaky node configuration based on the Merkle tree, a disclosure path with the minimum number of nodes is automatically generated based on verification requirements. For example, when verifying the binding relationship between a user's identity and a device, starting from the initial leaky node (such as the fingerprint feature leaf node), the path back to the root node is enumerated through an algorithm, and the minimum leaky node combination containing only the fingerprint feature leaf node and the parent node is screened out, rather than the entire path. This reduces the amount of information disclosed while ensuring verification integrity, effectively mitigating the risk of privacy leakage.

[0058] 3. Through the dynamic update of verifiable credentials and the construction of preset verifiable expressions, cross-institutional integration of multi-source verification factors and precise matching of permissions are achieved. For example, when a user obtains new verification factors (such as facial features and behavioral pattern data) from different issuers, they are integrated with the original verification factors into the updated Merkle tree, and a preset verifiable expression is generated based on the combination of verification factor attributes selected by the user. During the verification stage, only the corresponding set of leaked nodes is disclosed according to the verifier's needs, rather than the complete credentials. This improves verification efficiency while supporting cross-domain identity authentication and ensures that the verifier only obtains necessary verification information, achieving dual protection of permissions and privacy.

[0059] Example 2:

[0060] like Figure 2As shown, based on the same inventive concept as the trusted data authority matching access method for a digital avatar provided in Example 1, an embodiment of the present invention further provides a trusted data authority matching access system for a digital avatar, the system comprising:

[0061] The identity registration module 11 is used to register a DID digital identity through a blockchain, wherein the DID digital identity includes a verifiable credential, and the verifiable credential includes an initial verification factor.

[0062] The attribute mining module 12 is configured to, whenever receiving a number of newly added verification factors from a number of issuing parties, perform frequent attribute combination mining based on the verification factor attribute sets of the newly added verification factors and the initial verification factor and on historical verification records to obtain a plurality of frequent verification factor attribute combinations.

[0063] The attribute selection module 13 is configured to send the plurality of frequent verification factor attribute combinations to the user terminal for selection, thereby obtaining a plurality of selected verification factor attribute combinations.

[0064] A new combination module 14 is configured to combine the plurality of newly added verification factors and the initial verification factors based on the plurality of selected verification factor attribute combinations to construct a plurality of preset verifiable expressions.

[0065] The identity authentication module 15 is configured to retrieve a corresponding preset verifiable expression from the plurality of preset verifiable expressions and send the expression to the verifier for trusted identity authentication when the required verification attribute of the verifier coincides with any one of the plurality of selected verification factor attribute combinations.

[0066] Furthermore, the attribute mining module 12 is further configured to perform the following steps:

[0067] Based on the historical verification records, the verification factor attribute set is traversed to perform statistics on the proportion of trigger records to obtain a verification factor attribute frequent coefficient set; based on the verification factor attribute frequent coefficient set, a verification factor frequent attribute set whose verification factor attribute frequent coefficient is greater than or equal to a single frequent coefficient threshold is screened from the verification factor attribute set; based on the historical verification records, frequent attribute combination mining is performed on the verification factor frequent attribute set to obtain multiple frequent verification factor attribute combinations.

[0068] Furthermore, the attribute mining module 12 is further configured to perform the following steps:

[0069] Perform k-item enumeration combinations on the verification factor frequent attribute set to obtain multiple k-item frequent attribute combinations of verification factors; based on the historical verification records, traverse the multiple k-item frequent attribute combinations of verification factors to perform statistics on the proportion of trigger records to obtain multiple k-item frequent attribute combination frequency coefficients; based on the multiple k-item frequent attribute combination frequency coefficients, sort out the k-item attribute frequent combination sets whose k-item frequent attribute combination frequency coefficients are greater than or equal to the k-item frequent coefficient threshold from the multiple k-item frequent attribute combinations of verification factors, where the initial value of k is equal to 2, k is an integer, N≥k≥2, N represents the number of attributes of the verification factor frequent attribute set, and the single frequent coefficient threshold is less than the k-item frequent coefficient threshold and less than the k-1-item frequent coefficient threshold; add the k-item attribute frequent combination set to the multiple frequent verification factor attribute combinations, and if k<N, add one to k and continue to perform frequent attribute combination mining; if k=N, output the multiple frequent verification factor attribute combinations.

[0070] Furthermore, the newly added combination module 14 is further configured to perform the following steps:

[0071] Extracting a first selected verification factor attribute of a first selected verification factor attribute combination of the multiple selected verification factor attribute combinations up to a Qth selected verification factor attribute; randomly generating a candidate scrambling code set for the first selected verification factor attribute; retrieving a historical configuration scrambling code set for the first selected verification factor attribute from an on-chain database; performing outlier analysis on the candidate scrambling code set based on the historical configuration scrambling code set to obtain an outlier factor set; performing maximum value sorting on the candidate scrambling code set based on the outlier factor set to obtain a target scrambling code; performing zero-knowledge processing on the first selected verification factor of the first selected verification factor attribute based on the target scrambling code to obtain a first selected updated verification factor; until a Qth selected updated verification factor is obtained; constructing a first preset verifiable expression based on the first selected updated verification factor up to the Qth selected updated verification factor, and adding the first preset verifiable expression to the multiple preset verifiable expressions.

[0072] Furthermore, the newly added combination module 14 is further configured to perform the following steps:

[0073] Extracting a first scrambling code to be selected from the set of scrambling codes to be selected; adding the first scrambling code to the set of historically configured scrambling codes to obtain a set of historically configured updated scrambling codes; performing pairwise Hamming distance calculation on the set of historically configured updated scrambling codes to obtain a plurality of scrambling code Hamming distances; and performing LOF outlier factor analysis on the first scrambling code to obtain a first outlier factor based on the plurality of scrambling code Hamming distances, and adding the first outlier factor to the outlier factor set.

[0074] Furthermore, the newly added combination module 14 is further configured to perform the following steps:

[0075] Whenever a number of newly added verification factors are received from a number of issuing parties, the verifiable credential is updated to obtain an updated Merkle tree; based on the first selected updated verification factor up to the Qth selected updated verification factor, the updated Merkle tree is configured with leaky nodes to obtain a set of leaky nodes; and the node information corresponding to the set of leaky nodes is added to the first preset verifiable expression.

[0076] Furthermore, the newly added combination module 14 is further configured to perform the following steps:

[0077] An initial leaky node is set based on the first selected update verification factor up to the Qth selected update verification factor; a root node hash of the updated Merkle tree is generated as a target, leaky node combinations are enumerated based on the initial leaky node and combined with the updated Merkle tree to configure multiple leaky node combinations; a combination with a minimum number of nodes of the multiple leaky node combinations is extracted and set as the leaky node set.

[0078] Through the detailed description of the trusted data authority matching access method of a digital avatar in the above description, those skilled in the art can clearly understand the trusted data authority matching access system of a digital avatar in this embodiment. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0079] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A trusted data authority matching access method for a digital avatar, characterized in that: include: Registering a DID digital identity through a blockchain, wherein the DID digital identity includes verifiable credentials, and the verifiable credentials include an initial verification factor; Whenever a plurality of newly added verification factors are received from a plurality of issuing parties, frequent attribute combination mining is performed based on the verification factor attribute sets of the plurality of newly added verification factors and the initial verification factor and on historical verification records to obtain a plurality of frequent verification factor attribute combinations; After sending the multiple frequent verification factor attribute combinations to the user terminal for selection, multiple selected verification factor attribute combinations are obtained; Based on the multiple selected verification factor attribute combinations, combining the multiple newly added verification factors and the initial verification factors to construct multiple preset verifiable expressions; When the required verification attribute of the verifier coincides with any one of the plurality of selected verification factor attribute combinations, a corresponding preset verifiable expression is retrieved from the plurality of preset verifiable expressions and sent to the verifier for trusted identity authentication.

2. A method for accessing trusted data permissions matching of a digital avatar according to claim 1, characterized in that: Whenever a number of newly added verification factors are received from a number of issuing parties, frequent attribute combination mining is performed based on the verification factor attribute sets of the newly added verification factors and the initial verification factor and on historical verification records to obtain a plurality of frequent verification factor attribute combinations, including: Based on the historical verification records, traverse the verification factor attribute set to perform statistics on the proportion of trigger records to obtain a verification factor attribute frequency coefficient set; Based on the verification factor attribute frequent coefficient set, screening from the verification factor attribute set a verification factor frequent attribute set having a verification factor attribute frequent coefficient greater than or equal to a single frequent coefficient threshold; Based on the historical verification records, frequent attribute combination mining is performed on the verification factor frequent attribute set to obtain a plurality of frequent verification factor attribute combinations.

3. A method for accessing trusted data permissions matching of a digital avatar according to claim 2, characterized in that: Based on the historical verification records, frequent attribute combination mining is performed on the verification factor frequent attribute set to obtain multiple frequent verification factor attribute combinations, including: Performing k-item enumeration combinations on the verification factor frequent attribute set to obtain multiple k-item frequent attribute combinations of verification factors; Based on the historical verification records, traverse the multiple k frequent attribute combinations of the verification factors to perform statistics on the proportion of trigger records, and obtain the frequent coefficients of the multiple k frequent attribute combinations; Based on the multiple k-item frequent attribute combination frequent coefficients, sorting a k-item attribute frequent combination set whose k-item frequent attribute combination frequent coefficients are greater than or equal to a k-item frequent coefficient threshold from the multiple k-item frequent attribute combinations of the verification factors, where an initial value of k is equal to 2, k is an integer, N≥k≥2, N represents the number of attributes in the verification factor frequent attribute set, and a single frequent coefficient threshold < k-item frequent coefficient threshold < k-item frequent coefficient threshold; The k frequent attribute combination sets are added to the multiple frequent verification factor attribute combinations. If k < N, k is increased by one, and frequent attribute combination mining is continued. If k = N, the multiple frequent verification factor attribute combinations are output.

4. A method for accessing trusted data permissions matching of a digital avatar according to claim 1, characterized in that: Based on the multiple selected verification factor attribute combinations, the multiple newly added verification factors and the initial verification factors are combined to construct multiple preset verifiable expressions, including: Extracting a first selected authentication factor attribute of a first selected authentication factor attribute combination of the plurality of selected authentication factor attribute combinations up to a Qth selected authentication factor attribute; Randomly generating a set of scrambling codes to be selected for the first selected verification factor attribute; Retrieving a set of historical configuration perturbation codes for the first selected verification factor attribute from an on-chain database; Based on the historically configured scrambling code set, performing outlier analysis on each of the candidate scrambling code sets to obtain an outlier factor set; Based on the outlier factor set, performing maximum value sorting on the set of candidate scrambling codes to obtain a target scrambling code; performing zero-knowledge processing on a first selected verification factor having the first selected verification factor attribute according to the target scrambling code to obtain a first selected updated verification factor; Until the Qth selected updated verification factor is obtained; A first preset verifiable expression is constructed based on the first selected updated verification factor up to the Qth selected updated verification factor, and is added to the plurality of preset verifiable expressions.

5. A method for accessing trusted data permissions matching of a digital avatar according to claim 4, characterized in that: Based on the historically configured scrambling code set, outlier analysis is performed on each of the candidate scrambling code sets to obtain an outlier factor set, including: Extracting a first candidate scrambling code from the candidate scrambling code set; Adding the first candidate scrambling code to the historical configuration scrambling code set to obtain a historical configuration updated scrambling code set; Performing pairwise Hamming distance calculation on the historical configuration update perturbation code set to obtain multiple perturbation code Hamming distances; Based on the Hamming distances of the multiple scrambling codes, LOF outlier factor analysis is performed on the first candidate scrambling code to obtain a first outlier factor, which is added to the outlier factor set.

6. A method for accessing trusted data permissions matching of a digital avatar according to claim 4, characterized in that: Constructing a first preset verifiable expression based on the first selected updated verification factor up to the Qth selected updated verification factor, and adding the first preset verifiable expression to the plurality of preset verifiable expressions, including: Whenever a number of new verification factors are received from a number of issuing parties, the verifiable credentials are updated to obtain an updated Merkle tree; According to the first selected update verification factor up to the Qth selected update verification factor, configuring the updated Merkle tree with missing nodes to obtain a set of missing nodes; The node information corresponding to the set of missing nodes is added to the first preset verifiable expression.

7. A method for accessing trusted data permissions matching of a digital avatar according to claim 6, characterized in that: According to the first selected update verification factor to the Qth selected update verification factor, performing leaky node configuration on the updated Merkle tree to obtain a leaky node set includes: Setting an initial leaky node based on the first selected updated verification factor up to the Qth selected updated verification factor; Taking the root node hash generation of the updated Merkle tree as the goal, based on the initial leaky node, in combination with the updated Merkle tree, enumerate leaky node combinations, and configure multiple leaky node combinations; A combination with a minimum number of nodes among the multiple combinations of leaky nodes is extracted and set as the leaky node set.

8. A trusted data authority matching access system for digital avatars, characterized by: A system for implementing a trusted data authority matching access method for a digital avatar according to any one of claims 1 to 7, comprising: An identity registration module, configured to register a DID digital identity through a blockchain, wherein the DID digital identity includes a verifiable credential including an initial verification factor; an attribute mining module configured to, upon receiving a plurality of newly added verification factors from a plurality of issuing parties, perform frequent attribute combination mining based on the verification factor attribute sets of the plurality of newly added verification factors and the initial verification factor and based on historical verification records, to obtain a plurality of frequent verification factor attribute combinations; an attribute selection module, configured to send the plurality of frequent verification factor attribute combinations to a user terminal for selection, and obtain a plurality of selected verification factor attribute combinations; A new combination module is added, configured to combine the plurality of newly added verification factors and the initial verification factors based on the plurality of selected verification factor attribute combinations to construct a plurality of preset verifiable expressions; The identity authentication module is configured to retrieve a corresponding preset verifiable expression from the plurality of preset verifiable expressions and send the expression to the verifier for trusted identity authentication when the required verification attribute of the verifier coincides with any one of the plurality of selected verification factor attribute combinations.

Images