Data sharing method, system and computer readable storage medium

Abstract

The present invention discloses a data sharing method, which is applied to a data sharing system. First, the data end can be set as a credential issuing end, and the credential issuing end and the data dependent end are respectively deployed in the credential center subsystem and the open credential service subsystem, which can effectively avoid direct data connection between the credential issuing end and the data dependent end, thereby avoiding security issues that may be caused by direct data connection; in addition, the present invention can also transform the data of the data party into a credential, so that the data sharing and use process is converted into a request and verification process for encrypted credentials; and the machine-readable and verifiable encrypted credentials can effectively solve the security and privacy protection issues in the current data circulation and use process, and can prevent data from being copied and then circulated, thereby helping to promote data openness and sharing. The present invention also provides a data sharing system and a computer-readable storage medium, which have the above-mentioned beneficial effects.

Description

Technical Field

[0001] The present invention relates to the field of data sharing, and in particular to a data sharing method, system and computer-readable storage medium. Background Art

[0002] The main way of data sharing today is direct sharing of metadata, which requires the data-relying party to establish an offline trust relationship with the data subject and build a shared secret (such as a password or cryptographic credential information) associated with the sharing agreement; at the same time, it is necessary to establish an information channel between the two information systems, and submit the pre-agreed and recorded credential information during the online access process to obtain access authorization; in addition, the shared data is encrypted and transmitted based on the key negotiated by both parties to avoid security risks during the transmission process. However, the trust relationship between the data-relying party and the data subject and the encryption credential exchange mechanism limit the open sharing of data; at the same time, the direct connection between the data-relying party system and the data subject system may bring security risks to the data subject system; finally, although the data is encrypted and transmitted in an encrypted manner shared by both parties, it is impossible to limit the data from being used for non-agreed purposes and secondary circulation after reaching the data-relying party, and the rights and interests of the data subject cannot be protected.

[0003] Therefore, how to reduce the degree of coupling between the data dependent party and the data subject while performing secure data sharing between the two is a technical problem that technical personnel in this field need to face. Summary of the invention

[0004] The object of the present invention is to provide a data sharing method, system and computer-readable storage medium, which can reduce the degree of coupling between a data dependent party and a data subject while performing secure data sharing between the two.

[0005] In order to solve the above technical problems, the present invention provides a data sharing method, which is applied to a data sharing system, wherein the data sharing system includes a credential center subsystem and an open credential verification service subsystem, wherein the credential center subsystem includes a credential issuing end, a credential center and a verification center, and the open credential verification service subsystem includes the verification center and a data dependent end, and the method includes:

[0006] The data dependent end sends a data request to the verification center;

[0007] The verification center converts the data request into a credential verification request, and sends the credential verification request to the credential center;

[0008] The credential center searches for a corresponding verifiable credential according to the credential verification request, generates a verifiable statement using the verifiable credential, and sends the verifiable statement to the verification center; the verifiable credential is generated by the credential issuing end using the business data and is stored by the credential center;

[0009] The verification center verifies the verifiable statement and sends the verification result to the data-dependent end, so that the data-dependent end uses the verification result to perform business processing.

[0010] Optionally, the credential center subsystem further includes a verifiable data registry, wherein the verifiable data registry includes a credential template and an identity public key of the credential issuing end, and before the data dependent end sends a data request to the verification center, it further includes:

[0011] The credential issuing end obtains a credential template from the verifiable data registry, generates a verifiable credential using the credential template and the business data, and sends the verifiable credential to the credential center;

[0012] The credential center obtains the identity public key and the credential template from the verifiable data registry, verifies the received verifiable credential using the identity public key and the credential template, and saves the received verifiable credential after the verification is passed.

[0013] Optionally, the verifiable data registry further includes a credential cancellation list, the credential cancellation list is used to record the verifiable credential information revoked by the credential issuing end, and the verification center verifies the verifiable statement, including:

[0014] The verification center uses the credential cancellation list to determine whether the verifiable credential corresponding to the verifiable statement is valid;

[0015] If so, the verifiable statement is verified.

[0016] Optionally, the verifiable data registry is implemented based on a permissioned chain or a permissionless chain.

[0017] Optionally, before the credential center searches for a corresponding verifiable credential according to the credential verification request, the method further includes:

[0018] When receiving the credential verification request, the credential center determines whether to respond to the credential verification request according to a preset data sharing policy;

[0019] If so, proceed to the step of searching for the corresponding verifiable credential according to the credential verification request.

[0020] Optionally, the credential issuing end, the credential center and the verification center are all provided with a distributed identity agent that supports access to a distributed identity wallet, and the credential issuing end and the credential center, and the credential center and the verification center communicate through the distributed identity agent and a distributed identity-based point-to-point PKI authentication mechanism.

[0021] Optionally, the verification center communicates with the data-relying end via the TLS protocol.

[0022] Optionally, sending the verification result to the data dependent end includes:

[0023] The verification center converts the verification result into an ID Token format, and sends the verification result after format conversion to the data dependent end.

[0024] The present invention also provides a data sharing system, comprising: the data sharing system comprises a credential center subsystem and an open credential verification service subsystem, the credential center subsystem comprises a credential issuing end, a credential center and a verification center, the open credential verification service subsystem comprises the verification center and a data dependent end, wherein:

[0025] The data dependent end is used to send a data request to the verification center; receive and use the verification result returned by the verification center to perform business processing;

[0026] The verification center is used to convert the data request into a credential verification request and send the credential verification request to the credential center; verify the verifiable statement returned by the credential center, and send the verification result to the data dependent end;

[0027] The credential center is used to search for a corresponding verifiable credential according to the credential verification request, generate a verifiable statement using the verifiable credential, and send the verifiable statement to the verification center;

[0028] The credential issuing end is used to generate the verifiable credential using the business data and send it to the credential center for storage.

[0029] The present invention also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are loaded and executed by a processor, the data sharing method as described above is implemented.

[0030] The present invention provides a data sharing method, which is applied to a data sharing system. The data sharing system includes a credential center subsystem and an open credential verification service subsystem. The credential center subsystem includes a credential issuing end, a credential center and a verification center. The open credential verification service subsystem includes the verification center and a data dependent end. The method includes: the data dependent end sends a data request to the verification center; the verification center converts the data request into a credential verification request, and sends the credential verification request to the credential center; the credential center searches for a corresponding verifiable credential according to the credential verification request, generates a verifiable statement using the verifiable credential, and sends the verifiable statement to the verification center; the verifiable credential is generated by the credential issuing end using business data, and is saved by the credential center; the verification center verifies the verifiable statement, and sends the verification result to the data dependent end, so that the data dependent end uses the verification result to perform business processing.

[0031] It can be seen that the present invention first sets the data end as the credential issuing end, and deploys the credential issuing end and the data dependent end in the credential center subsystem and the open credential service subsystem respectively, which can effectively avoid direct data connection between the credential issuing end and the data dependent end, and thus avoid security issues that may be caused by direct data connection; in addition, the credential issuing end does not directly share business data with the data dependent end, but converts the business data into a verifiable credential and shares it with the data dependent end through the verifiable credential. Specifically, when the data dependent end needs to share data, it will send a credential verification request to the credential center through the verification center in the credential center subsystem, and the credential center will generate a verifiable statement using the verifiable credential corresponding to the request, and send it to the verification center for verification. After verifying the verifiable statement, the verification center will return the verification result to the data dependent end so that it can perform business processing. In simple terms, the present invention can transform the data of the data party into a credential, so that the data sharing and use process is transformed into the request and verification process of the encrypted credential; and the machine-readable and verifiable encrypted credential can effectively solve the security and privacy protection problems in the current data circulation and use process, and can prevent the data from being copied and then circulated, thereby helping to promote data openness and sharing. The present invention also provides a data sharing system and a computer-readable storage medium, which have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0033] Figure 1a A structural block diagram of a first data sharing system provided by an embodiment of the present invention;

[0034] Figure 1b A structural block diagram of a second data sharing system provided by an embodiment of the present invention;

[0035] Figure 2 A flow chart of a data sharing method provided by an embodiment of the present invention;

[0036] Figure 3 A schematic diagram of a credential center provided by an embodiment of the present invention;

[0037] Figure 4 A structural block diagram of a credential issuing terminal provided by an embodiment of the present invention;

[0038] Figure 5 A structural block diagram of a credential center provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] The main way of data sharing today is the direct sharing of metadata, which requires the data-relying party to establish an offline trust relationship with the data party and build a shared secret (such as a password or cryptographic credential information) associated with the sharing agreement; at the same time, it is necessary to establish an information channel between the two information systems, and submit the pre-agreed and recorded credential information during the online access process to obtain access authorization; in addition, the shared data is encrypted and transmitted based on the key negotiated by both parties to avoid security risks during the transmission process. However, the trust relationship between the data-relying party and the data party and the encryption credential exchange mechanism limit the open sharing of data; at the same time, the direct connection between the data-relying party system and the data party system may bring security risks to the data party system; finally, although the data is encrypted and transmitted in an encrypted manner shared by both parties, it is impossible to limit the data from being used for non-agreed purposes and secondary circulation after reaching the data-relying party, and the rights and interests of the data party cannot be protected. In view of this, the present invention provides a data sharing method that can reduce the degree of coupling between the data-relying party and the data party while performing secure data sharing between the two.

[0041] First, a brief introduction is given to the data sharing system to which the method of the present invention is applicable. Figure 1a , Figure 1a The structural block diagram of the first data sharing system provided by the embodiment of the present invention is shown in FIG. 1 . The system can be divided into a credential center subsystem 100 and an open credential verification service subsystem 200, wherein the credential center subsystem 100 includes a credential issuing end 101, a credential center 102 and a verification center 103. The subsystem is usually deployed in a DID trusted network (Decentralized ID, distributed identity), that is, the credential issuing end 101, the credential center 102 and the verification center 103 are all deployed based on a distributed identity infrastructure, and the credential center 102 can usually be deployed in a trusted network accessible to one or more credential issuing ends 101; the open credential verification service subsystem 200 includes a verification center 103 and a data dependent end 201. It can be seen that the verification center is used to connect the two subsystems and is a data bridge between the two subsystems. In the embodiment of the present invention, the original data end is updated to the credential issuing end, that is, the original data sharing process is replaced by a credential verification process in the embodiment of the present invention, which will be described in detail later. Of course, these subsystems may also further include other devices, and the description in the subsequent embodiments may be referred to.

[0042] Based on the above description of the system, the data sharing method provided by the embodiment of the present invention will be described in detail below. Figure 2 , Figure 2 A flow chart of a data sharing method provided by an embodiment of the present invention, the method comprising:

[0043] S201. The data dependent end sends a data request to the verification center.

[0044] In an embodiment of the present invention, the data-dependent end does not directly request business data from the data end (credential issuing end), but requests data from the verification center, which processes the data and returns the result. Since the data-dependent end is located outside the DID trusted network, that is, in other IT infrastructures, from a technical point of view, the least friction approach to integrating DID technology into the existing IT infrastructure is to do so by docking or converting the DID project to one of the currently used and widely accepted established protocols, without modifying or modifying the programs, directory services or management systems of the existing service systems. In other words, the existing identity authentication protocol can be deployed on the verification center, and the verification center can perform protocol conversion to achieve the docking of the DID trusted network with the existing IT infrastructure. The embodiment of the present invention does not limit the specific identity authentication protocol, and can refer to the relevant technology and be set according to actual application requirements. Specifically, considering that OpenID Connect (OIDC) is the most widely used authentication protocol, the data-reliant end and the verification center can communicate data based on this protocol, where OIDC is a simple identity layer built on the OAuth2.0 protocol, which follows the OAuth2.0 protocol process and provides an ID Token on this basis to solve the user authentication problem of three-party applications. With OIDC, users can perform authentication for another website / service based on the account they have registered with the OpenID Provider (OP).

[0045] Furthermore, the embodiment of the present invention does not limit the communication protocol between the data-dependent end and the verification center. To ensure the communication security between the verification center and the data-dependent end, both ends may use the TLS protocol (Transport Layer Security) to communicate.

[0046] Furthermore, it should be noted that the embodiments of the present invention do not limit the specific form of data requests, and can refer to the relevant technologies of OIDC and be set in combination with actual application requirements. The embodiments of the present invention also do not limit the data content that the data-dependent end can request from the verification center. Generally speaking, the data-dependent end can usually only request logical results generated by business data. For example, the data-dependent end asks the verification center whether the age of a certain user is greater than a certain value, and the verification center returns a logical result of "yes" or "no" to it; of course, under controlled conditions, the data-dependent end can also directly request specific business data from the verification center, and the specific request content can be set according to actual application requirements.

[0047] S202: The verification center converts the data request into a credential verification request, and sends the credential verification request to the credential center.

[0048] After receiving the data request sent by the data dependent end, the verification center will convert the request into a credential verification request to request the relevant verifiable credential from the credential center, where the verifiable credential (VC) is an electronic credential generated by business data. It can be understood that in order to make a credential verification request, the data request should include information about the required data, such as attribute information, and then the data request information can be converted into a protocol and format. For details, please refer to the relevant technology of verifiable credentials and set it in combination with actual application requirements. The embodiment of the present invention does not limit the specific form of the credential verification request, nor does it limit how to use the credential verification request to obtain the corresponding verifiable credential from the credential center. Please refer to the relevant technology of verifiable credentials.

[0049] It should be noted that the embodiments of the present invention do not limit the specific structure of the verification center. For example, the verification center may further have a distributed identity wallet for managing identity owner DID relationships, verifying verifiable credentials, and performing corresponding cryptographic operations; it may also further include an identity agent for implementing message exchange and corresponding protocol processing with external entities, and calling the identity wallet to complete encryption operations; it may also further include an identity controller for providing business logic such as credential issuance to the identity agent and managing the agent's behavior. The above specific structures can be set according to actual application requirements, and the embodiments of the present invention are not limited here.

[0050] S203. The credential center searches for the corresponding verifiable credential according to the credential verification request, generates a verifiable statement using the verifiable credential, and sends the verifiable statement to the verification center; the verifiable credential is generated by the credential issuing end using the business data and is stored by the credential center.

[0051] In the embodiment of the present invention, the credential center mainly realizes the centralized hosting (storage, verification, and revocation) of the internal credentials of the trusted network and the unified external retrieval service. Taking the credential center as a unit is conducive to establishing a verifiable credential network with self-expansion capabilities and network effects. Figure 3 , Figure 3A schematic diagram of a credential center provided in an embodiment of the present invention. The credential center is maintained by credential holders, who are usually centralized custodians of some publicly disclosable data (or conditionally disclosable data) (may be affiliated with the credential issuer), and are not the direct subjects of these credentials. The credential center generally has the ability to collect credentials and credibility, and supports data governance and improved data security in a cryptographic manner. It should be noted that the embodiment of the present invention does not limit the implementation form of the credential center, and reference may be made to the relevant technologies of verifiable credentials. Furthermore, in an embodiment of the present invention, the credential center may generate a verifiable presentation (Verifiable Presentation) from a verifiable credential, and send the presentation to a verification center, wherein the verifiable presentation may include one or more verifiable credentials. The embodiment of the present invention does not limit the generation and verification methods of the verifiable presentation, and reference may also be made to the relevant technologies of verifiable credentials.

[0052] Of course, it is understandable that different data-dependent terminals have different access rights to verifiable credentials, and the credential center should be set with a corresponding data sharing policy, and then when receiving a credential verification request, the verifiable credentials are provided to the verification center in a limited manner according to the policy. It should be noted that the embodiments of the present invention do not limit the specific data sharing policy, which can be set according to actual application requirements.

[0053] In a possible case, before the credential center searches for a corresponding verifiable credential according to the credential verification request, the following may also be included:

[0054] Step 11: When receiving the credential verification request, the credential center determines whether to respond to the credential verification request according to the preset data sharing policy; if so, proceed to step 12; if not, ignore the credential verification request.

[0055] Step 12: Enter the step of searching for the corresponding verifiable credential according to the credential verification request.

[0056] Furthermore, it is understandable that verifiable credentials should be issued by the credential issuing end. In order to standardize the credential format, the credential issuing end should generate verifiable credentials according to the preset credential template; in addition, the credential issuing end needs to provide its own public key to the outside world for the outside world to verify the verifiable credentials it issues. Obviously, the credential template and the credential issuing end public key are important data in the process of generating verifiable credentials, and should be properly kept and publicized so that all parties can use them for verification. In an embodiment of the present invention, the credential template and the credential issuing end public key can be stored in a verifiable data registry, where the verifiable data registry can be implemented based on a blockchain. The embodiment of the present invention does not limit the specific chain type. The selection of blockchain is related to data governance requirements. The verifiable data registry can be considered to be implemented based on a permissioned chain or a non-permissioned chain.

[0057] In a possible scenario, the credential center subsystem further includes a verifiable data registry, which includes a credential template and a public key of the credential issuing end. Before the data dependent end sends a data request to the verification center, it may also include:

[0058] Step 21: The credential issuing end obtains the credential template from the verifiable data registry, generates a verifiable credential using the credential template and business data, and sends the verifiable credential to the credential center;

[0059] Step 22: The credential center obtains the identity public key and credential template from the verifiable data registry, verifies the received verifiable credential using the identity public key and credential template, and saves the received verifiable credential after the verification is successful.

[0060] It should be noted that the verifiable credential should have a corresponding credential template. In other words, the credential center should use the credential template that the verifiable credential relies on when issuing it to verify the credential. The embodiment of the present invention does not limit the specific way in which the verifiable data registry stores the credential template and the public key. It can refer to the relevant technology of the blockchain and be set according to the actual application requirements. Of course, in order to facilitate the parties to perform anonymous credential zero-knowledge proof, the verifiable data registry can also further store the credential definition corresponding to the credential template.

[0061] Furthermore, the embodiments of the present invention do not limit the specific structure of the credential issuing end. For example, the credential issuing end may further have a distributed identity wallet (KMS wallet, Key Management System) for managing identity owner DID relationships, issuing verifiable credentials, and performing corresponding cryptographic operations; it may also further include an identity agent for implementing message exchange and corresponding protocol processing with external entities, and the encryption operation part is completed by the identity agent calling the wallet. It may also further include an identity controller for providing business logic such as credential issuance to the identity agent and managing the agent's behavior. Please refer to Figure 4 , Figure 4 This is a structural block diagram of a credential issuing terminal provided by an embodiment of the present invention. Of course, the above specific structures can be set according to actual application requirements, and the embodiment of the present invention does not limit this. Of course, the credential issuing terminal may also request other credential verification from the credential center in order to issue a credential, so the credential issuing terminal may also further have a credential verification component, which is responsible for providing the request and verification function of the verifiable credential based on the anonymous credential.

[0062] Furthermore, the embodiment of the present invention does not limit the specific structure of the credential center, which can also have the structure of a distributed identity wallet, identity proxy, and identity controller. Please refer to Figure 5 , Figure 5This is a structural block diagram of a credential center provided by an embodiment of the present invention, and its structure can also be set according to actual application requirements.

[0063] Furthermore, in order to facilitate communication among all parties in the credential center subsystem and ensure the communication protocol, each member of the credential center subsystem can set up a distributed identity agent that supports access to a distributed identity wallet, and the identity agent base implements machine communication security through a DID-based point-to-point PKI authentication mechanism, where PKI (Public Key Infrastructure) represents public key infrastructure, which is used to implement functions such as the generation, management, storage, distribution and revocation of keys and certificates based on the public key cryptography system.

[0064] In one possible scenario, the credential issuing end, the credential center, and the verification center are all equipped with distributed identity proxies that support access to distributed identity wallets. The credential issuing end and the credential center, and the credential center and the verification center communicate through the distributed identity proxies and a distributed identity-based point-to-point PKI authentication mechanism.

[0065] S204: The verification center verifies the verifiable statement and sends the verification result to the data-dependent end, so that the data-dependent end uses the verification result to perform business processing.

[0066] It should be noted that the embodiments of the present invention do not limit how the verification center verifies the verifiable statement, and reference may be made to the relevant technologies of verifiable credentials. Of course, the verifiable credentials are generally set with a valid state. To improve the verification efficiency, the verification center may query in advance whether the verifiable credentials related to the verifiable statement are valid, and then determine whether to perform subsequent verification operations based on the query results. To facilitate the query of the current validity of the credential, the credential issuing end should provide a corresponding verification mechanism, such as a credential cancellation list, which is used to record the currently expired verifiable credential information. In order to facilitate retrieval and verification by all parties, the list can also be updated in real time and published to the verifiable data registry.

[0067] In one possible scenario, the verifiable data registry also includes a credential revocation list, which is used to record the verifiable credential information revoked by the credential issuer. The verification center verifies the verifiable statement, including:

[0068] Step 31: The verification center uses the credential cancellation list to determine whether the verifiable credential corresponding to the verifiable statement is valid; if so, proceed to step 32; if not, ignore the verifiable statement.

[0069] Step 32: Verify the verifiable statement.

[0070] Furthermore, after obtaining the verification result, the verification center can send the result to the data dependent end so that the latter can perform relevant business operations. Of course, since the verification center and the data dependent end use the OIDC protocol for communication, the verification center should convert the verification result into the ID Token format so that the data dependent end can parse it.

[0071] In one possible scenario, sending the verification result to the data dependent end may include:

[0072] Step 41: The verification center converts the verification result into the ID Token format, and sends the verification result after the format conversion to the data dependent end.

[0073] It should be noted that the embodiment of the present invention does not limit the specific process of format conversion, which can be set according to actual application requirements.

[0074] Based on the above embodiments, the present invention first sets the data end as the credential issuing end, and deploys the credential issuing end and the data dependent end in the credential center subsystem and the open credential service subsystem respectively, which can effectively avoid direct data connection between the credential issuing end and the data dependent end, thereby avoiding security issues that may be caused by direct data connection; in addition, the credential issuing end does not directly share business data with the data dependent end, but converts the business data into a verifiable credential and shares it with the data dependent end through the verifiable credential. Specifically, when data sharing is required, the data dependent end will send a credential verification request to the credential center through the verification center in the credential center subsystem, and the credential center will generate a verifiable statement using the verifiable credential corresponding to the request, and send it to the verification center for verification. After verifying the verifiable statement, the verification center will return the verification result to the data dependent end so that it can perform business processing. In simple terms, the present invention can transform the data of the data party into a credential, so that the data sharing and use process is converted into a request and verification process for encrypted credentials; and the machine-readable and verifiable encrypted credentials can effectively solve the security and privacy protection issues in the current data circulation and use process, and can prevent data from being copied and then circulated, thereby helping to promote data openness and sharing.

[0075] The following is an introduction to a data sharing system and a computer-readable storage medium provided in an embodiment of the present invention. The data sharing system and the computer-readable storage medium described below and the data sharing method described above can be referenced to each other.

[0076] Please refer to Figure 1a , Figure 1aThe structural block diagram of the first data sharing system provided by the embodiment of the present invention, the system may include: the data sharing system includes a credential center subsystem 100 and an open credential verification service subsystem 200, the credential center subsystem 100 includes a credential issuing end 101, a credential center 102 and a verification center 103, the open credential verification service subsystem 200 includes a verification center 103 and a data dependent end 201, wherein:

[0077] The data dependent terminal 201 is used to send a data request to the verification center 103; receive and use the verification result returned by the verification center 103 to perform business processing.

[0078] The verification center 103 is used to convert the data request into a credential verification request and send the credential verification request to the credential center 102; verify the verifiable statement returned by the credential center 102, and send the verification result to the data dependent end 201;

[0079] The credential center 102 is used to find the corresponding verifiable credential according to the credential verification request, generate a verifiable statement using the verifiable credential, and send the verifiable statement to the verification center 103;

[0080] The credential issuing terminal 101 is used to generate a verifiable credential using business data and send it to the credential center 102 for storage.

[0081] Optionally, refer to Figure 1b , Figure 1b The structure diagram of the second data sharing system provided by the embodiment of the present invention is as follows. The credential center subsystem 100 also includes a verifiable data registry, which includes a credential template and an identity public key of the credential issuing terminal 101.

[0082] The credential issuing terminal 101 may also be used to obtain a credential template from a verifiable data registry, generate a verifiable credential using the credential template and business data, and send the verifiable credential to the credential center 102;

[0083] The credential center 102 may also be used to obtain an identity public key and a credential template from a verifiable data registry, verify the received verifiable credential using the identity public key and the credential template, and save the received verifiable credential after the verification is successful.

[0084] Optionally, the verifiable data registry further includes a credential cancellation list, which is used to record the verifiable credential information revoked by the credential issuing terminal 101, wherein:

[0085] The verification center 103 may also be used to use the credential cancellation list to determine whether the verifiable credential corresponding to the verifiable statement is valid; if so, the verifiable statement is verified.

[0086] Optionally, the verifiable data registry is implemented based on a permissioned chain or a permissionless chain.

[0087] Optionally, the credential center 102 may also be used to determine whether to respond to the credential verification request based on a preset data sharing policy when receiving the credential verification request; if so, enter the step of searching for a corresponding verifiable credential based on the credential verification request.

[0088] Optionally, the credential issuing end 101, the credential center 102 and the verification center 103 are all provided with a distributed identity agent that supports access to a distributed identity wallet, and the credential issuing end 101 and the credential center 102 and the credential center 102 and the verification center 103 communicate through the distributed identity agent and a distributed identity-based point-to-point PKI authentication mechanism.

[0089] Optionally, the verification center 103 and the data-relying end 201 communicate with each other via the TLS protocol.

[0090] Optionally, the verification center 103 may also be used to convert the verification result into an ID Token format, and send the verification result after format conversion to the data dependent end 201 .

[0091] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the data sharing method in any of the above embodiments are implemented.

[0092] Since the embodiments of the computer-readable storage medium part correspond to the embodiments of the data sharing method part, please refer to the description of the embodiments of the data sharing method part for the embodiments of the storage medium part, which will not be repeated here.

[0093] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0094] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0095] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0096] The above is a detailed introduction to a data sharing method, system and computer-readable storage medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A data sharing method, characterized in that: Applied to a data sharing system, the data sharing system includes a credential center subsystem and an open credential verification service subsystem, the credential center subsystem includes a credential issuing end, a credential center and a verification center, the open credential verification service subsystem includes the verification center and a data dependent end, the credential issuing end is a data end having business data, the method includes: The data dependent end sends a data request to the verification center; The verification center converts the data request into a credential verification request, and sends the credential verification request to the credential center; The credential center searches for a corresponding verifiable credential according to the credential verification request, generates a verifiable statement using the verifiable credential, and sends the verifiable statement to the verification center; the verifiable credential is generated by the credential issuing end using the business data and is stored by the credential center; The verification center verifies the verifiable statement and sends the verification result to the data-dependent end, so that the data-dependent end uses the verification result to perform business processing.

2. The data sharing method according to claim 1, characterized in that: The credential center subsystem further includes a verifiable data registry, which includes a credential template and the identity public key of the credential issuing end. Before the data dependent end sends a data request to the verification center, it also includes: The credential issuing end obtains a credential template from the verifiable data registry, generates a verifiable credential using the credential template and the business data, and sends the verifiable credential to the credential center; The credential center obtains the identity public key and the credential template from the verifiable data registry, verifies the received verifiable credential using the identity public key and the credential template, and saves the received verifiable credential after the verification is passed.

3. The data sharing method according to claim 2, characterized in that: The verifiable data registry further includes a credential cancellation list, which is used to record the verifiable credential information revoked by the credential issuing end. The verification center verifies the verifiable statement, including: The verification center uses the credential cancellation list to determine whether the verifiable credential corresponding to the verifiable statement is valid; If so, the verifiable statement is verified.

4. The data sharing method according to claim 2, characterized in that: The verifiable data registry is implemented based on a permissioned chain or a permissionless chain.

5. The data sharing method according to claim 1, characterized in that: Before the credential center searches for a corresponding verifiable credential according to the credential verification request, the method further includes: When receiving the credential verification request, the credential center determines whether to respond to the credential verification request according to a preset data sharing policy; If so, proceed to the step of searching for the corresponding verifiable credential according to the credential verification request.

6. The data sharing method according to claim 1, characterized in that: The certificate issuing end, the certificate center and the verification center are all provided with a distributed identity agent that supports access to a distributed identity wallet. The certificate issuing end and the certificate center, and the certificate center and the verification center communicate through the distributed identity agent and a distributed identity-based point-to-point PKI authentication mechanism.

7. The data sharing method according to claim 1, characterized in that: The verification center and the data dependent end communicate via the TLS protocol.

8. The data sharing method according to any one of claims 1 to 7, characterized in that: The sending of the verification result to the data dependent end includes: The verification center converts the verification result into an ID Token format, and sends the verification result after format conversion to the data dependent end.

9. A data sharing system, characterized in that: include: The data sharing system includes a credential center subsystem and an open credential verification service subsystem. The credential center subsystem includes a credential issuing end, a credential center and a verification center. The open credential verification service subsystem includes the verification center and a data dependent end. The credential issuing end is a data end with business data. The data dependent end is used to send a data request to the verification center; receive and use the verification result returned by the verification center to perform business processing; The verification center is used to convert the data request into a credential verification request and send the credential verification request to the credential center; verify the verifiable statement returned by the credential center, and send the verification result to the data dependent end; The credential center is used to search for a corresponding verifiable credential according to the credential verification request, generate a verifiable statement using the verifiable credential, and send the verifiable statement to the verification center; The credential issuing end is used to generate the verifiable credential using the business data and send it to the credential center for storage.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by a processor, the data sharing method according to any one of claims 1 to 8 is implemented.

Images