A secure data identification resolution method

Abstract

The present invention discloses a secure data identification and resolution method, which can effectively solve the shortcomings of the existing technology. It establishes an open logical identification system ODID on the basis of the existing digital coding system, shields the differences of the existing coding systems, realizes data intercommunication of each coding system, and solves the problem of information islands; introduces a logical digital code to shield the differences of users using multiple coding systems, and uses blockchain, distributed storage, cryptography and cache technology to achieve reliable and trustworthy rapid traceability, including the following steps: 1) users who share data use distributed block encryption to store the data to be shared on the premise that the data to be shared is reliable and complete; 2) shielding the differences of the existing digital identification systems, uniformly encoding the data to be shared, and distributing ODID codes; 3) users who use the shared data use ODID codes to quickly and conveniently obtain reliable shared data.

Description

Technical Field

[0001] The present invention relates to the fields of cyberspace security, Internet of Things technology, and more specifically, to a secure data identification parsing method. Background Art

[0002] Data identification and parsing methods use barcodes, QR codes, RFID tags, and other methods to assign unique identities to every physical or virtual object. These tags also carry relevant data, creating a new infrastructure for locating, connecting, and communicating between physical and virtual objects. Therefore, digital identification and parsing methods are also called "identity cards for the digital world."

[0003] However, existing digital identification and parsing methods have the following shortcomings:

[0004] 1. There are multiple digital systems and parsing methods, and these methods are incompatible with each other. This results in data identified by different methods being unable to communicate and parse each other, resulting in information "islands" between different methods.

[0005] 2. Existing methods lack the necessary consideration for the security of identified data, resulting in the possibility of tampering of identified data and low data feasibility;

[0006] 3. Existing identification and resolution methods use a serial approach, and data access latency depends on the geographic location of the user and server and the quality of link communication, which cannot ensure real-time data access needs. Summary of the Invention

[0007] The purpose of the present invention is to provide a secure data identification and resolution method, which establishes an open logical identification system ODID based on the existing digital coding system, shields the differences between the existing coding systems, realizes data intercommunication among various coding systems, and solves the problem of information islands.

[0008] The present invention is implemented by the following technical solution: A secure data identification parsing method includes the following steps:

[0009] 1) Users who share data use distributed block encryption to store the data to be shared, on the premise of ensuring that the data to be shared is reliable and complete;

[0010] 2) Shield the differences in existing digital identification systems, uniformly encode the data that needs to be shared, and distribute ODID codes;

[0011] 3) Users of shared data can use ODID codes to quickly and easily obtain reliable shared data.

[0012] To further implement the secure data identification resolution method of the present invention, the following configuration is particularly adopted: Step 1) includes the following steps:

[0013] 1.1) When a data sharing user needs to publish the data to be shared, he first calls the data publishing program to execute the block encryption module;

[0014] 1.2) Block encryption management module, calling the password management module to generate a key for data encryption (one-time pad);

[0015] 1.3) The block encryption management module divides the data into blocks and encrypts the blocks to generate grouped ciphertext;

[0016] 1.4) The data publishing program calls the data storage module to store the data in a distributed file system (a distributed file system, also known as a distributed storage system, can be composed entirely of enterprise servers or a combination of enterprise and supervisory servers (to prevent data publishers from destroying data)) and obtain a CID list that shows the relationship between data blocks and storage locations;

[0017] 1.5) The data publishing program generates data identifiers based on the coding system adopted by the user, and packages the generated data identifiers, CID list, metadata (for obtaining relevant information about the data), and data summary (for ensuring data integrity) into source data index information;

[0018] 1.6) The data publishing program stores the source data index information in the source data index information channel on the industry alliance chain, and users ensure that the source data index information cannot be tampered with;

[0019] 1.7) The data publishing program stores the data identifier, blockchain storage information of the source data index information (block serial number and block index), and the data encryption key (file encryption key) on the enterprise data identification resolution engine data.

[0020] To further implement the secure data identification parsing method of the present invention, the following configuration is particularly adopted: the specific steps of step 2) are:

[0021] 2.1) Users who intend to publish data must first register with the secondary data identification center and the industry alliance chain, confirm the data identification system (such as GS1, OID, CIID, Ecode, Handle, etc.) and data identification prefix (corresponding to the data identification of the country, region and institution, etc.) they use at the secondary data identification center, and obtain the public and private key pairs for identity authentication on the industry alliance chain;

[0022] 2.2) The data publisher identifies the generated data according to the coding rules of the secondary data identification system it registered, generates {data identification, metadata, data URI, data summary}, and saves it in the data identification library where the data producer is located in JSON format;

[0023] 2.3) The data publisher submits its data signature and data identifier to the industry alliance chain, generates an ODID identifier based on the block serial number where the user data is stored and the data identifier name used for the index and identifier within the block, and publishes the generated ODID identifier to the user in some encoding method (such as a QR code, etc.).

[0024] In order to further better implement the secure data identification resolution method described in the present invention, the following setting method is particularly adopted: step 2.3) also includes sending the generated ODID identifier, the metadata corresponding to the source data and the digital signature issued by the data publisher to the data supervisor for filing.

[0025] In order to further better implement the secure data identification resolution method described in the present invention, the following setting method is particularly adopted: the ODID code consists of three fields: the first field is the data identification name; the second field stores the block serial number of the user data identification code storage blockchain (that is, the block number of the blockchain where the data is stored, which can realize fast query of data); the third field stores the index of the data identifier in the block storage location (also known as the offset address, used to realize data positioning).

[0026] In order to further better implement the secure data identification and parsing method described in the present invention, the following setting method is particularly adopted: the data identification and digital signature actually used by the data are determined through the block serial number and the block index.

[0027] In order to further better implement the secure data identification resolution method described in the present invention, the following setting method is particularly adopted: the ODID identifier is published to the user in a certain encoding method, specifically: for all users, the ODID identifier is encoded into a QR code and published to all users, and users can obtain data by parsing the QR code.

[0028] To further implement the secure data identification resolution method of the present invention, the following configuration is particularly adopted: Step 3) includes the following steps:

[0029] 3.1) The user uses the reading module to obtain the ODID code of the data and extract the data identifier from the ODID code of the data;

[0030] 3.2) The data identifier resolution program submits the data identifier to the national node of the corresponding coding system. The national node resolves the data identifier based on the obtained data identifier to obtain the address of the secondary node server to which the data identifier belongs, and returns the secondary node server address to the data identifier resolution program;

[0031] 3.3) The data identifier resolution program sends the data identifier to the secondary node server based on the returned secondary node server address. The secondary node server resolves the data identifier based on the received data identifier to obtain the enterprise node resolution server address for the data identifier and returns it to the secondary node server;

[0032] 3.4) The data identifier resolution program sends the data identifier to the enterprise node resolution server and obtains the URI of the data;

[0033] 3.5) The data identifier resolution program initiates a request to the data URI to obtain the data.

[0034] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0035] The present invention introduces a logical digital code to shield the differences among users using multiple coding systems, and uses blockchain, distributed storage, cryptography and caching technology to achieve reliable and trustworthy rapid traceability.

[0036] The present invention introduces the industry alliance chain into the logical identification system ODID, and constructs an association mechanism from off-chain data to on-chain data identification, overcoming the untrustworthiness problem caused by direct access to data in the existing identification system and easy tampering.

[0037] The present invention introduces block segmentation, distributed storage and encryption technology into the logical identification system ODID, encrypts shared data in blocks and stores them in a distributed storage system. On the basis of ensuring data privacy and non-repudiation of publishing behavior, it overcomes the defects of serial transmission in existing methods and greatly improves the data access speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is the ODID logical digital identification system diagram.

[0039] Figure 2 This is a schematic diagram of ODID logical coding.

[0040] Figure 3 A logical flow chart for users to access data using ODID.

[0041] Figure 4 ODID data parsing flow chart.

[0042] Figure 5 This is a diagram of the ODID off-chain and on-chain data association mechanism.

[0043] Figure 6 Schematic diagram of distributed data storage for ODID data.

[0044] Figure 7 Flowchart for ODID data publishing.

[0045] Figure 8 A complete analysis flowchart of the ODID digital identification system. DETAILED DESCRIPTION

[0046] The present invention will be further described in detail below with reference to the examples, but the embodiments of the present invention are not limited thereto.

[0047] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the invention for which protection is sought, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0048] Glossary:

[0049] ODID: Open Data Identifier;

[0050] CID list: disk identification number;

[0051] Data publisher: A user who shares data using the ODID identification system.

[0052] Example 1:

[0053] The present invention designs a secure data identification parsing method, comprising the following steps:

[0054] 1) Users who share data use distributed block encryption to store the data to be shared, on the premise of ensuring that the data to be shared is reliable and complete;

[0055] 2) Shield the differences in existing digital identification systems, uniformly encode the data that needs to be shared, and distribute ODID codes;

[0056] 3) Users of shared data can use ODID codes to quickly and easily obtain reliable shared data.

[0057] Example 2:

[0058] This embodiment is a further optimization based on the above embodiment. The similarities with the above technical solutions are not repeated here. In order to better implement the secure data identification resolution method of the present invention, the following setting is particularly adopted: Step 1) includes the following steps:

[0059] 1.1) When a data sharing user needs to publish the data to be shared, he first calls the data publishing program to execute the block encryption module;

[0060] 1.2) Block encryption management module, calling the password management module to generate a key for data encryption (one-time pad);

[0061] 1.3) The block encryption management module divides the data into blocks and encrypts the blocks to generate grouped ciphertext;

[0062] 1.4) The data publishing program calls the data storage module to store the data in a distributed file system (a distributed file system, also known as a distributed storage system, can be composed entirely of enterprise servers or a combination of enterprise and supervisory servers (to prevent data publishers from destroying data)) and obtain a CID list that shows the relationship between data blocks and storage locations;

[0063] 1.5) The data publishing program generates data identifiers based on the coding system adopted by the user, and packages the generated data identifiers, CID list, metadata (for obtaining relevant information about the data), and data summary (for ensuring data integrity) into source data index information;

[0064] 1.6) The data publishing program stores the source data index information in the source data index information channel on the industry alliance chain, and users ensure that the source data index information cannot be tampered with;

[0065] 1.7) The data publishing program stores the data identifier, blockchain storage information of the source data index information (block serial number and block index), and the data encryption key (file encryption key) on the enterprise data identification resolution engine data.

[0066] Example 3:

[0067] This embodiment is a further optimization based on any of the above embodiments. The similarities with the above technical solutions are not repeated here. In order to better implement the secure data identification resolution method of the present invention, the following setting is particularly adopted: the specific steps of step 2) are:

[0068] 2.1) Users who intend to publish data must first register with the secondary data identification center and the industry alliance chain, confirm the data identification system (such as GS1, OID, CIID, Ecode, Handle, etc.) and data identification prefix (corresponding to the data identification of the country, region and institution, etc.) they use at the secondary data identification center, and obtain the public and private key pairs for identity authentication on the industry alliance chain;

[0069] 2.2) The data publisher identifies the generated data according to the coding rules of the secondary data identification system it registered, generates {data identification, metadata, data URI, data summary}, and saves it in the data identification library where the data producer is located in JSON format;

[0070] 2.3) The data publisher submits its data signature and data identifier to the industry alliance chain, generates an ODID identifier based on the block serial number where the user data is stored and the data identifier name used for the index and identifier within the block, and publishes the generated ODID identifier to the user in a certain encoding method (such as a QR code, etc.). Preferably, the ODID identifier is published to the user in a certain encoding method, specifically: for all users, the ODID identifier is encoded into a QR code and published to all users. Users can obtain data by parsing the QR code.

[0071] The step 2.3) also includes sending the generated ODID identifier, metadata corresponding to the source data, and the digital signature issued by the data publisher to the data supervisor for filing.

[0072] Example 4:

[0073] This embodiment is further optimized on the basis of any of the above embodiments, and the similarities with the above technical solutions are not repeated here. In order to better realize the secure data identification resolution method described in the present invention, the following setting method is particularly adopted: the ODID code consists of three fields: the first field is the data identification name; the second field stores the block serial number of the blockchain where the user data identification code is stored (that is, the block number of the blockchain where the data is stored, which can realize fast query of data); the third field stores the index of the data identifier in the block storage location (also called offset address, used to realize data positioning).

[0074] Example 5:

[0075] This embodiment is further optimized on the basis of any of the above embodiments, and the similarities with the above technical solutions are not repeated here. In order to better realize the secure data identification and parsing method described in the present invention, the following setting method is particularly adopted: the data identification and digital signature actually used by the data are determined by the block serial number and the block index.

[0076] Example 6:

[0077] This embodiment is a further optimization based on any of the above embodiments. The similarities with the above technical solutions are not repeated here. In order to better implement the secure data identification resolution method of the present invention, the following configuration is particularly adopted:

[0078] The step 3) comprises the following steps:

[0079] 3.1) The user uses a reading module to obtain the ODID code of the data and extract the data identifier from the ODID code of the data; preferably, the user uses a scanner to scan the QR code to obtain the data identifier and extract the data identifier;

[0080] 3.2) The data identifier resolution program submits the data identifier to the national node of the corresponding coding system. The national node resolves the data identifier based on the obtained data identifier to obtain the address of the secondary node server to which the data identifier belongs, and returns the secondary node server address to the data identifier resolution program;

[0081] 3.3) The data identifier resolution program sends the data identifier to the secondary node server based on the returned secondary node server address. The secondary node server resolves the data identifier based on the received data identifier to obtain the enterprise node resolution server address for the data identifier and returns it to the secondary node server;

[0082] 3.4) The data identifier resolution program sends the data identifier to the enterprise node resolution server and obtains the URI of the data;

[0083] 3.5) The data identifier resolution program initiates a request to the data URI to obtain the data.

[0084] Example 7:

[0085] like Figure 1 As shown in the figure, ODID is a logical coding and parsing method built on the existing coding system. ODID coding consists of three fields (such as Figure 2As shown): the first field is the data identification name; the second field stores the block serial number of the blockchain where the user data identification code is stored (that is, the block number of the blockchain where the data is stored, which can realize fast query of the data); the third field stores the offset address of the data identification in the block storage location. The data identification and digital signature actually used by the data can be determined by the block serial number and the index within the block. Different from the existing data coding system, the data identification code released to the end user is the ODID code proposed by the present invention. After the user scanning program scans the ODID code, it can accurately obtain the coding system name and specific data identification code of the data, and then can locate the correct data identification resolution engine according to the coding system name. Then, the digital identification code is used to obtain shared data, so that users can communicate data under different data coding systems.

[0086] like Figure 3 As shown in the figure, there are two ways to publish data using ODID encoding: the first publishing path is to encode the ODID identifier into a QR code and publish it to all users. Users can obtain the data by parsing the QR code. The second publishing path is to send the ODID identifier, the metadata corresponding to the source data, and the digital signature issued by the data publisher to the data regulator for filing. In addition to digitally filing the published ODID identifier, the data regulator also uses this data to provide ODID identifier query services. The regulator uses the data in the metadata to construct search conditions and provide ODID identifier retrieval when the user data identifier is missing.

[0087] like Figure 4 As shown, the method proposed by ODID will not change the existing workflow of digital identification resolution. It still uses the existing digital resolution service to obtain shared data by scanning the ODID identifier in the published QR code or storing the ODID identifier in the RFID.

[0088] like Figure 5 As shown, in order to overcome the unreliability problem caused by data tampering in the existing data identification system, the present invention introduces an industry alliance chain in ODID, constructs an association mechanism from off-chain data to on-chain data identification, and overcomes the problem of unreliable data in the existing system.

[0089] In order to improve the speed and reliability of data access, the present invention introduces block, distributed storage and encryption technology into the ODID system, encrypts the shared data into blocks and stores them in a distributed storage system. On the basis of ensuring data privacy and non-repudiation of publishing behavior, it overcomes the shortcomings of the existing method of serial transmission and greatly improves the access speed of data. Users who share data use distributed block encryption to store the data to be shared. The specific workflow is as follows: Figure 6 As shown:

[0090] Step 1: When a user publishes data to be shared, he calls the data publishing program, which first executes the block encryption module;

[0091] Step 2: The block encryption management module calls the password management module to generate a key (one-time pad) for data encryption;

[0092] Step 3: Then, the block encryption management module divides the data into blocks and encrypts the blocks to produce grouped ciphertext;

[0093] Step 4: Next, the data publishing program calls the data storage module to store the data in a distributed file system (a distributed file system, also known as a distributed storage system, can be composed entirely of enterprise servers or jointly by enterprise and supervisory servers (to prevent data publishers from destroying time)) and obtain a CID list of the relationship between data blocks and storage locations;

[0094] Step 5: The data publishing program generates data identifiers based on the coding system adopted by the user, and packages the generated data identifiers, CID list, metadata (used to obtain relevant information about the data), and data summary (used to ensure data integrity) into source data index information;

[0095] Step 6: The data publishing program stores the source data index information in the source data index information channel on the industry alliance chain, and the user ensures that the index information cannot be tampered with;

[0096] Step 7: Finally, the data publishing program stores the data identification, blockchain storage information of the source data index information (block serial number and block index) and the data encryption key (file encryption key) on the enterprise data identification resolution engine data.

[0097] In the above process, block encryption is used for the data flow to ensure data privacy, and block and distributed storage are used for data. On the basis of ensuring reliable data storage, the shared network is combined to achieve efficient data transmission. Distributed storage and index information are uploaded to the chain to ensure that the data cannot be tampered with, thereby improving data security.

[0098] Figure 7 The ODID data publishing process (i.e. generating ODID codes for stored data and distributing them) is shown. Data publishers are industry users who need to complete the secondary node and consortium chain secondary registration before publishing data. Data publishing involves three steps:

[0099] Step 1: The user who intends to publish data must first register with the secondary data identification center and the industry alliance chain respectively, and confirm the data identification system (such as GS1, OID, CIID, Ecode, Handle, etc.) and data identification prefix (corresponding to the data identification of the country, region and institution, etc.) used by the secondary data identification center, and obtain the public and private key pairs for identity authentication on the industry alliance chain;

[0100] Step 2: The data publisher identifies the generated data according to the coding rules of the secondary data identification system it registered, generates {data identification, metadata, data URI, data summary}, and saves it in the data identification library where the data producer is located in JSON format;

[0101] Step 3: The data publisher submits its data signature and data identifier to the industry alliance chain, generates an ODID identifier based on the block serial number where the user data is stored and the data identifier name used for the index and identifier in the block, and publishes the generated ODID identifier to the user in a certain encoding method (such as a QR code, etc.). Preferably, the ODID identifier is published to the user in a certain encoding method, specifically: for all users, the ODID identifier is encoded into a QR code and published to all users. Users can obtain data by parsing the QR code.

[0102] The Step 3 also includes sending the generated ODID identifier, metadata corresponding to the source data, and the digital signature issued by the data publisher to the data supervisor for filing.

[0103] Figure 8 The complete resolution process of the ODID digital identification system is demonstrated (i.e., users of shared data use ODID encoding to obtain reliable data). The specific process is as follows:

[0104] Step 1 (parse the QR code and obtain the identifier):

[0105] The user uses a scanner to scan the QR code to obtain the data identifier and extract the data identifier;

[0106] Step 2 (obtain the secondary node server address through the root node):

[0107] The data identifier resolution program submits the data identifier to the national node of the corresponding coding system. The national node resolves the data identifier based on the obtained data identifier to obtain the address of the secondary node server to which the identifier belongs and returns the address to the data identifier resolution program.

[0108] Step 3 (obtain the enterprise server address through the secondary node):

[0109] The data identifier resolution program sends the data identifier to the secondary node server according to the returned secondary node server address. The secondary node server resolves the enterprise node resolution server address of the data identifier according to the received data identifier and returns it to the secondary node server;

[0110] Step 4 (obtain data URI through enterprise node):

[0111] The data identifier resolution program sends the data identifier to the enterprise node resolution server and obtains the URI of the data;

[0112] Step 5 (get data through URI):

[0113] The data identifier resolution program initiates a request to the data URI to obtain the data.

[0114] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the scope of protection of the present invention.

Claims

1. A secure data identification resolution method, characterized by: The steps include: 1) Users who share data use distributed block encryption to store the data to be shared, ensuring that the data to be shared is reliable and complete; 2) Shield the differences in existing digital identification systems, uniformly encode the data that needs to be shared, and distribute ODID codes; the specific steps are: 2.1) Users who intend to publish data must first register with the secondary data identification center and the industry alliance chain, confirm the data identification system and data identification prefix they will use with the secondary data identification center, and obtain the public and private key pairs for identity authentication on the industry alliance chain; 2.2) The data publisher identifies the generated data according to the coding rules of the secondary data identification system it has registered, generates {data identification, metadata, data URI, data summary}, and saves it in the data identification library where the data producer is located in JSON format; 2.3) The data publisher submits its data signature and data identifier to the industry alliance chain, generates an ODID based on the block serial number where the user data is stored and the data identifier name used for the index and identifier within the block, and publishes the generated ODID to the user in a certain encoding method; 3) Users of shared data can use ODID codes to quickly and easily obtain reliable shared data; The ODID code consists of three fields: the first field is the data identification name; the second field stores the block serial number of the user data identification code storage blockchain; The third field stores the index within the block where the data is stored.

2. A secure data identification resolution method according to claim 1, characterized in that: The step 1) includes the following steps: 1.1) When a data sharing user wants to publish data to be shared, he first calls the data publishing program to execute the block encryption module; 1.2) Block encryption management module, calling the password management module to generate a key for data encryption; 1.3) The block encryption management module divides the data into blocks and encrypts the blocks to generate grouped ciphertext; 1.4) The data publishing program calls the data storage module to store the data in the distributed file system and obtains a CID list that shows the relationship between the data blocks and the storage locations; 1.5) The data publishing program generates data identifiers based on the coding system adopted by the user, and packages the generated data identifiers, CID lists, metadata, and data summaries into source data index information; 1.6) The data publishing program stores the source data index information in the source data index information channel on the industry alliance chain, and users ensure that the source data index information cannot be tampered with; 1.7) The data publishing program stores the blockchain storage information of the data identifier, source data index information, and the key for data encryption on the enterprise data identifier resolution engine data.

3. A secure data identification resolution method according to claim 1, characterized in that: The step 2.3) further includes sending the generated ODID identifier, metadata corresponding to the source data, and the digital signature issued by the data publisher to the data supervisor for filing.

4. A secure data identification resolution method according to claim 1, characterized in that: The data identification and digital signature actually used by the data are determined through the block serial number and the block index.

5. A secure data identification resolution method according to claim 1, characterized in that: The ODID identifier is issued to users in a certain encoding manner. Specifically, for all users, the ODID identifier is encoded into a QR code and issued to all users.

6. A secure data identification resolution method according to claim 1, 2, 3, 4, or 5, characterized in that: The step 3) includes the following steps: 3.1) The user uses the reading module to obtain the ODID code of the data and extract the data identifier from the ODID code of the data; 3.2) The data identifier resolution program submits the data identifier to the national node of the corresponding coding system. The national node resolves the data identifier based on the obtained data identifier to obtain the address of the secondary node server to which the data identifier belongs, and returns the secondary node server address to the data identifier resolution program; 3.3) The data identifier resolution program sends the data identifier to the secondary node server based on the returned secondary node server address. The secondary node server resolves the data identifier based on the received data identifier to obtain the enterprise node resolution server address for the data identifier and returns it to the secondary node server; 3.4) The data identifier resolution program sends the data identifier to the enterprise node resolution server and obtains the URI of the data; 3.5) The data identifier resolution program initiates a request to the data URI to obtain the data.

Images