A data illegal propagation accountability method and device based on time-varying identity watermark

Abstract

The application relates to the technical field of user identity privacy protection, and discloses a data illegal propagation accountability method and device based on a time-varying identity watermark. The method generates a time-varying identity TDID and a dynamic verifiable expression DVP of a user based on a timestamp, prevents malicious users from performing privacy information association analysis on the user by collecting a large amount of distributed identity verifiable expression information VP, embeds the signature of the TDID and the request access timestamp as a watermark into an owner data file, and stores the TDID and a DID identifier in a chain. When the authorized shared data is secondarily non-authorized to be propagated or accessed, the file watermark is extracted, an accountability smart contract is called, the non-authorized data propagator can be accurately located, and fast accountability is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of user identity privacy protection, and in particular to a data illegal propagation accountability method and device based on time-varying identity watermarking. BACKGROUND

[0002] In today's big data era, a large amount of data will be generated in people's daily life. The data are closed and not interconnected, leading to a serious "data island" problem. Only safe and orderly data flow sharing can break the data island. The prerequisite for safe and orderly data flow sharing is to verify and confirm the identity of data owners and data accessers, and then to control access to data before and after authorization.

[0003] At present, most identity authentication systems adopt a centralized architecture, which has the problems of authentication efficiency bottleneck and user identity privacy leakage. In order to solve the above problems, in recent years, distributed identity (Decentralized Identity, DID) has gradually become a research and application hotspot, especially the distributed digital identity under the W3C standard is most widely used. This standard mainly uses DID identification and verifiable credentials (Verifiable Credential, VC) based on blockchain technology to realize identity authentication under the condition of minimizing privacy exposure. Among them, DID identification is a unique string in a specific format, which is used to identify the unique identity of a user. VC is a unique credential containing DID identification and user information, etc. signed and issued by a trusted center. In order to protect user privacy to the greatest extent when verifying user identity, the user generates a verifiable presentation (Verifiable Presentation, VP) containing the user's DID identification and the required disclosure attributes. This method has the risk of identity and other key privacy leakage. Each time the VP is verified, it contains the user's unique DID identification, and each time the privacy attribute is disclosed. Malicious attackers can collect a large number of VP of each verification of the user, analyze and obtain the user's DID identification, and infer the user's real identity, which is difficult to achieve the effect of protecting user privacy to the greatest extent designed by the distributed identity.

[0004] In terms of data access control, the commonly used access control methods at present include self-access control, role-based access control and attribute-based encryption access control, etc. These methods mainly judge whether the requester has access rights according to the pre-set access control strategy. These methods are all through the judgment before authorization to control the safe access of data. However, due to the characteristics of data being easy to copy, the authorized data may be illegally copied and illegally propagated. Some scholars have proposed to extend the access control method to deal with it, but there is still a lack of effective solution. SUMMARY

[0005] Aiming at the problems of user privacy information association analysis and the difficult-to-control and traceable problems of authorized data propagation and access in the distributed identity authentication process under the W3C standard, in order to strengthen the privacy protection during user identity authentication, the application proposes a data illegal propagation traceability method and device based on time-varying identity watermark, the method generates a time-varying identity (TDID) of the user based on the timestamp, and embeds the signature of the TDID and the request access timestamp as a watermark into the data file, and realizes accurate traceability to the illegal data abuser based on the traceability smart contract.

[0006] In order to achieve the above purpose, the application adopts the following technical solutions:

[0007] The application proposes a data illegal propagation traceability method based on time-varying identity watermark, which includes:

[0008] Distributed identity authentication for preventing privacy association analysis:

[0009] The distributed identity authentication method in the W3C standard is improved. The data visitor performs a hash calculation on the user unique distributed identity DID identifier and the verification timestamp TimeVer to obtain a time-varying identity TDID, uses the TDID to replace the DID identifier in the verifiable presentation VP, generates a dynamic verifiable presentation DVP, and sends the DVP to the data owner, and at the same time, the TDID of the data visitor is used as the key and the DID identifier is used as the value on the blockchain, and the dynamic identity of the data visitor is verified through the distributed identity authentication smart contract based on the TDID and the Merkle path verification;

[0010] Authorized data illegal propagation traceability based on time-varying watermark:

[0011] Before the data owner shares the data file to the data visitor, the time-varying watermark information of the visitor is added to the shared file copy, and the related key information is recorded on the chain, when the unauthorized propagation of the shared file occurs, the traceability smart contract is used for traceability.

[0012] Further, it further includes:

[0013] The user registers a distributed digital identity with the trusted center and obtains a user identity certificate of the user, and the user identity certificate includes a user unique distributed identity DID identifier.

[0014] Further, the distributed identity authentication for preventing privacy association analysis specifically includes:

[0015] The data owner proposes an identity authentication application containing a verification timestamp TimeVer to the data visitor;

[0016] The data visitor obtains the DID identifier by using the user identity credential, and generates TDID=H(TimeVer||DID) by using the DID identifier and TimeVer, wherein H() represents a hash function; then the visitor generates a DVP containing TDID and a Merkle verification path, and sends the DVP to the data owner; the data visitor stores the mapping of TDID and the DID identifier on the blockchain, so that the trusted center can access and call the accountability smart contract to perform accountability, and the DVP is stored on the blockchain.

[0017] Further, the authorization data illegal propagation accountability based on the time-varying watermark specifically includes:

[0018] When the visitor applies to access a certain data file of the data owner, the data owner copies the original data file to obtain a file copy, and embeds the signature of the TDID of the visitor and the request access timestamp TimeReq as a watermark into the file copy, sends the file copy with the watermark to the visitor, and stores the watermark information on the blockchain;

[0019] If it is found that the data is in the hands of other unauthorized users other than the visitor, the watermark in the shared data file copy is extracted, the corresponding DID identifier is obtained by using the TDID as a key through the accountability smart contract called by the trusted center, and the illegal propagator is located and held accountable.

[0020] Another aspect of the application also provides a data illegal propagation accountability device based on time-varying identity watermark, characterized by comprising:

[0021] The distributed identity verification module is used for distributed identity verification for preventing privacy association analysis.

[0022] The data visitor performs hash calculation on the unique distributed identity DID identifier and the verification timestamp TimeVer to obtain a time-varying identity TDID, generates a dynamic verifiable expression DVP based on the TDID, and sends the DVP to the data owner; meanwhile, the TDID of the data visitor is stored on the blockchain as a key, and the DID identifier is stored as a value, and the dynamic identity of the data visitor is verified through the distributed identity verification smart contract based on the TDID and the Merkle path verification.

[0023] The illegal propagation accountability module is used for authorization data illegal propagation accountability based on the time-varying watermark.

[0024] Before the data owner shares the data file to the data visitor, the time-varying watermark information of the visitor is added to the shared file copy, and the related key information is recorded on the chain; when the shared file is illegally propagated, the accountability smart contract is used for accountability.

[0025] Further, the device further comprises:

[0026] A distributed identity generation module is configured to register a distributed digital identity of a user to a trusted center and obtain a user identity credential of the user, wherein the user identity credential comprises a unique distributed identity DID of the user.

[0027] Further, the distributed identity authentication module is specifically configured to:

[0028] The data owner proposes an identity authentication application containing a verification timestamp TimeVer to the data accesser;

[0029] The data accesser obtains the DID identifier through the user identity credential of the data accesser, and generates TDID = H(TimeVer||DID) by mixing the DID identifier with the TimeVer, wherein H() represents a mixing function; then the accesser generates a DVP containing the TDID and a Merkle verification path, and sends the DVP to the data owner; the data accesser stores the mapping of the TDID and the DID identifier on a blockchain, so as to enable the trusted center to access and invoke a liability smart contract to perform liability, and meanwhile, the DVP is stored on the blockchain.

[0030] Further, the illegal propagation liability module is specifically configured to:

[0031] When the accesser applies to access a certain data file of the data owner, the data owner copies out a file copy of the original data file, and embeds a signature of the TDID of the accesser and a request access timestamp TimeReq as a watermark into the file copy, and sends the file copy with the watermark to the accesser, and meanwhile, stores the watermark information on the blockchain;

[0032] If it is found that the data appears in the hands of other unauthorized users other than the accesser, the watermark in the shared data file copy is extracted, the DID identifier corresponding to the TDID is obtained as a key by invoking the liability smart contract of the trusted center, and the illegal propagator is located and held liable.

[0033] Compared with the prior art, the present application has the beneficial effects of:

[0034] 1. The user time-varying identity TDID based on the timestamp and the dynamic verifiable expression DVP of the user are generated by mixing the user identity verification timestamp TimeVer and the DID identifier, so as to solve the problem that the verifier analyzes the user privacy by collecting a large number of verifiable expressions VP.

[0035] 2. The data owner's signature of the shared file visitor's TDID and access timestamp (TimeReq) is embedded as a watermark into a copy of the shared data file. The data owner then sends this watermarked copy to authorized visitors. When unauthorized sharing of data occurs, the data owner can notify a trusted center (acting as a regulatory body) to extract the watermark information from the data file copy. The trusted center can then invoke an accountability verification smart contract to quickly locate the illegal disseminator and conduct precise accountability. Attached Figure Description

[0036] Figure 1 This is a schematic diagram of the distributed identity generation process according to an embodiment of the present invention;

[0037] Figure 2 This is an example diagram of the UMT embodiment of the present invention;

[0038] Figure 3 This is a schematic diagram of the distributed authentication process according to an embodiment of the present invention;

[0039] Figure 4 This is an example diagram of the Merkle verification path in an embodiment of the present invention;

[0040] Figure 5 This is a flowchart illustrating the overall process of distributed identity generation and verification in an embodiment of the present invention.

[0041] Figure 6 This is a schematic diagram of the watermark embedding process according to an embodiment of the present invention;

[0042] Figure 7 This is a schematic diagram illustrating the process for holding individuals accountable for illegal dissemination in an embodiment of the present invention.

[0043] Figure 8 This is a flowchart illustrating the overall process for holding individuals accountable for illegal dissemination in an embodiment of the present invention. Detailed Implementation

[0044] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments:

[0045] A method for holding individuals accountable for the illegal dissemination of data based on time-varying identity watermarking includes:

[0046] Distributed authentication that prevents privacy-related analytics:

[0047] Improvement is made to the distributed authentication method in the W3C standard. A data visitor performs a hash calculation on a user's unique distributed identity DID and a verification timestamp TimeVer to obtain a time-varying identity TDID, replaces the DID in the verifiable presentation VP with the TDID, generates a dynamic verifiable presentation DVP, and sends the DVP to a data owner. Meanwhile, the data visitor stores its TDID as a key and the DID as a value on a blockchain, and verifies the dynamic identity of the data visitor through a distributed identity authentication smart contract based on the TDID and a Merkle path.

[0048] Time-varying watermark-based authorized data illegal propagation accountability:

[0049] Before a data owner shares a data file with a data visitor, the visitor's time-varying watermark information is added to a shared file copy, and relevant key information is recorded on a chain. When unauthorized propagation of the shared file occurs, a pursuit smart contract is used for accountability.

[0050] Specifically, there are a trusted center T, a data visitor P, and a data owner V. The public and private key pair of the trusted center is {PK T , SK T}, which generates a distributed identity and a verification credential VC for all users, and serves as a regulatory unit to call a pursuit smart contract to hold accountable users who illegally propagate shared data. The public and private key pair of the data owner V is {PK V , SK V}.

[0051] Further, it also includes distributed identity generation:

[0052] A user registers a distributed digital identity with the trusted center, and the flowchart is as shown in Figure 1 . The specific steps are as follows:

[0053] Step 11: The user generates its own distributed identity identifier DID and sends it to the trusted center together with other attribute information such as nationality, birthday, name, and address, and records A = {nationality, birthday, name, address}.

[0054] Step 12: After the trusted center verifies the user information, it generates an identity information hash tree UMT according to the identity attributes, as shown in Figure 2 . The trusted center signs the root UMT_Root of the UMT with the private key SK T , that is, SK T (UMT_Root), and signs SK T (UMT_Root), the user's DID identifier, and the data visitor's identity attribute information A to generate the user's identity credential VC = SK T(DID||A||SK T (UMT_Root)),and sends to the user.

[0055] Step 13: After receiving the VC, the user verifies it with the trusted center public key, and saves the identity certificate VC in the local after verification.

[0056] The distributed identity verification process is shown in Figure 3 , and the specific steps are as follows:

[0057] Step 21: The data owner V proposes an identity verification application containing a verification timestamp TimeVer to the data accesser P.

[0058] Step 22: The data accesser P obtains the DID identity through its own VC, and generates TDID = H(TimeVer||DID) by hashing the DID identity and TimeVer, where H() represents the hash function. Then the accesser P generates a DVP containing TDID, Merkle verification path and SK T (UMT_Root), and sends it to the owner V. The Merkle verification path is shown in Figure 4 . The data accesser P stores the mapping of TDID and DID identity on the blockchain for the trusted center to access and call the accountability smart contract for accountability. At the same time, the DVP is stored on the blockchain. Among them, the accountability smart contract can only be called by the trusted center.

[0059] Step 23: In order to prevent replay attacks, after receiving the DVP of the data accesser P, the data owner V first inputs TimeVer into the verification smart contract to verify the consistency of H(TimeVer||DID) generated by the verification smart contract and TDID in the DVP. In order to prevent the accesser P from generating UMT, it is also necessary to verify whether SK T (UMT_Root) is signed by the trusted center. After verification, the root is generated through the Merkle path, and it is verified whether UMT_Root is consistent with the root generated by itself. Consistent means verification passed.

[0060] The overall process of distributed identity verification is shown in Figure 5 .

[0061] Further, the data illegal propagation accountability method based on time-varying identity watermark specifically includes:

[0062] (1) Watermark embedding

[0063] The watermark embedding process is shown in Figure 6 , and the specific steps are as follows:

[0064] Step31: After the identity and access permission of the data accesser P are determined by the data owner V, the signature of the TDID and the access request timestamp TimeReq of the accesser P, denoted as SK V (TDID||TimeReq), is embedded into the data file copy as watermark information, and the data file copy is sent to the accesser P.

[0065] Step32: The data owner V sends SK V (TDID||TimeReq) to the blockchain.

[0066] (2) Illegal propagation accountability

[0067] When the data owner V finds that the shared data file copy is used by other unauthorized users except the data accesser P, it is determined that the data file copy is illegally propagated and shared. By extracting the watermark information in the leaked file copy, the accountability smart contract is called to accurately hold the leaker accountable, and the flowchart is as shown in Figure 7 , and the specific steps are as follows.

[0068] Step41: The data owner V extracts the watermark information (SK V (TDID||TimeReq)) in the leaked file copy by using the watermark extraction algorithm.

[0069] Step42: The data owner V obtains the TDID by analyzing the watermark information, and obtains the corresponding DVP from the chain according to the TDID, and queries part of the identity information of the leaker through the DVP.

[0070] Step43: If the data owner V needs more detailed information, the TDID is sent to the trusted center, and the trusted center inputs the TDID into the accountability smart contract as a parameter to obtain the DID identifier corresponding to the TDID, and traces the full identity information of the leaker.

[0071] The overall flowchart of illegal propagation accountability is as shown in Figure 8 .

[0072] On the basis of the above embodiment, the application further provides a data illegal propagation accountability device based on time-varying identity watermark, comprising:

[0073] A distributed identity authentication module is used for distributed identity authentication for preventing privacy association analysis.

[0074] The data visitor hashes the user unique distributed identity DID and a verification timestamp TimeVer to obtain a time-varying identity TDID, generates a dynamic verifiable presentation DVP based on the TDID, sends the DVP to the data owner, and stores the TDID as a key and the DID as a value on the blockchain, and verifies the dynamic identity of the data visitor through a distributed identity verification smart contract based on the TDID and a Merkle path.

[0075] An illegal propagation accountability module is configured to hold an authorized data illegal propagation accountable based on a time-varying watermark.

[0076] Before the data owner shares a data file with a data visitor, the time-varying watermark information of the visitor is added to a shared file copy, and the related key information is recorded on the chain. When unauthorized propagation of the shared file occurs, the accountability smart contract is used for accountability.

[0077] Further, the method further comprises:

[0078] A distributed identity generation module is configured to register a distributed digital identity with a trusted center and obtain a user identity credential of the user, wherein the user identity credential comprises a user unique distributed identity DID.

[0079] Further, the distributed identity verification module is specifically configured to:

[0080] The data owner makes an identity verification application to the data visitor, and the identity verification application comprises a verification timestamp TimeVer.

[0081] The data visitor obtains the DID through the user identity credential, and generates TDID=H(TimeVer||DID) by hashing the DID and the TimeVer, wherein H() represents a hash function. Then, the visitor generates a DVP comprising the TDID and a Merkle verification path, and sends the DVP to the data owner. The data visitor stores the mapping of the TDID and the DID on the blockchain, so that the trusted center can access and call the accountability smart contract for accountability, and stores the DVP on the blockchain.

[0082] Further, the illegal propagation accountability module is specifically configured to:

[0083] When the visitor applies to access a data file of the data owner, the data owner copies the original data file to obtain a file copy, and embeds the signature of the TDID of the visitor and a request access timestamp TimeReq as a watermark in the file copy. The data owner sends the file copy with the watermark to the visitor, and stores the watermark information on the blockchain.

[0084] If it is found that the data is in the hands of other unauthorized users other than the visitor, the watermark in the shared data file copy is extracted, the accountability smart contract is called by the trusted center, the TDID is taken as the key to obtain the corresponding DID identification, the illegal spreader is located and held accountable.

[0085] In summary, the present application uses the user identity verification timestamp TimeVer and the DID identification to generate a time-varying identity TDID based on the timestamp and a dynamic verifiable expression DVP of the user, to solve the problem of privacy correlation analysis of the verifier by collecting a large number of verifiable expressions VP. The present application embeds the signature of the data owner to the TDID and the access timestamp TimeReq of the shared file access visitor as a watermark into the shared data file copy, and the data owner sends the shared file copy with the embedded watermark to the authorized access visitor. When the data is shared without authorization, the data owner can inform the trusted center as the regulatory department, extract the watermark information in the data file copy, call the accountability verification smart contract by the trusted center to quickly locate the illegal spreader, and accurately hold accountable.

[0086] The above-mentioned is only the preferred embodiment of the present application, it should be pointed out that, for those skilled in the technical field, without departing from the principles of the present application, a number of improvements and refinements can be made, these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. A method for holding individuals accountable for the illegal dissemination of data based on time-varying identity watermarks, characterized in that, include: Distributed authentication that prevents privacy-related analytics: The data visitor hashes the user's unique distributed identity DID with the verification timestamp TimeVer to obtain the time-varying identity TDID. Based on the TDID, a dynamic verifiable representation DVP is generated and sent to the data owner. At the same time, the data visitor stores its own TDID as the key and the DID as the value on the blockchain. The dynamic identity of the data visitor is verified through a distributed identity verification smart contract based on TDID and Merkle path verification. Accountability for the illegal dissemination of authorized data based on time-varying watermarks: Before the data owner shares the data file with the data visitor, the visitor's time-varying watermark information is added to the copy of the shared file, and relevant key information is recorded on the blockchain. When unauthorized dissemination of the shared file occurs, accountability is pursued through an accountability smart contract. The distributed authentication method for privacy-preventing association analysis specifically includes: The data owner submits an authentication request to the data accessor, which includes a verification timestamp (TimeVer). Data visitors obtain a DID identifier using their user identity credentials, and hash the DID identifier with TimeVer to generate TDID=H(TimeVer||DID), where H() represents the hash function; then the visitor generates a DVP containing the TDID and Merkle verification path and sends it to the data owner. The data visitor stores the mapping between the TDID and DID identifier on the blockchain, which is accessible to the trusted center and can invoke the accountability smart contract for accountability. At the same time, the DVP is stored on the blockchain. The accountability for the illegal dissemination of authorized data based on time-varying watermarks specifically includes: When a visitor requests access to a data file of a data owner, the data owner copies the original data file into a file copy and embeds the visitor's TDID and the request access timestamp TimeReq as a watermark into the file copy. The watermarked file copy is then sent to the visitor, and the watermark information is stored on the blockchain. If data is found to be in the hands of unauthorized users other than the visitor, the Trust Center can extract the watermark from the copy of the shared data file, call the accountability smart contract to obtain the corresponding DID identifier using TDID as the key, and locate and hold the illegal disseminator accountable.

2. The method for holding individuals accountable for illegal data dissemination based on time-varying identity watermarking as described in claim 1, characterized in that, Also includes: Users register their distributed digital identity with the trusted center and obtain their own user identity credentials, which include the user's unique distributed identity DID identifier.

3. A data tracing and accountability device based on time-varying identity watermarking, characterized in that, include: A distributed authentication module for distributed authentication that prevents privacy-related analytics: The data visitor hashes the user's unique distributed identity DID with the verification timestamp TimeVer to obtain the time-varying identity TDID. Based on the TDID, a dynamic verifiable representation DVP is generated and sent to the data owner. At the same time, the data visitor stores its own TDID as the key and the DID as the value on the blockchain. The dynamic identity of the data visitor is verified through a distributed identity verification smart contract based on TDID and Merkle path verification. The illegal dissemination accountability module is used to hold individuals accountable for the illegal dissemination of authorized data based on time-varying watermarks. Before the data owner shares the data file with the data visitor, the visitor's time-varying watermark information is added to the copy of the shared file, and relevant key information is recorded on the blockchain. When unauthorized dissemination of the shared file occurs, accountability is pursued through an accountability smart contract. The distributed authentication module is specifically used for: The data owner submits an authentication request to the data accessor, which includes a verification timestamp (TimeVer). Data visitors obtain a DID identifier using their user identity credentials, and hash the DID identifier with TimeVer to generate TDID=H(TimeVer||DID), where H() represents the hash function; then the visitor generates a DVP containing the TDID and Merkle verification path and sends it to the data owner. The data visitor stores the mapping between the TDID and DID identifier on the blockchain, which is accessible to the trusted center and can invoke the accountability smart contract for accountability. At the same time, the DVP is stored on the blockchain. The illegal dissemination accountability module is specifically used for: When a visitor requests access to a data file of a data owner, the data owner copies the original data file into a file copy and embeds the visitor's TDID and the request access timestamp TimeReq as a watermark into the file copy. The watermarked file copy is then sent to the visitor, and the watermark information is stored on the blockchain. If data is found to be in the hands of unauthorized users other than the visitor, the Trust Center can extract the watermark from the copy of the shared data file, call the accountability smart contract to obtain the corresponding DID identifier using TDID as the key, and locate and hold the illegal disseminator accountable.

4. The data illegal propagation accountability device based on time-varying identity watermarking according to claim 3, characterized in that, Also includes: The distributed identity generation module is used for users to register a distributed digital identity with a trusted center and obtain their own user identity credentials, which include the user's unique distributed identity DID identifier.

Images