An identity security management method for data space infrastructure

Abstract

The present invention discloses a data space management technology field, and particularly relates to an identity security management method for data space infrastructure, the method comprising: identity authentication of DID based on smart contracts, solving the problem of identity information leakage and lack of autonomous control in data space; implementing DID identity authentication and issuing verifiable statements based on threshold signature technology by forming an issuance committee composed of multiple Issuers committee nodes, solving the problem of single-point Issuer being attacked; implementing fine-grained data control through an enhanced verifiable credential model; and comprehensively evaluating the credibility of Issuer through a comprehensive trust model. The system comprises: a blockchain layer, a contract layer, and a trust layer; the blockchain layer implements distributed storage and provides cryptographic trust for the system; the contract layer implements peer-to-peer mutual authentication of DID and provides contract communication for the system; the trust layer uses data space as a carrier to implement user authentication and authorization.

Description

Technical Field

[0001] The present invention belongs to the technical field of data space management, and in particular relates to an identity security management method oriented to data space infrastructure. Background Art

[0002] With the development of the Internet and information technology, the demand for cross-border data sharing and interoperability continues to increase. Traditional identity management methods face complex data flow and security challenges. The centralized identity management system in existing technologies has the following problems:

[0003] (1) Privacy leakage: Personal identity information is stored in a central system, which can easily lead to information leakage and privacy infringement.

[0004] (2) Data islands: The central systems are not interconnected, forming data islands, which leads to duplicate development, increased costs, and increased security risks.

[0005] (3) Lack of autonomous control: Users lose autonomous control over their own identity data, and the flow of data cannot be traced.

[0006] Therefore, using traditional centralized solutions for identity management in the data space will lead to the risk of privacy leakage. In order to ensure the security of identity information, decentralized technology is needed to implement identity management in the data space.

[0007] Decentralized ID (DID) is a decentralized, verifiable identifier consisting of a string of characters that represents a digital identity. Entities can independently complete the registration, resolution, update or revocation of DIDs, and global uniqueness can be achieved without the need for a central registration agency. An entity can have multiple DIDs, which are managed and maintained by the entity itself. There is no associated information between different DIDs, which effectively avoids the risk of identity information being collected by a third party. In terms of technical implementation, blockchain technology is usually used. Blockchain has the characteristics of being tamper-proof, open and transparent, and easy to track and trace, and can realize distributed identity management based on blockchain. By giving users a digital identity DID generated based on real identity, the security and privacy issues of user identity can be effectively solved. Since DID does not contain real user data, the leakage of user data is avoided. DID is the user's digital "identity card" and is controlled by the user. It can realize the interconnection of identity in various systems and efficient and convenient business expansion, and open up the association of data identity.

[0008] However, the application of DID technology in the data space in the existing technology still has certain limitations. Among them, the Issuer is a centralized single point in the entire system and is considered to be completely trustworthy. Once the Issuer becomes a malicious role or is attacked, a single point of failure will occur, and the issued credentials will affect the security of the entire system. Therefore, further optimization is needed in the data space. An identity security management method for data space infrastructure is urgently needed. By optimizing DID, the security and effectiveness of identity management can be improved, adapting to the dynamic changes and diversified needs of the data space, and realizing functions such as identity authentication, permission control, and data security protection in the data space. Summary of the invention

[0009] The purpose of the present invention is to provide an identity security management method for data space infrastructure, characterized in that it is applied to a security service provider and comprises the following steps:

[0010] In response to the initialization operation, a security service provider DID and a security service provider DID document are generated; a security service provider key pair is generated; the security service provider DID is registered using smart contract communication, and the security service provider DID and the security service provider DID document are uploaded to the blockchain for evidence storage; the security service provider key pair includes: a security service provider private key and a security service provider public key; the security service provider DID document includes: a security service provider DID, a verification method type, and a security service provider public key;

[0011] In response to the DID verification and commitment credential request issued by the data user, the data user's DID is authenticated to confirm the ownership of the data user's DID by the entity issuing the request; verifiable information is obtained based on the commitment information, and the verifiable information is signed, and a verifiable statement is issued to the data user; the DID verification and commitment credential request includes: the data user's DID and the commitment information; the verifiable statement includes: the security service provider DID document acquisition interface and verifiable information;

[0012] The security service provider is the issuing committee, and the verifiable statement is jointly completed by multiple Issuers nodes in the issuing committee.

[0013] The verifiable claim uses an enhanced verifiable credential model;

[0014] The enhanced verifiable credential model includes:

[0015] Contextual information: Add more contextual information to the credential, including the issuance location and usage scenario, to better understand and verify the purpose of the credential.

[0016] Validity and conditions: Includes more detailed validity information and conditions of use, including the time frame in which the voucher is valid and the conditions under which it applies.

[0017] Biometric verification: Add biometric verification steps to the credential verification process, including fingerprint and facial recognition.

[0018] The steps of signing the information to be verified are:

[0019] A. Select an entity as the leader and notify each entity to enter the signing state;

[0020] B. The leader obtains the key from the hardware security module and generates a corresponding number of private key shares based on the number of entities ,in i The value of is consistent with the number of all entities participating in the signature;

[0021] C. The leader distributes the generated private key to each entity. After receiving the confirmation message, the entity replies with a confirmation message to ensure successful distribution.

[0022] D. Other uses Sign the user identity;

[0023] E. After the entity signs, the signed certificate Send to user;

[0024] F. User receives , concatenate the signatures, when When the number reaches a certain threshold, the signature will succeed regardless of the results of other signatures.

[0025] The verifiable statement is jointly completed by multiple Issuer nodes in the issuing committee, and also includes building a comprehensive trust model, evaluating the trust level of each Issuer node based on the trust score, and eliminating Issuer nodes with unqualified trust levels;

[0026] The comprehensive trust model is:

[0027]

[0028] in, TS Rating trust, SSR The success rate of signature, ER is the signature error rate, RT For response time, PF For the frequency of participation, UT For online time, UR For user evaluation, PR For peer review, SIRFor security incident records, TC Contribute to technology;

[0029] The trust scores are:

[0030]

[0031] in, Score the trust. is the score of the ith indicator, is the weight of the indicator;

[0032] The trust level is defined as:

[0033] According to the trust score TS:

[0034] When TS ≥ 90TS, the trust level is high trust;

[0035] When 70≤TS<90, the trust level is medium trust;

[0036] When 50≤TS<70, the trust level is low trust;

[0037] When TS<50, the trust level is untrustworthy.

[0038] Another object of the present invention is to provide an identity security management method for data space infrastructure, characterized in that it is applied to data users and comprises the following steps:

[0039] In response to the initialization operation, a data user DID and a data user DID document are generated; a data user key pair is generated; the data user DID is registered using smart contract communication, and the data user DID, the data user DID document and the data user public key are uploaded to the blockchain for evidence storage; the data user key pair includes: a data user private key and a data user public key; the data user DID document includes: a data user DID, a verification method type and a data user public key;

[0040] Sending a DID verification and commitment credential request to the security service provider; the DID verification and commitment credential request includes: the data user DID and commitment information;

[0041] In response to the verifiable statement issued by the security service provider, locally save the verifiable statement;

[0042] The security service provider is the issuing committee; the verifiable statement is jointly completed by multiple Issuers nodes in the issuing committee;

[0043] Sending a resource access request to the data provider, wherein the resource access request includes: a resource unique identifier and a data user DID;

[0044] In response to an access certificate request issued by a data provider, a one-time random number is obtained from the access certificate request, the one-time random number is signed using a data user's private key to obtain a one-time random number signature, and an access certificate is sent to the data provider; the access certificate includes: a one-time random number signature, a verifiable statement, and a data user DID;

[0045] In response to the credential verification result notification sent by the data provider, if the verification is successful, the resource access permission is obtained.

[0046] Another object of the present invention is to provide an identity security management method for data space infrastructure, characterized in that it is applied to a data provider and comprises the following steps:

[0047] In response to a resource access request issued by a data user, an access certificate request is sent to the data user; the access certificate request includes: a one-time random number;

[0048] In response to the access certificate issued by the data user, the data user DID is obtained from the access certificate. Based on the data user DID, the data user public key is obtained from the blockchain using smart contract communication. The one-time random number signature in the access certificate is verified using the data user public key. If the one-time random number signature verification is successful, based on the verifiable statement obtained in the access certificate, the security service provider DID document is obtained from the blockchain using smart contract communication. The verifiable statement is verified based on the security service provider DID document. If the verifiable statement is verified successfully, a credential verification result notification is issued to the data user.

[0049] Another object of the present invention is to provide an identity security management system for data space infrastructure, characterized in that it includes: a blockchain layer, a contract layer, and a trust layer;

[0050] The blockchain layer implements distributed storage and provides cryptographic trust for the system;

[0051] The contract layer implements peer-to-peer mutual authentication of DID and provides contract communication for the system;

[0052] The trust layer uses data space as a carrier to implement user authentication and authorization, providing authentication security for the system.

[0053] Another object of the present invention is to provide a computer device, characterized in that it includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor runs the computer program stored in the memory, the processor executes the identity security management method for data space infrastructure according to the present invention, or the identity security management system for data space infrastructure according to the present invention.

[0054] Another object of the present invention is to provide a computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the processor executes the identity security management method for data space infrastructure according to the present invention, or the identity security management system for data space infrastructure according to the present invention.

[0055] The beneficial effects of the present invention are:

[0056] The present invention discloses an identity security management method for data space infrastructure, which uses smart contract communication to put the user's DID and DID document on the chain, realizes secure communication between different users that does not rely on a trusted third party, realizes DID-based identity authentication, and combines smart contracts to realize DID registration, resolution, revocation and other functions. The DID technology is used to solve the problems of identity information leakage and lack of autonomous control in the data space; an identity autonomous control method in the data space is realized, so that users can manage and maintain their digital identities more conveniently.

[0057] Through the issuance committee composed of multiple Issuers nodes, the data user DID is authenticated and a verifiable statement is issued based on the threshold signature technology. The committee members jointly participate in generating credentials. After obtaining the credentials, the user can show them to the verifier. The verifier verifies the authenticity of the user's identity by checking the committee signature and the DID on the chain, solving the problem of the Issuer becoming a malicious role or being attacked, which may threaten the system security.

[0058] Considering the fine-grained requirements of data space for data control, the enhanced verifiable credential model is used to enhance the credential in Credential, which provides more detailed control and protection measures in the data space to ensure that the rights and interests of data providers and users are better protected. On the basis of meeting basic identity authentication requirements, the security and usability of the credential are further improved by adding enhanced functions such as contextual information, validity period and conditions, and biometric verification.

[0059] Considering the risk of Issuer nodes being attacked, although threshold signatures solve the single point failure problem caused by node attacks, if a node is attacked too many times, then this node needs to be kicked out of the committee. The present invention designs a comprehensive trust model to evaluate the trust level of each Issuer. The model comprehensively considers multiple factors, including historical behavior, node participation, signature success rate, node reputation and security audit results. The trust indicators are classified and weights are assigned to each indicator. The trust score of the Issuer is obtained by combining various indicators, thereby determining the trust level of each Issuer, comprehensively evaluating the credibility of the Issuer, ensuring the security and reliability of the DID system, and being able to fully reflect the Issuer's behavior, participation, reputation, security and contribution. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 This is a flow chart of an identity security management method for data space infrastructure according to the present invention;

[0061] Figure 2 This is a schematic diagram of the architecture of an identity security management system for data space infrastructure according to the present invention;

[0062] Figure 3 A schematic diagram of a flow chart of an interaction model of an identity security management system for data space infrastructure according to the present invention;

[0063] Figure 4 It is a schematic diagram of the structure of the multi-credential issuing committee of the present invention;

[0064] Figure 5 It is a schematic diagram of the signature flow of authentication in the data space of the present invention. DETAILED DESCRIPTION

[0065] The present invention provides an identity security management method for data space infrastructure, which is further described in detail below in conjunction with the accompanying drawings.

[0066] In response to the identity management problems faced by data spaces in the prior art, an embodiment of the present invention discloses an identity security management method for data space infrastructure. On the basis of solving the problems of identity information leakage and lack of autonomous control in the data space through DID technology, the problem of the Issuer becoming a malicious role or being attacked, which may threaten the system security, is solved by optimizing the DID technology.

[0067] like Figure 1 The embodiment of the present invention shown discloses an identity security management method for data space infrastructure, which is applied to a security service provider and includes the following steps:

[0068] In response to the initialization operation, a security service provider DID and a security service provider DID document are generated; a security service provider key pair is generated; the security service provider DID is registered using smart contract communication, and the security service provider DID and the security service provider DID document are uploaded to the blockchain for evidence storage; the security service provider key pair includes: a security service provider private key and a security service provider public key; the security service provider DID document includes: a security service provider DID, a verification method type, and a security service provider public key;

[0069] In this embodiment, the security service provider stores the security service provider private key by itself, which is used to digitally sign the relevant information.

[0070] In an optional embodiment, those skilled in the art can utilize conventional technical means in the prior art to verify the identity of the provider of the on-chain information, thereby improving the credibility of both parties exchanging data in the data space.

[0071] In an optional embodiment, according to the needs of a specific application scenario, smart contract communication is used to implement security service provider DID registration. The security service provider DID and the hash summary of the security service provider DID document can also be uploaded to the blockchain for evidence storage, and the DID document can be made public separately.

[0072] In response to the DID verification and commitment credential request issued by the data user, the data user's DID is authenticated to confirm the ownership of the data user's DID by the entity issuing the request; verifiable information is obtained based on the commitment information, and the verifiable information is signed, and a verifiable statement is issued to the data user; the DID verification and commitment credential request includes: the data user's DID and the commitment information; the verifiable statement includes: the security service provider DID document acquisition interface and verifiable information;

[0073] The security service provider is the issuing committee, and the verifiable statement is jointly completed by multiple Issuers nodes in the issuing committee.

[0074] The embodiment of the present invention discloses an identity security management method for data space infrastructure, which is applied to data users and includes the following steps:

[0075] In response to the initialization operation, a data user DID and a data user DID document are generated; a data user key pair is generated; the data user DID is registered using smart contract communication, and the data user DID, the data user DID document and the data user public key are uploaded to the blockchain for evidence storage; the data user key pair includes: a data user private key and a data user public key; the data user DID document includes: a data user DID, a verification method type and a data user public key;

[0076] Sending a DID verification and commitment credential request to the security service provider; the DID verification and commitment credential request includes: the data user DID and commitment information;

[0077] In response to the verifiable statement issued by the security service provider, locally save the verifiable statement;

[0078] The security service provider is the issuing committee; the verifiable statement is jointly completed by multiple Issuers nodes in the issuing committee;

[0079] Sending a resource access request to the data provider, wherein the resource access request includes: a resource unique identifier and a data user DID;

[0080] In response to an access certificate request issued by a data provider, a one-time random number is obtained from the access certificate request, the one-time random number is signed using a data user's private key to obtain a one-time random number signature, and an access certificate is sent to the data provider; the access certificate includes: a one-time random number signature, a verifiable statement, and a data user DID;

[0081] In response to the credential verification result notification sent by the data provider, if the verification is successful, the resource access permission is obtained.

[0082] The embodiment of the present invention discloses an identity security management method for data space infrastructure, which is applied to a data provider and includes the following steps:

[0083] In response to a resource access request issued by a data user, an access certificate request is sent to the data user; the access certificate request includes: a one-time random number;

[0084] In response to the access certificate issued by the data user, the data user DID is obtained from the access certificate. Based on the data user DID, the data user public key is obtained from the blockchain using smart contract communication. The one-time random number signature in the access certificate is verified using the data user public key. If the one-time random number signature verification is successful, based on the verifiable statement obtained in the access certificate, the security service provider DID document is obtained from the blockchain using smart contract communication. The verifiable statement is verified based on the security service provider DID document. If the verifiable statement is verified successfully, a credential verification result notification is issued to the data user.

[0085] like Figure 2 As shown, an embodiment of the present invention also discloses an identity security management system for data space infrastructure, including: a blockchain layer, a contract layer, and a trust layer;

[0086] The blockchain layer implements distributed storage and provides cryptographic trust for the system;

[0087] The contract layer implements peer-to-peer mutual authentication of DID and provides contract communication for the system;

[0088] The trust layer uses data space as a carrier to implement user authentication and authorization, providing authentication security for the system.

[0089] In this embodiment, the blockchain layer is based on cryptographic trust and is the foundation of the entire system. Credentials are stored in the distributed storage.

[0090] In this embodiment, the contract layer uses smart contract communication, and different users can achieve secure communication without relying on a trusted third party. By putting the user's DID and DID document on the chain and registering them in the distributed ledger of the blockchain, it is publicly verifiable, thereby realizing DID-based identity authentication. And combined with smart contracts, DID registration, resolution, revocation and other functions are realized.

[0091] In this embodiment, the trust layer implements authentication security, that is, trusted exchange is performed, in which all participants in the data space establish a secure identity authentication and data exchange layer with each other, and use a national secret algorithm to encrypt the data.

[0092] When data is exchanged for the first time, the data user is the Holder in the DID concept, the data provider is the Verifier, and the security service provider is the Issuer. The Holder sends a request for identity proof to the Issuer, and the Issuer verifies the correctness of the Holder's identity based on the blockchain storage platform and issues a verifiable statement VC. If the blockchain platform does not include the Holder's identity verification, the identity needs to be stored in the blockchain platform for subsequent use. The Holder sends the VC issued by the Issuer to the Verifier, and the Verifier verifies the correctness of the identity based on the identity proof in the blockchain storage platform.

[0093] The process of the interaction model of the identity security management system for data space infrastructure is as follows: Figure 3 As shown, the corresponding relationship between the relevant roles in the interaction model is shown in Table 1.

[0094] Table 1 Correspondence table of relevant roles in the interaction model

[0095]

[0096] In this embodiment, the data user will register his own DID, apply for Credential, and use it by showing it to the data provider. The security service provider refers to the issuer of the Credential. The security service provider is an organization or individual, usually an organization. The security service provider will first verify the entity's ownership of the DID, and then issue the Credential to the entity's issuing organization to provide Credential issuance services and issue the Credential as the issuer. The data provider is the party that provides the data. Before allowing the data user to use it, the data provider will first verify the entity's ownership of the DID, and then verify the validity of the Credential.

[0097] In a preferred embodiment, considering the fine-grained requirements of data space for data control, enhanced credentials are performed in Credential. In the prior art, according to the W3C standard, Credentials include:

[0098] @context: Specifies the JSON-LD context used by the credential, which defines the data model and meaning of the credential.

[0099] id: A unique identifier for the credential.

[0100] type: The type of the credential, which can contain multiple types.

[0101] issuer: The issuer of the credential, usually a DID (decentralized identifier).

[0102] issuanceDate: The date on which the certificate is issued.

[0103] credentialSubject: The subject of the credential, that is, the entity described by the credential.

[0104] proof: A digital signature used to verify the authenticity of a credential.

[0105] For common identity authentication, these fields are sufficient to meet usage requirements. However, in the data space, we have designed more detailed Credentials to enhance the data provider's control over the data while meeting the W3C standard.

[0106] In this preferred embodiment, an enhanced verifiable credential model is constructed, and the enhanced verifiable credential model includes:

[0107] Contextual information: Add more contextual information to the credential, including the issuance location and usage scenario, to better understand and verify the purpose of the credential.

[0108] Validity and conditions: Includes more detailed validity information and conditions of use, including the time frame in which the voucher is valid and the conditions under which it applies.

[0109] Biometric verification: Add biometric verification steps to the credential verification process, including fingerprint and facial recognition.

[0110] For example, the enhanced verifiable credential model is specifically:

[0111] {

[0112] "@context": [

[0113] "https: / / www.w3.org / 2018 / credentials / v1",

[0114] "https: / / example.org / extended-context / v1"

[0115] ],

[0116] "id": "http: / / example.edu / credentials / 3732",

[0117] "type": ["VerifiableCredential", "UniversityDegreeCredential", "ExtendedCredential"],

[0118] "issuer": "https: / / example.edu / issuers / 14",

[0119] "issuanceDate": "2023-01-01T19:23:24Z",

[0120] "expirationDate": "2024-01-01T19:23:24Z",

[0121] "credentialSubject": {

[0122] "id": "did:example:ebfeb1f712ebc6f1c276e12ec21",

[0123] "degree": {

[0124] "type": "BachelorDegree",

[0125] "name": "Bachelor of Science and Arts"

[0126] }

[0127] },

[0128] "contextInfo": {

[0129] "location": "Example University",

[0130] "scenario": "Degree Verification",

[0131] "issuerLocation": "123 University St, Example City, EX 12345",

[0132] "intendedUse": "Employment Verification"

[0133] },

[0134] "conditions": {

[0135] "validityPeriod": {

[0136] "startDate": "2023-01-01T00:00:00Z",

[0137] "endDate": "2024-01-01T00:00:00Z"

[0138] },

[0139] "usageTerms": [

[0140] "Non-transferable",

[0141] "Valid only within the United States",

[0142] "Valid for a single verification request" ]

[0144] },

[0145] "biometricVerification": {

[0146] "required": true,

[0147] "methods": [

[0148] {

[0149] "type": "Fingerprint",

[0150] "data": "FingerprintHashValue"

[0151] },

[0152] {

[0153] "type": "FacialRecognition",

[0154] "data": "FacialRecognitionHashValue"

[0155] } ]

[0157] },

[0158] "proof": {

[0159] "type": "RsaSignature2018",

[0160] "created": "2023-01-01T19:23:24Z",

[0161] "proofPurpose": "assertionMethod",

[0162] "verificationMethod": "https: / / example.edu / issuers / keys / 1",

[0163] "jws": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."

[0164] }

[0165] }

[0166] Among them, contextInfo: is context information, which provides more information about the use and issuance of the credential, including the issuance location, usage scenario, issuer address, and intended use.

[0167] "contextInfo": {

[0168] "location": "Example University",

[0169] "scenario": "Degree Verification",

[0170] "issuerLocation": "123 University St, Example City, EX 12345",

[0171] "intendedUse": "Employment Verification"

[0172] }

[0173] conditions: The validity period and usage conditions of the voucher, including detailed validity time range and applicable conditions.

[0174] "conditions": {

[0175] "validityPeriod": {

[0176] "startDate": "2023-01-01T00:00:00Z",

[0177] "endDate": "2024-01-01T00:00:00Z"

[0178] },

[0179] "usageTerms": [

[0180] "Non-transferable",

[0181] "Valid only within the United States",

[0182] "Valid for a single verification request" ]

[0184] }

[0185] biometricVerification: Biometric verification increases security during credential verification. Includes fingerprint and facial recognition methods.

[0186] "biometricVerification": {

[0187] "required": true,

[0188] "methods": [

[0189] {

[0190] "type": "Fingerprint",

[0191] "data": "FingerprintHashValue"

[0192] },

[0193] {

[0194] "type": "FacialRecognition",

[0195] "data": "FacialRecognitionHashValue"

[0196] } ]

[0198] }

[0199] The enhanced verifiable credential model provides more detailed control and protection measures in the data space to ensure that the rights and interests of data providers and users are better protected. This enhanced credential model not only meets basic identity authentication needs, but also further improves the security and usability of credentials by adding contextual information, validity period and conditions, biometric verification and other enhanced features.

[0200] In this embodiment, the structure of the multi-credential issuance committee is as follows: Figure 4 As shown in the figure, in order to solve the single point failure problem caused by Issuer centralization, the Issuer in the data space is decentralized and the single issuer is changed to an issuing committee.

[0201] In this embodiment, if a user creates a statement about his or her own attributes and it is verified by an Issuers Committee among the multiple credential Issuers Committees selected by the system; through the threshold signature technology, the committee members jointly participate in generating credentials, and the user can show the credentials to the verifier after obtaining them. The verifier verifies the authenticity of the user's identity by checking the committee signature and the on-chain DID.

[0202] The threshold signature is a distributed signature service that distributes private key sharing to committee members in the data space. Private key sharing is only a part of the entire secret key, which cannot be used as a signature certificate. However, when the number reaches a certain threshold, even if the components are incomplete, it can be completely assembled into a complete private key for signing the user's identity.

[0203] In this embodiment, the signature process of authentication in the data space is as follows: Figure 5 As shown,

[0204] The steps of signing the information to be verified in the data space are:

[0205] A. Select an entity as the leader and notify each entity to enter the signing state;

[0206] B. The leader obtains the key from the Hardware Security Module (HSM) and generates a corresponding number of private key shares based on the number of entities ,in i The value of is consistent with the number of all entities participating in the signature;

[0207] C. The leader distributes the generated private key to each entity. After receiving the confirmation message, the entity replies with a confirmation message to ensure successful distribution.

[0208] D. Other uses Sign the user identity;

[0209] E. After the entity signs, the signed certificate Send to user;

[0210] F. User receives , concatenate the signatures, when When the number reaches a certain threshold, the signature will succeed regardless of the results of other signatures.

[0211] In a preferred embodiment, considering the risk of Issuer nodes being attacked, although the threshold signature solves the single point failure problem caused by node attacks, if a node is attacked too many times, then this node needs to be kicked out of the committee, so for Issuer, the present invention designs a comprehensive trust model to evaluate the trust level of each Issuer. The model comprehensively considers multiple factors, including historical behavior, node participation, signature success rate, node reputation and security audit results. The trust indicators in the comprehensive trust model are summarized as shown in Table 2.

[0212] Table 2 Summary of trust indicators of comprehensive trust model

[0213]

[0214] In this embodiment, the trust indicators are divided into the following categories. Each indicator is assigned a certain weight according to its importance, and the trust score of the Issuer is obtained by combining various indicators. The score calculation formula is as follows:

[0215]

[0216] in, is the score of the ith indicator, is the weight of this indicator.

[0217] Specifically expressed as:

[0218]

[0219] After designing the specific algorithm, Issuers are divided into different levels according to the trust split, as follows:

[0220] High Trust: TS ≥ 90TS

[0221] Medium Trust: 70≤TS<90

[0222] Low Trust: 50≤TS<70

[0223] Not Trustworthy: TS<50

[0224] Through the above trust model design and weight distribution, the credibility of the Issuer is comprehensively evaluated to ensure the security and reliability of the DID system. Each indicator and weight is reasonably designed to fully reflect the Issuer's behavior, participation, reputation, security and contribution.

[0225] Another embodiment of the present invention discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the identity security management method for data space infrastructure described in the present invention, or the identity security management system for data space infrastructure described in the present invention.

[0226] Another embodiment of the present invention discloses a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the processor executes the identity security management method for data space infrastructure described in the present invention, or the identity security management system for data space infrastructure described in the present invention.

Claims

1. An identity security management method for data space infrastructure, characterized in that: Applied to the security service provider, it includes the following steps: In response to the initialization operation, generate a security service provider DID and a security service provider DID document; generate a security service provider key pair; use smart contract communication to implement security service provider DID registration, and upload the security service provider DID and security service provider DID document to the blockchain for evidence storage; The security service provider key pair includes: a security service provider private key and a security service provider public key; the security service provider DID document includes: a security service provider DID, a verification method type, and a security service provider public key; In response to the DID verification and commitment credential request issued by the data user, the data user's DID is authenticated to confirm the ownership of the data user's DID by the entity issuing the request; verifiable information is obtained based on the commitment information, and the verifiable information is signed, and a verifiable statement is issued to the data user; the DID verification and commitment credential request includes: the data user's DID and the commitment information; the verifiable statement includes: the security service provider DID document acquisition interface and verifiable information; The security service provider is the issuing committee, and the verifiable statement is jointly completed by multiple Issuers nodes in the issuing committee; The verifiable statement is jointly completed by multiple Issuer nodes in the issuing committee, and also includes building a comprehensive trust model, evaluating the trust level of each Issuer node based on the trust score, and eliminating Issuer nodes with unqualified trust levels; The comprehensive trust model is: ， in, TS Rating trust, SSR The success rate of signature, ER is the signature error rate, RT For response time, PF For the frequency of participation, UT For online time, UR For user evaluation, PR For peer review, SIR For security incident records, TC Contribute to technology; The trust scores are: ， Among them, Trust Score is the trust score, Indicator i is the score of the ith indicator, Weight i is the weight of the indicator; The trust level is defined as: According to the trust score TS: When TS ≥ 90TS, the trust level is high trust; When 70≤TS<90, the trust level is medium trust; When 50≤TS<70, the trust level is low trust; When TS<50, the trust level is untrustworthy.

2. The identity security management method for data space infrastructure according to claim 1 is characterized in that: The verifiable claim uses an enhanced verifiable credential model; The enhanced verifiable credential model includes: Contextual information: Add more contextual information to the credential, including the place of issuance and usage scenario, to better understand and verify the purpose of the credential; Validity and conditions: includes more detailed validity information and conditions of use, including the time frame in which the voucher is valid and the conditions under which it applies; Biometric verification: Add biometric verification steps to the credential verification process, including fingerprint and facial recognition.

3. The identity security management method for data space infrastructure according to claim 1 is characterized in that: The steps of signing the verifiable information are: A. Select an entity as the leader and notify each entity to enter the signing state; B. The leader obtains the key from the hardware security module and generates a corresponding number of private key shares based on the number of entities ,in i The value of is consistent with the number of all entities participating in the signature; C. The leader distributes the generated private key to each entity. After receiving the confirmation message, the entity replies with a confirmation message to ensure successful distribution. D. Other uses Sign the user identity; E. After the entity signs, the signed certificate Send to user; F. User receives , concatenate the signatures, when When the number reaches a certain threshold, the signature will succeed regardless of the results of other signatures.

4. An identity security management method for data space infrastructure, characterized in that: Applied to data users, including the following steps: In response to the initialization operation, a data user DID and a data user DID document are generated; a data user key pair is generated; the data user DID is registered using smart contract communication, and the data user DID, the data user DID document, and the data user public key are uploaded to the blockchain for evidence storage; The data user key pair includes: a data user private key and a data user public key; the data user DID document includes: a data user DID, a verification method type, and a data user public key; Sending a DID verification and commitment credential request to the security service provider; the DID verification and commitment credential request includes: the data user DID and commitment information; In response to the verifiable statement issued by the security service provider, locally save the verifiable statement; The security service provider is the issuing committee; the verifiable statement is jointly completed by multiple Issuers nodes in the issuing committee; Sending a resource access request to the data provider, wherein the resource access request includes: a resource unique identifier and a data user DID; In response to an access certificate request issued by a data provider, a one-time random number is obtained from the access certificate request, the one-time random number is signed using a data user's private key to obtain a one-time random number signature, and an access certificate is sent to the data provider; the access certificate includes: a one-time random number signature, a verifiable statement, and a data user DID; In response to the credential verification result notification sent by the data provider, if the verification is successful, the resource access permission is obtained; The verifiable statement is jointly completed by multiple Issuer nodes in the issuing committee, and also includes building a comprehensive trust model, evaluating the trust level of each Issuer node based on the trust score, and eliminating Issuer nodes with unqualified trust levels; The comprehensive trust model is: ， in, TS Score trust, SSR The success rate of signature, ER is the signature error rate, RT For response time, PF For the frequency of participation, UT For online time, UR For user evaluation, PR For peer review, SIR For security incident records, TC Contribute to technology; The trust scores are: ， Among them, Trust Score is the trust score, Indicator i is the score of the ith indicator, Weight i is the weight of the indicator; The trust level is defined as: According to the trust score TS: When TS ≥ 90TS, the trust level is high trust; When 70≤TS<90, the trust level is medium trust; When 50≤TS<70, the trust level is low trust; When TS<50, the trust level is untrustworthy.

5. A computer device, characterized in that: It comprises a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the identity security management method for data space infrastructure according to any one of claims 1 to 4.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the processor performs the identity security management method for data space infrastructure according to any one of claims 1 to 4.

Images