Autonomous data sovereignty container verification method and system

Abstract

The embodiment of the invention provides a verification method and system for an autonomous data sovereignty container, and the method can respond to an application request of a verification credential, and uses an application platform to generate a verifiable credential. And storing the verifiable certificate through an IPFS (Internet Protocol File System) uplink, and binding the verifiable certificate with the target distributed identifier through a content addressing identifier. Wherein the target distributed identifier is an identifier of a target distributed digital identity generated based on the block chain service platform. A verification request for the verifiable credential is received, and a verifiable expression of the verifiable credential is generated in response to the verification request. And performing verification on the verifiable expression to generate a verification result, and outputting the verification result. According to the method, the data is transmitted and stored in a multipoint-to-multipoint mode, and credential storage of the data can be realized in a mode of mounting the attachment in the verifiable certificate, so that the security of data storage is improved.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and in particular to a verification method and system for an autonomous data sovereignty container. Background Art

[0002] With the development of the Internet, users can store their personal data in the centralized system of the Internet, and then call the stored data through the centralized system to facilitate data storage and use.

[0003] A centralized system is a system that consists of one or more host computers forming a central node, where data is stored in a centralized manner, and all business units of the entire system are centrally deployed on the central node and processed centrally by the central node. Therefore, in a centralized system, each terminal or client is only responsible for data input and output, while the data storage and control processing process is completely handed over to the central node.

[0004] However, the centralized storage of data through a central node has a large single point security risk. When the central node of the centralized system fails, the entire system will be unusable, resulting in a decrease in the security of data storage. Summary of the invention

[0005] The present application provides a method and system for verifying an autonomous data sovereignty container to solve the problem of low data storage security.

[0006] In a first aspect, some embodiments of the present application provide a method for verifying an autonomous data sovereignty container, including:

[0007] In response to the application request for the verification credential, generating a verifiable credential using the application platform;

[0008] The verifiable credential is stored on the IPFS chain, and the verifiable credential is bound to a target distributed identifier through a content-addressable identifier; the target distributed identifier is an identifier of a target distributed digital identity generated based on a blockchain service platform;

[0009] receiving a request for verification of the verifiable credential;

[0010] In response to the verification request, generating a verifiable representation of the verifiable credential;

[0011] Performing verification on the verifiable expression to generate a verification result;

[0012] The verification result is outputted.

[0013] In combination with the first aspect, in an implementable manner, the verification method also includes: receiving a registration request for applying for a digital identity; generating the target distributed digital identity through a blockchain platform in response to the registration request; the target distributed digital identity includes the target distributed identifier and a digital identity document, the target distributed identifier is associated with the digital identity document, and the digital identity document is used to store the authentication information and service endpoint of the target distributed digital identity.

[0014] In combination with the first aspect, in an implementable manner, the target distributed digital identity also includes a verifiable data registry; the verifiable data registry is used to maintain the content-addressable identifier and the content-addressable identifier template.

[0015] In combination with the first aspect, in one practicable manner, the verifiable credential includes metadata, a credential subject, and multiple types of encrypted proofs.

[0016] In combination with the first aspect, in an implementable manner, a verifiable credential is generated using an application platform, including: obtaining an operation log input by a user; generating displayable fields and verifiable fields based on the operation log, the displayable fields being used to display content information of the verifiable credential, and the verifiable fields being used to verify the verifiable credential; packaging the displayable fields and the verifiable fields into a verifiable credential, and backing up the operation log in a preset format.

[0017] In combination with the first aspect, in one practicable manner, the verifiable expression includes metadata, verifiable credentials, and multiple types of encrypted proofs.

[0018] In combination with the first aspect, in an implementable manner, generating a verifiable expression of the verifiable credential includes: parsing the verification content and verification requirements of the verification request; querying expression information according to the verification content and the verification requirements, the expression information including type information, holder information, verifiable credential new type and digital signature information; and packaging the expression information into the verifiable expression.

[0019] In combination with the first aspect, in an implementable manner, the verification method also includes: receiving a configuration request for setting a verification target distributed identity, the configuration request including a verification address for verifying the target distributed identity; in response to the verification request, obtaining a verification threshold for data recovery and verification information of the verification address, the verification threshold including a threshold number for recovering the target distributed identity; and storing the verification threshold and the verification information on a chain.

[0020] In combination with the first aspect, in an implementable manner, the verification method also includes: receiving recovery data sent by the verification address; verifying the recovery data through an on-chain contract, and passing the verification of the recovery data when the domain name of the recovery data is legal; detecting the legal number of the recovery data, the legal number being the number of the recovery data that has passed the verification; when the legal number is greater than the threshold number, updating the master key of the target distributed identity information to restore the data information of the target distributed identity.

[0021] In a second aspect, some embodiments of the present application further provide a verification system for an autonomous data sovereignty container, including an application module, a storage module, and a verification module, wherein:

[0022] The application module is configured to generate a verifiable credential using the application platform in response to an application request for a verification credential;

[0023] The storage module is configured to store the verifiable credential on the IPFS chain, and bind the verifiable credential to a target distributed identifier through a content-addressable identifier; the target distributed identifier is an identifier of a target distributed digital identity generated based on a blockchain service platform;

[0024] The verification module is configured to receive a verification request for the verifiable credential; generate a verifiable expression of the verifiable credential in response to the verification request; perform verification on the verifiable expression to generate a verification result; and output the verification result.

[0025] It can be seen from the above technical solutions that the verification method and system of the autonomous data sovereignty container provided in some embodiments of the present application can generate a verifiable credential using an application platform in response to an application request for verification credentials. The verifiable credential is then stored on the chain through IPFS, and the verifiable credential is bound to the target distributed identifier through a content-addressable identifier. Among them, the target distributed identifier is an identifier of the target distributed digital identity generated based on the blockchain service platform. A verification request for the verifiable credential is received, and in response to the verification request, a verifiable expression of the verifiable credential is generated. The verifiable expression is then verified to generate a verification result, and the verification result is output. The method transmits and stores data in a multi-point to multi-point manner, and can realize the credential storage of data by mounting attachments in the verifiable credential, thereby improving the security of data storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0027] Figure 1 A flowchart of a method for verifying an autonomous data sovereignty container provided in some embodiments of the present application;

[0028] Figure 2 A schematic diagram of a process for registering a digital identity provided in some embodiments of the present application;

[0029] Figure 3 An architectural diagram of a distributed digital identity system based on distributed identifiers provided in some embodiments of the present application;

[0030] Figure 4 A schematic diagram of the data structure of a verifiable credential provided for some embodiments of the present application;

[0031] Figure 5 A schematic diagram of the use process of verifiable credentials provided in some embodiments of the present application;

[0032] Figure 6 A schematic diagram of the framework of a credential application platform system provided for some embodiments of the present application;

[0033] Figure 7 A schematic diagram of a data structure that can be verified and expressed in some embodiments of the present application;

[0034] Figure 8 A schematic diagram of a data recovery process provided by some embodiments of the present application;

[0035] Fig. 9 An architectural diagram of a verification system for an autonomous data sovereignty container provided in some embodiments of the present application. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solutions and advantages of the exemplary embodiments of the present application clearer, the technical solutions in the exemplary embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the exemplary embodiments of the present application. Obviously, the described exemplary embodiments are only part of the embodiments of the present application, not all of the embodiments.

[0037] The centralized system of the Internet needs to store data in a central node, that is, the data storage and control processing are all performed by the central node. If the central node of the centralized system fails, the entire storage system will be unusable, and data leakage may even occur. Therefore, the centralized storage method has a large single point security risk, and there are also problems such as data loss, data leakage, and data abuse during data use, resulting in a decrease in the security of data storage.

[0038] In order to solve the problem of single point security risk, in some embodiments, a distributed storage method is also used when storing data. Distributed storage refers to a storage method in which a hardware or software component is distributed on different network computers and communicates and coordinates with each other through message passing. For example, data can be distributedly stored through IPFS (InterPlanetary File System).

[0039] However, the above-mentioned distributed storage method can only improve the problem of single-point security risks. In the process of transmitting data through the distributed storage system, problems such as data loss may still occur, resulting in certain security risks in the data storage process.

[0040] Based on the above application scenarios, in order to improve the problem of low data storage security, some embodiments of the present application provide a verification method for an autonomous data sovereignty container, such as Figure 1 As shown, the procedure includes the following steps:

[0041] S1: In response to an application request for a verification credential, a verifiable credential is generated using an application platform.

[0042] When storing data, users can apply for a verifiable credential (VC) to the application platform by inputting an application request. The application platform generates a corresponding verifiable credential in response to the application request. The verifiable credential transfers the practicality and portability of physical identity credentials to digital devices.

[0043] A credential is a set of information issued by an authority such as a certificate, such as a birth certificate, degree certificate, driver's license, or ID card. In some embodiments, each credential contains a set of statements about the subject of the credential. The statements are made by a single authority, which is called the issuer of the credential in the verifiable credential, and the entity of the credential certificate is called the holder of the certificate.

[0044] In order to store verifiable credentials, it is necessary to register the user's digital identity before executing step S1. Figure 2As shown, in some embodiments, a registration request for applying for a digital identity is received, and in response to the registration request, a target distributed digital identity is generated through a blockchain platform. The target distributed digital identity includes a target distributed identifier and a digital identity document, the target distributed identifier is associated with the digital identity document, and the digital identity document is used to store the authentication information and service endpoint of the target distributed digital identity.

[0045] S2: Store the verifiable credentials on the IPFS chain and bind the verifiable credentials to the target distributed identifier through the content-addressable identifier.

[0046] The target distributed identifier is the identifier of the target distributed digital identity generated based on the blockchain service platform. After the verifiable credential is generated, the verifiable credential is stored on the chain based on IPFS, and the verifiable credential is bound to the user's distributed identifier DID through the content addressable identifier (Customer IDentity, CID). In this way, users can mount attachments in the verifiable credential to realize the credential storage of large files.

[0047] In some embodiments, the target distributed digital identity further includes a verifiable data registry, wherein the verifiable data registry is used to maintain content-addressable identifiers and content-addressable identifier templates.

[0048] For example, Figure 3 As shown, Figure 3 This is an architecture diagram for building a distributed digital identity system based on a distributed identifier (Decentralized Identity, DID). Among them, DID is used to identify the DID subject; each DID corresponds to a DID document, that is, a digital identity document; the DID document is used to store the authentication method, service endpoint and other related information of the DID. The DID resolver can parse the corresponding DID document through the DID, and then use the DID extractor to extract the corresponding resources in the DID document according to the DID URLs (Universal Resource Locators). The DID controller can modify the DID document after passing the verification. Among them, the digital certificate corresponding to the verifiable credential, a DID subject can hold multiple verifiable credentials. The verifiable expression generated based on the verifiable credential can maximize the protection of the user's data privacy while completing the verification. Both DID and DID documents are stored in the verifiable data registry.

[0049] like Figure 4As shown, in some embodiments, the verifiable credential includes metadata, credential subject, and multiple types of encrypted proofs. The metadata may be metadata such as the credential issuer, credential issuance date, credential expiration date, and credential status; the credential subject is a statement of the credential, which may be information such as the holder's name, the holder's gender, and the holder's address; and the multiple types of encrypted proofs may be digital signatures such as SM2, ECDSA, CL, and BBS+.

[0050] The process of using a verifiable credential involves three parties: the issuer of the credential, the holder of the credential, and the verifier of the credential. In some embodiments, the process of using a verifiable credential is as follows: Figure 5 As shown. The credential issuer issues a verifiable credential to the credential holder and saves the verification identifier to the verifiable data registry. That is, the issuer issues a verifiable credential to the holder's public key and digitally signs it with the issuer's private key. The holder can save the registered identifier of the verifiable credential to the verifiable data registry. The verifier can verify the identity of the holder through the digital signature algorithm, and the legitimacy of the verifiable credential can be determined by verifying the correctness of the verifiable credential.

[0051] In some embodiments, when using the application platform to generate a verifiable credential, it includes obtaining an operation log input by the user, and generating a displayable field and a verifiable field according to the operation log. Among them, the displayable field is used to display the content information of the verifiable credential, and the verifiable field is used to verify the verifiable credential. The displayable field and the verifiable field are packaged into a verifiable credential, and the operation log is backed up in a preset format.

[0052] For example, Figure 6 As shown, Figure 6 Schematic diagram of the framework of the credential application platform system. The credential application platform system framework includes a credential application platform, a credential reader, and a blockchain service platform. The credential application platform is the application platform described in the above embodiment.

[0053] Among them, the credential reader can provide the functions of credential parsing and credential verification. It is an open source public component that can provide credential verification interface specifications and support flexible integration, access, and calling by users. The credential application platform accesses the credential reader, provides complete business logic and business processes, can record user operation logs, and back up log storage in a standardized and complete log format. The blockchain service platform is used to ensure system security, has a complete monitoring system, and has complete security protection measures and emergency plans.

[0054] In some embodiments, the blockchain service platform can ensure data security, and has the capabilities of redundant backup, storage expansion, and off-site disaster recovery. The blockchain service platform can ensure the security of the communication network, has the ability to defend against network attacks and viruses, and the system of the blockchain service platform can be regularly checked to eliminate risks. The blockchain service platform can ensure data security, adopt cryptographic technology, and the keys used have corresponding secure storage mechanisms. The blockchain service platform has cross-chain docking capabilities, and has functions such as data model conversion, consensus mechanism adaptation, open API, and compliance with regulatory reporting models. The blockchain service platform also has certain concurrency performance to ensure normal business needs.

[0055] In some embodiments, the content information displayed by the displayable field may include the holder's distributed identity, issuance time, certificate number, total asset share value, issuer information, etc., in the format of an object array, and the displayable field can also be parsed and displayed by the certificate reader. The verifiable field includes the necessary parameters for certificate verification, such as the certificate source data, certificate information content, and certificate information encryption operator.

[0056] S3: Receive a verification request for a verifiable credential.

[0057] After the verifiable credentials are stored on the chain, they need to be verified, that is, receiving the verification request corresponding to the verifiable credentials. The verification request includes the verification content and verification requirements.

[0058] S4: In response to the verification request, generate a verifiable expression of the verifiable credential.

[0059] After receiving a verification request for a verifiable credential, respond to the verification request and generate a corresponding verifiable expression based on the verification request.

[0060] Therefore, in some embodiments, when generating a verifiable expression of a verifiable credential, the verification content and verification requirements of the verification request are parsed, and the expression information is queried according to the verification content and verification requirements. The expression information includes type information, holder information, verifiable credential new type, and digital signature information.

[0061] A verifiable expression is used to represent data from one or more verifiable credentials and is packaged in a way that the identity of the data holder can be verified. The data in the verifiable expression is about the same subject, but may be issued by multiple issuers. In some embodiments, Figure 7 As shown, the verifiable expression includes metadata, verifiable credentials and multiple types of encrypted proofs. The metadata can be type and holder information; the multiple types of encrypted proofs can be digital signatures such as SM2, ECDSA, CL, BBS+, etc.

[0062] S5: Verification is performed on the verifiable expression to generate a verification result.

[0063] S6: Output verification results.

[0064] After the verifiable expression is generated, the verifiable expression can be parsed and verified by the credential reader to generate a verification result of the verifiable expression. After the verification result is generated, the verification result is output to return the verification result to the DID controller.

[0065] Based on the above embodiments, it can be seen that the embodiments of the present application can convert offline, scattered, and unreliable paper credentials into online, digital, and reliable digital verifiable credentials. The data of the verifiable credentials is transmitted and authorized by individuals independently, which can improve data leakage, data abuse, data authorization and other issues in the data sharing process.

[0066] However, when the user forgets, loses, or cannot access the master key for various other reasons, the user will lose control of the target distributed identity. In order to improve the problem of data loss during transmission, in some embodiments, the method also receives a configuration request for setting a verification target distributed identity. The configuration request includes a verification address for verifying the target distributed identity, such as an email address. After receiving the configuration request, in response to the verification request, the verification threshold for data recovery and the verification information of the verification address are obtained. The verification threshold includes the threshold number for recovering the target distributed identity. The verification threshold and the verification information are stored on the chain to restore the data information of the target distributed identity through the verification threshold and the verification information.

[0067] For example, Figure 8 As shown in the figure, a data recovery mechanism is set up based on DKIM (DomainKeysIdentifiedMail). The user applies to set up N mailboxes as the guardians of the account. After the N mailboxes applied for pass the verification, the N mailboxes become the guardians of the account. At the same time, the user also needs to set the M-of-N threshold required for mailbox recovery, and store the M-of-N threshold and the mailbox information in the blockchain.

[0068] DKIM is an email authentication mechanism that uses digital signatures to authenticate identities based on public key encryption to detect whether the sender, subject, body, attachments, etc. have been forged or tampered with. DKIM mainly consists of a DKIM digital signature and a public key. DKIM can provide an encrypted, private digital signature for emails in a specific domain name, and the server receiving the email can use the published public key to verify the digital signature of the sending server to verify the identity.

[0069] Therefore, in some embodiments, the recovery data sent by the verification address is also received, and the recovery data is verified through the on-chain contract, and when the domain name of the recovery data is legal, the recovery data is verified. The legal amount of the recovery data is detected, and the legal amount is the amount of the recovery data that has passed the verification. When the legal amount is greater than the threshold amount, the master key of the target distributed identity information is updated to restore the data information of the target distributed identity.

[0070] For example, Figure 8 As shown in the figure, when a user loses the key of an account, an account recovery email is sent through the guardian mailbox. The on-chain contract verifies the legitimacy of the email sent by the guardian mailbox. When the recovery emails of more than N guardian mailboxes are verified, the account is recovered for the user. Through the on-chain email verification technology, multiple Internet mailboxes can be set as the guardians of the account, and account recovery can be achieved by submitting emails to the blockchain, which can lower the threshold for mailbox guardians.

[0071] Based on the above-mentioned verification method of the autonomous data sovereignty container, some embodiments of the present application also provide a verification system of the autonomous data sovereignty container, such as Fig. 9 As shown, it includes an application module, a storage module and a verification module, among which:

[0072] an application module configured to generate a verifiable credential using an application platform in response to an application request for a verification credential;

[0073] A storage module is configured to store the verifiable credential on the IPFS chain, and to bind the verifiable credential to a target distributed identifier through a content-addressable identifier; the target distributed identifier is an identifier of a target distributed digital identity generated based on a blockchain service platform;

[0074] The verification module is configured to receive a verification request for the verifiable credential; generate a verifiable expression of the verifiable credential in response to the verification request; perform verification on the verifiable expression to generate a verification result; and output the verification result.

[0075] It can be seen from the above technical solutions that the verification method and system of the autonomous data sovereignty container provided in some embodiments of the present application can generate a verifiable credential using an application platform in response to an application request for verification credentials. The verifiable credential is then stored on the chain through IPFS, and the verifiable credential is bound to the target distributed identifier through a content-addressable identifier. Among them, the target distributed identifier is an identifier of the target distributed digital identity generated based on the blockchain service platform. A verification request for the verifiable credential is received, and in response to the verification request, a verifiable expression of the verifiable credential is generated. The verifiable expression is then verified to generate a verification result, and the verification result is output. The method transmits and stores data in a multi-point to multi-point manner, and can realize the credential storage of data by mounting attachments in the verifiable credential, thereby improving the security of data storage.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0077] For the convenience of explanation, the above description has been made in conjunction with specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or limit the embodiments to the specific forms disclosed above. Based on the above teachings, various modifications and variations can be obtained. The selection and description of the above embodiments are to better explain the principles and practical applications, so that those skilled in the art can better use the embodiments and various different variations of the embodiments suitable for specific use considerations.

Claims

1. A method for verifying an autonomous data sovereignty container, characterized in that: include: In response to the application request for the verification credential, generating a verifiable credential using the application platform; The verifiable credential is stored on the IPFS chain, and the verifiable credential is bound to the target distributed identifier through a content-addressable identifier; The target distributed identifier is an identifier of a target distributed digital identity generated based on a blockchain service platform; receiving a request for verification of the verifiable credential; In response to the verification request, generating a verifiable representation of the verifiable credential; Performing verification on the verifiable expression to generate a verification result; The verification result is outputted.

2. The method for verifying an autonomous data sovereignty container according to claim 1, characterized in that: Also includes: receiving a registration request for applying for a digital identity; In response to the registration request, generating the target distributed digital identity through a blockchain platform; The target distributed digital identity includes the target distributed identifier and a digital identity document. The target distributed identifier is associated with the digital identity document. The digital identity document is used to store authentication information and a service endpoint of the target distributed digital identity.

3. The method for verifying an autonomous data sovereignty container according to claim 2, characterized in that: The target distributed digital identity also includes a verifiable data registry; the verifiable data registry is used to maintain the content-addressable identifier and the content-addressable identifier template.

4. The method for verifying an autonomous data sovereignty container according to claim 1, characterized in that: The verifiable credential includes metadata, a credential subject, and multiple types of cryptographic proofs.

5. The method for verifying an autonomous data sovereignty container according to claim 1, characterized in that: Use the application platform to generate verifiable credentials, including: Get the operation log of user input; Generate a displayable field and a verifiable field according to the operation log, wherein the displayable field is used to display the content information of the verifiable credential, and the verifiable field is used to verify the verifiable credential; The displayable fields and the verifiable fields are packaged into a verifiable credential, and the operation log is backed up in a preset format.

6. The method for verifying an autonomous data sovereignty container according to claim 1, characterized in that: The verifiable expression includes metadata, verifiable credentials, and multiple types of cryptographic proofs.

7. The method for verifying an autonomous data sovereignty container according to claim 1, characterized in that: Generating a verifiable expression of the verifiable credential, comprising: Analyze the verification content and verification requirements of the verification request; Querying expression information according to the verification content and the verification requirements, the expression information including type information, holder information, verifiable credential type, and digital signature information; The expression information is packaged into the verifiable expression.

8. The method for verifying an autonomous data sovereignty container according to claim 1, characterized in that: Also includes: receiving a configuration request for setting a verification target distributed identity, the configuration request including a verification address for verifying the target distributed identity; In response to the verification request, obtaining a verification threshold for data recovery and verification information of the verification address, wherein the verification threshold includes a threshold number of recovery target distributed identities; The verification threshold and the verification information are stored on a chain.

9. The method for verifying an autonomous data sovereignty container according to claim 8, characterized in that: Also includes: Receiving recovery data sent by the verification address; Verify the recovery data through the on-chain contract, and pass the verification of the recovery data when the domain name of the recovery data is legal; Detecting the legal amount of the restored data, where the legal amount is the amount of restored data that has passed verification; When the legal number is greater than the threshold number, the master key of the target distributed identity information is updated to restore the data information of the target distributed identity.

10. A verification system for autonomous data sovereignty containers, characterized in that: include: an application module configured to generate a verifiable credential using an application platform in response to an application request for a verification credential; A storage module is configured to store the verifiable credential on the IPFS chain, and to bind the verifiable credential to a target distributed identifier through a content-addressable identifier; The target distributed identifier is an identifier of a target distributed digital identity generated based on a blockchain service platform; a verification module configured to receive a verification request for the verifiable credential; In response to the verification request, generating a verifiable representation of the verifiable credential; Verification is performed on the verifiable expression to generate a verification result; and the verification result is output.

Images