Data right confirmation method and data management method and system

Abstract

The invention discloses a data right confirmation method and a data management method and system, and belongs to the technical field of data right confirmation. A distributed digital identity identifier of an authorization mechanism is used as an attribute to be embedded into a preset access strategy so as to appoint that the authorization mechanism has the right of decrypting data and checking data plaintext, and a distributed digital identity identifier of a data owner is used as an attribute to be embedded into the preset access strategy so as to clarify the ownership of right confirmation data. Secondly, encrypting right confirmation data by adopting a preset access strategy after global parameters and attributes are embedded, and submitting an obtained data ciphertext to an authorization mechanism for right confirmation, so that the security and privacy of the data are ensured; meanwhile, the obtained data ownership declaration directly carries the distributed digital identity identifier information of the authorization mechanism, so that the authorization mechanism for data right confirmation does not need to be combined for authentication in the subsequent authentication process of the data ownership declaration, and the data ownership declaration can be easily intercommunicated and recognized among different platforms.

Description

Technical Field

[0001] The present invention belongs to the technical field of data rights confirmation, and more specifically, relates to a data rights confirmation method, a data management method and a system. Background Art

[0002] With the rapid development of Internet technology and the advancement of informatization, data security and privacy protection have become important issues that need to be addressed. Since the existing data rights registration and release rely on the traditional management method of "manual registration-expert review", it is unable to cope with digital attacks such as tampering and replacement. The existing data trading market is still plagued by problems such as difficulty in controlling data rights and interests and hidden infringements. Therefore, it is urgent to study a data rights confirmation method to provide a practical technical guarantee to face the data trading market with multiple stakeholders involved and high complexity of data ownership.

[0003] In order to solve the above problems, the existing data rights confirmation methods often encrypt the rights confirmation data before confirming the rights. Although it can ensure the security and privacy of the data output process, the rights confirmation records obtained by this method need to be jointly confirmed by multiple parties during the authentication process on other platforms. For example, the platform needs to jointly authenticate the rights confirmation records with the authorized agency during the authentication process. The whole process is relatively complicated, and the rights confirmation records are difficult to communicate and recognize between different platforms, which easily forms data islands and cannot be applied to complex data trading markets. Summary of the invention

[0004] In response to the above defects or improvement needs of the prior art, the present invention provides a data rights confirmation method, a data management method and a system, the purpose of which is to enable the obtained rights confirmation records to be easily and conveniently communicated and recognized between different platforms under the premise of ensuring the security and privacy of the data.

[0005] In order to achieve the above-mentioned purpose, in a first aspect, the present invention provides a data rights confirmation method, which is applied to a data rights confirmation system based on blockchain; the data rights confirmation system includes: a client, an authorization agency, a blockchain and a data storage server;

[0006] Data rights confirmation methods include:

[0007] The data owner obtains the distributed digital identity identifier of the authorized agency and requests the authorized agency to obtain the global parameters required for encryption through the client;

[0008] The data owner embeds his / her own and the authorized institution's distributed digital identity identifiers as attributes into the preset access policy; the data for confirmation of ownership is encrypted using the preset access policy with global parameters and attributes embedded to obtain data ciphertext; the data ciphertext is submitted to the authorized institution through the client and a request for confirmation of ownership is initiated;

[0009] After receiving the data ciphertext and the confirmation request, the authorized agency uses its own attribute key to decrypt the data ciphertext and reviews the obtained data plaintext; when the review is passed, the hash value of the data plaintext is extracted, a distributed digital identity is generated for the data plaintext, the hash value is embedded in the distributed digital identity of the data plaintext and uploaded to the blockchain; the distributed digital identity identifiers of the data owner and the data plaintext are embedded in the data ownership statement and uploaded to the blockchain; the data ciphertext is stored in the data storage server; the data owner is informed of the completion of the confirmation through the client; when the review fails, the data owner is informed of the failure of the confirmation through the client.

[0010] Further preferably, the preset access policy includes: access rights, usage scope and time limit of the ownership confirmation data uploaded by the data owner.

[0011] Further preferably, the above data rights confirmation method further includes: the following steps performed after the rights confirmation is completed:

[0012] The data owner submits a request to the authorized agency through the client to obtain verifiable credentials for the ownership data;

[0013] After receiving the request, the authorized agency obtains the data ownership statement of the confirmed data from the blockchain, and uses its own private key to digitally sign it, constructing a verifiable credential including the digital signature, the data ownership statement of the confirmed data and its own distributed digital identity identifier, and sends it to the data owner through the client; extracts the hash value of the verifiable credential, and uploads the hash value of the verifiable credential to the blockchain for evidence storage.

[0014] In a second aspect, the present invention provides a data rights confirmation system, a client, an authorization agency, a blockchain, and a data storage server:

[0015] The client, the authorization agency and the blockchain execute the data rights confirmation method provided in the first aspect of the present invention.

[0016] In a third aspect, the present invention provides a data management method, which is applied to a data management system; the data management system comprises: a client, N authorization agencies, a blockchain, and a data storage server; N≥1;

[0017] The above data management method includes:

[0018] When the data owner confirms the data rights, the client, the first authorization agency and the blockchain execute the data rights confirmation method provided by the first aspect of the present invention; wherein the first authorization agency is any one of the N authorization agencies;

[0019] When a data user requests to use data, the data user requests the second authorization agency through the client to obtain his own attribute key, downloads the data ciphertext from the data storage server through the second authorization agency, and uses his own attribute key to decrypt the data ciphertext. When his own attributes meet the preset access policy in the data ciphertext, the decryption is successful and the data plaintext is obtained; otherwise, the decryption fails; the second authorization agency is any one of the N authorization agencies.

[0020] Further preferably, the above data management method further includes:

[0021] When a verifier proposes to verify the authenticity of a verifiable credential for a piece of ownership data:

[0022] The verifier sends a verifiable credential to a third authority through the client; the third authority is any authority among the N authorities;

[0023] After receiving the verifiable credential, the third authorized institution parses the digital signature, the distributed digital identity identifier of the authorized institution that performs the confirmation operation on the confirmation data, and the data ownership statement from the verifiable credential, and queries the blockchain to see whether the authorized institution that performs the confirmation operation has the qualification to issue certificates;

[0024] If there is a certificate-issuing qualification, the authenticity of the digital signature obtained by parsing is verified. When the verification is passed, the hash value of the verifiable credential is extracted and compared with the hash value of the verifiable credential queried through the blockchain. When the comparison is consistent, the verification result that the verifiable credential is authentic is obtained; when the comparison is inconsistent, the verification result that the verifiable credential is not authentic is obtained; when the verification fails, the verification result that the verifiable credential is not authentic is obtained;

[0025] If there is no certificate-issuing qualification, the verification result obtained will prove that the certificate is not authentic;

[0026] The authenticity of the digital signature obtained by verification includes:

[0027] Using the parsed digital signature and data ownership statement, the public key of the authorized agency performing the title confirmation operation is calculated and compared with the public key of the authorized agency performing the title confirmation operation obtained through blockchain query. When the comparison is consistent, the verification is considered to be successful; otherwise, the verification fails.

[0028] Further preferably, the above data management method further includes:

[0029] When a user registers an identity, the user sends a request to create a distributed digital identity to the fourth authority through the client;

[0030] After receiving the request, the fourth authorization agency generates a distributed digital identity for the user and uploads the user's distributed digital identity to the blockchain;

[0031] Among them, users include: data owners, data users and verifiers; the fourth authorization agency is any authorization agency among the N authorization agencies.

[0032] In a third aspect, the present invention provides a data management system, comprising: a client, N authorization agencies, a blockchain, and a data storage server; N≥1;

[0033] The client, N authorized agencies and blockchain are used to execute the data management method provided in the third aspect of the present invention.

[0034] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects:

[0035] 1. The present invention provides a data rights confirmation method, which embeds the distributed digital identity identifier of the authorization agency as an attribute into the preset access policy to stipulate that the authorization agency has the right to decrypt data and review the data plain text, embeds the distributed digital identity identifier of the data owner as an attribute into the preset access policy to clarify the ownership of the confirmation data, and then uses the preset access policy after the global parameters and attributes are embedded to encrypt the confirmation data, and submits the obtained data ciphertext to the authorization agency for confirmation, thereby avoiding the risk of data leakage in the confirmation process and ensuring the security and privacy of the data; at the same time, the data ownership statement obtained thereby directly carries the distributed digital identity identifier information of the authorization agency, so that in the subsequent authentication process of the data ownership statement, there is no need to jointly authenticate the authorization agency that performs data confirmation, and authentication can be achieved by only obtaining the information of the authorization agency that performs data confirmation from the data ownership statement, thereby simplifying the authentication process, so that the data ownership statement can be easily and conveniently interoperable and mutually recognized between different platforms, and is suitable for complex data trading markets.

[0036] 2. Furthermore, the data ownership confirmation method provided by the present invention has a preset access policy including: access rights, usage scope and time limit of the ownership confirmation data uploaded by the data owner, and can independently specify the use of the data, so that in the subsequent data access process, users do not need to rely on centralized service providers to ensure that only authorized users can access the data, thereby realizing distributed access control, reducing single points of failure, and increasing the security of subsequent data access.

[0037] 3. Furthermore, in the data ownership confirmation method provided by the present invention, when the data owner submits a request to the authorized agency to obtain a verifiable credential for the ownership confirmation data, the authorized agency, while generating the verifiable credential, also extracts the hash value of the verifiable credential, and uploads the hash value of the verifiable credential to the blockchain for evidence storage; the purpose of this design is that, on the one hand, the storage cost of the blockchain is relatively high, and directly storing credential data will affect performance, while the hash value of the verifiable credential is only a string of fixed length, which greatly reduces the amount of data; on the other hand, any change to the data will change the value of the hash summary, so it is possible to verify whether the verifiable credential has been tampered with by only the hash value of the verifiable credential without saving the verifiable credential.

[0038] 4. The present invention provides a data management method. When the data owner confirms the data ownership, the data confirmation method provided by the present invention is used to perform the confirmation operation. Under the premise of ensuring the security and privacy of the data, the obtained confirmation records can be easily and conveniently interoperable and mutually recognized between different platforms; when the data user requests to use the data, the data ciphertext is decrypted based on the data user's attribute key. Only data users who meet the preset access policy can complete the decryption, realizing fine-grained access control without the need for complex key management processes.

[0039] 5. Furthermore, in the data management method provided by the present invention, when the verifier proposes to verify the authenticity of the verifiable certificate of a certain title confirmation data, the digital signature, the distributed digital identity identifier of the authorized agency that performs the title confirmation operation on the title confirmation data, and the data ownership statement are parsed from the verifiable certificate, and the blockchain is used to query whether the authorized agency that performs the title confirmation operation has the qualification to issue certificates. The digital signature is then used to verify the authenticity of the certificate, and then the certificate verification method of the blockchain is used to verify the information on the certificate on the chain. The authenticity of the verifiable certificate is guaranteed by layer-by-layer verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A flowchart of a data rights confirmation method provided by an embodiment of the present invention;

[0041] Figure 2 A process diagram of data rights confirmation provided by an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of the structure of a data management system provided by an embodiment of the present invention;

[0043] Figure 4 A schematic diagram of a data management process provided by an embodiment of the present invention;

[0044] Figure 5A process diagram for verifying the authenticity of a verifiable credential for certain ownership confirmation data provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0046] In order to achieve the above-mentioned purpose, in a first aspect, the present invention provides a data rights confirmation method, which is applied to a data rights confirmation system based on blockchain; the data rights confirmation system includes: a client, an authorization agency, a blockchain and a data storage server;

[0047] like Figure 1 As shown, the above data rights confirmation method includes:

[0048] The data owner obtains the distributed digital identity identifier of the authorized institution and requests the authorized institution through the client to obtain the global parameters required for encryption; the global parameters include the mathematical domain and parameters used for encryption and decryption;

[0049] The data owner embeds his / her own and the authorized institution's distributed digital identity identifiers as attributes into the preset access policy; the data for confirmation of ownership is encrypted using the preset access policy with global parameters and attributes embedded to obtain data ciphertext; the data ciphertext is submitted to the authorized institution through the client and a request for confirmation of ownership is initiated;

[0050] After receiving the data ciphertext and the confirmation request, the authorized agency uses its own attribute key to decrypt the data ciphertext and reviews the obtained data plaintext; when the review is passed, the hash value of the data plaintext is extracted, a distributed digital identity is generated for the data plaintext, the hash value is embedded in the distributed digital identity of the data plaintext and uploaded to the blockchain to achieve the binding of the data and the distributed digital identity; the distributed digital identity identifiers of the data owner and the data plaintext are embedded in the data ownership statement and uploaded to the blockchain to ensure the transparency and security of ownership through a consensus mechanism; the data ciphertext is stored in the data storage server; the data owner is informed of the completion of the confirmation through the client; when the review fails, the data owner is informed of the failure of the confirmation through the client.

[0051] The specific process diagram of the above process is as follows Figure 2 shown.

[0052] In an optional implementation, when the authorized agency has reviewed and approved the decrypted data plaintext, it extracts the hash value of the data plaintext, generates a distributed digital identity for the data plaintext, embeds the hash value into the distributed digital identity of the data plaintext and uploads it to the blockchain, and generates a record containing the data location after the upload is completed, which is used to obtain the data, and finally generates a record for the data owner to fill in the data confirmation data information such as data name, data type and usage scenario, so that the subsequent verification party can find the data location from the above record when reviewing the data, and use the external interface of the data storage server to obtain the data. The process of generating a distributed digital identity of the data is the same as the process of generating a distributed digital identity of the data owner, so it will not be repeated. Finally, the data owner's ownership information of the data, that is, the data ownership statement, is recorded on the blockchain through a smart contract. It should be noted that there are many ways to extract the hash value, and algorithms such as SHA-1, SHA-3, SHA-256, and BLAKE2 can be used; preferably, in an optional implementation, the authorized agency uses the SHA-256 algorithm to generate a data fingerprint for the data, that is, the hash value of the data plaintext.

[0053] In an optional implementation, the main process of encrypting the ownership confirmation data includes:

[0054] The initialization process is performed by the authority: the authority is responsible for generating the global parameters and master keys required for encryption. The global parameters include the mathematical domains and parameters used for encryption and decryption, while the master key is used for subsequent key derivation and verification.

[0055] The key generation process is also performed by the authority: an attribute key is generated for each user (such as data owner, user user), which is associated with a set of attributes of the user. The generation of attribute keys depends on the master key generated during the initialization process;

[0056] Encryption process: When encrypting data, the data owner defines a preset access policy, which is a string in a specific format that describes which attribute combinations can decrypt the data; on this basis, the data owner embeds the distributed digital identity identifiers of himself and the authorized agency as attributes into the preset access policy. This preset access policy is encrypted together with the ownership data to form data ciphertext. The encryption process uses the global system parameters and the preset access policy after the attributes are embedded to encrypt the ownership data and generate data ciphertext, ensuring that only keys that meet the requirements of the preset access policy can decrypt the data. When a user holding an attribute key tries to decrypt the ciphertext, it will check whether the attributes in the key meet the access policy in the ciphertext. If they do, the data will be decrypted; if they do not, the decryption process will fail and the data will remain encrypted.

[0057] It should be noted that the data owner can also set other attributes in the preset access policy, such as (data access rights, usage scope, time limit, etc.) to independently determine how the data is used. Specifically, in an optional implementation, the preset access policy includes: access rights, usage scope and time limit of the ownership confirmation data uploaded by the data owner.

[0058] The present invention supports user-defined access policies, distributes keys according to attributes, and reduces the complexity of key management: it only needs to generate keys according to attributes, without complex key management processes, and users can use a single attribute key to decrypt all data that meets the access policy, without the need to generate a separate decryption key for each encryption task. It supports dynamic permission changes: when user attributes change, only their attributes need to be updated without redistributing keys.

[0059] In an optional implementation manner, the above data rights confirmation method further includes: the following steps performed after the rights confirmation is completed:

[0060] The data owner submits a request to the authorized agency through the client to obtain verifiable credentials for the ownership data;

[0061] After receiving the request, the authorized agency obtains the data ownership statement of the confirmed data from the blockchain, and uses its own private key to digitally sign it, constructing a verifiable credential including the digital signature, the data ownership statement of the confirmed data and its own distributed digital identity identifier, and sends it to the data owner through the client; extracts the hash value of the verifiable credential, and uploads the hash value of the verifiable credential to the blockchain for evidence storage.

[0062] Specifically, in one implementation, the digital signature, the data ownership statement of the confirmation data, and the distributed digital identity identifier of the authorized institution are directly combined as a verifiable credential. In another specific implementation, a unique identifier of the verifiable credential is generated as an ID, and the digital signature, the data ownership statement of the confirmation data, the distributed digital identity identifier of the authorized institution, the ID, and metadata such as the generation time and expiration time are packaged to form a complete verifiable credential.

[0063] Specifically, when issuing a verifiable credential, the authorized institution first confirms the ownership information from the blockchain, then packages the distributed identity identifier of the data owner, the distributed identity identifier of the data, the distributed identity identifier of the authorized institution, the generation time and expiration time of the credential, uses the private key of the authorized institution to generate a digital signature on the packaged information through a cryptographic algorithm, and finally packages all the information into a verifiable credential, and returns the verifiable credential to the data owner in the form of a text document. The authorized institution also generates a hash summary for the verifiable credential and records the hash summary on the blockchain for evidence storage. The purpose of saving the hash summary is that on the one hand, the storage cost of the blockchain is high, and directly storing the credential data will affect the performance. The hash summary is only a fixed-length hexadecimal string, which greatly reduces the amount of data. On the other hand, the hash summary is generated by the original data through a cryptographic algorithm. Any change to the data will change the value of the hash summary. Therefore, it is possible to verify whether the verifiable credential has been tampered with only through the hash summary without saving the verifiable credential.

[0064] In an optional implementation manner, the above-mentioned data ownership confirmation method further includes: a pre-performed identity registration operation of the data owner;

[0065] When a data owner registers an identity, the data owner sends a request to create a distributed digital identity to the authority through the client;

[0066] After receiving the request, the authorized agency generates a distributed digital identity for the user and uploads the user's distributed digital identity to the blockchain;

[0067] Specifically, in this embodiment, when creating the distributed digital identity of the data owner, the authorization agency uses a cryptographic algorithm to generate a private key and a public key. The public key is embedded in the user's distributed digital identity and uploaded to the blockchain. The private key is returned to the data owner and saved by the data owner himself. The attribute information of the data owner is recorded in the distributed digital identity. In a specific embodiment, the authorization agency uses a cryptographic algorithm to create a public-private key pair for the data owner; wherein the public key is represented by an Ethereum wallet address, and the public key is registered on the blockchain by the authorization agency calling a smart contract as part of the distributed digital identity; the private key is a hexadecimal string, and the role of the private key is to verify the distributed digital identity of the data owner and create a digital signature. The private key is kept by the data owner himself and prevented from being leaked.

[0068] In summary, the present invention strengthens the protection of data copyright and ensures the immutability and transparency of the copyright confirmation process. In addition, the present invention also implements fine-grained access control without relying on centralized institutions, and strengthens the security management of data.

[0069] In a second aspect, the present invention provides a data rights confirmation system, a client, an authorization agency, a blockchain, and a data storage server:

[0070] The client, the authorization agency and the blockchain execute the data rights confirmation method provided in the first aspect of the present invention.

[0071] The relevant technical solution is the same as the data rights confirmation method provided in the first aspect of the present invention, and will not be elaborated here.

[0072] In a third aspect, the present invention provides a data management method, which is applied to a data management system; Figure 3 As shown, the data management system includes: a client, N authorized agencies, a blockchain and a data storage server; N ≥ 1;

[0073] like Figure 4 As shown, the above data management method includes:

[0074] When the data owner confirms the data rights, the client, the first authorization agency and the blockchain execute the data rights confirmation method provided by the first aspect of the present invention; wherein the first authorization agency is any one of the N authorization agencies;

[0075] When a data user requests to use data, the data user requests the second authorization agency through the client to obtain his own attribute key, downloads the data ciphertext from the data storage server through the second authorization agency, and uses his own attribute key to decrypt the data ciphertext. When his own attributes meet the preset access policy in the data ciphertext, the decryption is successful and the data plaintext is obtained; otherwise, the decryption fails; the second authorization agency is any one of the N authorization agencies.

[0076] In an alternative embodiment, Figure 5 As shown, the above data management method further includes:

[0077] When a verifier proposes to verify the authenticity of a verifiable credential for a piece of ownership data:

[0078] The verifier sends a verifiable credential to a third authority through the client; the third authority is any authority among the N authorities;

[0079] After receiving the verifiable credential, the third authorized institution parses the digital signature, the distributed digital identity identifier of the authorized institution that performs the confirmation operation on the confirmation data, and the data ownership statement from the verifiable credential, and queries the blockchain to see whether the authorized institution that performs the confirmation operation has the qualification to issue certificates;

[0080] If there is a certificate-issuing qualification, the authenticity of the digital signature obtained by parsing is verified. When the verification is passed, the hash value of the verifiable credential is extracted and compared with the hash value of the verifiable credential queried through the blockchain. When the comparison is consistent, the verification result that the verifiable credential is authentic is obtained; when the comparison is inconsistent, the verification result that the verifiable credential is not authentic is obtained; when the verification fails, the verification result that the verifiable credential is not authentic is obtained;

[0081] If there is no certificate-issuing qualification, the verification result obtained will prove that the certificate is not authentic;

[0082] The authenticity of the digital signature obtained by verification includes:

[0083] Using the parsed digital signature and data ownership statement, the public key of the authorized agency performing the title confirmation operation is calculated and compared with the public key of the authorized agency performing the title confirmation operation obtained through blockchain query. When the comparison is consistent, the verification is considered to be successful; otherwise, the verification fails.

[0084] It should be noted that in the above process, the third authorized agency first parses the distributed digital identity identifier and digital signature of the issuer (the authorized agency that performs the title confirmation operation on the title confirmation data) from the verifiable certificate, and queries the blockchain to see whether the issuer has the qualifications to issue the certificate, and then uses the digital signature to verify the authenticity of the certificate, and then uses the blockchain's certificate verification method to verify the information on the certificate chain, and further verify the authenticity of the verifiable certificate.

[0085] The information contained in the verifiable credential can support the verifier to independently complete the credential verification, but it requires certain knowledge. Therefore, the verifier often hands over the verifiable credential to the authorized agency for proxy verification. The verification process is: first check the declaration part of the verifiable credential, especially the ownership information in the declaration, then extract the message that needs signature verification from the verifiable credential and hash the message to generate the hash value of the message, then use the message and signature to recover the signer's Ethereum address from the signature, check whether the signer matches the issuer field described in the credential and verify whether the issuer is qualified through the smart contract, and finally check and compare the hash value of the verifiable credential stored on the chain through the smart contract to further ensure that the credential cannot be tampered with.

[0086] In an optional implementation manner, the above data management method further includes:

[0087] When a user registers an identity, the user sends a request to create a distributed digital identity to the fourth authority through the client;

[0088] After receiving the request, the fourth authorization agency generates a distributed digital identity for the user and uploads the user's distributed digital identity to the blockchain;

[0089] Among them, users include: data owners, data users and verifiers; the fourth authorization agency is any authorization agency among the N authorization agencies.

[0090] Specifically, in this embodiment, when creating a distributed digital identity of a user, the authorization agency uses a cryptographic algorithm to generate a private key and a public key. The public key is embedded in the distributed digital identity and uploaded to the blockchain. The private key is returned to the user and saved by the user himself. The user's attribute information is recorded in the distributed digital identity. In a specific embodiment, the authorization agency uses a cryptographic algorithm to create a public-private key pair for the user. The public key is represented by an Ethereum wallet address. As part of the distributed digital identity, the public key is registered on the blockchain by the authorization agency calling a smart contract. The private key is a hexadecimal string. The function of the private key is to verify the user's distributed digital identity and create a digital signature. The private key is kept by the user himself and prevented from being leaked.

[0091] It should be noted that the above-mentioned first authorization agency, second authorization agency, third authorization agency and fourth authorization agency may be the same or different, and there is no limitation here.

[0092] In a third aspect, the present invention provides a data management system, comprising: a client, N authorization agencies, a blockchain, and a data storage server; N≥1;

[0093] The client, N authorized agencies and blockchain are used to execute the data management method provided in the third aspect of the present invention.

[0094] Among them, the user can act as the owner of the data, that is, the initiator of the right confirmation operation, encrypt the data to generate data ciphertext and submit it to the authorized agency, and use verifiable credentials to prove ownership; or as a data user, download the data ciphertext and obtain the attribute key from the authorized agency. Only the user attributes with ownership meet the access policy and can complete the decryption operation; or as a verifier of ownership, submit a verifiable certificate to the authorized agency to verify the authenticity of ownership.

[0095] The authorized institution is directly connected to the blockchain and stores the user's business information on the blockchain. The authorized institution also has a distributed digital identity and can endorse the user's data ownership. At the same time, the authorized institution also assumes the role of generating and publishing the global parameters required for user encryption and the attribute keys required for decryption;

[0096] Blockchain can store distributed digital identities and verifiable credential information, and assist authorized agencies in completing credential verification and attribute key generation operations;

[0097] The data storage server is responsible for storing the user's encrypted data and providing upload and download interfaces for authorized agencies.

[0098] The relevant technical solution is the same as the data management method provided in the third aspect of the present invention, and will not be described in detail here.

[0099] In summary, the present invention provides a data confirmation method, a data management method and a system for data confirmation. Distributed digital identity has the characteristics of cross-platform identity authentication and privacy protection. The data confirmation process no longer relies solely on centralized identity providers. Users can manage their identities independently and selectively disclose some private data. At the same time, data silos are broken to achieve unified management and sharing of data. Attribute-based encryption is introduced to ensure data security. During the confirmation process, users do not need to trust the authorization agency or worry about data leakage, and fine-grained access control of data is achieved.

[0100] The present invention combines distributed digital identity and ciphertext policy attribute-based encryption, introduces distributed digital identity as an attribute, stores the distributed digital identity of users and data and rights information on the blockchain, and users independently determine access policies during encryption. User attributes are read from the blockchain to generate decryption keys during decryption. Only users who meet the access policies can complete decryption, thereby achieving fine-grained access control and avoiding the risk of data leakage during the process of rights confirmation, ensuring the tamper-proof and transparency of the process of rights confirmation. Users do not need to trust centralized service providers to ensure that only authorized users can access data, thereby achieving distributed access control to reduce single points of failure and increase system security.

[0101] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A data rights confirmation method, characterized in that: Applied to the data rights confirmation system based on blockchain; The data rights confirmation system includes: a client, an authorization agency, a blockchain and a data storage server; The data rights confirmation method includes: The data owner obtains the distributed digital identity identifier of the authorization agency, and requests the authorization agency to obtain the global parameters required for encryption through the client; The data owner embeds the distributed digital identity identifiers of himself and the authorized institution as attributes into the preset access policy; encrypts the ownership confirmation data using the preset access policy after the global parameters and attributes are embedded to obtain data ciphertext; submits the data ciphertext to the authorized institution through the client and initiates a request for ownership confirmation; After receiving the data ciphertext and the confirmation request, the authorization agency uses its own attribute key to decrypt the data ciphertext and reviews the obtained data plaintext; when the review is passed, the hash value of the data plaintext is extracted, a distributed digital identity is generated for the data plaintext, the hash value is embedded in the distributed digital identity of the data plaintext and uploaded to the blockchain; the distributed digital identity identifier of the data owner and the data plaintext is embedded in the data ownership statement and uploaded to the blockchain; the data ciphertext is stored in the data storage server; the data owner is informed of the completion of the confirmation through the client; when the review fails, the data owner is informed of the failure of the confirmation through the client.

2. The data rights confirmation method according to claim 1, characterized in that: The preset access policy includes: access rights, usage scope and time limit of the ownership confirmation data.

3. The data rights confirmation method according to claim 1 or 2, characterized in that: Also includes: The following steps are performed after the confirmation of ownership: The data owner submits a request to the authorization agency through the client to obtain a verifiable credential for the ownership confirmation data; After receiving the request, the authorization agency obtains the data ownership statement of the confirmation data from the blockchain, and uses its own private key to digitally sign it, constructs a verifiable credential including the digital signature, the data ownership statement of the confirmation data and its own distributed digital identity identifier, and sends it to the data owner through the client; extracts the hash value of the verifiable credential, and uploads the hash value of the verifiable credential to the blockchain for evidence storage.

4. A data rights confirmation system, characterized in that: Client, authority, blockchain and data storage server: The client, the authorization agency and the blockchain execute the data rights confirmation method described in any one of claims 1-3.

5. A data management method, characterized in that: Application in data management systems; The data management system includes: a client, N authorized institutions, a blockchain and a data storage server; N≥1; The data management method comprises: When the data owner confirms the data rights, the client, the first authorization agency and the blockchain execute the data rights confirmation method described in any one of claims 1 to 3; the first authorization agency is any one of the N authorization agencies; When a data user requests to use data, the data user requests the second authorization agency through the client to obtain his own attribute key, and downloads the data ciphertext from the data storage server through the second authorization agency, and uses his own attribute key to decrypt the data ciphertext. When his own attributes meet the preset access policy in the data ciphertext, the decryption is successful and the data plaintext is obtained; otherwise, the decryption fails; the second authorization agency is any one of the N authorization agencies.

6. The data management method according to claim 5, characterized in that: Also includes: When a verifier proposes to verify the authenticity of a verifiable credential for a piece of ownership data: The verifier sends a verifiable credential to the third authorization agency through the client; the third authorization agency is any one of the N authorization agencies; After receiving the verifiable credential, the third authorized institution parses the digital signature, the distributed digital identity identifier of the authorized institution that performs the confirmation operation on the confirmation data, and the data ownership statement from the verifiable credential, and queries the blockchain to see whether the authorized institution that performs the confirmation operation has the qualification to issue certificates; If there is a certificate-issuing qualification, the authenticity of the digital signature obtained by parsing is verified. When the verification is passed, the hash value of the verifiable credential is further extracted and compared with the hash value of the verifiable credential queried through the blockchain. When the comparison is consistent, a verification result that the verifiable credential is authentic is obtained; when the comparison is inconsistent, a verification result that the verifiable credential is not authentic is obtained; when the verification fails, a verification result that the verifiable credential is not authentic is obtained; If there is no certificate issuing qualification, the verification result obtained is that the verifiable certificate is not authentic; The verification of the authenticity of the digital signature obtained by the analysis includes: The public key of the authorized agency performing the confirmation operation is calculated using the parsed digital signature and data ownership statement, and compared with the public key of the authorized agency performing the confirmation operation obtained through the blockchain query. When the comparison is consistent, the verification is determined to be successful; otherwise, the verification fails.

7. The data management method according to claim 5 or 6, characterized in that: Also includes: When the user registers an identity, the user sends a request to create a distributed digital identity to the fourth authority through the client; After receiving the request, the fourth authorization agency generates a distributed digital identity for the user and uploads the distributed digital identity of the user to the blockchain; Among them, users include: data owners, data users and verifiers; the fourth authorization agency is any authorization agency among the N authorization agencies.

8. A data management system, characterized in that: include: Client, N authorized institutions, blockchain and data storage server; N≥1； The client, the N authorized agencies and the blockchain are used to execute the data management method described in any one of claims 5-7.

Images