Precisely authorized data element credible circulation method and system

Abstract

The invention relates to the technical field of big data, in particular to a precise authorized data element credible circulation method and system.The method comprises the following steps that user identity registration is carried out through an authentication center, information collection, face detection, face feature extraction, digital identity generation and data storage are included, a vector database is used for storing face feature vectors, and the face feature vectors are stored in the database; generating a digital identity (ID) and a public and private key pair by using a cryptographic algorithm SM2, and generating summary information by using an SM3 algorithm and storing the summary information in an evidence storage center; the beneficial effects are that according to the accurate authorization data element credible circulation method and system provided by the invention, an authentication center realizes digital identity authentication based on face recognition of a vector database, and an authorization center realizes data contract authorization based on modes such as an electronic signature and a handwritten authorization book; the evidence storage center realizes process data evidence storage traceability based on a block chain technology, and the ARQC and ARPC communication protocols realize data signature, encryption and accurate authorization based on a national secret SM2 / SM4 algorithm.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and specifically to a method and system for the trusted circulation of accurately authorized data elements. Background Art

[0002] With the advent of the digital age, data has become a basic strategic resource for economic development and one of the most important assets for enterprises and individuals.

[0003] However, the security and credibility of data have always been the focus of people's attention. At present, data elements are vulnerable to security threats such as tampering, forgery, and leakage during circulation. These problems seriously affect the credibility and integrity of data, especially in the fields of finance, medical care, and the Internet of Things. The demand for data security and credibility is more urgent.

[0004] Therefore, in order to give full play to the role of data elements, it is necessary to establish a trusted data circulation system, and it is imperative to develop a technology that can ensure the security and reliability of data elements during the circulation process. Summary of the invention

[0005] The purpose of the present invention is to provide a method and system for the trusted circulation of accurately authorized data elements to solve the problems raised in the above-mentioned background technology.

[0006] To achieve the above object, the present invention provides the following technical solution: a method for the trusted circulation of accurately authorized data elements, the method comprising the following steps:

[0007] User identity registration is carried out through the authentication center, including information collection, face detection, face feature extraction, digital identity generation and data storage. The vector database is used to store face feature vectors, and the national secret algorithm SM2 is used to generate digital identity ID and public and private key pairs, and the SM3 algorithm is used to generate summary information and save it to the storage center;

[0008] During the data circulation process, the data signature and verification services provided by the authentication center are used to ensure the authenticity and credibility of the data circulation, including face comparison, data signature and verification, and the summary of relevant information is saved in the evidence storage center;

[0009] Data authorization is achieved through the authorization center, including registering digital identity, obtaining authorization documents, building authorization requests, requesting authorization codes and data storage, ensuring that data circulates within the authorized scope, and recording the authorization process through the blockchain storage center;

[0010] The ARQC communication protocol is used for encrypted communication of data requests. The authenticity and accurate authorization of data requests are ensured by constructing and encrypting passes, and the validity of data requests is verified by parsing ARQC.

[0011] The ARPC communication protocol is used to encrypt the result data to ensure its authenticity and credibility. The integrity and security of data circulation are guaranteed through the signing and encrypted transmission of the result data, as well as the decryption and signature verification process.

[0012] Preferably, the facial recognition technology of the authentication center is based on the InsightFace open source facial analysis library, uses the RetinaFace algorithm for face detection and feature extraction, and uses the Milvus vector database for storage and indexing of feature vectors.

[0013] Preferably, during the data authorization process, the authorization center uses an electronic signature or a photo of a handwritten authorization letter to sign the authorization request through the data signature service of the authentication center, and issues an authorization code after review by the authorization center to achieve accurate authorization of the data.

[0014] Preferably, the evidence storage center is based on blockchain technology to achieve decentralized evidence storage and traceability of data. By storing the hash value of the data in the blockchain network, it ensures the authenticity and credibility of the data and provides data traceability function.

[0015] Preferably, ARQC and ARPC communication protocols are used for encrypted communication of data request and result data, respectively. By adopting national secret algorithms SM2 and SM3 and symmetric encryption algorithm SM4, the security and authenticity of data during transmission are ensured, and accurate authorization and verification of data are achieved by parsing the protocol content.

[0016] A precisely authorized trusted circulation system for data elements, the system comprising:

[0017] The authentication center is used to provide digital identity authentication services based on face recognition technology based on vector databases, including identity registration, data signing, and data signature verification functions;

[0018] The authorization center is used to authorize third parties to use personal data, and to issue authorization codes through electronic signatures and handwritten authorization letters.

[0019] The evidence storage center realizes decentralized evidence storage and traceability of data based on blockchain technology to ensure the authenticity and credibility of the data;

[0020] ARQC communication protocol, used for encrypted communication of data requests, ensuring the authenticity and accurate authorization of requests;

[0021] ARPC communication protocol is used for encrypted communication of result data to ensure the authenticity and reliability of the result data.

[0022] Preferably, the authentication center performs the following steps to implement the identity registration function:

[0023] Information collection, including personal information such as ID number and name filled in by the user, and facial images collected or uploaded through the camera;

[0024] Face detection: detect faces and locate key points of facial features based on InsightFace's RetinaFace algorithm;

[0025] Face feature extraction: extract face feature vectors and save them into Milvus vector database;

[0026] Digital identity generation, generating digital identity ID and public and private key pairs of SM2 algorithm;

[0027] Data storage: Personal digital identity related information is stored in the storage center through the SM3 algorithm to generate summary information.

[0028] Preferably, the authorization center performs the following steps to implement the data authorization function:

[0029] Third-party data users register digital identities through the authentication center;

[0030] The third party obtains the data use contract document and applies for an electronic signature or handwritten authorization letter from the data holder;

[0031] The third party constructs an authorization request containing information such as the authorizing subject, the authorized subject, the number of authorizations, and the validity period, and signs it through the certification center;

[0032] The third party sends an authorization request to the authorization center, which issues an authorization code after verification.

[0033] The authorization-related information is saved in the evidence storage center by generating summary information through the SM3 algorithm.

[0034] Preferably, the evidence storage center uses blockchain technology to achieve the following functions:

[0035] Data storage: storing the hash value of the data in the blockchain network to ensure the authenticity and credibility of the data;

[0036] Data traceability, by querying the hash value in the blockchain network, the traceability verification of the original data is achieved.

[0037] Preferably, ARQC and ARPC communication protocols are used for encrypted communication of data request and result data respectively, wherein:

[0038] The ARQC protocol includes pass generation, ARQC encryption and parsing steps, and encrypts and decrypts data through SM4 and SM3 algorithms to ensure the authenticity and accurate authorization of data requests;

[0039] The ARPC protocol includes result data signature, ARPC encryption and parsing steps. The result data is processed by the same encryption technology to ensure the authenticity and credibility of the result data.

[0040] Both enhance the security of data circulation through the signature and verification services of the certification center.

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] The present invention proposes a method and system for the trusted circulation of data elements with precise authorization. The authentication center implements digital identity authentication based on face recognition of vector database, the authorization center implements data contract authorization based on electronic signatures and handwritten authorization letters, and the evidence storage center implements process data evidence storage and traceability based on blockchain technology. The ARQC and ARPC communication protocols implement data signing, encryption, and precise authorization based on the national secret SM2 / SM4 algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 is a flow chart of the method of the present invention;

[0044] Figure 2 This is a flowchart of the authorization request protocol of the present invention;

[0045] Figure 3 The ARQC structure flow chart of the present invention is as follows;

[0046] Figure 4 This is a flow chart of the ARPC structure of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose and technical solution of the present invention clearly and completely described, and the advantages more clearly understood, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] For example, see Figure 1 The present invention provides a technical solution: a method for the trusted circulation of accurately authorized data elements, the method comprising the following steps:

[0049] User identity registration is performed through the authentication center, including information collection, face detection, face feature extraction, digital identity generation and data storage. A vector database is used to store face feature vectors, and the national secret algorithm SM2 is used to generate a digital identity ID and public-private key pairs, and the SM3 algorithm is used to generate summary information and save it to the storage center. The authentication center's face recognition technology is based on the InsightFace open source facial analysis library, using the RetinaFace algorithm for face detection and feature extraction, and using the Milvus vector database for feature vector storage and indexing.

[0050] During the data circulation process, the data signature and verification services provided by the certification center are used to ensure the authenticity and credibility of the data circulation, including face matching, data signature and verification, and the summary of relevant information is saved in the evidence storage center; during the data authorization process, the authorization center uses electronic signatures or takes photos of handwritten authorization letters, signs the authorization request through the data signature service of the certification center, and issues an authorization code after review by the authorization center to achieve accurate data authorization.

[0051] Data authorization is achieved through the authorization center, including registering digital identity, obtaining authorization documents, building authorization requests, requesting authorization codes and data notarization, ensuring that data circulates within the authorized scope, and recording the authorization process through the blockchain notarization center; the notarization center is based on blockchain technology to achieve decentralized notarization and traceability of data, and ensures the authenticity and credibility of the data by storing the hash value of the data in the blockchain network, and provides data traceability function.

[0052] The ARQC communication protocol is used for encrypted communication of data requests. The authenticity and accurate authorization of data requests are ensured by constructing and encrypting passes, and the validity of data requests is verified by parsing ARQC.

[0053] The ARPC communication protocol is used to encrypt the result data to ensure its authenticity and credibility. The integrity and security of data circulation are guaranteed through the signing and encrypted transmission of the result data, as well as the decryption and signature verification process. The ARQC and ARPC communication protocols are used for encrypted communication of data requests and result data respectively. The security and authenticity of data during transmission are ensured by adopting the national secret algorithms SM2 and SM3 and the symmetric encryption algorithm SM4, and accurate authorization and verification of data are achieved by parsing the protocol content.

[0054] Embodiment 2, based on embodiment 1, refers to the attached Figures 2 to 4 As shown, a precisely authorized data element trusted circulation system is proposed, and the system includes:

[0055] I. Certification Center

[0056] The authentication center provides digital identity authentication services based on face recognition technology of vector database to ensure the security, accuracy and reliability of user identity information. This module includes identity registration, data signature and data verification functions.

[0057] The specific steps of the identity registration function are as follows:

[0058] A. Information collection: Users fill in personal information such as ID number and name, and collect personal facial images through a camera or upload them themselves.

[0059] B. Face detection: Based on the InsightFace open source facial analysis library, the authentication center uses its face detection algorithm RetinaFace to detect the face position, locate the key points of the facial features, and extract the face to ensure that there is only one face in the image while ensuring the quality of the face image.

[0060] C. Facial feature extraction: Based on the InsightFace open source facial analysis library, the authentication center extracts the facial feature vector through its facial feature extraction algorithm and saves the feature vector in the vector database Milvus. Milvus will store and index the facial feature vector.

[0061] D. Digital identity generation: Generate a personal digital identity ID and a pair of public and private keys of the national secret algorithm SM2 for subsequent data signing and signature verification functions.

[0062] E. Data storage: The personal digital identity related information is saved in the storage center by generating summary information through the SM3 algorithm

[0063] The specific steps of the data signature function are as follows:

[0064] A. Information collection: The user fills in the ID number and the data to be signed, and collects the personal face image through the camera or uploads it by himself.

[0065] B. Face matching: Face similarity is calculated based on cosine distance. When the cosine similarity between the uploaded face image and Milvus face image is greater than 90%, they are judged to be the same person.

[0066] C. Data signature: Get the user's private key and sign the data based on the SM2 algorithm

[0067] D. Data storage: The signature-related information of the data is saved in the storage center by generating summary information through the SM3 algorithm.

[0068] The specific steps of the data signature verification function are as follows:

[0069] A. Information collection: The user fills in the ID number, signed data, and data to be verified, and collects the personal face image through the camera or uploads it by himself.

[0070] B. Face matching: Face similarity is calculated based on cosine distance. When the cosine similarity between the uploaded face image and Milvus face image is greater than 90%, they are judged to be the same person.

[0071] C. Data signature verification: Obtain the user's public key and verify the data based on the SM2 algorithm

[0072] D. Data storage: The data verification related information is saved in the storage center by generating summary information through the SM3 algorithm

[0073] II. Authorization Center

[0074] In scenarios where personal data needs to be authorized for use by a third party, the authorization center authorizes the data based on electronic signatures and handwritten authorization letters, and issues an authorization code to the third party for subsequent data requests. The specific steps of this module are as follows:

[0075] A. Register digital identity: Third-party data users register digital identity through the authentication center and obtain digital identity ID and public and private keys.

[0076] B. Obtain authorization documents: The third-party data user drafts a data usage contract document, including data fields, data scope conditions, etc., and applies to the data holder for an electronic signature or requires the data holder to take a photo of a handwritten authorization letter.

[0077] C. Constructing an authorization request: The third-party data user constructs an authorization request through the authorization file obtained above, including the authorization subject identification, the authorized subject identification, the number of authorizations, the authorization validity period, the authorization agreement, etc. The authorization request is signed through the data signature service of the certification center. The specific authorization request protocol is as follows: Figure 2 shown.

[0078] D. Request authorization code: The third-party data user sends an authorization request to the authorization center. The authorization center verifies the request signature through the authentication center data verification service. After the review is passed, the authorization code is issued for subsequent construction of ARQC data requests.

[0079] E. Data storage: The authorization-related information is saved in the storage center by generating summary information through the SM3 algorithm.

[0080] III. Evidence Storage Center

[0081] Based on blockchain technology, the evidence storage center realizes decentralized data storage and traceability, avoiding data tampering, loss, forgery and other problems that may exist in centralized databases or third-party institutions, and ensuring the authenticity and credibility of the data.

[0082] A. Data storage: Store the hash value of the data in the blockchain network, and use the decentralized and tamper-proof characteristics of the blockchain to ensure the authenticity and credibility of the data.

[0083] B. Data traceability: By querying the hash value in the blockchain network, the original data can be traced. When the authenticity of the data needs to be verified, it is only necessary to compare the hash value of the data with the hash value in the blockchain network. If they are consistent, it proves that the data has not been tampered with and is authentic and trustworthy.

[0084] IV.ARQC Communication Protocol

[0085] The ARQC communication protocol is used for encrypted communication of data requests to ensure the authenticity and reliability of data requests. By extracting the unique identifier of the business data subject in the pass, such as identity card information, and related authorized data contract conditions, the data subject's unique identifier and data contract conditions are added to the data request body to ensure that the requested data is indeed the data authorized by the data subject itself, rather than other data out of scope, thereby achieving the purpose of accurate authorization.

[0086] The ARQC construction steps are as follows:

[0087] A. Pass generation: There are two types of passes: issued by individuals and issued by agencies. They contain basic information such as data platform / channel, business matters, service subject (data holder), handling unit (data user), data products, data resources, data access parameters, etc.

[0088] a) After completing the basic information of the individual's pass, a signature needs to be generated through the authentication center's data signature interface.

[0089] b) The agency that issues the pass on behalf of others needs to obtain the authorization code from the authorization center and put it in the pass without signing.

[0090] B.ARQC encryption: ARQC is generated after encrypting the pass to ensure the reliability of the pass. It contains the ARQC version number, the pass ciphertext encrypted by SM4, the SM4 key ciphertext encrypted by the SM3 public key, the symmetric key algorithm (SM4), and the asymmetric key algorithm (SM3).

[0091] a) Generate the SM4 key K and use the key K to encrypt the pass to generate ciphertext

[0092] b) Obtain the public key P of SM2 of the data platform from the authentication center, use the public key P to encrypt the key K, and generate the key ciphertext

[0093] c) Fill the pass ciphertext, key ciphertext, symmetric encryption algorithm SM4, and asymmetric encryption algorithm SM2 into ARQC

[0094] The ARQC analysis steps are as follows:

[0095] A.ARQC decryption: After receiving the ARQC request, the data platform uses its own SM2 private key to decrypt the SM4 key ciphertext to obtain the key K, and then uses the key K to decrypt the pass ciphertext to obtain the pass.

[0096] B. Pass verification: Obtain the pass type. Individuals who issue passes obtain the service subject identification and have it verified by the certification center. The agency that issues the pass on behalf of others obtains the authorization code and has the authorization center verify the validity of the authorization code.

[0097] C. Complete data request parameters: Complete the service subject identification and data resource constraints into the request parameters to ensure accurate authorization of data.

[0098] V.ARPC Communication Protocol

[0099] The ARPC communication protocol is used for encrypted communication of result data to ensure the authenticity and reliability of the result data.

[0100] The ARPC construction steps are as follows:

[0101] A. Result data signature: The result data includes business information, number of data items, data sets, etc. The data platform signs the result data with its own SM2 private key or through the data signature interface of the certification center.

[0102] B.ARPC encryption: ARPC is generated after encrypting the result data to ensure the reliability of the result data. It includes the ARPC version number, the result data ciphertext encrypted by SM4, the SM4 key ciphertext encrypted by the SM3 public key, the symmetric key algorithm (SM4), and the asymmetric key algorithm (SM3).

[0103] a) Generate the SM4 key K and use the key K to encrypt the pass to generate ciphertext

[0104] b) Obtain the public key P of SM2 of the handling unit from the certification center, use the public key P to encrypt the key K, and generate the key ciphertext

[0105] c) Fill the pass ciphertext, key ciphertext, symmetric encryption algorithm SM4, and asymmetric encryption algorithm SM2 into ARPC

[0106] The ARPC parsing steps are as follows:

[0107] A. ARQC decryption: After receiving the ARPC response, the data user uses his own SM2 private key to decrypt the SM4 key ciphertext to obtain the key K, and then decrypts the result data ciphertext using the key K to obtain the result data.

[0108] B. Result data verification: obtain the data platform public key to verify the result data or verify it through the authentication center data verification interface.

[0109] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for the trusted circulation of data elements with precise authorization, characterized by: The method comprises the following steps: User identity registration is carried out through the authentication center, including information collection, face detection, face feature extraction, digital identity generation and data storage. The vector database is used to store face feature vectors, and the national secret algorithm SM2 is used to generate digital identity ID and public and private key pairs, and the SM3 algorithm is used to generate summary information and save it to the storage center; During the data circulation process, the data signature and verification services provided by the authentication center are used to ensure the authenticity and credibility of the data circulation, including face comparison, data signature and verification, and the summary of relevant information is saved in the evidence storage center; Data authorization is achieved through the authorization center, including registering digital identity, obtaining authorization documents, building authorization requests, requesting authorization codes and data storage, ensuring that data circulates within the authorized scope, and recording the authorization process through the blockchain storage center; The ARQC communication protocol is used for encrypted communication of data requests. The authenticity and accurate authorization of data requests are ensured by constructing and encrypting passes, and the validity of data requests is verified by parsing ARQC. The ARPC communication protocol is used to encrypt the result data to ensure its authenticity and credibility. The integrity and security of data circulation are guaranteed through the signing and encrypted transmission of the result data, as well as the decryption and signature verification process.

2. According to claim 1, a method for the trusted circulation of data elements with accurate authorization is characterized by: The authentication center's facial recognition technology is based on the InsightFace open source facial analysis library, uses the RetinaFace algorithm for face detection and feature extraction, and uses the Milvus vector database for feature vector storage and indexing.

3. According to claim 1, a method for the trusted circulation of data elements with accurate authorization is characterized by: During the data authorization process, the authorization center uses an electronic signature or a photo of a handwritten authorization letter to sign the authorization request through the data signature service of the certification center, and issues an authorization code after review by the authorization center to achieve accurate data authorization.

4. According to claim 1, a method for the trusted circulation of data elements with accurate authorization is characterized by: The evidence storage center is based on blockchain technology to achieve decentralized evidence storage and traceability of data. By storing the hash value of the data in the blockchain network, it ensures the authenticity and credibility of the data and provides data traceability function.

5. According to claim 1, a method for the trusted circulation of data elements with accurate authorization is characterized by: The ARQC and ARPC communication protocols are used for encrypted communication of data requests and result data respectively. By adopting the national secret algorithms SM2 and SM3 and the symmetric encryption algorithm SM4, the security and authenticity of data during transmission are ensured, and accurate authorization and verification of data are achieved by parsing the protocol content.

6. A system for the trusted circulation of data elements with accurate authorization according to the trusted circulation method of data elements with accurate authorization according to any one of claims 1 to 5, characterized in that: The system comprises: The authentication center is used to provide digital identity authentication services based on face recognition technology based on vector databases, including identity registration, data signing, and data signature verification functions; The authorization center is used to authorize third parties to use personal data, and to issue authorization codes through electronic signatures and handwritten authorization letters. The evidence storage center realizes decentralized evidence storage and traceability of data based on blockchain technology to ensure the authenticity and credibility of the data; ARQC communication protocol, used for encrypted communication of data requests, ensuring the authenticity and accurate authorization of requests; ARPC communication protocol is used for encrypted communication of result data to ensure the authenticity and reliability of the result data.

7. The data element trusted circulation system for accurate authorization according to claim 6, characterized in that: The authentication center performs the following steps to implement the identity registration function: Information collection, including personal information such as ID number and name filled in by the user, and facial images collected or uploaded through the camera; Face detection: detect faces and locate key points of facial features based on InsightFace's RetinaFace algorithm; Face feature extraction: extract face feature vectors and save them into Milvus vector database; Digital identity generation, generating digital identity ID and public and private key pairs of SM2 algorithm; Data storage: Personal digital identity related information is stored in the storage center through the SM3 algorithm to generate summary information.

8. The data element trusted circulation system for accurate authorization according to claim 6, characterized in that: The authorization center performs the following steps to implement the data authorization function: Third-party data users register digital identities through the authentication center; The third party obtains the data use contract document and applies for an electronic signature or handwritten authorization letter from the data holder; The third party constructs an authorization request containing information such as the authorizing subject, the authorized subject, the number of authorizations, and the validity period, and signs it through the certification center; The third party sends an authorization request to the authorization center, which issues an authorization code after verification. The authorization-related information is saved in the evidence storage center by generating summary information through the SM3 algorithm.

9. The data element trusted circulation system for accurate authorization according to claim 6, characterized in that: The Evidence Storage Center uses blockchain technology to achieve the following functions: Data storage: storing the hash value of the data in the blockchain network to ensure the authenticity and credibility of the data; Data traceability, by querying the hash value in the blockchain network, the traceability verification of the original data is achieved.

10. The data element trusted circulation system for accurate authorization according to claim 6, characterized in that: The ARQC and ARPC communication protocols are used for encrypted communication of data request and result data respectively, where: The ARQC protocol includes pass generation, ARQC encryption and parsing steps, and encrypts and decrypts data through SM4 and SM3 algorithms to ensure the authenticity and accurate authorization of data requests; The ARPC protocol includes result data signature, ARPC encryption and parsing steps. The result data is processed by the same encryption technology to ensure the authenticity and credibility of the result data. Both enhance the security of data circulation through the signature and verification services of the certification center.

Images