A trusted interaction method and system for cross-domain smart justice

Abstract

The present invention belongs to the field of identity authentication. In order to solve the problem that the current judicial cross-departmental networks are physically isolated and the blockchain cannot be deployed and applied across departments, the present invention provides a trusted interaction method and system for smart judicial cross-domain. Each domain configures a trust domain through the proxy node of the domain, and multiple trust domains are composed of a trust group; the proxy node obtains the digital identity information of other proxy nodes in the trust domain at regular intervals, and synchronizes with the shared cache database of the proxy node of the domain; the user generates a key pair using a homomorphic encryption algorithm through the proxy node of the domain, generates a verifiable credential using a private key, uploads it to a distributed shared cache database, and stores the private key locally; the resource service provider obtains the user's public key by retrieving the shared cache database, and uses a challenge response method to verify whether the credential is valid using zero-knowledge proof. The present invention can realize the trusted mutual recognition of cross-domain digital identities in the judicial private network.

Description

Technical Field

[0001] The present invention belongs to the field of identity authentication, and specifically relates to a trusted interaction method and system for cross-domain smart justice. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the rapid development of social economy and science and technology, the content of digital services is becoming more and more abundant, and people are becoming more and more dependent on digital space. Digital identity, as the unique identifier of physical space entities mapped to digital space, has become increasingly important in the trust system of digital space and has become one of the key infrastructures for the construction of a digital society. In the judicial field, the various departments of the courts and procuratorates use dedicated networks to be physically isolated from the Internet, and cross-border information interaction between departments is achieved by dual one-way isolation gateways and file ferrying. Due to the urgent need for judicial business collaboration to improve case handling efficiency and quality, it is urgent to explore new digital identity authentication systems to ensure that cross-domain user privacy data is not leaked in order to meet the relevant requirements under the current judicial status quo.

[0004] At present, most of the secure and reliable digital identity technologies represented by Chinese patent application CN11716361A, a blockchain digital identity authentication control system and method, Chinese patent application CN115834162B, a distributed digital identity management method, a trusted identity chain and a user terminal, and Chinese patent application CN115883102 A, a cross-domain identity authentication method, system and electronic device based on identity credibility, are based on blockchain, combined with cryptography and privacy protection theory to build a decentralized trusted digital identity, solving problems such as cross-platform verification, authorization, identity fragmentation, single point failure, and privacy compatibility.

[0005] However, the current cross-departmental communication of the judicial dedicated network is based on dual one-way isolation optical gates, the network is physically isolated, and the blockchain cannot be deployed across departments. Therefore, the above methods are difficult to meet the relevant requirements of the current judicial situation. Summary of the invention

[0006] In order to solve the above problems, the present invention proposes a trusted interaction method and system for cross-domain smart judicial services. The present invention is based on the privacy protection theory, integrates technologies such as decentralized digital identity and digital sovereign identity, and realizes trusted mutual recognition of cross-domain digital identities in judicial private networks without relying on third parties, laying the foundation for the construction of a trust system for collaborative services.

[0007] The precondition of the present invention is that the proxy node within the judicial and prosecutorial department domain is credible and the user information imported into the proxy node is authorized by the judicial and prosecutorial department unit.

[0008] The judicial and prosecutorial departments of the present invention refer to courts, procuratorates and judicial administrative organs. Each part has a domain.

[0009] According to some embodiments, the present invention adopts the following technical solutions:

[0010] A cross-domain trusted interaction method for smart justice includes the following steps:

[0011] The court domain, the procuratorate domain and the judicial administrative organ domain configure trust domains through the proxy nodes of the respective domains, and form a trust group with multiple trust domains;

[0012] Based on the message mechanism of dual one-way isolation optical gates, the proxy node periodically obtains the digital identity information of other proxy nodes in the trust domain, synchronizes it with the shared cache database of the proxy node in the domain, and keeps the digital identity information of the trust domain consistent;

[0013] The shared cache database of the proxy node is synchronized with the physical database of the domain to ensure that the digital identity data of the shared cache database and the physical database are consistent;

[0014] The court domain, procuratorate domain and judicial administrative organ domain import user identity data through the proxy node of the domain and generate a shared unified digital identity;

[0015] When a user logs in to the proxy node of this domain, the identity information is initialized, a key pair is generated using a homomorphic encryption algorithm, the private key is stored locally, and the public key and verifiable credentials are uploaded to the shared cache database;

[0016] The resource service provider or the credential verifier obtains the public key by searching the shared cache database, and uses a two-way challenge response mode and zero-knowledge proof to verify whether the credential is valid.

[0017] As an optional implementation, all proxy nodes of the trust group may establish a connection to achieve trusted intercommunication among the proxy nodes within the trust group.

[0018] As an optional implementation, the formation process of the trust group includes multiple digital identity identifiers of different trust domains. Form a group, each digital identity in the group They can all trust each other; the group administrator of the proxy node in the group, the digital identity under the jurisdiction of the proxy node is the group member, the group administrator issues certificates to the group members, the group members use the certificates and information to generate the group signature, and the verifier verifies the group signature to obtain the legitimacy of the digital identity.

[0019] As an optional implementation, the process of the proxy node's message mechanism based on dual unidirectional isolation optical gates includes a message sending / receiving machine, a front-end / back-end machine, and an uplink / downlink unidirectional optical gate.

[0020] As a further step, the message sending machine packages the message and transmits it to the file directory specified by the front-end machine; the upstream one-way optical gate transmits the sending file of the front-end machine to the specified file directory of the back-end machine in one direction; the message receiving machine periodically reads the file directory of the back-end machine to obtain the message; the message receiving machine generates a data packet from the feedback message and pushes it to the file directory specified by the back-end machine; the downstream one-way optical gate transmits the sending file of the back-end machine to the specified file directory of the front-end machine in one direction; the message sending machine periodically reads the file directory of the front-end receiving file to obtain the feedback message.

[0021] As an optional implementation, the unified digital identity is used as a unique identity for each domain, and the format includes a domain name and a universal unique identifier.

[0022] As an optional implementation, the process of generating a key pair using a homomorphic encryption algorithm includes using a multiplication homomorphic RSA algorithm, wherein the RSA algorithm was proposed by Ronald Rivest, Adi Shamir, and Leonard Adleman in 1977. RSA is composed of the initials of the surnames of the three people, and is an asymmetric encryption algorithm. Unlike the symmetric encryption algorithm, the RSA algorithm has two different keys, one is a public key and the other is a private key.

[0023] The private key signs the information, and the verifier uses the public key to verify the legitimacy of the signature; the public key encrypts the information, and only the private key owner can decrypt the information, ensuring the security of the information;

[0024] The encryption process is: ,in For plain text, is the ciphertext, is the public key;

[0025] The decryption process is: ,in For plain text, is the ciphertext, For the private key.

[0026] As an optional implementation, the process of using the two-way challenge response mode includes:

[0027] The client randomly generates a challenge , using the server's public key Homomorphic encryption ciphertext , where the function It is an encryption function and requests identity authentication;

[0028] The server accepts the challenge from the client ,in is the server-side private key, To serve the challenge ciphertext received from the client, function is the decryption function;

[0029] The server generates a response ,in For the received client challenge, is the client's public key;

[0030] The server randomly generates a challenge , using the client's public key Homomorphic encryption becomes a ciphertext challenge ;

[0031] The server will challenge the ciphertext and response Send to the client;

[0032] The client receives the response from the server and Challenges ,like , the server is credible;

[0033] The client accepts the server's challenge ,in is the client private key, The client receives the challenge ciphertext from the server;

[0034] The client generates a response ,in For the server challenge received, is the public key of the server;

[0035] The client will respond with the ciphertext Send to the server;

[0036] The server receives the client's response .like , the client is credible;

[0037] After the server and client verify each other's trustworthiness, they can communicate.

[0038] As an optional implementation method, the process of using zero-knowledge proof to verify whether the credential is valid includes: the verifiable credential mainly includes three parts: the first part is the header, including the sender identifier, the sender's domain, the receiver identifier, the receiver's domain and the title; the second part is the data part; the third part is the verifiable information, including the issuance time, issuance duration, issuing agent node and the digital signature of the credential.

[0039] A cross-domain trusted interaction system for smart justice, including:

[0040] The grouping module is configured as a court domain, a procuratorate domain and a judicial administrative organ domain, and each domain configures a trust domain through a proxy node of the domain, and forms a trust group with multiple trust domains;

[0041] The proxy node information update module is configured as a message mechanism based on dual one-way isolation optical gates, which periodically obtains the digital identity information of other proxy nodes in the trust domain, synchronizes with the shared cache database of the proxy nodes in the domain, and keeps the digital identity information of the trust domain consistent;

[0042] A database synchronization module is configured to synchronize the shared cache database of the proxy node with the physical database of the domain to ensure that the digital identity data of the shared cache database and the physical database are consistent;

[0043] The identity information import module is configured to import user identity data through the proxy node of the court domain, the procuratorate domain and the judicial administrative organ domain, and generate a shared unified digital identity;

[0044] The encryption module is configured to initialize the identity information when a user logs into the proxy node of the domain, generate a key pair using a homomorphic encryption algorithm, store the private key locally, and upload the public key and verifiable credentials to the shared cache database;

[0045] The credential verification module is configured to obtain the public key by searching the shared cache database, and use a two-way challenge response mode and zero-knowledge proof to verify whether the credential is valid.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] The present invention can propose a solution for trusted mutual recognition of cross-domain digital identities in a judicial private network without relying on a third party and ensuring security, thereby reducing the difficulty of deploying and implementing cross-domain digital identities in a judicial private network.

[0048] The present invention establishes a data sharing model based on a trust group to replace the alliance chain solution, form a universal method, improve the speed of data sharing access, and reduce the cost of data security infrastructure construction.

[0049] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0051] Figure 1A schematic diagram of decentralized digital identity authentication for smart justice according to an embodiment;

[0052] Figure 2 A schematic diagram of a message mechanism based on dual unidirectional isolation optical gates according to an embodiment;

[0053] Figure 3 A flow chart of a two-way challenge response mode according to an embodiment. DETAILED DESCRIPTION

[0054] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0055] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0056] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0057] In the absence of conflict, the embodiments in this application and the features in the embodiments may be combined with each other.

[0058] Embodiment 1

[0059] A trusted interaction method for cross-domain unified digital identity authentication for smart justice, based on privacy protection theory, integrating technologies such as decentralized digital identity and digital sovereign identity.

[0060] The following is a detailed description, such as Figure 1 As shown, the method comprises the following steps:

[0061] S1: The judicial and prosecutorial domain configures a trust domain through the proxy node of the domain, and multiple trust domains are combined into a trust group. All proxy nodes in the trust group can establish connections to achieve trusted intercommunication between proxy nodes in the trust group.

[0062] S2: Based on the message mechanism of dual one-way isolation optical gates, the proxy node periodically obtains the digital identity information of other proxy nodes in the trust domain, synchronizes it with the shared cache database of the proxy nodes in this domain, and keeps the digital identity information of the trust domain consistent.

[0063] If the proxy node crashes and restarts, repeat this step;

[0064] It should be noted that this step is continuously executed during the entire process to update the digital identity information of other proxy nodes in the trust domain.

[0065] S3: The shared cache database of the proxy node is synchronized with the physical database of the domain to ensure that the digital identity data of the shared cache database and the physical database are consistent.

[0066] In some embodiments, after this step is completed, step S2 may be repeated;

[0067] S4: The judicial and prosecutorial domain imports user identity data through the proxy node of this domain and generates a shared unified digital identity.

[0068] The imported new user digital identity data and step S5 are performed simultaneously;

[0069] In some embodiments, after this step is completed, step S2 may be repeated;

[0070] S5: The user logs in to the proxy node of the domain, initializes the identity information, and generates a key pair using the homomorphic encryption algorithm. The private key is stored locally, and the public key and verifiable credentials are uploaded to the shared cache database.

[0071] In some embodiments, after this step is completed, step S2 may be repeated;

[0072] S6: The resource service provider (credential verifier) ​​obtains the user's public key by retrieving the shared cache database, and uses a two-way challenge response mode and zero-knowledge proof to verify whether the credential is valid.

[0073] In this embodiment, the trust group is expressed as follows:

[0074] Digital identities across multiple trust domains Form a group, each digital identity in the group The group administrator of the proxy node in the group and the digital identity under the control of the proxy node are group members. The group administrator issues certificates to group members. Group members can use certificates and information to generate group signatures. The verifier only needs to verify the generated group signature to obtain the legitimacy of the digital identity.

[0075] In this embodiment, Figure 2As shown, the message mechanism based on dual unidirectional isolation optical gates includes a message sending / receiving machine, a front-end machine / rear-end machine, and an upstream / downstream unidirectional optical gate. The message sending machine packages the message and transmits it to the file directory specified by the front-end machine; the upstream unidirectional optical gate unidirectionally transmits the sending file of the front-end machine to the specified file directory of the rear-end machine; the message receiving machine periodically reads the file directory of the rear-end machine to obtain the message; the message receiving machine generates a data packet from the feedback message and pushes it to the file directory specified by the rear-end machine; the downstream unidirectional optical gate unidirectionally transmits the sending file of the rear-end machine to the specified file directory of the front-end machine; the message sending machine periodically reads the file directory of the receiving file of the front-end machine to obtain the feedback message.

[0076] In this embodiment, the unified digital identity is a unique identity in the judicial and prosecutorial domain. The format is as follows:

[0077] domain:uuid

[0078] domain: domain name. For example, the domain name of the court is FY; the domain name of the procuratorate is JC.

[0079] uuid: (Universally Unique Identifier) ​​Universally unique identifier, a string of 32-bit characters that identifies the user.

[0080] Optionally, the homomorphic encryption algorithm adopts the multiplicative homomorphic RSA algorithm, the private key signs the information, and the verifier can use the public key to verify the legitimacy of the signature; the public key encrypts the information, and only the private key owner can decrypt the information, ensuring the security of the information.

[0081] The RSA encryption process is: ,in For plain text, is the ciphertext, is the public key.

[0082] The RSA decryption process is: ,in For plain text, is the ciphertext, For the private key.

[0083] Optionally, the two-way challenge response mode is an identity authentication mechanism that enhances security and ensures the identity of the requester.

[0084] The specific process is as follows Figure 3 As shown:

[0085] (1) The client randomly generates a challenge , using the server's public key Homomorphic encryption ciphertext , where the function is an encryption function. And request identity authentication;

[0086] (2) The server accepts the challenge from the client ,in is the server-side private key, To serve the challenge ciphertext received from the client, function is the decryption function;

[0087] (3) The server generates a response ,in For the received client challenge, is the client's public key;

[0088] (4) The server randomly generates a challenge , using the client's public key Homomorphic encryption becomes a challenge ciphertext ;

[0089] (5) The server will challenge the ciphertext and response Send to the client;

[0090] (6) The client receives the response from the server and Challenges .like , the server is credible;

[0091] (7) The client accepts the server's challenge ,in is the client private key, The client receives the challenge ciphertext from the server;

[0092] (8) The client generates a response ,in For the server challenge received, is the public key of the server;

[0093] (9) The client will respond with a ciphertext Send to the server;

[0094] (10) The server receives the client's response .like , the client is trustworthy.

[0095] After the server and client have verified each other's trustworthiness, they can communicate.

[0096] Optionally, a zero-knowledge proof verifiable credential is a generated unified digital identity credential that uses a zero-knowledge proof protocol to prove the legitimacy of the credential without leaking privacy. The verifiable credential mainly consists of three parts: the first part is the header, including information such as the sender identifier, the sender's domain, the receiver identifier, the receiver's domain and the title; the second part is the data part; the third part is the verifiable information, including the issuance time, issuance duration, issuing agent node and the digital signature of the credential.

[0097] This embodiment achieves the trusted mutual recognition of cross-domain digital identities in the judicial network without relying on a third party (such as blockchain, Certificate Authority (CA)), laying the foundation for the construction of a trust system for collaborative services. The prerequisite of the present invention is that the proxy node in the domain of the judicial and prosecutorial department is credible and the user information imported into the proxy node is permitted by the judicial and prosecutorial department.

[0098] Embodiment 2

[0099] A cross-domain trusted interaction system for smart justice, including:

[0100] The grouping module is configured as a court domain, a procuratorate domain and a judicial administrative organ domain, and each domain configures a trust domain through a proxy node of the domain, and forms a trust group with multiple trust domains;

[0101] The proxy node information update module is configured as a message mechanism based on dual one-way isolation optical gates, which periodically obtains the digital identity information of other proxy nodes in the trust domain, synchronizes with the shared cache database of the proxy nodes in the domain, and keeps the digital identity information of the trust domain consistent;

[0102] A database synchronization module is configured to synchronize the shared cache database of the proxy node with the physical database of the domain to ensure that the digital identity data of the shared cache database and the physical database are consistent;

[0103] The identity information import module is configured to import user identity data through the proxy node of the court domain, the procuratorate domain and the judicial administrative organ domain, and generate a shared unified digital identity;

[0104] The encryption module is configured to initialize the identity information when a user logs into the proxy node of the domain, generate a key pair using a homomorphic encryption algorithm, store the private key locally, and upload the public key and verifiable credentials to the shared cache database;

[0105] The credential verification module is configured to obtain the public key by searching the shared cache database, and use a two-way challenge response mode and zero-knowledge proof to verify whether the credential is valid.

[0106] It should be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of an all-hardware embodiment, an all-software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of one or more computer-usable storage media (including but not limited to disk storage, CD - ROM , optical storage, etc.).

[0107] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0108] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0109] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0110] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made by those skilled in the art within the spirit and principle of the present invention without creative labor shall be included in the protection scope of the present invention.

Claims

1. A trusted interaction method for cross-domain smart justice, characterized by: The following steps are involved: The court domain, the procuratorate domain and the judicial administrative organ domain configure trust domains through the proxy nodes of the respective domains, and form a trust group with multiple trust domains; Based on the message mechanism of dual one-way isolation optical gates, the proxy node periodically obtains the digital identity information of other proxy nodes in the trust domain, synchronizes it with the shared cache database of the proxy node in the domain, and keeps the digital identity information of the trust domain consistent; The shared cache database of the proxy node is synchronized with the physical database of the domain to ensure that the digital identity data of the shared cache database and the physical database are consistent; The court domain, procuratorate domain and judicial administrative organ domain import user identity data through the proxy node of the domain and generate a shared unified digital identity; When a user logs in to the proxy node of this domain, the identity information is initialized, a key pair is generated using a homomorphic encryption algorithm, the private key is stored locally, and the public key and verifiable credentials are uploaded to the shared cache database; The resource service provider or the credential verifier obtains the public key by searching the shared cache database, and uses a two-way challenge response mode and zero-knowledge proof to verify whether the credential is valid.

2. The cross-domain trusted interaction method for smart justice as claimed in claim 1 is characterized in that: All proxy nodes of the trust group can establish connections to achieve trusted intercommunication between proxy nodes within the trust group.

3. The cross-domain trusted interaction method for smart justice as claimed in claim 1 is characterized in that: The formation process of the trust group includes multiple digital identity identifications of different trust domains Form a group, each digital identity in the group They can all trust each other; the group administrator of the proxy node in the group, the digital identity under the jurisdiction of the proxy node is the group member, the group administrator issues certificates to the group members, the group members use the certificates and information to generate the group signature, and the verifier verifies the group signature to obtain the legitimacy of the digital identity.

4. The cross-domain trusted interaction method for smart justice as claimed in claim 1 is characterized in that: The process of the proxy node's message mechanism based on dual one-way isolation optical gates includes a sending / receiving message machine, a front-end machine / back-end machine, and an uplink / downlink one-way optical gate.

5. The cross-domain trusted interaction method for smart justice as claimed in claim 4 is characterized in that: The message sending machine packages the message and transmits it to the file directory specified by the front-end machine; the upstream one-way light gate transmits the sending file of the front-end machine to the specified file directory of the back-end machine in one direction; the message receiving machine periodically reads the file directory of the back-end machine to obtain the message; the message receiving machine generates a data packet from the feedback message and pushes it to the file directory specified by the back-end machine; the downstream one-way light gate transmits the sending file of the back-end machine to the specified file directory of the front-end machine in one direction; the message sending machine periodically reads the file directory of the front-end receiving file to obtain the feedback message.

6. The cross-domain trusted interaction method for smart justice as claimed in claim 1 is characterized in that: The unified digital identity serves as a unique identity for each domain, and the format includes a domain name and a universal unique identification code.

7. The cross-domain trusted interaction method for smart justice as claimed in claim 1 is characterized in that: The process of generating a key pair using a homomorphic encryption algorithm includes using a multiplicative homomorphic RSA algorithm, signing the information with a private key, and the verifier using a public key to verify the legitimacy of the signature; the public key encrypts the information, and only the owner of the private key can decrypt the information, ensuring the security of the information; The encryption process is: ,in For plain text, is the ciphertext, is the public key; The decryption process is: ,in For plain text, is the ciphertext, For the private key.

8. The cross-domain trusted interaction method for smart justice as claimed in claim 1 is characterized in that: The process of utilizing the two-way challenge response model includes: The client randomly generates a challenge , using the server's public key Homomorphic encryption ciphertext , where the function It is an encryption function and requests identity authentication; The server accepts the challenge from the client ,in is the server-side private key, To serve the challenge ciphertext received from the client, function is the decryption function; The server generates a response ,in For the received client challenge, is the client's public key; The server randomly generates a challenge , using the client's public key Homomorphic encryption becomes a ciphertext challenge ; The server will challenge the ciphertext and response Send to the client; The client receives the response from the server and Challenges ,like , the server is credible; The client accepts the server's challenge ,in is the client private key, The client receives the challenge ciphertext from the server; The client generates a response ,in For the server challenge received, is the public key of the server; The client will respond with the ciphertext Send to the server; The server receives the client's response ,like , then the client is credible; After the server and client verify each other's trustworthiness, they can communicate.

9. The cross-domain trusted interaction method for smart justice as claimed in claim 1 is characterized in that: The process of using zero-knowledge proof to verify whether the credential is valid includes: the verifiable credential consists of three parts: the first part is the header, including the sender identifier, the sender's domain, the receiver identifier, the receiver's domain and the title; the second part is the data part; the third part is the verifiable information, including the issuance time, issuance duration, issuing agent node and the digital signature of the credential.

10. A cross-domain trusted interaction system for smart justice, characterized by: include: The grouping module is configured as a court domain, a procuratorate domain and a judicial administrative organ domain, and each domain configures a trust domain through a proxy node of the domain, and forms a trust group with multiple trust domains; The proxy node information update module is configured as a message mechanism based on dual one-way isolation optical gates, which periodically obtains the digital identity information of other proxy nodes in the trust domain, synchronizes it with the shared cache database of the proxy nodes in the domain, and keeps the digital identity information of the trust domain consistent; A database synchronization module is configured to synchronize the shared cache database of the proxy node with the physical database of the domain to ensure that the digital identity data of the shared cache database and the physical database are consistent; The identity information import module is configured to import user identity data through the proxy node of the court domain, the procuratorate domain and the judicial administrative organ domain, and generate a shared unified digital identity; The encryption module is configured to initialize the identity information when a user logs into the proxy node of the domain, generate a key pair using a homomorphic encryption algorithm, store the private key locally, and upload the public key and verifiable credentials to the shared cache database; The credential verification module is configured to obtain the public key by searching the shared cache database, and use a two-way challenge response mode and zero-knowledge proof to verify whether the credential is valid.

Images