Method and system for realizing trusted data circulation based on digital identity

Abstract

The invention relates to the technical field of data security, in particular to a trusted data circulation implementation method and system based on digital identities, and the method comprises the following steps: digital identity issuing parties in various regions register as trusted issuing institutions through a data circulation utilization service platform, and disclose DIDs of the digital identity issuing parties and DID Documents containing public keys of the issuing parties; a certificate issuing party generates a unique DID for an individual or an enterprise, and issues a verifiable certificate VC for the enterprise according to requirements; the trusted data circulation implementation method and system based on the digital identity have the beneficial effects that efficient circulation of data is promoted, so that participants do not need to register multiple types of users and repeatedly submit materials, and the pre-field time is saved; and by using an asymmetric key and a distributed evidence storage technology, credibility of identities of participants is guaranteed, data tracing is facilitated, and disputes are solved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a method and system for implementing trusted data circulation based on digital identity. Background Art

[0002] With the rapid development of information technology, multi-party data circulation is gradually becoming a trend. From the early single data source to today's cross-platform and cross-industry data integration, data circulation not only improves information transparency, but also promotes scientific decision-making. Driven by technologies such as big data, privacy computing, and blockchain, data circulation will be more efficient and secure in the future, providing strong support for social development and governance.

[0003] However, the existing data circulation business lacks a credible digital identity management mechanism. The business platforms of various data exchanges are mostly chimney-style structures, and it is difficult to unify identities between platforms. After users have completed business at a data exchange, they need to resubmit their identity documents when they go to the Zero One trading platform to do business, which increases the user's time cost and reduces the user's willingness to trade in multiple regions. Summary of the invention

[0004] The purpose of the present invention is to provide a method and system for implementing trusted data circulation based on digital identity to solve the problems raised in the above background technology.

[0005] To achieve the above object, the present invention provides the following technical solution: a method for implementing trusted data circulation based on digital identity, the method comprising the following steps:

[0006] Digital identity issuers in various regions register as trusted issuers through the data circulation and utilization service platform, and disclose their DID and DID Document containing the issuer's public key;

[0007] The issuer generates a unique DID for an individual or enterprise, and issues a verifiable certificate VC to the enterprise as needed;

[0008] The issuer will encrypt and store the issued VC or centrally host it, and at the same time make public the DID Document and VC signature information of the individual or enterprise. The DID and private key of the individual or enterprise will be stored through a secure client and kept by the individual or enterprise for subsequent data circulation and verification.

[0009] Preferably, the following verification process is also included:

[0010] Users access the data circulation platform through a digital identity client and submit their personal or corporate DID as a login request;

[0011] The data circulation platform generates a login random code and login link, and returns them to the digital identity client after encrypting them with the personal or corporate public key;

[0012] The digital identity client uses the private key to decrypt the encrypted information and verify the legitimacy of the user's identity;

[0013] The digital identity client uses the private key to issue an authorization command, sends the random number, authorization command, and enterprise DID to the Identity Hub, and agrees to send the VC information to the login link;

[0014] After receiving the authorization command, Identity Hub sends the VC and random number to the login link of the data circulation platform so that the data circulation platform can verify the issuer of the VC and its credibility.

[0015] Preferably, in the verification process, the data circulation platform further includes the following steps:

[0016] Obtain the enterprise VC information and verify whether the issuer of the VC is a registered and trusted issuing authority;

[0017] Request the data circulation service platform to verify whether the issuer is in the list of trusted issuing agencies. If so, the verification is successful and the user is allowed to perform data circulation operations.

[0018] Preferably, the overall architecture of the digital identity management platform includes a data resource layer, an application support layer, a business application layer, and a user interaction layer, wherein:

[0019] The data resource layer includes the user information library, identity credential information library, risk control strategy library and audit log library, which are used to store and manage various types of information related to data circulation;

[0020] The application support layer includes single sign-on, multi-factor authentication, data encryption, and multi-source verification technology components, providing secure technical support for data circulation;

[0021] The business application layer includes four business modules: identity management, agent management, access control and audit supervision, providing comprehensive business management and risk control services;

[0022] The user interaction layer provides user registration, user login, user retrieval, user center and digital identity client modules, providing users with convenient account management and data circulation services.

[0023] Preferably, the digital identity client of the user interaction layer is a digital identity management APP or U shield, which is used to store user credential information and support credential presentation and verification functions so that users can prove their identity and authority during data circulation.

[0024] A digital identity-based trusted data circulation implementation system is applied to a digital identity-based trusted data circulation implementation method, the system comprising:

[0025] The trusted issuing authority registration module is used for digital identity issuers in various places to register as trusted issuing authorities through the data circulation and utilization service platform, and to disclose their DID and DID Document containing the issuer's public key;

[0026] DID generation and VC issuance module, used to generate unique DID for individuals or enterprises, and issue verifiable credentials VC for enterprises according to needs;

[0027] VC storage and publishing module, which is used to encrypt and store the issued VC or centrally manage it, and at the same time disclose the DID Document and VC signature information of individuals or enterprises. The DID and private key of individuals or enterprises are stored through a secure client;

[0028] The digital identity authentication module is used to authenticate the user through the digital identity client when the user accesses the data circulation platform, including generating a login random code and platform loginUrl, encrypting them with the public key and returning them to the digital identity client, which then uses the private key to decrypt and verify the user's identity;

[0029] The VC verification and issuing agency verification module is used to verify the issuer of the VC and its credibility after obtaining the enterprise VC information on the data circulation platform, and request the data circulation utilization service platform to verify whether the issuer is a trustworthy issuing agency.

[0030] Preferably, it also includes a data resource layer for storing a user information library, an identity credential information library, a risk control policy library and an audit log library to support the security and traceability of the entire data flow process.

[0031] Preferably, an application support layer is also included, which includes single sign-on, multi-factor authentication, data encryption, and multi-source verification technology components to provide secure technical support and ensure the security of data transmission and storage.

[0032] Preferably, it also includes a business application layer, including four business modules: identity management, agent management, access control and audit supervision, so as to provide comprehensive identity management, risk control and service support;

[0033] Among them, the identity management module provides information verification of the issuer, individual and corporate identities, and credential issuance, management, update and revocation services; the agent management module provides internal employee management, agent position credential issuance, management, update and revocation services; the access control module provides a variety of user authentication methods, and has the ability to manage black and white lists and risk control strategies; the audit supervision module mainly focuses on user login operation log audits, credential issuance and update log audits, and timely discovers security risks of user identity information leakage.

[0034] Preferably, it also includes a user interaction layer, which provides user registration, user login, user retrieval, user center and digital identity client modules, providing users with one-stop account management services;

[0035] Among them, the user registration module is used for individuals or enterprises to complete user registration and submit authentication materials; the user login module provides a user login entrance to complete user login interaction; the user retrieval module provides a user account complaint entrance when the user account is lost; the user center module provides a user center to manage personal user information and credential information; the digital identity client module provides a digital identity management APP or U shield to store user credential information, and supports credential presentation and verification functions.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] The digital identity-based trusted data circulation implementation method and system proposed in the present invention promote efficient data circulation, so that each participant does not need to register multiple types of users and submit materials repeatedly, saving pre-event time; improves data circulation security, uses asymmetric keys and distributed evidence storage technology to ensure the credibility of the identities of the participants, facilitates data tracing, and resolves disputes. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 The present invention is a flow chart of the method for forming the present invention;

[0039] Figure 2 This is a system block diagram of the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose and technical solution of the present invention clearly and completely described, and the advantages more clearly understood, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] In the first embodiment, the present invention provides a technical solution: a method for implementing trusted data circulation based on digital identity, the method comprising the following steps:

[0042] Digital identity issuers in various regions register as trusted issuers through the data circulation and utilization service platform, and disclose their DID and DID Document containing the issuer's public key;

[0043] The issuer generates a unique DID for an individual or enterprise, and issues a verifiable certificate VC to the enterprise as needed;

[0044] The issuer will encrypt and store the issued VC or centrally host it, and at the same time make public the DID Document and VC signature information of the individual or enterprise. The DID and private key of the individual or enterprise will be stored through a secure client and kept by the individual or enterprise for subsequent data circulation and verification.

[0045] It also includes the following verification process: the user accesses the data circulation platform through the digital identity client and submits the personal or corporate DID as a login request; the data circulation platform generates a login random code and login link, and returns it to the digital identity client after encrypting it with the personal or corporate public key; the digital identity client uses the private key to decrypt the encrypted information and verify the legitimacy of the user's identity; the digital identity client uses the private key to issue an authorization command, sends the random number, authorization command and corporate DID to the Identity Hub, and agrees to send the VC information to the login link; after receiving the authorization command, the Identity Hub sends the VC and random number to the login link of the data circulation platform so that the data circulation platform can verify the issuer of the VC and its credibility.

[0046] In the verification process, the data circulation platform also includes the following steps: obtaining the enterprise VC information and verifying whether the issuer of the VC is a registered trusted issuing agency; requesting the data circulation utilization service platform to verify whether the issuer is in the list of trusted issuing agencies. If so, the verification is passed and the user is allowed to perform data circulation operations.

[0047] The overall architecture of the digital identity management platform includes the data resource layer, application support layer, business application layer and user interaction layer, among which: the data resource layer contains the user information library, identity credential information library, risk control strategy library and audit log library, which are used to store and manage various types of information related to data circulation; the application support layer contains single sign-on, multi-factor authentication, data encryption, and multi-source verification technology components to provide secure technical support for data circulation; the business application layer includes four business modules: identity management, agent management, access control and audit supervision, providing comprehensive business management and risk control services; the user interaction layer provides user registration, user login, user retrieval, user center and digital identity client modules to provide users with convenient account management and data circulation services.

[0048] The digital identity client of the user interaction layer is a digital identity management APP or U-Shield, which is used to store user credential information and supports the presentation and verification of credentials so that users can prove their identity and authority during data circulation.

[0049] Embodiment 2, refer to the attached Figure 1 As shown, based on the first embodiment, it is proposed to use a distributed digital identity (DID) to build a digital identity management system, which mainly includes two links: issuance and verification. The technical implementation process is as follows:

[0050] 1. Issuance process

[0051] (1) Digital identity issuers in various regions register as trusted issuers through the data circulation and utilization service platform and disclose the DID and the DID Document containing the issuer’s public key.

[0052] (2) The issuer generates a DID for the individual / enterprise and issues a VC for Enterprise A

[0053] (3) The VC issued by the issuer is encrypted and stored by the individual / enterprise (or centrally managed); the DIDDocument and VC signature information of the individual / enterprise are published publicly; the DID and private key of the individual / enterprise are stored by the individual or enterprise (person in charge) through the client and carried with them.

[0054] 2. Verification process

[0055] (1) Users access the data circulation platform, scan and log in through the digital identity client, and initiate a login request to the platform (providing personal / enterprise DID).

[0056] (2) The data circulation platform generates a login random code + platform loginUrl, encrypts it with the personal / enterprise public key, and generates an encrypted string and returns it to the digital identity client.

[0057] (3) The digital identity client decrypts the encrypted string using the personal / enterprise private key and the decryption result proves the legitimacy of the user's identity.

[0058] (4) The digital identity client uses the personal / enterprise private key to issue an authorization command, sends the random number, authorization command, and enterprise DID to the Identity Hub, and agrees to send the enterprise VC information to the loginUrl.

[0059] (5) Identity Hub receives the authorization command and sends the enterprise VC and random number to the circulation platform loginUrl.

[0060] (6) Obtain the enterprise VC information and verify that the VC is indeed issued by Beijing.

[0061] (7) Request the data circulation and utilization service platform to verify whether Beijing is a trusted issuing agency. If it is on the list of trusted issuing agencies, the verification is successful.

[0062] Embodiment 3, refer to the attached Figure 2 As shown, based on the first embodiment, a system for implementing trusted data circulation based on digital identity is proposed, which is applied to a method for implementing trusted data circulation based on digital identity. The system includes:

[0063] The trusted issuing authority registration module is used for digital identity issuers in various places to register as trusted issuing authorities through the data circulation and utilization service platform, and to disclose their DID and DID Document containing the issuer's public key;

[0064] DID generation and VC issuance module, used to generate unique DID for individuals or enterprises, and issue verifiable credentials VC for enterprises according to needs;

[0065] VC storage and publishing module, which is used to encrypt and store the issued VC or centrally manage it, and at the same time disclose the DID Document and VC signature information of individuals or enterprises. The DID and private key of individuals or enterprises are stored through a secure client;

[0066] The digital identity authentication module is used to authenticate the user through the digital identity client when the user accesses the data circulation platform, including generating a login random code and platform loginUrl, encrypting them with the public key and returning them to the digital identity client, which then uses the private key to decrypt and verify the user's identity;

[0067] The VC verification and issuing agency verification module is used to verify the issuer of the VC and its credibility after obtaining the enterprise VC information on the data circulation platform, and request the data circulation utilization service platform to verify whether the issuer is a trustworthy issuing agency.

[0068] It also includes a data resource layer for storing user information library, identity credential information library, risk control policy library and audit log library to support the security and traceability of the entire data flow process.

[0069] It also includes an application support layer, which contains single sign-on, multi-factor authentication, data encryption, and multi-source verification technology components to provide secure technical support and ensure the security of data transmission and storage.

[0070] It also includes the business application layer, which includes four business modules: identity management, agent management, access control and audit supervision, to provide comprehensive identity management, risk control and service support;

[0071] Among them, the identity management module provides information verification of the issuer, individual and corporate identities, and credential issuance, management, update and revocation services; the agent management module provides internal employee management, agent position credential issuance, management, update and revocation services; the access control module provides a variety of user authentication methods, and has the ability to manage black and white lists and risk control strategies; the audit supervision module mainly focuses on user login operation log audits, credential issuance and update log audits, and timely discovers security risks of user identity information leakage.

[0072] It also includes a user interaction layer, which provides user registration, user login, user retrieval, user center and digital identity client modules, providing users with one-stop account management services;

[0073] Among them, the user registration module is used for individuals or enterprises to complete user registration and submit authentication materials; the user login module provides a user login entrance to complete user login interaction; the user retrieval module provides a user account complaint entrance when the user account is lost; the user center module provides a user center to manage personal user information and credential information; the digital identity client module provides a digital identity management APP or U shield to store user credential information, and supports credential presentation and verification functions.

[0074] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for implementing trusted data circulation based on digital identity, characterized in that: The method comprises the following steps: Digital identity issuers in various regions register as trusted issuers through the data circulation and utilization service platform, and disclose their DID and DID Document containing the issuer's public key; The issuer generates a unique DID for an individual or enterprise, and issues a verifiable certificate VC to the enterprise as needed; The issuer will encrypt and store the issued VC or centrally host it, and at the same time make public the DID Document and VC signature information of the individual or enterprise. The DID and private key of the individual or enterprise will be stored through a secure client and kept by the individual or enterprise for subsequent data circulation and verification.

2. A method for implementing trusted data circulation based on digital identity according to claim 1, characterized in that: The following verification processes are also included: Users access the data circulation platform through a digital identity client and submit their personal or corporate DID as a login request; The data circulation platform generates a login random code and login link, and returns them to the digital identity client after encrypting them with the personal or corporate public key; The digital identity client uses the private key to decrypt the encrypted information and verify the legitimacy of the user's identity; The digital identity client uses the private key to issue an authorization command, sends the random number, authorization command, and enterprise DID to the Identity Hub, and agrees to send the VC information to the login link; After receiving the authorization command, Identity Hub sends the VC and random number to the login link of the data circulation platform so that the data circulation platform can verify the issuer of the VC and its credibility.

3. A method for implementing trusted data circulation based on digital identity according to claim 2, characterized in that: In the verification process, the data circulation platform also includes the following steps: Obtain the enterprise VC information and verify whether the issuer of the VC is a registered and trusted issuing authority; Request the data circulation service platform to verify whether the issuer is in the list of trusted issuing agencies. If so, the verification is successful and the user is allowed to perform data circulation operations.

4. The method for implementing trusted data circulation based on digital identity according to claim 1, characterized in that: The overall architecture of the digital identity management platform includes the data resource layer, application support layer, business application layer and user interaction layer, among which: The data resource layer includes the user information library, identity credential information library, risk control strategy library and audit log library, which are used to store and manage various types of information related to data circulation; The application support layer includes single sign-on, multi-factor authentication, data encryption, and multi-source verification technology components, providing secure technical support for data circulation; The business application layer includes four business modules: identity management, agent management, access control and audit supervision, providing comprehensive business management and risk control services; The user interaction layer provides user registration, user login, user retrieval, user center and digital identity client modules, providing users with convenient account management and data circulation services.

5. The method for implementing trusted data circulation based on digital identity according to claim 1, characterized in that: The digital identity client of the user interaction layer is a digital identity management APP or U-Shield, which is used to store user credential information and supports the presentation and verification of credentials so that users can prove their identity and authority during data circulation.

6. A system for implementing trusted data circulation based on digital identity, applied to a method for implementing trusted data circulation based on digital identity according to any one of claims 1 to 5, characterized in that: The system comprises: The trusted issuing authority registration module is used for digital identity issuers in various places to register as trusted issuing authorities through the data circulation and utilization service platform, and to disclose their DID and DID Document containing the issuer's public key; DID generation and VC issuance module, used to generate unique DID for individuals or enterprises, and issue verifiable credentials VC for enterprises according to needs; VC storage and publishing module, which is used to encrypt and store the issued VC or centrally host it, and at the same time make public the DIDDocument and VC signature information of individuals or enterprises. The DID and private key of individuals or enterprises are stored through a secure client; The digital identity authentication module is used to authenticate the user through the digital identity client when the user accesses the data circulation platform, including generating a login random code and platform loginUrl, encrypting them with the public key and returning them to the digital identity client, which then uses the private key to decrypt and verify the user's identity; The VC verification and issuing agency verification module is used to verify the issuer of the VC and its credibility after obtaining the enterprise VC information on the data circulation platform, and request the data circulation utilization service platform to verify whether the issuer is a trustworthy issuing agency.

7. A digital identity-based trusted data circulation implementation system according to claim 6, characterized in that: It also includes a data resource layer for storing user information library, identity credential information library, risk control policy library and audit log library to support the security and traceability of the entire data flow process.

8. A digital identity-based trusted data circulation implementation system according to claim 6, characterized in that: It also includes an application support layer, which contains single sign-on, multi-factor authentication, data encryption, and multi-source verification technology components to provide secure technical support and ensure the security of data transmission and storage.

9. A digital identity-based trusted data circulation implementation system according to claim 6, characterized in that: It also includes the business application layer, which includes four business modules: identity management, agent management, access control and audit supervision, to provide comprehensive identity management, risk control and service support; Among them, the identity management module provides information verification of the issuer, individual and corporate identities, and credential issuance, management, update and revocation services; the agent management module provides internal employee management, agent position credential issuance, management, update and revocation services; the access control module provides a variety of user authentication methods, and has the ability to manage black and white lists and risk control strategies; the audit supervision module mainly focuses on user login operation log audits, credential issuance and update log audits, and timely discovers security risks of user identity information leakage.

10. A digital identity-based trusted data circulation implementation system according to claim 6, characterized in that: It also includes a user interaction layer, which provides user registration, user login, user retrieval, user center and digital identity client modules, providing users with one-stop account management services; Among them, the user registration module is used for individuals or enterprises to complete user registration and submit authentication materials; the user login module provides a user login entrance to complete user login interaction; the user retrieval module provides a user account complaint entrance when the user account is lost; the user center module provides a user center to manage personal user information and credential information; the digital identity client module provides a digital identity management APP or U shield to store user credential information, and supports credential presentation and verification functions.

Images