Data access control method and device, electronic equipment, medium and program product

Abstract

The embodiment of the invention discloses a data access control method and device, electronic equipment, a medium and a program product, and the method comprises the steps: determining a target disclosure field in a target data text based on the request access content of a target user for the target data text; based on the target disclosure field, generating a verifiable certificate with executable proof information, and sending the verifiable certificate to the target user, so that the target user generates a zero-knowledge proof corresponding to the target disclosure field based on the executable proof information; in response to a received first access request which is sent by the target user and carries the verifiable certificate and the zero-knowledge proof, verifying the verifiable certificate and the zero-knowledge proof; and accepting the first access request in response to the verifiable credential and the zero-knowledge proof passing verification. According to the embodiment of the invention, the data security can be effectively protected on the premise that part of contents are disclosed, and the disclosed contents can be adjusted according to user requirements, so that diversified data sharing requirements are met.

Description

Technical Field

[0001] The present disclosure relates to the field of data security technology, and in particular to a data access control method, device, electronic device, medium and program product. Background Art

[0002] Digital infrastructure is a system formed by hardware and software that processes, stores and transmits data in a digital way. With the development of digital infrastructure, data access security is becoming increasingly important.

[0003] International Data Spaces (IDS) is a cross-border, cross-industry data sharing standard and architecture that aims to build a trust-based data ecosystem. IDS ensures security and interoperability during data transmission by defining standardized data connectors, access control, and identity management. However, the existing IDS architecture mainly relies on traditional permission management mechanisms for data access control, which has limited flexibility and privacy protection capabilities and is difficult to meet diverse data sharing needs. Summary of the invention

[0004] The embodiments of the present disclosure provide a data access control method, device, electronic device, medium and program product to solve the above problems.

[0005] According to a first aspect of an embodiment of the present disclosure, a method for controlling data access is provided, comprising: Determining a target disclosure field in the target data text based on a target user's request to access content of the target data text; Based on the target disclosure field, generate a verifiable credential with executable proof information, and send the verifiable credential to the target user, so that the target user can generate a zero-knowledge proof corresponding to the target disclosure field based on the executable proof information; In response to receiving a first access request sent by the target user and carrying the verifiable credential and the zero-knowledge proof, verifying the verifiable credential and the zero-knowledge proof; In response to both the verifiable credential and the zero-knowledge proof being verified, accepting the first access request.

[0006] In some embodiments of the present disclosure, the step of determining a target disclosure field in the target data text based on a target user's request to access content for the target data text includes: The target disclosure field is determined based on the requested access content and the confidentiality level of each field in the target data text.

[0007] In some embodiments of the present disclosure, generating a verifiable credential with executable proof information based on the target disclosure field includes: Using a zero-knowledge proof application, based on the target disclosure field, to generate the executable proof information, wherein the executable proof information includes an executable file corresponding to the zero-knowledge proof application; The verifiable credential is generated based on the user information of the target user, the access rights of the target user to the target disclosure field, and the executable certification information.

[0008] In some embodiments of the present disclosure, the verifiable credential has signature information, and the signature information includes at least one of a signature of the target user and a signature of a provider of the target data text; The verifying the verifiable credential and the zero-knowledge proof includes: The target disclosure field is verified based on the zero-knowledge proof, and the signature information is verified.

[0009] In some embodiments of the present disclosure, after the target user is allowed to access the target disclosure field in response to both the verifiable credential and the zero-knowledge proof being verified, the method further includes: revoking access to said verifiable credentials; In response to receiving a second access request sent by the target user and carrying the verifiable credential for revoking access rights, denying the second access request.

[0010] According to a second aspect of an embodiment of the present disclosure, a data access control device is provided, including: A disclosure field determination module, configured to determine a target disclosure field in the target data text based on a target user's request to access content for the target data text; A verifiable credential processing module, configured to generate a verifiable credential with executable proof information based on the target disclosure field, and send the verifiable credential to the target user so that the target user can generate a zero-knowledge proof corresponding to the target disclosure field based on the executable proof information; a verification module, configured to verify the verifiable credential and the zero-knowledge proof in response to receiving a first access request sent by the target user and carrying the verifiable credential and the zero-knowledge proof; The access control module is configured to accept the first access request in response to both the verifiable credential and the zero-knowledge proof being verified.

[0011] In some embodiments of the present disclosure, the disclosure field determination module is used to determine the target disclosure field based on the requested access content and the confidentiality level of each field in the target data text.

[0012] In some embodiments of the present disclosure, the verifiable credential processing module is used to generate the executable proof information based on the target disclosure field using a zero-knowledge proof application, wherein the executable proof information includes an executable file corresponding to the zero-knowledge proof application; The verifiable credential processing module is further configured to generate the verifiable credential based on the user information of the target user, the access rights of the target user to the target disclosure field, and the executable proof information.

[0013] In some embodiments of the present disclosure, the verifiable credential has signature information, and the signature information includes at least one of a signature of the target user and a signature of a provider of the target data text; The verification module is used to verify the target disclosure field based on the zero-knowledge proof and to verify the signature information.

[0014] In some embodiments of the present disclosure, the verifiable credential processing module is further used to revoke access rights to the verifiable credential; The access control module is further configured to, in response to receiving a second access request sent by the target user and carrying the verifiable credential for revoking access rights, reject the second access request.

[0015] According to a third aspect of the present disclosure, an electronic device is provided, including: A memory for storing a computer program product; The processor is used to execute the computer program product stored in the memory, and when the computer program product is executed, the method described in the first aspect above is implemented.

[0016] According to a fourth aspect of the embodiments of the present disclosure, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described in the first aspect is implemented.

[0017] According to a fifth aspect of the embodiments of the present disclosure, a computer program product is provided, comprising computer program instructions, which, when executed by a processor, enable the processor to execute the method described in the first aspect.

[0018] The data access control method, device, electronic device, medium and program product of the disclosed embodiments ensure the authenticity and non-tamperability of the credential through an encrypted signature, and the zero-knowledge proof allows the prover to prove the authenticity of a statement to the verifier without leaking any additional information. Therefore, the executable proof information corresponding to the target disclosure field is added to the verifiable credential to achieve an organic combination of the verifiable credential and the zero-knowledge proof. The organically combined verifiable credential and zero-knowledge proof are applied to data access control, which can effectively protect data security on the premise of disclosing part of the content, and the disclosed content can be adjusted according to user needs to meet diverse data sharing needs, with high flexibility.

[0019] The technical solution of the present disclosure is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0021] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which: Figure 1 A flowchart of a method for controlling data access in one embodiment of the present disclosure; Figure 2 This is a partial flow chart of step S2 in some embodiments of the present disclosure; Figure 3 It is a schematic diagram of the process after step S4 in some embodiments of the present disclosure; Figure 4 A structural block diagram of a data access control device in one embodiment of the present disclosure; Figure 5 The structure block diagram of an electronic device in one embodiment of the present disclosure is shown in FIG. DETAILED DESCRIPTION

[0022] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that the relative arrangement of components and steps, numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure unless otherwise specifically stated.

[0023] Those skilled in the art can understand that the terms "first" and "second" in the embodiments of the present disclosure are only used to distinguish different steps, devices or modules, etc., and neither represent any specific technical meaning nor indicate the necessary logical order between them.

[0024] It should also be understood that in the embodiments of the present disclosure, “plurality” may refer to two or more than two, and “at least one” may refer to one, two, or more than two.

[0025] It should also be understood that any component, data or structure mentioned in the embodiments of the present disclosure can generally be understood as one or more, unless explicitly limited or otherwise indicated in the context.

[0026] In addition, the term "and / or" in the present disclosure is only a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in the present disclosure generally indicates that the associated objects before and after are in an "or" relationship.

[0027] It should also be understood that the description of the various embodiments in the present disclosure focuses on the differences between the various embodiments, and the same or similar aspects thereof can be referenced to each other, and for the sake of brevity, they will not be described one by one.

[0028] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present disclosure, its application, or uses.

[0029] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered as part of the specification.

[0030] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0031] The embodiments of the present disclosure can be applied to electronic devices such as terminal devices, computer systems, servers, etc., which can operate with many other general or special computing system environments or configurations. Examples of well-known terminal devices, computing systems, environments and / or configurations suitable for use with electronic devices such as terminal devices, computer systems, servers, etc. include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network personal computers, small computer systems, large computer systems, and distributed cloud computing technology environments including any of the above systems, etc.

[0032] Electronic devices such as terminal devices, computer systems, servers, etc. can be described in the general context of computer system executable instructions (such as program modules) executed by computer systems. Generally, program modules can include routines, programs, object programs, components, logic, data structures, etc., which perform specific tasks or implement specific abstract data types. Computer systems / servers can be implemented in distributed cloud computing environments, where tasks are performed by remote processing devices linked through a communication network. In a distributed cloud computing environment, program modules can be located on local or remote computing system storage media including storage devices.

[0033] Figure 1 FIG. 1 is a flow chart of a method for controlling data access in one embodiment of the present disclosure. Figure 1 As shown, the data access control method includes the following steps: S1: Determine a target disclosure field in a target data text based on a target user's request access content for the target data text.

[0034] After the data buyer (i.e., the target user) finds the target data text stored by the data provider on the decentralized network through the decentralized network, he or she can learn the data content included in the target data text and the function of the data content based on the description information of the target data text.

[0035] Data buyers can negotiate with data providers through online communication tools to determine the data content they want to access in the target data text.

[0036] The data provider can form a transaction on a decentralized network based on the data content that the data buyer wants to access, and determine the target disclosure fields to be disclosed to the data buyer in the transaction.

[0037] S2: Based on the target disclosure field, a verifiable credential (VC) with executable proof information is generated, and the verifiable credential is sent to the target user so that the target user can generate a zero-knowledge proof (Zero-Knowledge Proof, ZKP) corresponding to the target disclosure field based on the executable proof information.

[0038] Verifiable credentials are digital credentials based on decentralized identity (DID), which ensure the authenticity and immutability of the credentials through encrypted signatures. VC allows data owners to issue credentials with specific permissions to visitors, and visitors can verify the legitimacy of the credentials through a decentralized network without relying on a centralized verification agency.

[0039] Zero-Knowledge Proof (ZKP) is a cryptographic technology that allows the prover to prove the authenticity of a statement to the verifier without revealing any additional information. In data access control, ZKP can help the visitor disclose only the permission information related to the current request in the credential without exposing other sensitive data.

[0040] The data provider can use the zero-knowledge proof running program to process the target disclosure field and obtain executable proof information. The executable proof information is used to obtain the zero-knowledge proof corresponding to the target disclosure field when it is executed.

[0041] After generating executable proof information, the data provider can set corresponding access rights for the data buyer based on the user information of the data buyer. The user information of the data buyer may include: the user ID of the data buyer on the decentralized network, and the age and gender of the data buyer. Access rights may include: operation rights for the target disclosed content (such as read-only, copy and download, etc.). In addition, the data provider can also set the validity period of the access rights for the data buyer.

[0042] The data provider can generate the data buyer's verifiable credentials based on the executable proof information and the data buyer's access rights, as well as other information required for the verifiable credentials, and can sign the verifiable credentials to ensure their authenticity and non-tamperability. The data provider can send the verifiable credentials to the data buyer through encrypted transmission.

[0043] When the data buyer receives the encrypted verifiable credential, it decrypts the encrypted verifiable credential to obtain the verifiable credential. The executable proof information is extracted from the verifiable credential, and the zero-knowledge proof corresponding to the target disclosure field is generated based on the executable proof information. In addition, the data buyer can also verify the signature of the verifiable credential using the public key disclosed by the data provider on the decentralized network.

[0044] S3: In response to receiving a first access request sent by a target user and carrying a verifiable credential and a zero-knowledge proof, verify the verifiable credential and the zero-knowledge proof.

[0045] The data buyer can send a first access request to the data provider for accessing the target disclosure field in the target data text. The first access request carries the user information of the data provider, the verifiable credentials sent by the data provider, and the zero-knowledge proof corresponding to the target disclosure field.

[0046] After receiving the first access request, the data provider verifies the verifiable credentials and zero-knowledge proof in the first access request to verify whether the data buyer has access rights to the target disclosure field in the target data text.

[0047] S4: In response to both the verifiable credential and the zero-knowledge proof being verified, accepting the first access request.

[0048] If both the verifiable credential and the zero-knowledge proof are verified by the data provider, the data provider accepts the first access request, allowing the data buyer to access the target disclosure field in the target data text within the access permission, and can generate a corresponding access log based on the data buyer's access content.

[0049] In this embodiment, since the verifiable credential ensures the authenticity and non-tamperability of the credential through an encrypted signature, and the zero-knowledge proof allows the prover to prove the authenticity of a statement to the verifier without leaking any additional information, the executable proof information corresponding to the target disclosure field is added to the verifiable credential to achieve an organic combination of the verifiable credential and the zero-knowledge proof. The organically combined verifiable credential and zero-knowledge proof are applied in data access control, which can effectively protect data security on the premise of disclosing part of the content, and the disclosed content can be adjusted according to user needs to meet diverse data sharing needs, with high flexibility.

[0050] In some embodiments of the present disclosure, step S1 may include: determining a target disclosure field based on the requested access content and the confidentiality level of each field in the target data text.

[0051] The data provider can set a corresponding confidentiality level for each field in the target data text. Specifically, the data provider can set multiple confidentiality levels for each field in the target data text: the field with the highest confidentiality level is not allowed to be accessed, the field with the lowest confidentiality level can be browsed and downloaded, and the intermediate confidentiality level between the highest confidentiality level and the lowest confidentiality level can be browsed but not downloaded.

[0052] The data provider can access the content and confidentiality level of each field in the target data text based on the data buyer's request, and ultimately determine the target disclosure fields that can be disclosed to the data buyer.

[0053] In this embodiment, the target disclosure fields that can be disclosed to the user can be determined quickly and reasonably based on the user's requested access content and the confidentiality level of each field in the target data text.

[0054] Figure 2 FIG. 2 is a partial flow chart of step S2 in some embodiments of the present disclosure. Figure 2 As shown, step S2 may include the following steps: S2-1: Generate executable proof information based on the target disclosure field using zero-knowledge proof application.

[0055] The data provider compiles the target disclosure field using the zero-knowledge proof application to obtain executable proof information. The zero-knowledge proof application is an application used to generate zero-knowledge proofs. The executable proof information includes an executable file that can be run by the zero-knowledge proof application.

[0056] S2-2: Generate a verifiable credential based on the user information of the target user, the access rights of the target user to the target disclosure field, and the executable proof information.

[0057] The data provider obtains the user information of the data buyer (i.e., the target user). The user information of the data buyer at least includes the age of the data buyer, because some data can be disclosed to people of a certain age, such as some film and television works that are only available to people over a preset age. In addition, the user information of the data buyer may also include information such as the gender and occupation of the data buyer.

[0058] The data provider can set access permissions for the target disclosure fields for the data buyer, for example, the data buyer can be set permissions such as read-only, download, and forward for the target disclosure fields.

[0059] The data provider can use the user information of the data buyer, the data buyer's access rights to the target disclosure field, and the executable proof information as inputs of the verifiable credential application, and use the verifiable credential application to generate the data buyer's verifiable credentials. The verifiable credential application is an application used to generate verifiable credentials.

[0060] In this embodiment, a zero-knowledge proof application can be used to generate executable proof information for a target user based on a target disclosure field, and then a verifiable credential can be quickly generated for the target user based on the target user's user information, the target user's access rights to the target disclosure field, and the executable proof information.

[0061] In some embodiments of the present disclosure, the verifiable credential has signature information, wherein the signature information includes at least one of the signature of the target user and the signature of the target data text provider, that is, the data provider can send the signed verifiable credential to the data buyer, and the data buyer (i.e., the target user) can sign the verifiable credential with its own private key after receiving it.

[0062] Accordingly, the step of verifying the verifiable credentials and the zero-knowledge proof in step S4 may include: verifying the target disclosure field based on the zero-knowledge proof, and verifying the signature information.

[0063] After receiving the first access request sent by the data sender, the data provider verifies the zero-knowledge proof carried in the first access request to verify whether the zero-knowledge proof corresponds to the target disclosure field.

[0064] In addition, the data provider also verifies the signature information in the verifiable credential carried in the first access request, that is, the signature of the data provider can be verified by the public key of the data provider, and the signature of the data buyer can be verified by the public key of the data buyer.

[0065] After both the verifiable credential and the zero-knowledge proof are verified by the data provider, the data provider accepts the first access request, allowing the data buyer to access the target disclosure field in the target data text within the access permission, and can generate a corresponding access log based on the data buyer's access content.

[0066] In this embodiment, by verifying the signature of the zero-knowledge proof and the verifiable credential, data security can be effectively protected on the premise of disclosing part of the content.

[0067] Figure 3 FIG. 4 is a flow chart of the process after step S4 in some embodiments of the present disclosure. Figure 3 As shown, after step S4, the following steps may also be included: S5: Revoking access to verifiable credentials.

[0068] The data provider may revoke the data buyer's access rights to the verifiable credentials. For example, if the data buyer is found to have downloaded, forwarded, or used the target disclosure fields without authorization, the data provider may revoke the data buyer's access rights to the verifiable credentials and mark the status of the data buyer's verifiable credentials as revoked.

[0069] S6: In response to receiving a second access request sent by the target user and carrying a verifiable credential for revoking access rights, rejecting the second access request.

[0070] After the data provider revokes the access rights of the data buyer's (i.e., the target user) verifiable credentials, if the data buyer sends a second access request to the data provider carrying the verifiable credentials with revoked access rights, the second access request will be rejected, the data buyer will not be allowed to access the target disclosure field, and corresponding log information may be generated.

[0071] In this embodiment, the data provider can revoke access rights to the verifiable credentials, thereby denying the target user access to the target disclosed content that was previously allowed to be accessed, thereby achieving flexible management of data.

[0072] In an example of the present disclosure, a method for controlling data access may include the following steps: 1. Data purchasing and strategy negotiation.

[0073] (1) The data purchaser connector sends a data purchase request to the data provider connector, expressing the need for data access (including the requested access content).

[0074] (2) The data provider connector negotiates access policies with the data buyer connector. For example, they can communicate online through a trading platform provided by a decentralized network or other trading platforms outside the decentralized network to clarify access rights, data disclosure scope, and other specific requirements. After that, they can generate and confirm transactions between the data buyer and the data provider on the trading platform.

[0075] 2. Data purchase and strategy negotiation.

[0076] (1) The data provider connector defines the access policy based on the negotiated content, which may include information such as access rights and validity period.

[0077] (2) The data provider connector can generate VC based on the user information and access policy provided by the data provider connector.

[0078] (3) The data provider connector sets a selective disclosure field (i.e., target disclosure field) for the VC based on the access requirements, ensuring that the data buyer can use ZKP to disclose only the required permission information when presenting the VC without revealing the full content. Among them, the VC includes executable proof information, so that the ZKP corresponding to the selective disclosure field can be obtained through the executable proof information.

[0079] (4) The data provider connector digitally signs the VC to ensure its authenticity and non-tamperability.

[0080] (5) After generating the VC, the data provider connector stores it locally for subsequent permission management.

[0081] 3. Issued by VC.

[0082] (1) The data provider connector securely issues the VC to the data buyer connector through encryption (for example, encryption based on the Transport Layer Security (TLS) protocol) so that the data buyer can access the data based on the VC.

[0083] 4. Data access requests and selective disclosure.

[0084] (1) The data buyer connector sends a data access request to the data provider connector, along with VC and ZKP.

[0085] (2) The data provider connector queries the DID document of the data buyer connector (BuyerConnector) from the blockchain.

[0086] (3) The data provider connector obtains the data buyer's public key through the data buyer connector's DID document for subsequent verification.

[0087] 5. Verify ZKP and access rights.

[0088] (1) The data provider connector uses ZKP to verify the selectively disclosed permission information in VC, ensuring that the data buyer connector only presents the necessary permission proof without leaking additional information.

[0089] (2) The data provider connector uses the public key obtained from the blockchain to verify the digital signature of the VC and confirm the authenticity and integrity of the VC.

[0090] (3) The data provider connector checks the validity period and permission scope of the VC to ensure that the data access request complies with the access policy negotiated in advance.

[0091] 6. Perform data access.

[0092] (1) If both VC verification and permission verification are passed, the data provider connector allows the data buyer connector to access the data (i.e., access the target disclosure field in the target data text) and perform corresponding operations according to the access policy, such as browsing, copying, downloading, or forwarding.

[0093] (2) The data provider connector records the relevant logs of this data access for auditing and tracking.

[0094] 7. Revocation of Permissions.

[0095] (1) If the data provider connector decides to revoke the data buyer's access rights, it will update the VC status locally and mark the VC as revoked.

[0096] (2) When the data buyer connector tries to access data again using the revoked VC, the data provider connector will re-query the DID document on the blockchain and verify the VC status.

[0097] (3) Once it is confirmed that the VC has been revoked, the data provider connector rejects the data buyer's access request and records the revocation-related log information.

[0098] Figure 4 FIG. 1 is a structural block diagram of a data access control device in one embodiment of the present disclosure. Figure 4 As shown, the data access control device includes: A disclosure field determination module 100 is used to determine a target disclosure field in a target data text based on a target user's request to access content for the target data text; A verifiable credential processing module 200 is used to generate a verifiable credential with executable proof information based on the target disclosure field, and send the verifiable credential to the target user so that the target user can generate a zero-knowledge proof corresponding to the target disclosure field based on the executable proof information; A verification module 300, configured to verify the verifiable credentials and the zero-knowledge proof in response to receiving a first access request sent by a target user and carrying the verifiable credentials and the zero-knowledge proof; The access control module 400 is configured to accept the first access request in response to both the verifiable credential and the zero-knowledge proof being verified.

[0099] In some embodiments of the present disclosure, the disclosure field determination module 100 is used to determine the target disclosure field based on the requested access content and the confidentiality level of each field in the target data text.

[0100] In some embodiments of the present disclosure, the verifiable credential processing module 200 is used to generate executable proof information based on the target disclosure field using the zero-knowledge proof application, wherein the executable proof information includes an executable file corresponding to the zero-knowledge proof application; The verifiable credential processing module 200 is further used to generate a verifiable credential based on the user information of the target user, the access rights of the target user to the target disclosure field, and the executable proof information.

[0101] In some embodiments of the present disclosure, the verifiable credential has signature information, and the signature information includes at least one of a signature of a target user and a signature of a target data text provider; The verification module 300 is used to verify the target disclosure field based on zero-knowledge proof and to verify the signature information.

[0102] In some embodiments of the present disclosure, the verifiable credential processing module 200 is also used to revoke access rights to the verifiable credential; The access control module 400 is further configured to, in response to receiving a second access request sent by a target user and carrying a verifiable credential for revoking access rights, reject the second access request.

[0103] It should be noted that the specific implementation of the data access control device of the embodiment of the present disclosure is similar to the specific implementation of the data access control method of the embodiment of the present disclosure, and the technical effect of the data access control device of the embodiment of the present disclosure is similar to the technical effect of the data access control method of the embodiment of the present disclosure. Please refer to the description of the data access control method part for details. In order to reduce redundancy, it is not repeated here.

[0104] In addition, an embodiment of the present disclosure further provides an electronic device, including: Memory for storing computer programs; The processor is used to execute the computer program stored in the memory, and when the computer program is executed, the data access control method described in any of the above embodiments of the present disclosure is implemented.

[0105] Below, reference Figure 5 To describe the electronic device according to the embodiment of the present disclosure. Figure 5 As shown, the electronic device includes one or more processors and memory.

[0106] The processor may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0107] The memory may store one or more computer program products, and the memory may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may include, for example, a read-only memory (ROM), a hard disk, a flash memory, etc. One or more computer program products may be stored on the computer-readable storage medium, and the processor may run the computer program product to implement the data access control method of each embodiment of the present disclosure described above and / or other desired functions.

[0108] In one example, the electronic device may further include: an input device and an output device, and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0109] In addition, the input device may also include, for example, a keyboard, a mouse, and the like.

[0110] The output device can output various information to the outside, including determined distance information, direction information, etc. The output device can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0111] Of course, to simplify, Figure 5 Only some of the components related to the present disclosure in the electronic device are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device may further include any other appropriate components.

[0112] In addition to the above-mentioned methods and devices, an embodiment of the present disclosure may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the data access control method according to various embodiments of the present disclosure described in the above part of this specification.

[0113] The computer program product may be written in any combination of one or more programming languages ​​to write program code for performing the operations of the disclosed embodiments, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0114] In addition, an embodiment of the present disclosure may also be a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, enables the processor to execute the steps of the data access control method according to various embodiments of the present disclosure described in the above part of this specification.

[0115] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0116] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0117] Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system embodiment, since it basically corresponds to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0118] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0119] The method and apparatus of the present disclosure may be implemented in many ways. For example, the method and apparatus of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present disclosure may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present disclosure. Therefore, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

[0120] It should also be noted that in the apparatus, device and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0121] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0122] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A data access control method, characterized in that: include: Determining a target disclosure field in the target data text based on a target user's request to access content of the target data text; Based on the target disclosure field, generate a verifiable credential with executable proof information, and send the verifiable credential to the target user, so that the target user can generate a zero-knowledge proof corresponding to the target disclosure field based on the executable proof information; In response to receiving a first access request sent by the target user and carrying the verifiable credential and the zero-knowledge proof, verifying the verifiable credential and the zero-knowledge proof; In response to both the verifiable credential and the zero-knowledge proof being verified, accepting the first access request.

2. The method according to claim 1, characterized in that: The step of determining a target disclosure field in the target data text based on the target user's request to access the target data text comprises: The target disclosure field is determined based on the requested access content and the confidentiality level of each field in the target data text.

3. The method according to claim 1, characterized in that The generating, based on the target disclosure field, a verifiable credential having executable proof information comprises: Using a zero-knowledge proof application, based on the target disclosure field, to generate the executable proof information, wherein the executable proof information includes an executable file corresponding to the zero-knowledge proof application; The verifiable credential is generated based on the user information of the target user, the access rights of the target user to the target disclosure field, and the executable certification information.

4. The method according to any one of claims 1 to 3, characterized in that: The verifiable credential has signature information, and the signature information includes at least one of a signature of the target user and a signature of a provider of the target data text; The verifying the verifiable credential and the zero-knowledge proof includes: The target disclosure field is verified based on the zero-knowledge proof, and the signature information is verified.

5. The method according to any one of claims 1 to 3, characterized in that: After allowing the target user to access the target disclosure field in response to both the verifiable credential and the zero-knowledge proof being verified, the method further includes: revoking access to said verifiable credentials; In response to receiving a second access request sent by the target user and carrying the verifiable credential for revoking access rights, denying the second access request.

6. A data access control device, characterized in that: include: A disclosure field determination module, configured to determine a target disclosure field in the target data text based on a target user's request to access content for the target data text; A verifiable credential processing module, configured to generate a verifiable credential with executable proof information based on the target disclosure field, and send the verifiable credential to the target user so that the target user can generate a zero-knowledge proof corresponding to the target disclosure field based on the executable proof information; a verification module, configured to verify the verifiable credential and the zero-knowledge proof in response to receiving a first access request sent by the target user and carrying the verifiable credential and the zero-knowledge proof; The access control module is configured to accept the first access request in response to both the verifiable credential and the zero-knowledge proof being verified.

7. The device according to claim 6, characterized in that The disclosure field determination module is used to determine the target disclosure field based on the requested access content and the confidentiality level of each field in the target data text.

8. The device according to claim 6, characterized in that The verifiable credential processing module is used to generate the executable proof information based on the target disclosure field using the zero-knowledge proof application, wherein the executable proof information includes an executable file corresponding to the zero-knowledge proof application; The verifiable credential processing module is further configured to generate the verifiable credential based on the user information of the target user, the access rights of the target user to the target disclosure field, and the executable proof information.

9. The device according to any one of claims 6 to 8, characterized in that: The verifiable credential has signature information, and the signature information includes at least one of a signature of the target user and a signature of a provider of the target data text; The verification module is used to verify the target disclosure field based on the zero-knowledge proof and to verify the signature information.

10. The device according to any one of claims 6 to 8, characterized in that: The verifiable credential processing module is further used to revoke access rights to the verifiable credential; The access control module is further configured to, in response to receiving a second access request sent by the target user and carrying the verifiable credential for revoking access rights, reject the second access request.

11. An electronic device, characterized in that: include: a memory for storing a computer program product; A processor is used to execute the computer program product stored in the memory, and when the computer program product is executed, it implements the method described in any one of claims 1 to 5.

12. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method described in any one of claims 1 to 5 is implemented.

13. A computer program product, characterized in that The method comprises computer program instructions, which, when executed by a processor, enable the processor to execute the method according to any one of claims 1 to 5.

Images