Method, apparatus, electronic device, medium and program product for controlling data access

Abstract

The method comprises: determining a target disclosure field in a target data text based on a request access content of a target user for the target data text; generating a verifiable credential with executable proof information based on the target disclosure field; sending the verifiable credential to the target user, so that the target user generates zero-knowledge proof corresponding to the target disclosure field based on the executable proof information; in response to receiving a first access request sent by the target user and carrying the verifiable credential and the zero-knowledge proof, verifying the verifiable credential and the zero-knowledge proof; and in response to the verifiable credential and the zero-knowledge proof both passing the verification, accepting the first access request. The data security can be effectively protected on the premise of disclosing part of the content, and the disclosed content can be adjusted according to the user demand, thereby meeting diversified data sharing demand.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of data security, and particularly relates to a data access control method and device, electronic equipment, medium and program product. BACKGROUND

[0002] Digital infrastructure is a system formed by hardware and software, which processes, stores and transmits data in a digital way. With the development of digital infrastructure, data access security is becoming more and more important.

[0003] International Data Spaces (IDS) is a cross-country and cross-industry data sharing standard and architecture, aiming to establish a trust-based data ecosystem. IDS ensures the security and interoperability of data transmission by defining standardized data connectors, access control and identity management. However, the existing IDS architecture mainly relies on traditional permission management mechanism in data access control, and has limited flexibility and privacy protection capability, which is difficult to meet the diversified data sharing needs. SUMMARY

[0004] The embodiments of the present disclosure provide a data access control method, device, electronic equipment, medium and program product to solve the above problems.

[0005] In a first aspect, the embodiments of the present disclosure provide a data access control method, comprising:

[0006] determining a target disclosure field in the target data text based on the target user's request access content for the target data text;

[0007] generating a verifiable credential with executable proof information based on the target disclosure field, and sending the verifiable credential to the target user, so that the target user generates a zero-knowledge proof corresponding to the target disclosure field based on the executable proof information;

[0008] verifying the verifiable credential and the zero-knowledge proof in response to receiving the first access request sent by the target user and carrying the verifiable credential and the zero-knowledge proof;

[0009] accepting the first access request in response to the verifiable credential and the zero-knowledge proof passing the verification.

[0010] In some embodiments of the present disclosure, the determining a target disclosure field in the target data text based on the target user's request access content for the target data text comprises:

[0011] determine the target disclosure field based on the request access content and the security level of each field in the target data text.

[0012] In some embodiments of the present disclosure, the generating a verifiable credential with executable proof information based on the target disclosure field comprises:

[0013] generating the executable proof information based on the target disclosure field by using a zero-knowledge proof application, wherein the executable proof information comprises an executable file corresponding to the zero-knowledge proof application;

[0014] generating the verifiable credential based on the user information of the target user, the access permission of the target user for the target disclosure field, and the executable proof information.

[0015] In some embodiments of the present disclosure, the verifiable credential has signature information, and the signature information comprises at least one of a signature of the target user and a signature of the target data text provider;

[0016] The verifying the verifiable credential and the zero-knowledge proof comprises:

[0017] verifying the target disclosure field based on the zero-knowledge proof and verifying the signature information.

[0018] In some embodiments of the present disclosure, after the target user is allowed to access the target disclosure field in response to the verifiable credential and the zero-knowledge proof both passing the verification, the method further comprises:

[0019] revoking the access permission of the verifiable credential;

[0020] In response to receiving a second access request sent by the target user and carrying the verifiable credential with revoked access permission, rejecting the second access request.

[0021] A second aspect of the embodiments of the present disclosure provides a data access control device, comprising:

[0022] a disclosure field determination module configured to determine a target disclosure field in a target data text based on a request access content of a target user for the target data text;

[0023] a verifiable credential processing module configured to generate a verifiable credential with executable proof information based on the target disclosure field, and send the verifiable credential to the target user, so that the target user generates a zero-knowledge proof corresponding to the target disclosure field based on the executable proof information;

[0024] a verification module, configured to verify the verifiable credential and the zero-knowledge proof in response to receiving the first access request sent by the target user and carrying the verifiable credential and the zero-knowledge proof;

[0025] an access control module, configured to accept the first access request in response to the verifiable credential and the zero-knowledge proof both passing the verification.

[0026] In some embodiments of the present disclosure, the disclosure field determination module is configured to determine the target disclosure field based on the requested access content and the security level of each field in the target data text.

[0027] In some embodiments of the present disclosure, the verifiable credential processing module is configured to generate the executable proof information based on the target disclosure field by using a zero-knowledge proof application, wherein the executable proof information includes an executable file corresponding to the zero-knowledge proof application.

[0028] The verifiable credential processing module is further configured to generate the verifiable credential based on the user information of the target user, the access right of the target user to the target disclosure field, and the executable proof information.

[0029] In some embodiments of the present disclosure, the verifiable credential has signature information, and the signature information includes at least one of a signature of the target user and a signature of the target data text provider.

[0030] The verification module is configured to verify the target disclosure field based on the zero-knowledge proof and verify the signature information.

[0031] In some embodiments of the present disclosure, the verifiable credential processing module is further configured to revoke the access right of the verifiable credential.

[0032] The access control module is further configured to reject a second access request sent by the target user and carrying the verifiable credential with the revoked access right in response to receiving the second access request.

[0033] A third aspect of the embodiments of the present disclosure provides an electronic device, comprising:

[0034] a memory, configured to store a computer program product;

[0035] a processor, configured to execute the computer program product stored in the memory, and when the computer program product is executed, implement the method of the first aspect.

[0036] In a fourth aspect of the embodiments of the present disclosure, a computer readable storage medium is provided, and the computer readable storage medium stores computer program instructions. When the computer program instructions are executed by a processor, the method in the first aspect is implemented.

[0037] In a fifth aspect of the embodiments of the present disclosure, a computer program product is provided, and the computer program product includes computer program instructions. When the computer program instructions are executed by a processor, the processor executes the method in the first aspect.

[0038] The data access control method and device, the electronic device, the medium and the program product of the embodiments of the present disclosure can effectively protect data security on the premise of disclosing part of the content, and the disclosed content can be adjusted according to user demand, thereby meeting diversified data sharing demand and being high in flexibility.

[0039] The technical solutions of the present disclosure will be described in further detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0040] The accompanying drawings, which form a part of the specification, illustrate the embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0041] The present disclosure can be more clearly understood with reference to the following detailed description when considered in conjunction with the accompanying drawings, in which:

[0042] Figure 1 A flowchart of a data access control method in an embodiment of the present disclosure is shown.

[0043] Figure 2 A partial flowchart of step S2 in some embodiments of the present disclosure is shown.

[0044] Figure 3 A flowchart after step S4 in some embodiments of the present disclosure is shown.

[0045] Figure 4 A structure block diagram of a data access control device in an embodiment of the present disclosure is shown.

[0046] Figure 5 A structure block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0047] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. Note that the relative arrangement, numerical expressions, and numerical values of components and steps set forth in these embodiments are not limiting to the scope of the present disclosure unless specifically stated otherwise.

[0048] Those skilled in the art can understand that the terms "first", "second", and the like in the embodiments of the present disclosure are only used to distinguish different steps, devices, or modules, and do not represent any specific technical meaning, nor do they represent a necessary logical sequence between them.

[0049] It should also be understood that in the embodiments of the present disclosure, "multiple" can mean two or more, and "at least one" can mean one, two, or more.

[0050] It should also be understood that for any component, data, or structure mentioned in the embodiments of the present disclosure, it can be understood as one or more in general, unless specifically limited or given a contrary implication by the context.

[0051] In addition, the term "and / or" in the present disclosure is only a description of the association relationship between the associated objects, which means that there can be three relationships, for example, A and / or B can represent the existence of A alone, the existence of A and B together, and the existence of B alone. In addition, the character " / " in the present disclosure generally represents an "or" relationship between the front and rear associated objects.

[0052] It should also be understood that the description of the embodiments of the present disclosure focuses on the differences between the embodiments, and the same or similar parts can be referred to each other, and for the sake of brevity, will not be repeated.

[0053] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way limiting to the disclosure and its application or uses.

[0054] Techniques, methods, and devices known to those of ordinary skill in the relevant art can not be discussed in detail, but should be considered part of the specification where appropriate.

[0055] It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further discussed in subsequent drawings.

[0056] The disclosed embodiments can be applied to terminal devices, computer systems, servers, and other electronic devices, which can operate with many other general-purpose or special-purpose computing system environments or configurations. Examples of well-known terminal devices, computing systems, environments, and / or configurations suitable for use with terminal devices, computer systems, servers, and other electronic devices include, but are not limited to, personal computers, server computers, thin clients, thick clients, hand-held or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network personal computers, minicomputers, mainframe computers, and distributed cloud computing technology environments that include any of the above systems, and the like.

[0057] Terminal devices, computer systems, servers, and other electronic devices can be described in the general context of computer system-executable instructions, such as program modules, being executed by the computer system. Generally, program modules can include routines, programs, objects, components, logic, data structures, and the like, which perform particular tasks or implement particular abstract data types. Computer systems / servers can be implemented in a distributed cloud computing environment, where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules can be located in local or remote computer system storage media including storage devices.

[0058] Figure 1 A flowchart of a control method for data access in one embodiment of the present disclosure is shown. As shown in Figure 1 The control method for data access includes the following steps:

[0059] S1: Based on the request access content of the target user for the target data text, determine the target disclosure field in the target data text.

[0060] After the data buyer (i.e., the target user) finds the target data text stored by the data provider on the decentralized network through the decentralized network, the data buyer can learn the data content included in the target data text and the role of the data content according to the description information of the target data text.

[0061] The data buyer can negotiate with the data provider through an online communication tool to determine the data content in the target data text that the data buyer wants to access.

[0062] The data provider can form a transaction on the decentralized network according to the data content that the data buyer wants to access, and determine the target disclosure field to be disclosed to the data buyer in the transaction.

[0063] S2: Based on the target disclosure field, a verifiable credential (VC) with executable proof information is generated, and the verifiable credential is sent to the target user, so that the target user generates a zero-knowledge proof (ZKP) corresponding to the target disclosure field based on the executable proof information.

[0064] The verifiable credential is a decentralized identity (DID) based digital credential that ensures the authenticity and tamper resistance of the credential through encryption signature. VC allows data owners to issue credentials with specific permissions to visitors, and visitors can verify the legitimacy of the credentials through a decentralized network without relying on centralized verification agencies.

[0065] Zero-knowledge proof (ZKP) is a cryptographic technology that allows the prover to prove the authenticity of a statement to the verifier without revealing any additional information. In data access control, ZKP can help visitors disclose only the permission information in the credential related to the current request without exposing other sensitive data.

[0066] The data provider can process the target disclosure field using the zero-knowledge proof program to obtain executable proof information. The executable proof information is used to obtain the zero-knowledge proof corresponding to the target disclosure field when executed.

[0067] After generating the executable proof information, the data provider can set the corresponding access rights for the data buyer according to the user information of the data buyer. The user information of the data buyer can include the user identifier of the data buyer on the decentralized network, as well as the age and gender information of the data buyer. The access rights can include operation rights for the target disclosure content (such as read-only, copy, and download, etc.). In addition, the data provider can also set an effective period within the access rights for the data buyer.

[0068] The data provider can generate the verifiable credential of the data buyer according to the executable proof information and the access rights of the data buyer, as well as other information required by the verifiable credential, and can sign the verifiable credential to ensure its authenticity and tamper resistance. The data provider can send the verifiable credential to the data buyer through encrypted transmission.

[0069] When the data buyer receives the encrypted verifiable credential, the encrypted verifiable credential is decrypted to obtain the verifiable credential. The executable proof information is extracted from the verifiable credential, and the zero-knowledge proof corresponding to the target disclosure field is generated according to the executable proof information. In addition, the data buyer can also verify the signature of the verifiable credential by using the public key of the data provider disclosed on the decentralized network.

[0070] S3: In response to receiving the first access request sent by the target user and carrying the verifiable credential and the zero-knowledge proof, the verifiable credential and the zero-knowledge proof are verified.

[0071] The data buyer can send a first access request for accessing the target disclosure field in the target data text to the data provider. The first access request carries the user information of the data provider, the verifiable credential sent by the data provider, and the zero-knowledge proof corresponding to the target disclosure field.

[0072] After receiving the first access request, the data provider verifies the verifiable credential and the zero-knowledge proof in the first access request to verify whether the data buyer has the access right to the target disclosure field in the target data text.

[0073] S4: In response to the verifiable credential and the zero-knowledge proof passing the verification, the first access request is accepted.

[0074] If the verifiable credential and the zero-knowledge proof pass the verification of the data provider, the data provider accepts the first access request, allows the data buyer to access the target disclosure field in the target data text within the access right, and can generate the corresponding access log according to the access content of the data buyer.

[0075] In the embodiment, since the verifiable credential ensures the authenticity and non-tamperability of the credential through the encryption signature, and the zero-knowledge proof allows the prover to prove the authenticity of a statement to the verifier without revealing any additional information, the executable proof information corresponding to the target disclosure field is added to the verifiable credential to realize the organic combination of the verifiable credential and the zero-knowledge proof. The organic combination of the verifiable credential and the zero-knowledge proof is applied in the data access control, which can effectively protect the data security on the premise of disclosing part of the content, and the disclosed content can be adjusted according to the user demand, meeting the diversified data sharing demand and having high flexibility.

[0076] In some embodiments of the present disclosure, step S1 can include determining the target disclosure field based on the requested access content and the security level of each field in the target data text.

[0077] The data provider can set corresponding security levels for each field in the target data text. The data provider can set multiple security levels for each field in the target data text: the field with the highest security level is not allowed to be accessed, the field with the lowest security level can be browsed and downloaded, and the field with an intermediate security level between the highest security level and the lowest security level can be browsed but not downloaded.

[0078] The data provider can access the content and the security level of each field in the target data text according to the request of the data buyer, and finally determine the target disclosure field that can be disclosed to the data buyer.

[0079] In this embodiment, according to the request of the user to access the content and the security level of each field in the target data text, the target disclosure field that can be disclosed to the user can be quickly and reasonably determined.

[0080] Figure 2 A partial flowchart of step S2 in some embodiments of the present disclosure is shown. As shown in Figure 2 Step S2 can include the following steps:

[0081] S2-1: Using a zero-knowledge proof application, generating executable proof information based on the target disclosure field.

[0082] The data provider compiles the target disclosure field using a zero-knowledge proof application to obtain executable proof information. The zero-knowledge proof application is an application for generating zero-knowledge proof. The executable proof information includes an executable file that the zero-knowledge proof application can run.

[0083] S2-2: Based on the user information of the target user, the access permission of the target user to the target disclosure field, and the executable proof information, generating a verifiable credential.

[0084] The data provider obtains the user information of the data buyer (i.e. the target user). The user information of the data buyer at least includes the age of the data buyer, because some data can be disclosed to people of a corresponding age, for example, some video works are only for people over a predetermined age to watch. In addition, the user information of the data buyer can also include the gender and occupation of the data buyer, etc.

[0085] The data provider can set the access permission of the data buyer to the target disclosure field, for example, the data buyer can be set to have read-only, download, and forward permissions for the target disclosure field.

[0086] The data provider can take the user information of the data buyer, the access right of the data buyer to the target disclosure field, and the executable proof information as inputs of the verifiable credential application, and generate the verifiable credential of the data buyer by using the verifiable credential application. The verifiable credential application is an application for generating the verifiable credential.

[0087] In this embodiment, the zero-knowledge proof application can be used to generate the executable proof information for the target user according to the target disclosure field, and then generate the verifiable credential for the target user according to the user information of the target user, the access right of the target user to the target disclosure field, and the executable proof information.

[0088] In some embodiments of the present disclosure, the verifiable credential has signature information. The signature information includes at least one of the signature of the target user and the signature of the target data text provider. The data provider can send the signature information to the data buyer after signing the verifiable credential, and the data buyer (i.e., the target user) can sign the verifiable credential by using the private key of the data buyer after receiving the verifiable credential.

[0089] Correspondingly, the step of verifying the verifiable credential and the zero-knowledge proof in step S4 can include verifying the target disclosure field based on the zero-knowledge proof and verifying the signature information.

[0090] After receiving the first access request sent by the data sender, the data provider verifies the zero-knowledge proof carried in the first access request to verify whether the zero-knowledge proof corresponds to the target disclosure field.

[0091] In addition, the data provider also verifies the signature information in the verifiable credential carried in the first access request, that is, the signature of the data provider can be verified by the public key of the data provider, and the signature of the data buyer can be verified by the public key of the data buyer.

[0092] After the verifiable credential and the zero-knowledge proof are verified by the data provider, the data provider accepts the first access request, allows the data buyer to access the target disclosure field in the target data text within the access right, and can generate the corresponding access log according to the access content of the data buyer.

[0093] In this embodiment, by verifying the zero-knowledge proof and the signature of the verifiable credential, the data security can be effectively protected on the premise of disclosing part of the content.

[0094] Figure 3 The flowchart after step S4 in some embodiments of the present disclosure is shown in FIG. 4. As shown in FIG. 4, after step S4, the following steps can be further included. Figure 3 ​

[0095] S5: Revoking the access right of the verifiable credential.

[0096] The data provider can revoke the access right of the verifiable credential of the data buyer, for example, in the case of unauthorized downloading, forwarding and using the target disclosure field by the data buyer, if the data buyer is found to have unauthorized downloading, forwarding or using the target disclosure field, the data buyer can revoke the access right of the verifiable credential, and the status of the verifiable credential of the data buyer can be marked as revoked.

[0097] S6: In response to receiving the second access request sent by the target user carrying the revoked access right verifiable credential, the second access request is rejected.

[0098] After the data provider revokes the access right of the verifiable credential of the data buyer (i.e. the target user), if the data buyer sends a second access request carrying the revoked access right verifiable credential to the data provider, the second access request is rejected, the data buyer is not allowed to access the target disclosure field, and corresponding log information can be provided.

[0099] In this embodiment, the data provider can revoke the access right of the verifiable credential, thereby rejecting the target user's access to the previously allowed target disclosure content, and achieving flexible management of data.

[0100] In one example of the present disclosure, the data access control method can include the following steps:

[0101] 1. Data purchase and policy negotiation.

[0102] (1) The data buyer connector sends a data purchase request to the data provider connector, expressing the demand for data access (including requesting access content).

[0103] (2) The data provider connector and the data buyer connector negotiate the access policy, for example, through an online communication platform provided by a decentralized network or other transaction platforms outside the decentralized network, to clearly define the access right, data disclosure range and other specific requirements, and then generate and confirm the transaction between the data buyer and the data provider on the transaction platform.

[0104] 2. Data purchase and policy negotiation.

[0105] (1) The data provider connector defines the access policy according to the negotiation content, which can include access right and validity period, etc.

[0106] (2) The data provider connector can generate a VC according to the user information provided by the data provider connector and the access policy.

[0107] (3) The data provider connector sets a selective disclosure field (i.e., target disclosure field) for the VC according to the access requirement, ensuring that the data buyer can use ZKP to disclose only the required permission information when presenting the VC, without revealing the complete content. The executable proof information is included in the VC to obtain the ZKP corresponding to the selective disclosure field.

[0108] (4) The data provider connector digitally signs the VC to ensure its authenticity and tamper resistance.

[0109] (5) The data provider connector stores the VC locally after generation for subsequent permission management.

[0110] 3. VC issuance.

[0111] (1) The data provider connector securely issues the VC to the data buyer connector through an encryption method (e.g., encryption based on the Transport Layer Security (TLS)) so that the data buyer can use the VC for data access.

[0112] 4. Data access request and selective disclosure.

[0113] (1) The data buyer connector sends a data access request to the data provider connector, accompanied by the VC and ZKP.

[0114] (2) The data provider connector queries the DID document of the data buyer connector (BuyerConnector) from the blockchain.

[0115] (3) The data provider connector obtains the public key of the data buyer from the DID document of the data buyer connector for subsequent verification.

[0116] 5. Verify ZKP and access permissions.

[0117] (1) The data provider connector verifies the selective disclosure permission information in the VC using ZKP, ensuring that the data buyer connector only presents the necessary permission proof without revealing additional information.

[0118] (2) The data provider connector uses the public key obtained from the blockchain to verify the digital signature of the VC, confirming the authenticity and integrity of the VC.

[0119] (3) The data provider connector checks the validity period and permission range of the VC, ensuring that the data access request complies with the previously negotiated access policy.

[0120] 6. Perform data access.

[0121] (1) If both VC verification and permission verification pass, the data provider connector allows the data purchaser connector to access the data (i.e., access the target disclosure field in the target data text) and perform corresponding operations according to the access policy, such as browsing, copying, downloading or forwarding.

[0122] (2) The data provider connector records the relevant logs for this data access for auditing and tracking purposes.

[0123] 7. Revoke permissions.

[0124] (1) If the data provider connector decides to revoke the data purchaser’s access rights, it will update the VC status locally and mark the VC as revoked.

[0125] (2) When the data purchaser connector tries to access the data again using the revoked VC, the data provider connector will re-query the DID document on the blockchain and verify the VC status.

[0126] (3) Once it is confirmed that the VC has been revoked, the data provider connector rejects the data purchaser's access request and records the revocation-related log information.

[0127] Figure 4 This is a structural block diagram of a data access control device in one embodiment of this disclosure. Figure 4 As shown, the data access control device includes:

[0128] The disclosure field determination module 100 is used to determine the target disclosure fields in the target data text based on the content of the target user's request access to the target data text;

[0129] The verifiable credential processing module 200 is used to generate verifiable credentials with executable proof information based on the target disclosure field, and send the verifiable credentials to the target user so that the target user can generate a zero-knowledge proof corresponding to the target disclosure field based on the executable proof information.

[0130] The verification module 300 is used to verify the verifiable credentials and zero-knowledge proof in response to receiving a first access request sent by the target user, which carries verifiable credentials and zero-knowledge proof.

[0131] Access control module 400 is used to accept the first access request in response to the verification of both verifiable credentials and zero-knowledge proofs.

[0132] In some embodiments of this disclosure, the disclosure field determination module 100 is used to determine the target disclosure field based on the confidentiality level of each field in the requested access content and the target data text.

[0133] In some embodiments of the present disclosure, the verifiable credential processing module 200 is configured to generate executable proof information based on the target disclosure field by using a zero-knowledge proof application, wherein the executable proof information comprises an executable file corresponding to the zero-knowledge proof application.

[0134] The verifiable credential processing module 200 is further configured to generate a verifiable credential based on the user information of the target user, the access permission of the target user for the target disclosure field, and the executable proof information.

[0135] In some embodiments of the present disclosure, the verifiable credential has signature information, and the signature information comprises at least one of a signature of the target user and a signature of the target data text provider.

[0136] The verification module 300 is configured to verify the target disclosure field based on the zero-knowledge proof and verify the signature information.

[0137] In some embodiments of the present disclosure, the verifiable credential processing module 200 is further configured to revoke the access permission of the verifiable credential.

[0138] The access control module 400 is further configured to reject a second access request sent by the target user and carrying the verifiable credential with the revoked access permission in response to receiving the second access request.

[0139] It should be noted that the specific implementation of the data access control apparatus of the embodiments of the present disclosure is similar to that of the data access control method of the embodiments of the present disclosure, and the technical effects of the data access control apparatus of the embodiments of the present disclosure are similar to those of the data access control method of the embodiments of the present disclosure. For details, refer to the description of the data access control method part. In order to reduce redundancy, no further description is made.

[0140] In addition, the embodiments of the present disclosure also provide an electronic device, comprising:

[0141] A memory is configured to store a computer program.

[0142] A processor is configured to execute the computer program stored in the memory, and when the computer program is executed, the data access control method of any one of the embodiments of the present disclosure is implemented.

[0143] Next, the electronic device according to the embodiments of the present disclosure will be described with reference to Figure 5 As shown in Figure 5 The electronic device comprises one or more processors and a memory.

[0144] The processor can be a central processing unit (CPU) or other form of processing unit having data processing and / or instruction execution capabilities and can control other components in the electronic device to perform desired functions.

[0145] The memory can store one or more computer program products, which can include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory, for example, can include random access memory (RAM), cache memory, and / or the like. The non-volatile memory, for example, can include read-only memory (ROM), hard disk, flash memory, and / or the like. One or more computer program products can be stored on the computer-readable storage media, and the processor can execute the computer program products to implement the data access control method of various embodiments of the present disclosure described above and / or other desired functions.

[0146] In one example, the electronic device can further include an input device and an output device, which are interconnected through a bus system and / or other forms of connection mechanisms (not shown).

[0147] In addition, the input device can further include, for example, a keyboard, a mouse, and / or the like.

[0148] The output device can output various information, including the determined distance information, direction information, and / or the like, to the outside. The output device can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and / or the like.

[0149] Of course, in order to simplify, Figure 5 Only some of the components in the electronic device related to the present disclosure are shown in FIG. 1, and components such as buses, input / output interfaces, and / or the like are omitted. In addition, the electronic device can further include any other appropriate components according to specific application cases.

[0150] In addition to the above-described method and device, embodiments of the present disclosure can be a computer program product including computer program instructions that, when executed by a processor, cause the processor to perform the steps of the data access control method according to various embodiments of the present disclosure described in the above parts of the specification.

[0151] The computer program product can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++, or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server.

[0152] Furthermore, embodiments of the present disclosure can also be a computer readable storage medium, having stored thereon computer program instructions which, when executed by a processor, cause the processor to perform the steps described in the foregoing disclosure of the control method of data access according to various embodiments of the present disclosure.

[0153] The computer readable storage medium can be any combination of one or more computer readable media. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium can include, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the above. More specific examples (a non-exhaustive list) of the computer readable storage medium include an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0154] The above describes the basic principles of the present disclosure in combination with specific embodiments, but it should be noted that the advantages, benefits, effects and the like mentioned in the present disclosure are only examples and are not limiting, and these advantages, benefits, effects and the like cannot be considered as the various embodiments of the present disclosure must have. In addition, the above specific details are only for the purpose of example and for the purpose of understanding, and the above details do not limit the present disclosure to the above specific details.

[0155] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same or similar parts between each embodiment can be referred to each other. For system embodiments, since they basically correspond to method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0156] The block diagrams of devices, apparatuses, equipment, systems referred to in this disclosure are merely illustrative examples and are not intended to require or imply that the connection, arrangement, configuration must be as shown in the block diagrams. These devices, apparatuses, equipment, systems can be connected, arranged, configured in any manner as will be appreciated by those skilled in the art. Words such as "include," "contain," "have," and the like are open-ended words that are intended to mean "including but not limited to," and are to be taken in their broadest context. The words "or" and "and" as used herein are intended to mean "and / or," and are to be taken in their broadest context unless the context clearly indicates otherwise. The word "such as" as used herein is intended to mean "such as but not limited to," and is to be taken in its broadest context.

[0157] The methods and apparatuses of this disclosure can be implemented in a number of ways. For example, the methods and apparatuses of this disclosure can be implemented using software, hardware, firmware, or any combination of these methods and apparatuses. The above described order of steps for the methods is merely illustrative, and the steps of the methods of this disclosure are not limited to the order specifically described above unless otherwise specifically stated. Furthermore, in some embodiments, the disclosure can also be implemented as a program recorded in a recording medium, which includes machine readable instructions for implementing the methods according to the disclosure. Thus, the disclosure also covers a recording medium storing a program for executing the methods according to the disclosure.

[0158] It is also important to note that the devices, equipment and methods of this disclosure can be split and / or recombined into various components or steps. These splits and / or recombination should be considered as equivalent to this disclosure.

[0159] The above description of the disclosed aspects is given for illustrative purposes and not intended to limit the scope or applicability of the disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the generic principles defined herein can be applied to other aspects without departing from the scope of the disclosure. Thus, the present disclosure is not intended to be limited to the aspects shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0160] The above description has been given for the purpose of illustration and description. Furthermore, this description does not purport to be exhaustive or to limit the embodiments of the disclosure to the precise forms disclosed. Although several example aspects and embodiments have been discussed above, those of ordinary skill in the art will appreciate a variety of modifications, alternatives, permutations, additions, and sub-combinations that fall within the scope of the disclosure.

Claims

1. A data access control method, characterized in that, The method incorporates the executable proof information corresponding to the target disclosure field into the verifiable credential, thereby achieving an organic combination of verifiable credentials and zero-knowledge proofs; the method includes: Based on the content of the target user's request to access the target data text, the target disclosure field in the target data text is determined; Based on the target disclosure field, a verifiable credential with executable proof information is generated, and the verifiable credential is sent to the target user so that the target user can generate a zero-knowledge proof corresponding to the target disclosure field based on the executable proof information. In response to receiving a first access request sent by the target user carrying the verifiable credential and the zero-knowledge proof, the verifiable credential and the zero-knowledge proof are verified. In response to the fact that both the verifiable credential and the zero-knowledge proof have been verified, the first access request is accepted. The step of generating a verifiable credential with executable proof information based on the target disclosure field includes: generating the executable proof information based on the target disclosure field using a zero-knowledge proof application, wherein the executable proof information includes an executable file corresponding to the zero-knowledge proof application; and generating the verifiable credential based on the target user's user information, the target user's access permissions to the target disclosure field, and the executable proof information. The verification of the verifiable credential and the zero-knowledge proof includes: verifying the target disclosure field based on the zero-knowledge proof, and verifying the signature information in the verifiable credential.

2. The method according to claim 1, characterized in that, The step of determining the target disclosure field in the target data text based on the target user's request for access to the target data text includes: The target disclosure fields are determined based on the requested access content and the confidentiality level of each field in the target data text.

3. The method according to claim 1 or 2, characterized in that, The verifiable credential has signature information, which includes at least one of the signature of the target user and the signature of the target data text provider.

4. The method according to claim 1 or 2, characterized in that, After the response that both the verifiable credential and the zero-knowledge proof have been verified, allowing the target user to access the target disclosure field, the method further includes: Revoke access rights to the verifiable credentials; In response to receiving a second access request from the target user carrying the verifiable credentials for revoking access rights, the second access request is rejected.

5. A data access control device, characterized in that, The apparatus is used to add executable proof information corresponding to the target disclosure field to the verifiable credential, thereby achieving an organic combination of verifiable credential and zero-knowledge proof. The apparatus includes: The disclosure field determination module is used to determine the target disclosure fields in the target data text based on the content of the target user's request access to the target data text; The verifiable credential processing module is used to generate a verifiable credential with executable proof information based on the target disclosure field, and send the verifiable credential to the target user so that the target user can generate a zero-knowledge proof corresponding to the target disclosure field based on the executable proof information. The verification module is configured to verify the verifiable credential and the zero-knowledge proof in response to receiving a first access request sent by the target user carrying the verifiable credential and the zero-knowledge proof. The access control module is configured to accept the first access request in response to the fact that both the verifiable credential and the zero-knowledge proof have been verified. Specifically, the verifiable credential processing module is used to generate the executable proof information based on the target disclosure field using a zero-knowledge proof application, and to generate the verifiable credential based on the user information of the target user, the access permissions of the target user to the target disclosure field, and the executable proof information, wherein the executable proof information includes the executable file corresponding to the zero-knowledge proof application; The verification module is specifically used to verify the target disclosure field based on the zero-knowledge proof and to verify the signature information in the verifiable credential.

6. The apparatus according to claim 5, characterized in that, The disclosure field determination module is used to determine the target disclosure field based on the requested access content and the confidentiality level of each field in the target data text.

7. The apparatus according to claim 5 or 6, characterized in that, The verifiable credential has signature information, which includes at least one of the signature of the target user and the signature of the target data text provider.

8. The apparatus according to claim 5 or 6, characterized in that, The verifiable credential processing module is also used to revoke access permissions to the verifiable credential; The access control module is further configured to reject the second access request in response to receiving a second access request from the target user carrying the verifiable credentials for revoking access permissions.

9. An electronic device, characterized in that, include: Memory, used to store computer program products; A processor for executing a computer program product stored in the memory, wherein when the computer program product is executed, it implements the method described in any one of claims 1-4.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1-4.

11. A computer program product, characterized in that, It includes computer program instructions that, when executed by a processor, cause the processor to perform the method described in any one of claims 1-4.

Images