Information security management system based on non-homogeneous digital rights

Abstract

The present invention relates to the field of information security management technology, and specifically discloses an information security management system based on non-homogeneous digital rights, the system comprising: a service request acquisition module for acquiring service requests from users; a collaboration module for collaborating with a third party to obtain a commitment value through secret sharing based on a first commitment value shard; a generation module for generating a digital identity certificate based on the non-homogeneous digital rights and the commitment value; a sending module for sending the digital identity certificate to a third party so that the third party can authenticate the identity based on the digital identity certificate and the commitment value. The technical solution of the present invention achieves efficient identity authentication and information security management while ensuring privacy security by utilizing the user's biometrics to generate non-homogeneous digital rights and secret sharing technology.

Description

Technical Field

[0001] The present invention relates to the technical field of information security management, and in particular to an information security management system based on non-homogeneous digital rights. Background Art

[0002] Existing technical applications based on non-fungible tokens are more focused on the trading of digital art and virtual assets, but their application in information security management is still in its infancy. With the rapid advancement of digitalization, user identity authentication and rights management in various digital services have become crucial. Traditional information security management systems mostly rely on a unified and homogeneous identity authentication method, which may pose the risk of information leakage and user identity fraud. In addition, existing information security management systems also have deficiencies in terms of privacy protection and the reliability of security verification.

[0003] Therefore, it is necessary to provide an information security management system based on non-homogeneous digital rights to better solve the problems of information leakage, identity authentication security, uniqueness and access rights management. Summary of the invention

[0004] The purpose of the present invention is to provide an information security management system based on non-homogeneous digital rights to solve the following technical problems:

[0005] In the current digital economy, digital asset management faces many challenges, including data ownership verification, permission management, security assurance, etc. Existing information security management systems mostly rely on homogeneous authentication methods, such as user name, password, permission control, etc. This approach may have the risk of information leakage and user identity being misused. At the same time, existing information security management systems are also insufficient in terms of privacy protection and the reliability of security verification.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] An information security management system based on non-homogeneous digital rights, the system comprising:

[0008] A service request acquisition module, used to acquire a service request from a user; wherein the service request includes a non-homogeneous digital right and an operation service generated based on the biometrics of the user;

[0009] A collaboration module, configured to collaborate with a third party to obtain a commitment value through secret sharing based on the first commitment value slice; the third party owns the second commitment value slice;

[0010] A generation module, configured to generate a digital identity certificate based on the non-fungible digital rights and the commitment value;

[0011] A sending module, used for sending the digital identity certificate to a third party so that the third party can perform identity authentication based on the digital identity certificate and the commitment value; the commitment value of the third party is obtained in collaboration with the information security management system through secret sharing based on the second commitment value slice;

[0012] A judgment module, used to receive an identity verification result from the third party, and judge whether the service request is legal according to the identity verification result;

[0013] The execution module is used to execute the operation service corresponding to the service request in response to the service request being legal, and upload the identity authentication result to the blockchain.

[0014] As a further solution of the present invention, the non-homogeneous digital rights are obtained in the following manner:

[0015] Collecting biometric features of the user; the biometric features include facial images and fingerprint images;

[0016] Performing feature recognition on the face image and the fingerprint image to determine key feature areas in the face image and the fingerprint image;

[0017] Perform feature extraction based on the key feature area to obtain a feature vector;

[0018] A non-homogeneous digital mark is added to the feature vector to obtain the non-homogeneous digital right.

[0019] As a further solution of the present invention, in order to generate a digital identity certificate based on the non-homogeneous digital rights and the commitment value, the generation module is further used to:

[0020] Generate a zero-knowledge proof based on the user's private key and the commitment value;

[0021] Generate a proof of rights based on the user's private key and the non-fungible digital rights;

[0022] The digital identity certificate is obtained according to the zero-knowledge certificate and the equity certificate.

[0023] As a further solution of the present invention, the first commitment value slice and the second commitment value slice are obtained by:

[0024] Obtaining the commitment value by random generation;

[0025] Mapping the commitment value to a point Ps on a preset elliptic curve;

[0026] Generate a random number r1;

[0027] Based on the random number r1, a first commitment value fragment P1=r1·G is obtained; wherein G is a base point defined on the elliptic curve;

[0028] The second commitment value fragment P2=Ps-P1 is calculated.

[0029] As a further solution of the present invention, based on the first commitment value sharding, the commitment value is obtained in collaboration with a third party by secret sharing, and the collaboration module is further used to:

[0030] Obtain a first commitment value slice P1 of the information security management system;

[0031] Obtain the second commitment value slice P2 of the third party;

[0032] Calculate a point Ps based on the first commitment value slice P1 and the second commitment value slice P2;

[0033] The commitment value is obtained by solving the discrete logarithm based on the point Ps.

[0034] As a further solution of the present invention, the first commitment value slice and the second commitment value slice are obtained by:

[0035] Obtaining the commitment value by random generation;

[0036] Based on the commitment value, generating the first commitment value slice and the second commitment value slice by a predefined nonlinear function;

[0037] The predefined nonlinear function is:

[0038] ;

[0039] Among them, a0 is the commitment value, a1 and a2 are randomly generated coefficients, f(x) is the generated commitment value slice, and x represents an independent variable, which is a preset value used to generate the commitment value slice.

[0040] As a further solution of the present invention, generating the first commitment value slice and the second commitment value slice based on the commitment value through a predefined nonlinear function includes:

[0041] Determine a preset value i1 corresponding to the first commitment value slice, and a preset value i2 corresponding to the second commitment value slice;

[0042] Substituting the preset value i1 into the predefined nonlinear function to obtain the first commitment value slice P1;

[0043] Substitute the preset value i2 into the predefined nonlinear function to obtain the second commitment value slice P2.

[0044] As a further solution of the present invention, based on the first commitment value sharding, the commitment value is obtained in collaboration with a third party by secret sharing, and the collaboration module is further used to:

[0045] Obtain a first commitment value slice P1 of the information security management system;

[0046] Obtain the second commitment value slice P2 of the third party;

[0047] The commitment value is obtained by interpolation based on the following formula;

[0048] ;

[0049] Where g(x) is the commitment value, s j For the j-th commitment value shard, i j is the jth preset value, t is the number of committed value shards participating in the collaboration, x is the independent variable in the interpolation, which is used to indicate the location of calculating the recovery value, i m Different from i j The default value of the shard.

[0050] The present invention also provides an information security management method based on non-homogeneous digital rights, the method comprising:

[0051] Obtaining a service request from a user; wherein the service request includes a non-homogeneous digital right and an operation service generated based on a biometric feature of the user;

[0052] Based on the first commitment value shard, the commitment value is obtained in collaboration with a third party by secret sharing; the third party owns the second commitment value shard;

[0053] Generate a digital identity certificate based on the non-fungible digital rights and the commitment value;

[0054] Sending the digital identity certificate to a third party so that the third party can perform identity authentication based on the digital identity certificate and the commitment value; the commitment value of the third party is obtained in collaboration with the information security management system based on the second commitment value slice by secret sharing;

[0055] receiving an identity verification result from the third party, and determining whether the service request is legitimate based on the identity verification result;

[0056] In response to the service request being legitimate, executing the operation service corresponding to the service request, and uploading the identity authentication result to the blockchain.

[0057] Beneficial effects of the present invention: The information security management system based on non-homogeneous digital rights provided by the present invention utilizes the transparency and immutability of blockchain technology, as well as the uniqueness of non-homogeneous digital rights, significantly improving the security of digital assets and sensitive data. At the same time, the user's identity is authenticated by combining secret sharing with non-homogeneous digital rights, which ensures the uniqueness of the identity authentication result while protecting the user's privacy information, and effectively solves the problems of information leakage, identity authentication security, uniqueness and access rights management. The system can not only solve many pain points in current information security management, but also provide more reliable solutions for future digital assets and information security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The present invention will be further described below in conjunction with the accompanying drawings.

[0059] Figure 1 It is a structural diagram of the information security management system based on non-homogeneous digital rights and interests of the present invention.

[0060] Figure 2 It is a flow chart of the information security management method based on non-homogeneous digital rights and interests of the present invention. DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] See also Figure 1 As shown, Figure 1 It is an information security management system based on non-homogeneous digital rights of the present invention. The system 100 includes a service request module 110, a collaboration module 120, a generation module 130, a sending module 140, a judgment module 150 and an execution module 160.

[0063] The service request acquisition module 110 may be used to acquire a service request from a user.

[0064] The service request includes non-homogeneous digital rights and operating services generated based on the biometrics of the user.

[0065] The collaboration module 120 may be used to collaborate with a third party to obtain a commitment value through secret sharing based on the first commitment value sharding.

[0066] The third party owns the second commitment value slice.

[0067] The generation module 130 may be configured to generate a digital identity certificate based on the non-fungible digital rights and the commitment value.

[0068] The sending module 140 may be configured to send the digital identity certificate to a third party so that the third party can perform identity authentication based on the digital identity certificate and the commitment value.

[0069] The third party's commitment value is obtained based on the second commitment value slice and in collaboration with the information security management system through secret sharing.

[0070] The determination module 150 may be configured to receive an identity verification result from the third party, and determine whether the service request is legal based on the identity verification result.

[0071] The execution module 160 can be used to execute the operation service corresponding to the service request in response to the service request being legal, and upload the identity authentication result to the blockchain.

[0072] See also Figure 2 As shown, Figure 2 is a flowchart of an information security management method based on non-homogeneous digital rights of the present invention. In some embodiments, Figure 2 The process 200 shown may be executed by a processor or an information security management system based on non-fungible digital rights (eg, system 100 ).

[0073] Step 201: Obtain a service request from a user.

[0074] The service request includes non-homogeneous digital rights and operating services generated based on the biometrics of the user.

[0075] Non-homogeneous digital rights refer to unique digital identities generated based on user biometrics. Each user's biometrics (such as fingerprints, facial recognition data, iris data, etc.) will be used to generate a unique digital identity information that cannot be copied or forged. Non-homogeneous digital rights are used in the identity authentication process in the information security management system to ensure the uniqueness and authenticity of the user's identity.

[0076] Operation services can be accessing specific resources or performing certain operations.

[0077] In some embodiments, a user may input and submit a service request through a system interface, at which point the system may read the user's biometric data (such as a fingerprint or facial scan) and generate a non-homogeneous digital right for the user based on the biometric data read.

[0078] In some embodiments, non-fungible digital rights may be obtained by:

[0079] S10, collecting biometric features of the user.

[0080] Biometrics refers to physiological or behavioral characteristics that are unique to an individual and can be used for identity recognition. In the present invention, biometrics include face images and fingerprint images, which are unique and stable and suitable for identity verification.

[0081] In some embodiments, the user may input his / her face image and fingerprint image through the system's biometric acquisition device (e.g., camera and fingerprint scanner). The system acquisition device captures the user's face image and fingerprint image and transmits the image data to the system's processing unit (e.g., processor).

[0082] S11, performing feature recognition on the face image and the fingerprint image to determine key feature areas in the face image and the fingerprint image.

[0083] Feature recognition refers to the process of identifying key distinguishing feature areas from biometric data. For example, in a face image, the key feature areas may include the eyes, nose, and mouth; in a fingerprint image, the key feature areas may include the ridges and valleys of the fingerprint.

[0084] In some embodiments, the system may use a face recognition algorithm (such as a Haar feature cascade classifier or a deep learning model) to analyze a face image and identify key feature areas such as eyes, nose, and mouth. Also, the system may use a fingerprint recognition algorithm (such as a Minutiae feature extraction algorithm) to analyze a fingerprint image and identify key feature areas such as ridges, valleys, bifurcation points, and endpoints of a fingerprint.

[0085] S12, performing feature extraction based on the key feature area to obtain a feature vector.

[0086] Feature extraction is the process of converting the identified key feature regions into numerical form (e.g., feature vectors). A feature vector is a set of numerical values ​​that can represent the uniqueness of a biometric feature.

[0087] In some embodiments, the system extracts features from key feature areas in a face image and converts them into feature vectors (e.g., by principal component analysis, convolutional neural network, etc.). Also, the system extracts features from key feature areas in a fingerprint image and converts them into feature vectors (e.g., by Minutiae feature point extraction and descriptor generation methods).

[0088] S13, adding a non-homogeneous digital mark to the feature vector to obtain the non-homogeneous digital rights.

[0089] Adding non-homogeneous digital markers refers to the process of giving a unique identifier to a feature vector. By adding markers, each feature vector can be unique and cannot be copied or forged, thus forming non-homogeneous digital rights.

[0090] In some embodiments, the system may generate a unique digital identifier (such as a UID or a unique identifier generated based on blockchain technology, etc.). The system combines the digital identifier with the feature vector to generate a feature vector with a non-homogeneous digital mark. The system stores the feature vector with the non-homogeneous digital mark as the user's non-homogeneous digital rights.

[0091] Step 202: Based on the first commitment value shard, collaborate with a third party to obtain the commitment value through secret sharing.

[0092] Secret sharing is a cryptographic protocol that allows a piece of secret information to be split into multiple pieces and distributed to multiple parties. The original secret information can only be recovered when all the pieces are reassembled. In this system, secret sharing is used to split the commitment value into pieces and ensure the secure transmission and storage of information through collaborative calculation with a third party through an information management system.

[0093] The third party may be a trusted computing device designated by the information management system. The third party has the second commitment value slice. The first commitment value slice and the second commitment value slice may be data segments obtained by dividing the commitment value. The information security management system and the third party each hold a data slice and are unaware of the specific information of the commitment value owned by the other party.

[0094] The commitment value is the key data for verifying the user's identity. It is generated and transmitted between the information security management system and the third party through secret sharing. The shards of the commitment value are held by the system and the third party respectively. The complete commitment value is obtained through the collaborative calculation of the two, which is used for the generation and verification of digital identity proof.

[0095] During collaborative computing, the third party and the information security management system can send their respective commitment value shards to a trusted execution environment (e.g., TEE), perform recovery operations based on the first commitment value shard and the second commitment value shard in the trusted execution environment, and thereby obtain the commitment value.

[0096] Since the recovery operation is performed in a trusted execution environment, neither the third party nor the information security management system will know the other party's commitment value sharding information, thereby ensuring the privacy and security of the data and preventing it from being leaked.

[0097] In some embodiments, the first commitment value slice and the second commitment value slice may be obtained in the following manner:

[0098] S20, obtaining the commitment value by random generation.

[0099] The system can generate a random number through a secure random number generation algorithm (such as a pseudo-random number generator) and set it as a committed value.

[0100] S21, mapping the commitment value to a point Ps on a preset elliptic curve.

[0101] The point Ps on the elliptic curve is the result of the mapping of the commitment value in elliptic curve cryptography. Elliptic curve cryptography (ECC) is an algorithm that uses the mathematical properties of elliptic curves for encryption and has high security. Point Ps represents a coordinate point of the commitment value on the elliptic curve, which is used for encryption calculation and verification.

[0102] S22, generate a random number r1.

[0103] The random number r1 is a random value generated by the system for security purposes and is used to generate the commitment value shards to ensure data security. The randomness and uniqueness of the random number prevent the commitment value from being calculated or cracked.

[0104] The random number r1 will be used as a multiplier when generating the first commitment value shard.

[0105] S23, obtaining a first commitment value fragment P1=r1·G based on the random number r1; wherein G is a base point defined on the elliptic curve.

[0106] The base point G is a fixed point on the elliptic curve, which is usually used to generate other points.

[0107] S23, calculate and obtain the second commitment value fragment P2=Ps-P1.

[0108] In some embodiments, based on the first commitment value shard, obtaining the commitment value in collaboration with a third party by secret sharing can be achieved in the following ways:

[0109] S30, obtaining a first commitment value slice P1 of the information security management system;

[0110] S31, obtaining the second commitment value slice P2 of the third party;

[0111] S32, calculating a point Ps based on the first commitment value slice P1 and the second commitment value slice P2;

[0112] S33, obtaining the commitment value by solving the discrete logarithm based on the point Ps.

[0113] The system can use the discrete logarithm algorithm on the elliptic curve to solve the point Ps and restore the commitment value. The solved commitment value will be used in the subsequent encryption verification process to ensure the integrity of the information security management system.

[0114] In some other embodiments, the first commitment value slice and the second commitment value slice may also be obtained by: obtaining the commitment value by random generation; and, based on the commitment value, generating the first commitment value slice and the second commitment value slice by a predefined nonlinear function.

[0115] The predefined nonlinear function is a mathematical function used to generate commitment value shards, which contains randomly generated coefficients a1 and a2. It generates the corresponding commitment value shards by bringing the preset values ​​(i1 and i2) into the calculation formula, ensuring the randomness and uniqueness of the shards.

[0116] The predefined nonlinear function is shown in the following formula (1).

[0117] (1);

[0118] Among them, a0 is the commitment value, a1 and a2 are randomly generated coefficients, f(x) is the generated commitment value slice, and x represents an independent variable, which is a preset value used to generate the commitment value slice.

[0119] In some embodiments, based on the commitment value, the first commitment value slice and the second commitment value slice are generated through a predefined nonlinear function, including: determining a preset value i1 corresponding to the first commitment value slice, and a preset value i2 corresponding to the second commitment value slice; substituting the preset value i1 into the predefined nonlinear function to obtain the first commitment value slice P1; substituting the preset value i2 into the predefined nonlinear function to obtain the second commitment value slice P2.

[0120] In some embodiments, based on the first commitment value shard, the commitment value is obtained in collaboration with a third party by secret sharing, including:

[0121] Obtain the first commitment value slice P1 of the information security management system; obtain the second commitment value slice P2 of the third party; obtain the commitment value by interpolation method based on the following formula (2);

[0122] (2);

[0123] Where g(x) is the commitment value, s j For the j-th commitment value shard, i j is the jth preset value, t is the number of committed value shards participating in the collaboration, x is the independent variable in the interpolation, which is used to indicate the location of calculating the recovery value, i m Different from i j The default value of the shard.

[0124] Interpolation is a mathematical method that uses known data points to infer the values ​​of other points. This method is used to restore the commitment value through multiple shard data points. In this embodiment, the Lagrange interpolation polynomial is combined for solution.

[0125] In this embodiment, the system can generate and collaboratively calculate the commitment value through nonlinear functions and interpolation methods. The use of nonlinear functions and random coefficients a1 and a2 increases data security, and the interpolation method restores the commitment value without leaking the original data.

[0126] Step 203: Generate a digital identity certificate based on the non-fungible digital rights and the commitment value.

[0127] The system can input non-homogeneous digital rights and commitment values ​​into a preset algorithm, and generate a unique digital identity certificate through the algorithm using digital signature technology. The generated digital identity certificate can contain the user's identity information and verification identification.

[0128] In some embodiments, the system may generate a digital identity certificate based on the non-fungible digital equity and the commitment value through the following operations.

[0129] S40, generating a zero-knowledge proof based on the user's private key and the commitment value.

[0130] A private key is a cryptographic key that is unique to the user and cannot be disclosed. It is used to sign and decrypt information. The private key can be generated by the user on the device and kept strictly to ensure the uniqueness and security of their identity in the system. The private key can be paired with the public key to verify the user's identity, and a third party can have the public key.

[0131] Zero-knowledge proof is a cryptographic technique used to prove the authenticity of a specific statement without revealing information. It allows one party (the prover) to prove to another party (the verifier) ​​that it knows a secret (such as a user's private key) without revealing the contents of the secret. In this system, zero-knowledge proofs are generated based on the user's private key and commitment value to ensure the privacy and security of user authentication.

[0132] In some embodiments, the user provides his private key to the system, the system calls a zero-knowledge proof algorithm (such as zk-SNARKs or zk-STARKs) to process the private key and the commitment value, and the zero-knowledge proof algorithm generates a zero-knowledge proof.

[0133] S41, generating a rights certificate based on the user's private key and the non-fungible digital rights.

[0134] Proof of interest is a proof generated based on the user's non-homogeneous digital rights and private keys, which is used to demonstrate the user's unique access rights to certain specific resources. It ensures that only legitimate users can access resources and services related to their non-homogeneous digital rights.

[0135] In some embodiments, the system receives the user's non-fungible digital rights and private key, calls the equity proof algorithm, binds the user's private key to the non-fungible digital rights, and generates a unique equity proof.

[0136] S42, obtaining the digital identity certificate according to the zero-knowledge certificate and the equity certificate.

[0137] Digital identity proof is a unique identity generated based on zero-knowledge proof and proof of stake, which is used to provide user identity verification to third parties. In this system, digital identity proof serves as the final credential of the user's identity, containing the key information required to verify the user's identity, but does not disclose the user's private information.

[0138] In some embodiments, the system combines zero-knowledge proof and proof of stake to generate a complete digital identity.

[0139] Through the above steps, the system of the present invention uses zero-knowledge proof and equity proof to generate digital identity proof, ensuring the security, privacy and uniqueness of user identity authentication. The generated digital identity proof serves as the final identification of the user's identity and does not contain the plaintext information of the user's private key or non-homogeneous digital equity, thus protecting the user's information security to the greatest extent.

[0140] Step 204: Send the digital identity certificate to a third party so that the third party can perform identity authentication based on the digital identity certificate and the commitment value.

[0141] As mentioned above, the digital identity certificate is generated based on non-homogeneous digital rights and commitment values. Therefore, a third party also needs to use the commitment value to verify the digital identity certificate.

[0142] The third party's commitment value is obtained based on the second commitment value slices and in collaboration with the information security management system through secret sharing. The specific collaborative calculation method can be found in the description of step 202.

[0143] Step 205: Receive an identity verification result from the third party, and determine whether the service request is legal based on the identity verification result.

[0144] The authentication results include authentication passed and authentication failed.

[0145] When the identity authentication is passed, it can be determined that the service request requested by the user is legitimate.

[0146] Step 206, in response to the service request being legal, executing the operation service corresponding to the service request, and uploading the identity verification result to the blockchain.

[0147] Blockchain is decentralized and cannot be tampered with. Uploading identity verification results to the blockchain can not only ensure the permanent and reliable preservation of identity verification results, but also store the records of each identity verification for subsequent verification.

[0148] Working principle of the invention: By introducing non-homogeneous digital rights, the system can identify users more accurately and avoid the risks in traditional password and username authentication. The application of secret sharing technology ensures the security of the commitment value in the collaborative computing process and reduces the risk of single point failure. By uploading the verification results to the blockchain, the system ensures the transparency of the operation process and the traceability of information.

[0149] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. An information security management system based on non-homogeneous digital rights, characterized in that: The system comprises: A service request acquisition module, used to acquire a service request from a user; wherein the service request includes a non-homogeneous digital right and an operation service generated based on the biometrics of the user; A collaboration module, configured to collaborate with a third party to obtain a commitment value through secret sharing based on the first commitment value slice; the third party owns the second commitment value slice; A generation module, configured to generate a digital identity certificate based on the non-fungible digital rights and the commitment value; A sending module, used for sending the digital identity certificate to a third party so that the third party can perform identity authentication based on the digital identity certificate and the commitment value; the commitment value of the third party is obtained in collaboration with the information security management system through secret sharing based on the second commitment value slice; A judgment module, used to receive an identity verification result from the third party, and judge whether the service request is legal according to the identity verification result; An execution module, configured to execute the operation service corresponding to the service request in response to the service request being legitimate, and upload the identity verification result to the blockchain; The first commitment value slice and the second commitment value slice are obtained in the following manner: Obtaining the commitment value by random generation; Mapping the commitment value to a point Ps on a preset elliptic curve; Generate a random number r1; Based on the random number r1, a first commitment value fragment P1=r1·G is obtained; wherein G is a base point defined on the elliptic curve; The second commitment value fragment P2=Ps-P1 is calculated; In order to obtain the commitment value by collaborating with a third party through secret sharing based on the first commitment value sharding, the collaboration module is further used to: Obtain a first commitment value slice P1 of the information security management system; Obtain the second commitment value slice P2 of the third party; Calculate a point Ps based on the first commitment value slice P1 and the second commitment value slice P2; The commitment value is obtained by solving the discrete logarithm based on the point Ps.

2. According to claim 1, an information security management system based on non-homogeneous digital rights is characterized in that: The non-fungible digital rights are obtained in the following ways: Collecting biometric features of the user; the biometric features include facial images and fingerprint images; Performing feature recognition on the face image and the fingerprint image to determine key feature areas in the face image and the fingerprint image; Perform feature extraction based on the key feature area to obtain a feature vector; A non-homogeneous digital mark is added to the feature vector to obtain the non-homogeneous digital right.

3. According to claim 1, an information security management system based on non-homogeneous digital rights is characterized in that: To generate a digital identity certificate based on the non-fungible digital rights and the commitment value, the generating module is further used to: Generate a zero-knowledge proof based on the user's private key and the commitment value; Generate a proof of rights based on the user's private key and the non-fungible digital rights; The digital identity certificate is obtained according to the zero-knowledge certificate and the equity certificate.

4. According to claim 1, an information security management system based on non-homogeneous digital rights is characterized in that: The first commitment value slice and the second commitment value slice may also be obtained in the following manner: Obtaining the commitment value by random generation; Based on the commitment value, generating the first commitment value slice and the second commitment value slice by a predefined nonlinear function; The predefined nonlinear function is: ； Among them, a0 is the commitment value, a1 and a2 are randomly generated coefficients, f(y) is the generated commitment value slice, and y represents an independent variable, which is a preset value used to generate the commitment value slice.

5. According to claim 4, an information security management system based on non-homogeneous digital rights is characterized in that: The generating the first commitment value slice and the second commitment value slice based on the commitment value through a predefined nonlinear function includes: Determine a preset value i1 corresponding to the first commitment value slice, and a preset value i2 corresponding to the second commitment value slice; Substituting the preset value i1 into the predefined nonlinear function to obtain the first commitment value slice P1; Substitute the preset value i2 into the predefined nonlinear function to obtain the second commitment value slice P2.

6. The information security management system based on non-homogeneous digital rights according to claim 5 is characterized in that: In order to obtain the commitment value by collaborating with a third party through secret sharing based on the first commitment value sharding, the collaboration module is further used to: Obtain a first commitment value slice P1 of the information security management system; Obtain the second commitment value slice P2 of the third party; The commitment value is obtained by interpolation based on the following formula; ； Where g(x) is the commitment value, s j For the j-th commitment value shard, i j is the jth preset value, t is the number of committed value shards participating in the collaboration, x is the independent variable in the interpolation, which is used to indicate the location of calculating the recovery value, i m Different from i j The default value of the shard.

7. An information security management method based on non-homogeneous digital rights, applied to the information security management system according to any one of claims 1 to 6, characterized in that: The method comprises: Obtaining a service request from a user; wherein the service request includes a non-homogeneous digital right and an operation service generated based on a biometric feature of the user; Based on the first commitment value shard, the commitment value is obtained in collaboration with a third party by secret sharing; the third party owns the second commitment value shard; Generate a digital identity certificate based on the non-fungible digital rights and the commitment value; Sending the digital identity certificate to a third party so that the third party can perform identity authentication based on the digital identity certificate and the commitment value; the commitment value of the third party is obtained in collaboration with the information security management system through secret sharing based on the second commitment value slice; receiving an identity verification result from the third party, and determining whether the service request is legitimate based on the identity verification result; In response to the service request being legitimate, executing the operation service corresponding to the service request, and uploading the identity authentication result to the blockchain.

Images