Position verifiable voucher generation method, position credibility verification method and related device

Abstract

The invention provides a position verifiable voucher generation method, a position credibility verification method and a related device. The method comprises the following steps: receiving a position signal of to-be-verified equipment sent by information source equipment; the trusted hardware generates position data of the to-be-verified equipment according to the position signal; a location verifiable credential is generated by the trusted hardware based on the location data and attestation information determined based on the location data. In the implementation process of the scheme, the position data is generated according to the position signal of the to-be-verified equipment, and the position verifiable certificate is generated according to the position data and the certification information determined according to the position data; therefore, the condition that the position data is not credible by other equipment is improved by effectively combining credible hardware and a software mode of the position verifiable certificate, and the reliability of the position data is effectively improved.

Description

Technical Field

[0001] The present application relates to the technical field of information security and network security, and in particular, to a method for generating a location-verifiable credential, a location-trusted verification method, and related devices. Background Art

[0002] Currently, location data is easily tampered with during the storage and transmission process after acquisition. For example, after obtaining its location data, a mobile phone can store the location data and hand it over to a third-party service device for processing. However, malicious programs that may exist in the mobile phone directly tamper with the location data, causing the third-party service device to receive the tampered location data. Therefore, it is difficult for the third-party service device, as the recipient, to verify the trustworthiness of the location data. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a method for generating a location-verifiable credential, a method for credibly verifying a location, and related devices, so as to improve the problem that it is difficult to credibly verify location data.

[0004] The embodiment of the present application provides a method for generating a location-verifiable credential, including: receiving a location signal of a device to be verified sent by a source device; generating location data of the device to be verified based on the location signal by trusted hardware; generating a location-verifiable credential based on the location data and certification information determined based on the location data by trusted hardware. In the implementation of the above scheme, the location data is generated based on the location signal of the device to be verified by trusted hardware, and the location-verifiable credential is generated based on the location data and certification information determined based on the location data by trusted hardware, thereby effectively combining trusted hardware and software methods of location-verifiable credential to improve the situation where the location data is not trusted by other devices, and effectively improve the reliability of the location data.

[0005] Optionally, in an embodiment of the present application, after generating the location data of the device to be verified according to the location signal, it further includes: storing the location data of the device to be verified in a secure storage area of ​​the device to be verified. In the implementation process of the above scheme, by reading the location data of the device to be verified from the secure storage area of ​​the device to be verified, the storage process of the location data is reliable, which effectively improves the authenticity and reliability of the location data in the storage process.

[0006] Optionally, in an embodiment of the present application, before generating a location-verifiable credential based on the location data and the certification information determined based on the location data, it further includes: performing fuzzy processing on the location data. In the implementation process of the above scheme, by performing fuzzy processing on the location data of the device to be verified, the privacy of the location data of the device to be verified is protected, and the security and accuracy controllability of the location data are effectively improved.

[0007] Optionally, in an embodiment of the present application, the location data is fuzzified, including: intercepting the numbers after the preset number of digits in the location data; and / or randomly replacing the numbers after the preset number of digits in the location data. In the implementation of the above scheme, by intercepting and / or randomly replacing the numbers after the preset number of digits in the location data, the sharing accuracy of the location data is autonomously controllable, that is, location data of different granularities can be provided according to actual application requirements, effectively improving the security and accuracy controllability of the location data.

[0008] Optionally, in an embodiment of the present application, the proof information is signature information; generating a location-verifiable credential based on the location data and the proof information determined based on the location data includes: signing the location data using the private key of the device to be verified to obtain signature information; generating a location-verifiable credential based on the signature information and the location data. In the implementation of the above scheme, the location data is signed using the private key of the device to be verified, and a location-verifiable credential is generated based on the signature information and the location data, so that the location data can be verified through the signature information and the location-verifiable credential, which effectively improves the verifiability and reliability of the location data.

[0009] Optionally, in an embodiment of the present application, the proof information is a zero-knowledge proof; generating a location-verifiable credential based on the location data and the proof information determined based on the location data includes: constructing a zero-knowledge proof based on the location data of the device to be verified; generating a location-verifiable credential based on the zero-knowledge proof and the location data. In the implementation of the above scheme, by constructing a zero-knowledge proof based on the location data of the device to be verified, and generating a location-verifiable credential based on the zero-knowledge proof and the location data, the location data can be verified through the zero-knowledge proof and the location-verifiable credential, which effectively improves the verifiability and generalization of the location data.

[0010] Optionally, in an embodiment of the present application, the certification information is anonymous identity information; generating a location-verifiable credential based on the location data and the certification information determined based on the location data includes: obtaining the user identity information corresponding to the device to be verified; anonymizing the user identity information to obtain anonymous identity information; and generating a location-verifiable credential based on the anonymous identity information and the location data. In the implementation of the above scheme, by anonymizing the user identity information to obtain anonymous identity information, and generating a location-verifiable credential based on the anonymous identity information and the location data, when the location data can be verified through the location-verifiable credential, the privacy of the identity information can also be protected, and the location data is effectively provided with anonymity of identity, thereby improving the security of the identity information and the reliability of the location data.

[0011] The embodiment of the present application provides a location trust verification method, including: obtaining a location verifiable credential generated according to the above-mentioned location verifiable credential generation method; sending the location verifiable credential, which is used to perform trustworthy verification on the location data of the device to be verified. In the implementation process of the above-mentioned scheme, by sending the location verifiable credential generated according to the location data, the location data of the device to be verified can be trusted verified according to the location verifiable credential, which effectively improves the reliability of the location data.

[0012] Optionally, in the embodiment of the present application, before sending the location verifiable credential, the method further includes: encrypting the location verifiable credential. In the implementation process of the above solution, by encrypting the location verifiable credential, the security of the location verifiable credential is effectively improved.

[0013] Optionally, in an embodiment of the present application, sending a location verifiable credential includes: storing the location verifiable credential in a distributed file of the blockchain network, and sending it to a receiving device via the distributed file. In the implementation of the above solution, by sharing location data on the distributed file of the blockchain network and making it tamper-proof, the location data traceability and accountability capabilities are achieved, effectively improving the security of user location data.

[0014] The embodiment of the present application also provides a location trust verification method, including: receiving a location verifiable credential of a device to be verified; parsing the location data of the device to be verified and the certification information determined based on the location data from the location verifiable credential; and using the certification information to perform trustworthy verification on the location data. In the implementation process of the above scheme, by parsing the location data of the device to be verified and the certification information determined based on the location data from the verifiable credential; and using the certification information to perform trustworthy verification on the location data, the situation where the location data of the device to be verified is difficult to verify is improved, and the authenticity and reliability of the location data are effectively improved.

[0015] Optionally, in an embodiment of the present application, the certification information is signature information; the location data is verified to be credible using the certification information, including: using the public key of the device to be verified to perform signature verification on the signature information to obtain a signature verification result; if the signature verification result fails, the location data is determined to be unreliable. In the implementation process of the above scheme, the signature information parsed from the verifiable credential is used to verify whether the location data is credible, thereby improving the situation where the location data interaction between digital twins is unreliable, and effectively improving the authenticity and reliability of the location data interaction between digital twins.

[0016] Optionally, in an embodiment of the present application, the proof information is a zero-knowledge proof; the location data is verified to be trustworthy using the proof information, including: performing data verification on the zero-knowledge proof to obtain a data verification result; if the data verification result fails, the location data is determined to be untrustworthy. In the implementation process of the above scheme, the trustworthiness of the location data is verified by the zero-knowledge proof in the verifiable credential, thereby improving the situation where the location data interaction between digital twins is untrustworthy, and effectively improving the authenticity and reliability of the location data interaction between digital twins.

[0017] Optionally, in an embodiment of the present application, the certification information includes: trusted hardware information, source device information, execution environment information and / or storage area information corresponding to the location data; the location data is verified to be trustworthy using the certification information, including: using multiple preset trust factors to multiply the trusted hardware information, source device information, execution environment information and / or storage area information to obtain the degree of trustworthiness of the location data; determining whether the location data is trustworthy based on the degree of trustworthiness of the location data. In the implementation of the above scheme, whether the location data is trustworthy is determined by multiplying the trusted hardware information, source device information, execution environment information and / or storage area information by multiple preset trust factors to calculate the degree of trustworthiness, thereby improving the situation where the location data interaction between digital twins is untrustworthy, and effectively improving the authenticity and reliability of the location data interaction between digital twins.

[0018] Optionally, in an embodiment of the present application, after the location data is trusted and verified using the certification information, the process further includes: if the location data passes the trusted verification, executing the application task according to the location data. In the implementation process of the above scheme, by executing the application task according to the location data when the location data passes the trusted verification, the situation where the application task uses untrusted location data resulting in unreliable execution results of the application task is improved, and the reliability of executing the application task according to the location data is effectively improved.

[0019] Optionally, in an embodiment of the present application, executing an application task according to location data includes: sending location data to a target device so that the target device performs an audit task on the location data, and the target device includes: an audit server, a digital twin, and / or an audit agency node in a blockchain network. In the implementation of the above scheme, by sending location data to the target device so that the target device performs an audit task on the location data, the situation in which the application task abuses location data and is difficult to audit and trace is improved, and the reliability of executing application tasks according to location data is effectively improved.

[0020] Optionally, in an embodiment of the present application, executing an application task according to the location data includes: searching an application database for application data corresponding to the location data, the application database including: a navigation path information library, a location alarm information library and / or an advertisement recommendation information library; executing the application task according to the application data corresponding to the location data. In the implementation process of the above scheme, the application task is executed by the application data corresponding to the location data, so that the navigation service, the location alarm service and / or the advertisement recommendation service can be realized, which improves the generalization of the location trust verification method.

[0021] The embodiment of the present application also provides a device for generating a location-verifiable credential, including: a location signal receiving module for receiving a location signal of a device to be verified sent by a source device; a location data generating module for generating location data of the device to be verified by trusted hardware based on the location signal; and a verification credential generating module for generating a location-verifiable credential by trusted hardware based on the location data of the device to be verified and the certification information determined based on the location data. In the implementation process of the above scheme, the location data of the device to be verified is generated by trusted hardware based on the location signal, and the location-verifiable credential is generated by trusted hardware based on the location data of the device to be verified and the certification information determined based on the location data, thereby effectively combining trusted hardware and the software method of the location-verifiable credential to improve the situation where the location data is not trusted by other devices, and effectively improving the reliability of the location data.

[0022] The embodiment of the present application also provides a location trusted verification device, including: a verification credential acquisition module, used to obtain the location verifiable credential generated by the above-mentioned location verifiable credential generation method; a verification credential sending module, used to send the location verifiable credential, and the location verifiable credential is used to perform trusted verification on the location data of the device to be verified.

[0023] An embodiment of the present application also provides a location trusted verification device, including: a verification credential receiving module, used to obtain a location verifiable credential of a device to be verified; a location data parsing module, used to parse the location data of the device to be verified and the proof information determined based on the location data from the location verifiable credential; and a location data verification module, used to perform trusted verification on the location data using the proof information.

[0024] An embodiment of the present application also provides a location trusted verification system, including: a source device and a device to be verified; the source device is used to provide a location signal of the device to be verified; the device to be verified is used to receive the location signal of the device to be verified sent by the source device; trusted hardware generates location data of the device to be verified based on the location signal; and trusted hardware generates a location verifiable credential based on the location data and proof information determined based on the location data.

[0025] Optionally, in an embodiment of the present application, the device to be verified includes: a secure storage area; the device to be verified is also used to read location data of the device to be verified from the secure storage area; the secure storage area is used to store location data of the device to be verified.

[0026] Optionally, in an embodiment of the present application, the location trusted verification system also includes: a blockchain network; the blockchain network is used to store the location verifiable credential in a distributed file of the blockchain network, and send it to the recipient device via the distributed file.

[0027] An embodiment of the present application further provides an electronic device, including: a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the machine-readable instructions are executed by the processor, the method described above is performed.

[0028] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method described above is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 A schematic diagram of a process for generating a location verifiable credential provided in an embodiment of the present application is shown;

[0031] Figure 2 A schematic diagram of fuzzy processing of location data provided by an embodiment of the present application is shown;

[0032] Figure 3 A flow chart of a location trust verification method provided by an embodiment of the present application is shown;

[0033] Figure 4 A schematic diagram showing a flow chart of a location trust verification method performed by a receiving device according to an embodiment of the present application;

[0034] Figure 5 A schematic diagram of the structure of a device for generating a location-verifiable credential provided in an embodiment of the present application is shown;

[0035] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0036] To make the purpose, technical scheme and advantages of the embodiment of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. It should be understood that the drawings in the embodiment of the present application only serve the purpose of explanation and description, and are not used to limit the protection scope of the embodiment of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in the embodiment of the present application shows the operation implemented according to some embodiments of the embodiment of the present application. It should be understood that the operation of the flowchart can be implemented out of order, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the embodiment of the present application, or remove one or more operations from the flowchart.

[0037] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all embodiments. The components of the embodiments of the present application described and shown in the drawings generally here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the embodiments of the present application claimed, but merely represents the selected embodiments of the embodiments of the present application.

[0038] It is understandable that the "first" and "second" in the embodiments of the present application are used to distinguish similar objects. Those skilled in the art will understand that the words "first" and "second" do not limit the quantity and execution order, and the words "first" and "second" do not necessarily limit the difference. In the description of the embodiments of the present application, the term "and / or" is merely a description of the association relationship of associated objects, indicating that there may be three relationships, such as A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the related objects before and after are in an "or" relationship. The term "multiple" refers to more than two (including two), and similarly, "multiple groups" refers to more than two groups (including two groups).

[0039] After the relevant technology obtains the location data, the location data is easily tampered by the running malicious program, etc. For example: after the mobile phone generates the location data based on the original location signal sent by the source device such as the satellite and / or base station, the location data is easily tampered by the malicious program running on the mobile phone, making it difficult for the receiving device to verify whether the location data has been intercepted and tampered with, etc. Another example: some developers hijack the relevant functions in the LocationManagerService service through Hook means, and then use the principle of fake location to modify the location of the vehicle-side dashboard device to forge the travel record of the online car-hailing, or modify the mobile phone to forge the attendance punch-in record, etc.

[0040] In response to the above-mentioned problems, in an embodiment of the present application, a verifiable credential generated based on the location data of the device to be verified is sent, and the location verifiable credential is used to verify the authenticity, consistency and availability of the location data. Therefore, the location data of the device to be verified can be reliably verified based on the location verifiable credential, thereby effectively improving the reliability of the location data.

[0041] See also Figure 1 The flowchart of the method for generating a location-verifiable credential provided by the embodiment of the present application is shown; the method for generating a location-verifiable credential can be executed by trusted hardware of an electronic device having the function of executing a computer program, and a trusted execution environment (TEE) can be set on the trusted hardware. The electronic device here can be a terminal device such as a smart phone, a personal computer, a tablet computer, a personal digital assistant, or a mobile Internet device. The implementation method of the above-mentioned method for generating a location-verifiable credential may include:

[0042] Step S101: receiving a location signal of a device to be verified sent by a source device.

[0043] Source device refers to the source device used to obtain location signals, such as: Global Positioning System (GPS) positioning satellites, BeiDou Navigation Satellite System (BDS) positioning equipment, base station equipment of operating equipment providers, short-range communication positioning equipment, QR code scanning positioning equipment, etc. The short-range communication positioning equipment here includes Bluetooth devices, Ultra Wide Band (UWB) devices or routers.

[0044] The implementation method of the above step S101 is, for example: Since the positioning principles of the source devices are different, the methods of obtaining the location signals generated by each source device are also different. For example: the coverage of satellite GPS device positioning is the widest, but the positioning accuracy is not enough. If the receiving device provides navigation services, the satellite location signal can be obtained through a mobile phone or a navigation device. Another example: If you are looking for a parking space in a basement, the location signal of the satellite GPS device is weak at this time, and short-range communication positioning technology or QR code scanning positioning technology can be used for indoor positioning, and Bluetooth signals or UWB device signals can be obtained through a mobile phone or a navigation device.

[0045] Step S102: The trusted hardware generates location data of the device to be verified based on the location signal.

[0046] The device to be verified refers to a device used to obtain the location data to be verified, and the location data is used to generate the verifiable credentials. The device to be verified here can be, for example, a terminal device such as a smartphone, a personal computer, a tablet computer, a personal digital assistant, or a mobile Internet device. The location data of the device to be verified refers to the current location data of the device, such as: location identification (such as location number) and latitude and longitude data, etc.

[0047] An implementation example of the above-mentioned step S102 is as follows: assuming that the above-mentioned source device is a satellite GPS device, the GPS location signal is used as an example for explanation here. The GPS location signal can be preprocessed by the trusted hardware (including noise removal, frequency calibration and signal analysis, etc.) to obtain a preprocessed location signal. The trusted hardware determines the distance, location and time data between the device to be verified (such as a mobile phone) and (three or four) source devices based on the arrival time difference of the preprocessed location signal, and then uses algorithms such as triangulation and least squares method to calculate the above-mentioned distance, location and time data to obtain the location data of the receiving device (such as a mobile phone). The location data here is usually expressed in the form of longitude, latitude and altitude.

[0048] Step S103: The trusted hardware generates a location-verifiable credential based on the location data and the certification information determined based on the location data.

[0049] An implementation method of the above-mentioned step S103 is, for example: the trusted hardware generates a verifiable credential based on the location data of the device to be verified, the hardware data of the device to be verified, the terminal system security startup data and / or the generation process data of the location data, so that the receiving device can confirm that the acquisition process and generation process of the location data are safe and reliable based on the hardware data of the device to be verified, the terminal system security startup data, and the acquisition process data of the location data. The above-mentioned terminal system security startup data refers to data for implementing security protection and verification (such as signature verification, file verification and data mirroring, etc.) during the startup process of the device to be verified.

[0050] Another implementation of the above step S103 is, for example: in the trusted hardware of the device to be verified and / or the trusted execution environment (TEE) of the trusted hardware, a location-verifiable credential is generated according to the location data and the certification information determined according to the location data. The above-mentioned trusted hardware includes, but is not limited to, a hardware security module (Hardware Secure Module, HSM) or a read-only memory (Read-Only Memory, ROM for short), etc. The hardware security module (HSM) here can adopt a trusted zone (TrustZone) module or a secure hardware extension (Secure Hardware Extension) module. The above-mentioned trusted execution environment includes, but is not limited to, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or a dedicated hardware system, etc.

[0051] In the implementation process of the above scheme, by generating location data based on the location signal of the device to be verified, and generating a location verifiable credential based on the location data and the proof information determined according to the location data, the hardware of the device to be verified and the software of the location verifiable credential are effectively combined to improve the situation where the location data is not trusted by other devices, thereby effectively improving the reliability of the location data.

[0052] As an optional implementation of the above-mentioned method for generating a location verifiable credential, after generating the location data of the device to be verified according to the location signal, the method may further include:

[0053] Step S104: storing the location data of the device to be verified in the secure storage area of ​​the device to be verified.

[0054] An implementation method of the above-mentioned step S104 is, for example: storing the data in a secure storage area of ​​the device to be verified in a secure storage area such as an encrypted database of the local system, an encrypted digital twin, an encrypted distributed file system (DFS) or an encrypted network attached storage (NAS) system.

[0055] It is understandable that if the location data of the device to be verified is stored in the secure storage area of ​​the device to be verified, then when generating a verifiable credential based on the location data of the device to be verified, the location data can be directly read from the secure storage area. For example: read the location data of the device to be verified from a secure storage area such as an encrypted database, an encrypted digital twin, an encrypted distributed file system (DFS) or an encrypted network attached storage (NAS) system of the local system, where the distributed file system includes GFS, HDFS, Ceph, Lustre, MogileFS, MooseFS, FastDFS, TFS and GridFS, etc.

[0056] As an optional implementation of the above-mentioned method for generating a location verifiable credential, before generating the location verifiable credential according to the location data and the certification information determined according to the location data, the method may further include:

[0057] Step S104: performing fuzzy processing on the location data.

[0058] See also Figure 2 A schematic diagram of fuzzy processed location data provided by an embodiment of the present application is shown; the fuzzy processing in the figure includes but is not limited to: fuzzification by interception processing and fuzzification by random replacement. It can be understood that the location data obtained by the fuzzification by interception processing is inaccurate, but it can still be known that the location of the electronic device is within a certain area (such as a city), however, the location data obtained by the fuzzification by random replacement is precise, but not accurate, for example: the location data before the fuzzification by random replacement is at No. 1 Street A, but the location data after the fuzzification by random replacement is at No. 2 Street B.

[0059] As an optional implementation of the above step S104, the implementation of fuzzy processing of the location data can also be achieved by interception processing, which includes:

[0060] Step S104a: truncating the digits after the preset number of digits in the position data.

[0061] An implementation example of the above step S104a is: assuming that the precise location data is 121.1234 and the preset number of digits is 1, that is, the number 234 after the 1-digit number in the location data is truncated, so that the fuzzy location data is 121.1 or expressed as 121.1000.

[0062] And / or, the implementation of the fuzzy processing can also be implemented by random replacement, and the implementation includes:

[0063] Step S104b: Perform random replacement processing on the digits after the preset number of digits in the position data.

[0064] An example of an implementation of the above step S104b is: assuming that the precise location data is 121.1234, and the preset number of digits is 1, that is, the number 234 after the 1-digit number in the location data is to be randomly replaced. Assume that the number 234 is randomly replaced with 567, and the fuzzy location data obtained is 121.1567.

[0065] As an optional implementation of the above step S102, the above certification information may be signature information of the location data, and the above generating a location verifiable credential based on the location data and the certification information determined based on the location data may include:

[0066] Step S102a: Use the private key of the device to be verified to sign the location data to obtain signature information.

[0067] Step S102b: Generate a location verifiable credential based on the signature information and the location data.

[0068] Another implementation of the above steps S102a to S102b is, for example: using the RSA algorithm or the ECDSA algorithm to digitally sign (Digital Signature) the location data through the private key of the device to be verified, obtaining the signature information of the location data, and then obtaining the timestamp of the location data, and generating a location verifiable credential based on the timestamp of the location data and the signature information of the location data.

[0069] As an optional implementation of the above step S102, the above proof information may be a zero-knowledge proof; a zero-knowledge proof is a cryptographic technique used to prove the authenticity of a statement without revealing additional information to the verifier, that is, the prover can prove a fact to the verifier without revealing specific information related to the fact. The above implementation of generating verifiable credentials based on location data may include:

[0070] Step S102c: construct a zero-knowledge proof based on the location data of the device to be verified.

[0071] An implementation method of the above step S102c is, for example: committing the location data of the device to be verified, obtaining a location commitment value, encapsulating and constructing the location commitment value, and obtaining a zero-knowledge proof.

[0072] Step S102d: Generate a location verifiable credential based on the zero-knowledge proof and the location data.

[0073] An implementation of the above step S102d is, for example, to commit the location data, obtain information commitment data, encapsulate the information commitment data using a non-interactive zero-knowledge proof algorithm, and obtain a zero-knowledge proof; the non-interactive zero-knowledge proof algorithm here is, for example, a zkSNARKs algorithm, etc. Finally, a verifiable credential is generated based on the signature information and the zero-knowledge proof.

[0074] Another implementation of the above step S102d is, for example: using the RSA algorithm or the ECDSA algorithm to digitally sign the location data with the private key of the device to be verified to obtain signature information. Then, the signature information and the location data are committed to obtain information commitment data, the information commitment data is encapsulated to obtain zero-knowledge proof, and finally, a verifiable credential is generated based on the signature information and the zero-knowledge proof.

[0075] As an optional implementation of the above step S102, the above certification information may be anonymous identity information; the above implementation of generating a location verifiable credential based on the location data and the certification information determined based on the location data may include:

[0076] Step S102e: Obtain the user identity information corresponding to the device to be verified.

[0077] Step S102f: Anonymize the user identity information to obtain anonymous identity information.

[0078] Step S102g: Generate location verifiable credentials based on the anonymous identity information and location data.

[0079] The implementation method of the above steps S102e to S102g is, for example: obtaining the user identity information corresponding to the device to be verified from the identity database, anonymizing or de-identifying the user identity information, for example: masking or deleting part of the name, ID number, passport number, driver's license number, etc., so as to obtain anonymous identity information. Finally, generating a location verifiable credential based on the anonymous identity information and location data.

[0080] See also Figure 3 The flowchart of the location trust verification method provided by the embodiment of the present application is shown; the location trust verification method can be executed by an electronic device having the function of executing a computer program, and the electronic device here can be a terminal device such as a smart phone, a personal computer, a tablet computer, a personal digital assistant or a mobile Internet device. The implementation method of the above-mentioned location trust verification method may include:

[0081] Step S110: Obtain the location verifiable credential generated according to the above-mentioned location verifiable credential generation method.

[0082] The above-mentioned location verifiable credential (VC) can be generated based on the location data of the device to be verified and / or the zero-knowledge proof constructed by the location data; of course, it can also be that the location data is first signed using the private key of the device to be verified, the signature information of the location data is obtained, and the location verifiable credential is generated based on the signature information of the location data and the location data; of course, the location verifiable credential can also be generated based on the location data, the zero-knowledge proof constructed by the location data and the signature information of the location data.

[0083] Step S120: Sending a location-verifiable credential, where the location-verifiable credential is used to perform trustworthy verification on the location data of the device to be verified.

[0084] It is understandable that after receiving the location-verifiable credential, the location-verifiable credential can be used to perform trustworthy verification on the location data of the device to be verified. There are many ways of trustworthy verification, which will be described in detail below.

[0085] In the implementation process of the above scheme, the location verifiable credential is generated by sending the location data of the device to be verified, so that the receiving device can perform credible verification on the location data of the device to be verified based on the location verifiable credential, which effectively improves the authenticity and reliability of the location data.

[0086] As an optional implementation of the above step S120, before sending the location verifiable credential, the location verifiable credential may also be encrypted. This implementation may include:

[0087] Step S121: Encrypt the location verifiable credential to obtain the encrypted verifiable credential.

[0088] Step S122: Send the encrypted verifiable credential.

[0089] The implementation method of the above steps S121 to S122 is, for example: using encryption algorithms such as DES, 3DES, RC4, RC5, RC6 and AES to encrypt the location verifiable credential to obtain the encrypted verifiable credential. Then, the encrypted verifiable credential is sent via the Transmission Control Protocol (TCP) or the User Datagram Protocol (UDP).

[0090] As an optional implementation of the above step S120, the above implementation of sending the location verifiable credential may include:

[0091] Step S123: Store the location verifiable credential in a distributed file of the blockchain network and send it to the recipient device via the distributed file.

[0092] The implementation method of the above step S123 can be an active synchronization method, for example: the location verifiable credential is stored in a distributed file of the blockchain network, and a consensus request for the distributed file can be actively broadcast to the blockchain network, so that the nodes in the blockchain network can reach a consensus on the latest block file in which the location verifiable credential is stored in the distributed file. After the number of nodes that have reached a consensus in the blockchain network exceeds a preset threshold, the latest block file can be synchronized to the blockchain nodes in the blockchain network through a peer-to-peer (Peer To Peer, P2P) protocol, so that the blockchain network sends the location verifiable credential in the latest block file to the receiving device in a synchronous manner.

[0093] The implementation method of the above step S123 can be a passive synchronization method, for example: after receiving the consensus request sent by the node in the blockchain network, the latest block file storing the location verifiable credential in the distributed file is consensused. After the number of nodes reaching consensus in the blockchain network exceeds the preset threshold, the latest block file can be synchronized to the blockchain node in the blockchain network through the peer-to-peer (PeerToPeer, P2P) protocol, so that the blockchain network sends the location verifiable credential in the latest block file to the receiving device in a synchronous manner.

[0094] Among them, the above-mentioned blockchain network can be used to obtain location data from verifiable credentials and store the location data in the storage of the blockchain network. The blockchain network can also include: supervision nodes and audit agency nodes, etc., which can provide a storage audit environment for location data, thereby realizing the multi-party authentication and audit function of the location data. Among them, the above-mentioned supervision node is used to obtain verifiable credentials from the blockchain network, and parse the location data from the verifiable credentials, and then supervise the use process of the location data according to the regulatory laws and regulations. The above-mentioned audit agency node is used to obtain verifiable credentials from the blockchain network, and parse the location data from the verifiable credentials, and then audit the use process records of the location data.

[0095] See also Figure 4 The flowchart of the location trust verification method performed by the receiving device provided in the embodiment of the present application is shown; the location trust verification method can be performed by an electronic device that provides computing services through a network, and the electronic device may include: a terminal device or a server, where the server is, for example: an x86 server or a non-x86 server, and the non-x86 server includes: a mainframe, a minicomputer, and a UNIX server. The implementation method of the above-mentioned location trust verification method may include:

[0096] Step S210: receiving a location verifiable credential of the device to be verified, and parsing the location data of the device to be verified and the certification information determined according to the location data from the location verifiable credential.

[0097] Proof information refers to information used to prove the authenticity of the location data of the device to be verified. The proof information here can be signature information after a digital signature, zero-knowledge proof, anonymous identity information, or trusted hardware information corresponding to the location data, source device information, execution environment information and / or storage area information, etc.

[0098] A receiver device refers to an electronic device used to receive location-verifiable credentials. The receiver device here may be, for example, an x86 server or a non-x86 server.

[0099] An implementation example of the above-mentioned step S210 is as follows: the receiving device receives the verifiable credentials of the device to be verified through the TCP protocol or the UDP protocol, and uses an executable program compiled or interpreted by a preset programming language to parse the location data of the device to be verified from the verifiable credentials; wherein the programming languages ​​that can be used are, for example: C, C++, Java, BASIC, JavaScript, LISP, Shell, Perl, Ruby, Python and PHP, etc.

[0100] Step S220: Use the certification information to perform trustworthy verification on the location data to obtain a trustworthy verification result.

[0101] Optionally, the above-mentioned receiving device can also provide location authentication services. For example, after obtaining a trusted verification result, the trusted verification result can be sent to an authentication service subscription device so that the authentication service subscription device can directly use the location data, eliminating the operation of verifying the location data and improving the efficiency of using the location data.

[0102] As an optional implementation of the above step S220, the above certification information may be signature information, and the above implementation of using the certification information to perform trustworthy verification on the location data may include:

[0103] Step S221: Parse the signature information from the verifiable credential, where the signature information is obtained by signing the location data using the private key of the device to be verified.

[0104] Step S222: Use the public key of the device to be verified to perform signature verification on the signature information to obtain a signature verification result.

[0105] Step S223: If the signature verification result fails, it is determined that the location data is unreliable.

[0106] The implementation method of the above steps S221 to S223 is, for example: using an executable program to parse the signature information from the verifiable credential, the signature information is obtained by digitally signing the location data using the private key of the device to be verified. The signature information is digitally signed using the public key of the device to be verified to obtain a signature verification result. It is determined whether the signature verification result passes. If the signature verification result fails, it is determined that the location data is unreliable. If the signature verification result passes, it can also be combined with other verification results to determine whether the location data is credible, which will be described in detail below.

[0107] As an optional implementation of the above step S220, the above proof information may be a zero-knowledge proof; the above implementation of using the proof information to perform trustworthy verification on the location data includes:

[0108] Step S224: Parse the zero-knowledge proof from the verifiable credential.

[0109] Step S225: Perform data verification on the zero-knowledge proof to obtain a data verification result.

[0110] Step S226: If the data verification result fails, it is determined that the location data is unreliable.

[0111] The implementation method of the above steps S224 to S226 is, for example: after parsing the zero-knowledge proof from the verifiable credential, the zero-knowledge proof can be data-verified using an executable program to obtain a data verification result. It is determined whether the data verification result is passed. If the data verification result is not passed, it is determined that the location data is not credible. If the data verification result is passed, it can also be combined with other verification results to determine whether the location data is credible, which will be described in detail below.

[0112] As an optional implementation of the above step S220, the above certification information may also include: trusted hardware information, source device information, execution environment information and / or storage area information corresponding to the location data; the above implementation of using the certification information to perform trusted verification on the location data may include:

[0113] Step S227: Parse the trusted hardware information, source device information, execution environment information and / or storage area information corresponding to the location data from the verifiable credential.

[0114] Step S228: Use multiple preset trust factors to multiply the trusted hardware information, the information source device information, the execution environment information and / or the storage area information respectively to obtain the trustworthiness of the location data.

[0115] The above-mentioned multiple preset trust factors include but are not limited to: trusted hardware information factor (which can be represented by α), source device information factor (which can be represented by β), execution environment information factor (for example, which can be represented by γ) and / or storage area information factor (for example, storage audit environment can be represented by δ). The execution environment information here includes but is not limited to: the above-mentioned signature verification result and / or zero-knowledge proof data verification result, etc.

[0116] Step S229: Determine whether the location data is credible based on the credibility of the location data.

[0117] The implementation of the above steps S228 to S229 is, for example: according to the formula degree of trust = α × β × γ × δ × normalized preset trust factor, the trusted hardware information, trusted hardware information, source device information, execution environment information and / or storage area information are calculated to obtain the degree of trust of the location data, and determine whether the location data is trustworthy based on the degree of trust of the location data. It can be determined whether the degree of trust of the location data is greater than a preset threshold. If the degree of trust of the location data is greater than the preset threshold, it is determined that the location data is trustworthy. If the degree of trust of the location data is less than or equal to the preset threshold, it is determined that the location data is untrustworthy.

[0118] As an optional implementation of the above-mentioned location trust verification method, after the location data is trusted and verified using the certification information, the method further includes:

[0119] Step S230: If the location data passes the trustworthy verification, the application task is executed according to the location data.

[0120] As an optional implementation of the above step S230, executing the application task according to the location data includes:

[0121] Step S231: The receiving device sends location data to the target device so that the target device performs an audit task on the location data. The target device includes: an audit server, a digital twin and / or an audit agency node in the blockchain network.

[0122] It can be understood that the audit server, digital twin and / or audit agency node in the blockchain network is used to parse the location data from the verifiable credentials after obtaining the verifiable credentials, and then perform audit tasks on the usage process records of the location data.

[0123] As an optional implementation, executing the application task according to the location data of the device to be verified includes:

[0124] Step S232: searching for application data corresponding to the location data in an application database, where the application database includes: a navigation path information library, a location alarm information library and / or an advertisement recommendation information library.

[0125] It is understandable that the above-mentioned navigation path information library, location alarm information library and / or advertising recommendation information library can provide users with navigation services, path planning services, location-based surrounding services and equipment management services, etc. For example, the location-based surrounding services and equipment management services are as follows: when the remaining power of the user's electric vehicle is less than a preset threshold, the dashboard device on the electric vehicle can help the user find and navigate to the nearest charging station or charging pile. The dashboard device of the electric vehicle in the underground parking lot can send the calculated location data to the user's mobile phone, so that the user can quickly find his electric vehicle in the underground parking lot.

[0126] Step S233: Execute the application task according to the application data corresponding to the location data.

[0127] The implementation method of the above steps S232 to S233 is, for example: searching the application database for navigation path information, location warning information (such as automatic emergency warning of traffic accidents, tsunami and earthquake warning notifications, etc.) and / or advertising recommendation information corresponding to the location data, and executing the application task according to the navigation path information, location warning information and / or advertising recommendation information. It is understandable that the above application database can adopt a relational database or a non-relational database; relational databases that can be used include Mysql, PostgreSQL, Oracle and SQLSever, etc., and non-relational databases that can be used include: Grakn database, Hadoop subsystem HBase, MongoDB and CouchDB, etc.

[0128] See also Figure 5 The structure diagram of the device for generating a location verifiable credential provided in the embodiment of the present application is shown; the embodiment of the present application also provides a device for generating a location verifiable credential 300, including:

[0129] The location signal receiving module 310 is used to receive the location signal of the device to be verified sent by the source device;

[0130] The location data generation module 320 is used to generate location data of the device to be verified according to the location signal by the trusted hardware.

[0131] The verification credential generation module 330 is used to generate a location-verifiable credential by trusted hardware according to the location data of the device to be verified and the certification information determined according to the location data.

[0132] The present application also provides a location trust verification device, including:

[0133] The verification credential acquisition module is used to obtain the location verifiable credential generated by the above-mentioned location verifiable credential generation method.

[0134] The verification credential sending module is used to send a location-verifiable credential, and the location-verifiable credential is used to perform credible verification on the location data of the device to be verified.

[0135] It is understandable that the embodiment of the present application also provides a location trust verification device, including:

[0136] A verification credential receiving module, used to receive a location verifiable credential of a device to be verified;

[0137] The location data parsing module is used to parse the location data of the device to be verified and the certification information determined based on the location data from the location verifiable credential.

[0138] The location data verification module is used to use the proof information to perform credible verification on the location data.

[0139] An embodiment of the present application provides a location trust verification system, including: a source device and a device to be verified.

[0140] The source device is used to provide the location signal of the device to be verified;

[0141] The device to be verified is used to receive a location signal of the device to be verified sent by the source device;

[0142] The trusted hardware generates the location data of the device to be verified based on the location signal;

[0143] A location-verifiable credential is generated by trusted hardware based on the location data and attestation information determined based on the location data.

[0144] Optionally, in an embodiment of the present application, the device to be verified includes: a secure storage area.

[0145] The device to be authenticated is further used to read the location data of the device to be authenticated from the secure storage area.

[0146] The secure storage area is used to store the location data of the device to be verified.

[0147] Optionally, in an embodiment of the present application, the location trusted verification system also includes: a blockchain network.

[0148] The blockchain network is used to store the location verifiable credentials in a distributed file of the blockchain network and send it to the recipient device via the distributed file.

[0149] It should be understood that the device corresponds to the above-mentioned location trusted verification method embodiment and can execute the various steps involved in the above-mentioned method embodiment. The specific functions of the device can be found in the description above, and the detailed description is appropriately omitted here. The device includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the operating system (OS) of the device.

[0150] See also Figure 6 The structural diagram of the electronic device provided by the embodiment of the present application is shown. An electronic device 400 provided by the embodiment of the present application includes: a processor 410 and a memory 420, the memory 420 stores machine-readable instructions executable by the processor 410, and the machine-readable instructions execute the above method when executed by the processor 410. The embodiment of the present application also provides a computer-readable storage medium 430, on which a computer program is stored, and the computer program executes the above method when executed by the processor 410. Among them, the computer-readable storage medium 430 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Read-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic storage, flash memory, disk or optical disk.

[0151] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0152] In several embodiments provided by the embodiments of the present application, it should be understood that the disclosed device and method can also be implemented in other ways. The device embodiments described above are only schematic, for example, the flowcharts and block diagrams in the accompanying drawings show the possible implementation architecture, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a part of a module, a program segment or a code, and a part of a module, a program segment or a code includes one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also be different from the order of occurrence marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which is mainly determined by the functions involved.

[0153] In addition, each functional module of each embodiment in the embodiment of the present application can be integrated together to form an independent part, or each module can exist separately, or two or more modules can be integrated to form an independent part. In addition, in the description of this specification, the description of reference terms "one embodiment", "some embodiments", "example", "specific example", "some examples", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of the present application. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples without contradiction.

[0154] The above description is only an optional implementation manner of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or replacements within the technical scope disclosed in the embodiments of the present application, which should be covered within the protection scope of the embodiments of the present application.

Claims

1. A method for generating a location verifiable credential, characterized in that: include: Receiving a location signal of a device to be verified sent by a source device; Generate, by the trusted hardware, the location data of the device to be verified according to the location signal; A location-verifiable credential is generated by the trusted hardware based on the location data and attestation information determined based on the location data.

2. The method according to claim 1, characterized in that After generating the location data of the device to be verified according to the location signal, the method further includes: The location data of the device to be authenticated is stored in a secure storage area of ​​the device to be authenticated.

3. The method according to claim 1, characterized in that Before generating a location verifiable credential based on the location data and the certification information determined based on the location data, the method further includes: The location data is fuzzified.

4. The method according to claim 3, characterized in that The fuzzy processing of the location data includes: Performing truncation processing on the digits after the preset number of digits in the position data; And / or, randomly replace the numbers after the preset number of digits in the position data.

5. The method according to claim 1, characterized in that The certification information is signature information; the generating of a location verifiable credential based on the location data and the certification information determined based on the location data includes: Sign the location data using the private key of the device to be verified to obtain signature information; The location verifiable credential is generated based on the signature information and the location data.

6. The method according to claim 1, characterized in that The proof information is a zero-knowledge proof; the generating of a location verifiable credential based on the location data and the proof information determined based on the location data includes: Constructing a zero-knowledge proof based on the location data of the device to be verified; The location verifiable credential is generated based on the zero-knowledge proof and the location data.

7. The method according to claim 1, characterized in that The certification information is anonymous identity information; the generating of a location verifiable credential based on the location data and the certification information determined based on the location data includes: Obtaining user identity information corresponding to the device to be verified; Anonymizing the user identity information to obtain anonymous identity information; The location verifiable credential is generated based on the anonymous identity information and the location data.

8. A location trust verification method, characterized in that: include: Obtaining a location verifiable credential generated according to any one of the methods of claims 1 to 7; The location-verifiable credential is sent, where the location-verifiable credential is used to perform trustworthy verification on the location data of the device to be verified.

9. The method according to claim 8, characterized in that Before sending the location verifiable credential, the method further includes: The location verifiable credential is encrypted.

10. The method according to claim 8, characterized in that The sending of the location verifiable credential includes: The location verifiable credential is stored in a distributed file of the blockchain network and sent to a recipient device via the distributed file.

11. A location trust verification method, characterized in that: include: Receiving location verifiable credentials of the device to be verified; Parsing the location data of the device to be verified and the certification information determined based on the location data from the location verifiable credential; The location data is credibly verified using the certification information.

12. The method according to claim 11, characterized in that The certification information is signature information; the using the certification information to perform trustworthy verification on the location data includes: Use the public key of the device to be verified to perform signature verification on the signature information to obtain a signature verification result; If the signature verification result fails, it is determined that the location data is unreliable.

13. The method according to claim 11, characterized in that The proof information is a zero-knowledge proof; and the using the proof information to perform trustworthy verification on the location data includes: Performing data verification on the zero-knowledge proof to obtain a data verification result; If the data verification result fails, it is determined that the location data is unreliable.

14. The method according to claim 11, characterized in that The certification information includes: trusted hardware information, source device information, execution environment information and / or storage area information corresponding to the location data; the use of the certification information to perform trustworthy verification on the location data includes: Using a plurality of preset trust factors to multiply the information source device information, the execution environment information and / or the storage area information respectively to obtain the trustworthiness of the location data; Whether the location data is credible is determined according to the credibility of the location data.

15. The method according to any one of claims 11 to 14, characterized in that: After the location data is trusted and verified using the certification information, the method further includes: If the location data passes the trustworthy verification, the application task is executed according to the location data.

16. The method according to claim 15, characterized in that The executing the application task according to the location data comprises: The location data is sent to a target device so that the target device performs an audit task on the location data. The target device includes: an audit server, a digital twin, and / or an audit agency node in a blockchain network.

17. The method according to claim 15, characterized in that The executing the application task according to the location data comprises: Searching for application data corresponding to the location data in an application database, the application database comprising: a navigation path information library, a location alarm information library and / or an advertisement recommendation information library; The application task is executed according to the application data corresponding to the location data.

18. A device for generating a location verifiable credential, characterized in that: include: A location signal receiving module, used to receive a location signal of a device to be verified sent by a source device; A location data generating module, configured to generate location data of the device to be verified according to the location signal by trusted hardware; The verification credential generation module is used to generate a location-verifiable credential by the trusted hardware according to the location data of the device to be verified and the certification information determined according to the location data.

19. A location trust verification device, characterized in that: include: A verification credential acquisition module, used to acquire a location verifiable credential generated according to any one of the methods described in claims 1 to 7; The verification credential sending module is used to send the location verifiable credential, and the location verifiable credential is used to perform credible verification on the location data of the device to be verified.

20. A location trust verification device, characterized in that: include: A verification credential receiving module, used to receive a location verifiable credential of a device to be verified; A location data parsing module, used to parse the location data of the device to be verified and the certification information determined based on the location data from the location verifiable credential; The location data verification module is used to use the certification information to perform trustworthy verification on the location data.

21. A location trusted verification system, characterized in that: include: Source device and device to be verified; The source device is used to provide a location signal of the device to be verified; The device to be verified is used to receive a location signal of the device to be verified sent by a source device through trusted hardware; The trusted hardware generates location data of the device to be verified according to the location signal; A location verifiable credential is generated based on the location data and attestation information determined based on the location data.

22. The system according to claim 21, characterized in that The device to be verified includes: a secure storage area; The device to be authenticated is further used to read the location data of the device to be authenticated from the secure storage area; The secure storage area is used to store the location data of the device to be verified.

23. The system according to claim 21, characterized in that Also includes: Blockchain network; The blockchain network is used to store the location verifiable credential in a distributed file of the blockchain network and send it to a recipient device via the distributed file.

24. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the machine-readable instructions are executed by the processor, the method according to any one of claims 1 to 17 is performed.

25. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 17 is executed.

Images