Exercise data security management method and system in meta universe smart exercises

Abstract

The invention provides a motion data security management method and system in meta-universe smart motion, and relates to the technical field of meta-universe, and the method comprises the steps: obtaining user motion data and identity information, building an identity authentication model based on a zero-knowledge proof mechanism, generating Merkle tree zero-knowledge proof, and verifying the authenticity of the user identity. Carrying out distributed storage on the motion data by adopting a fragmentation storage technology; and providing corresponding data according to the access permission level of the third-party application. According to the invention, privacy protection and efficient storage of user data are realized, multi-level data access control is supported, and data security and utilization efficiency are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of the metaverse, and particularly to a method and system for secure management of motion data in metaverse intelligent sports. Background Art

[0002] With the rapid development of metaverse technology, metaverse intelligent sports, as a new type of healthy lifestyle, are gradually attracting people's attention and favor. Metaverse intelligent sports refer to activities where users carry out physical exercises and health management in a virtual digital world, collecting users' motion data through digital devices and presenting and analyzing it in the metaverse space. These motion data include information such as users' motion trajectories, heart rate changes, energy consumption, and sports performance, and have extremely high personal privacy attributes and commercial value. With the expansion of metaverse sports scenarios and the growth of the user base, how to securely and effectively manage this massive amount of motion data has become an urgent technical problem to be solved.

[0003] Traditional metaverse motion data management systems mainly adopt a centralized data storage and management method. User authentication is usually based on a simple username and password mechanism, and data storage often focuses on a single server or cloud platform. However, this management method has obvious technical defects. First, the security of traditional authentication mechanisms is relatively low, being easily vulnerable to identity theft and data forgery attacks, and unable to effectively guarantee the authenticity and uniqueness of user identities in the metaverse, resulting in the generation and spread of false motion data. Second, the centralized storage mode makes a large amount of sensitive personal motion data concentrated in the hands of a single entity. Once a data leak or system attack occurs, it will cause large-scale user privacy leakage, bringing serious security risks to users. Summary of the Invention

[0004] Embodiments of the present invention provide a method and system for secure management of motion data in metaverse intelligent sports, which can solve the problems in the prior art.

[0005] In a first aspect of embodiments of the present invention, there is provided a method for secure management of motion data in metaverse intelligent sports, including: Obtaining the motion data of a user in a metaverse sports scenario and the user's identity information, establishing an identity authentication model for the user based on the zero-knowledge proof mechanism, generating a zero-knowledge proof protocol based on the Merkle tree, calculating a hash value according to the identity information to construct the leaf nodes of the Merkle tree, obtaining the Merkle root node value through iterative calculation, generating a zero-knowledge proof including path proof, verifying the authenticity of the identity information, and generating an authentication credential including a timestamp and a digital signature; After the authenticity verification of the identity information passes, the motion data is distributedly stored using the sharding storage technology, including: splitting the motion data into metadata shards, feature data shards, and evaluation result shards according to the data structure of the motion data, establishing index identifiers for each data shard using a Bloom filter, distributing and storing the data shards to multiple storage nodes through a circular hash space, and determining the storage location of the data shards through a consistent hashing algorithm; When responding to a data access request from a third-party application, verify the authentication credentials and access privilege level provided by the requester, and retrieve and assemble the access result data at the corresponding level from the distributed storage network. Among them, full access privileges can obtain all motion data, and restricted access privileges can only obtain basic motion type information.

[0006] Generate a zero-knowledge proof protocol based on the Merkle tree. Calculate the hash value according to the identity information to construct the leaf nodes of the Merkle tree, and obtain the Merkle tree root node value through iterative calculation. The generation of the zero-knowledge proof including path proof includes: Split the identity information into user identification fields, registration time fields, and privilege level fields, and calculate the SHA-256 hash values of the user identification fields, registration time fields, and privilege level fields to form leaf nodes; Arrange the leaf nodes in a preset order to construct the bottom layer of the Merkle tree, and calculate the SHA-256 hash value after cascading the hash values of adjacent two leaf nodes to obtain the parent node value; Repeat the operation of pairing and combining adjacent leaf nodes until a unique Merkle tree root node value is generated. During the pairing and combining process, record the index information of the left and right child nodes of each leaf node and the corresponding hash values to construct a node relationship mapping table; Select the target leaf node that needs to be authenticated, determine the verification path from the target leaf node to the root node based on the node relationship mapping table, and extract the hash values of adjacent leaf nodes and the node index information of the left and right child nodes on the verification path; Generate a random prime number as the homomorphic encryption key, encrypt the hash values of the leaf nodes on the verification path using the homomorphic encryption key to generate an encrypted node sequence, and combine the encrypted node sequence with the node index information to form a zero-knowledge proof.

[0007] Verify the authenticity of the identity information and generate an authentication credential including a timestamp and a digital signature, including: Send the zero-knowledge proof and the Merkle tree root node value to the verifier. The verifier decrypts the encrypted node sequence using the homomorphic encryption key, reconstructs the verification path according to the node index information, and verifies whether the reconstructed root node value is consistent with the received root node value; Receive the verification result returned by the verification party. When the verification result indicates that the reconstructed root node value is consistent with the received root node value, confirm that the identity authentication is passed, and generate an authentication credential containing a timestamp and a digital signature.

[0008] Split the motion data into metadata shards, feature data shards, and evaluation result shards according to the data structure of the motion data. Use a Bloom filter to establish an index identifier for each data shard, and distribute and store the data shards to multiple storage nodes through a circular hash space. Determining the storage location of the data shards through a consistent hashing algorithm includes: Perform sharding processing on the motion data according to the data structure type, including: dividing the user identifier, timestamp, and device information into metadata shards, dividing the motion trajectory data and motion posture data into feature data shards, and dividing the physiological feature data into evaluation result shards; Construct a Bloom filter index for each data shard, including: selecting multiple independent hash functions, calculating the feature values of the data shard using the multiple hash functions respectively, mapping the feature values to the corresponding positions in the multi-dimensional vector space, setting the binary values of the mapped positions to 1, and generating the Bloom filter fingerprint of the data shard; Determine the storage location of the data shards based on the consistent hashing algorithm, including: constructing a circular hash space, mapping the storage nodes to the virtual nodes of the circular hash space, calculating the hash value of the data shard, and finding the first virtual node greater than or equal to the hash value in the clockwise direction on the circular hash space as the storage location; Send the metadata shard, the feature data shard, and the evaluation result shard to the corresponding storage locations for storage respectively, and record the corresponding relationship between the data shard and the Bloom filter fingerprint at the storage location.

[0009] Construct a circular hash space, map the storage nodes to the virtual nodes of the circular hash space, calculate the hash value of the data shard, and find the first virtual node greater than or equal to the hash value in the clockwise direction on the circular hash space as the storage location includes: Generate a node identifier for each storage node, and the node identifier is obtained by concatenating the node network address, the node weight value, and the timestamp; Determine the number of virtual nodes of each storage node based on the node weight value, combine the virtual node serial number with the node identifier to generate a virtual node identifier, calculate the hash value of the virtual node identifier, map the virtual node to the corresponding hash segment in the circular hash space, and generate a routing table containing the virtual node location and the actual node mapping relationship; Extract the shard identifier, shard size, and shard content from the data shard, and calculate the target hash value of the shard identifier using the same hash algorithm as the virtual node; Starting from the target hash value in the circular hash space, search the routing table in the clockwise direction, and use the first virtual node greater than or equal to the target hash value as the primary storage location, and select the two adjacent virtual nodes behind it as backup storage locations. The primary storage location and the backup storage locations respectively correspond to different actual storage nodes.

[0010] Verify the authentication credentials and access privilege level provided by the requester, and retrieve and assemble access result data at the corresponding level from the distributed storage network, including: Receive a data access request sent by the requester. The data access request includes authentication credentials, a privilege level identifier, and a target data index, where the authentication credentials include the digital signature and timestamp of the requester. Verify the validity of the authentication credentials, including: checking whether the timestamp is within the allowed time window, verifying the legality of the digital signature using the public key of the requester, and confirming whether the identity identifier of the requester is in the authorized user list. Obtain the data access rules corresponding to the privilege level identifier from the access control policy library. The data access rules define the set of data fields and access operation types that can be accessed at different privilege levels, and determine the actual access privilege range of the requester according to the data access rules. Query the data location mapping table in the distributed storage network based on the target data index, and obtain the storage location information of the target data. The storage location information includes multiple storage node addresses and corresponding data shard identifiers. According to the actual access privilege range of the requester, filter out the set of data shard identifiers allowed to be accessed from the storage location information, and send a data retrieval request to the corresponding storage nodes. Receive the data shard content returned by the storage node, verify the integrity and consistency of the data shard, and reorganize the data shards that pass the verification into complete data according to the preset assembly rules. Filter the reorganized data according to the access privilege level of the requester, and only retain the data fields allowed to be accessed at this privilege level to generate access result data.

[0011] In the second aspect of the embodiments of the present invention, a motion data security management system in the metaverse intelligent sports is provided, including: The first unit is used to obtain the motion data of the user in the metaverse motion scenario and the identity information of the user, establish an identity authentication model of the user based on the zero-knowledge proof mechanism, generate a zero-knowledge proof protocol based on the Merkle tree, calculate the hash value according to the identity information to construct the leaf nodes of the Merkle tree, obtain the Merkle root node value through iterative calculation, generate a zero-knowledge proof including path proof, verify the authenticity of the identity information, and generate an authentication credential including a timestamp and a digital signature. A second unit, which is used to perform distributed storage on the motion data by using a sharding storage technology after the authenticity verification of the identity information passes, includes: splitting the motion data into metadata shards, feature data shards, and evaluation result shards according to the data structure of the motion data, establishing an index identifier for each data shard by using a Bloom filter, distributing and storing the data shards to multiple storage nodes through a circular hash space, and determining the storage location of the data shards through a consistent hashing algorithm; A third unit, which is used to verify the authentication credentials and access privilege levels provided by the requester when responding to a data access request from a third-party application, and retrieve and assemble access result data of corresponding levels from the distributed storage network according to the access privilege levels. Among them, full access privileges can obtain all motion data, and restricted access privileges can only obtain basic motion type information.

[0012] In a third aspect of the embodiments of the present invention, an electronic device is provided, including: A processor; A memory for storing instructions executable by the processor; Wherein, the processor is configured to call the instructions stored in the memory to execute the method described above.

[0013] In a fourth aspect of the embodiments of the present invention, a computer-readable storage medium is provided, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the method described above is implemented.

[0014] The beneficial effects of the present application are as follows: The motion data security management method in the metaverse intelligent motion provided by the present invention, through an identity authentication model combining a zero-knowledge proof mechanism and a Merkle tree structure, realizes the secure verification and privacy protection of user identity information, effectively prevents the risks of identity fraud and information leakage, and at the same time ensures the efficiency and reliability of the identity verification process.

[0015] The present invention adopts a sharding storage technology and a distributed storage architecture, splits the motion data into different types of data shards in a structured manner, establishes an efficient index through a Bloom filter, and then flexibly distributes them in a multi-node storage network by using a consistent hashing algorithm, significantly improving the scalability and access efficiency of data storage, and at the same time enhancing the fault tolerance and security of the data.

[0016] The present invention designs a data access control mechanism based on privilege levels. By verifying the authentication credentials and access privileges of third-party applications, it realizes the refined authorized access management of motion data, which not only guarantees the control right of the data owner over personal motion data, but also provides a flexible data sharing scheme for different application scenarios, effectively balancing the data utilization value and privacy protection requirements. Description of the Drawings

[0017] Figure 1 It is a flowchart of the motion data security management method in the metaverse intelligent motion of the embodiment of the present invention; Figure 2 It is a flowchart of zero-knowledge proof verification based on the Merkle tree in the embodiment of the present invention; Figure 3 It is a complete flowchart of the data distribution and routing mechanism based on the circular hash space in the embodiment of the present invention; Figure 4 It is a flowchart of distributed data access control in the embodiment of the present invention. Detailed implementation manners

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are only a part rather than all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0019] The technical solutions of the present invention will be described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0020] Figure 1 It is a flowchart of the motion data security management method in the metaverse intelligent motion of the embodiment of the present invention, as Figure 1 shown, the method includes: Obtain the motion data of the user in the metaverse motion scenario and the identity information of the user, establish an identity authentication model of the user based on the zero-knowledge proof mechanism, generate a zero-knowledge proof protocol based on the Merkle tree, calculate the hash value according to the identity information to construct the leaf nodes of the Merkle tree, obtain the Merkle root node value through iterative calculation, generate a zero-knowledge proof including path proof, verify the authenticity of the identity information, and generate an authentication credential including a timestamp and a digital signature; After the authenticity of the identity information is verified, use the sharding storage technology to perform distributed storage on the motion data, including: divide the motion data into metadata shards, feature data shards, and evaluation result shards according to the data structure of the motion data, establish an index identifier for each data shard using a Bloom filter, distribute and store the data shards to multiple storage nodes through the circular hash space, and determine the storage location of the data shards through the consistent hashing algorithm; When responding to a data access request from a third-party application, verify the authentication credentials and access privilege level provided by the requester, and retrieve and assemble access result data at the corresponding level from the distributed storage network. Among them, full access privilege can obtain all motion data, and restricted access privilege can only obtain basic motion type information.

[0021] In an alternative embodiment, generate a zero-knowledge proof protocol based on the Merkle tree. Calculate the hash value according to the identity information to construct the leaf nodes of the Merkle tree, and obtain the Merkle tree root node value through iterative calculation. The generation of the zero-knowledge proof including the path proof includes: Split the identity information into a user identification field, a registration time field, and a privilege level field, and calculate the SHA-256 hash values of the user identification field, the registration time field, and the privilege level field to form leaf nodes; Arrange the leaf nodes in a preset order to construct the bottom layer of the Merkle tree, and calculate the SHA-256 hash value after concatenating the hash values of adjacent two leaf nodes to obtain the parent node value; Repeat the operation of pairing and combining adjacent leaf nodes until a unique Merkle tree root node value is generated. During the pairing and combining process, record the index information of the left and right child nodes of each leaf node and the corresponding hash values to construct a node relationship mapping table; Select the target leaf node that needs to be authenticated, determine the verification path from the target leaf node to the root node based on the node relationship mapping table, and extract the hash values of adjacent leaf nodes and the node index information of the left and right child nodes on the verification path; Generate a random prime number as the homomorphic encryption key, encrypt the hash values of the leaf nodes on the verification path using the homomorphic encryption key to generate an encrypted node sequence, and combine the encrypted node sequence with the node index information to form a zero-knowledge proof.

[0022] The identity information is split into a user identification field, a registration time field, and a privilege level field. To construct the Merkle tree, it is necessary to calculate the hash values of these fields as leaf nodes. For the identity information of any user, calculate the SHA-256 hash values of its user identification, registration time, and privilege level respectively to obtain the corresponding hash value results.

[0023] These hash values constitute the leaf nodes of the Merkle tree. Arrange these leaf nodes in a preset order to form the bottom layer of the Merkle tree. In practical applications, there may be the identity information of multiple users, constituting a large number of leaf nodes. If the number of leaf nodes is odd, an empty node (all-zero hash value) can be added to make it an even number of nodes, which is convenient for constructing a complete binary Merkle tree.

[0024] The hash values ​​of two adjacent leaf nodes are concatenated, and then the SHA-256 hash value of the concatenated result is calculated to obtain the parent node value. The specific operation is to connect the hash values ​​of two adjacent leaf nodes from left to right into a string, and then calculate the SHA-256 hash value of the string to obtain their parent node hash value.

[0025] This process is executed recursively, each time taking two adjacent nodes for pairing and combining, calculating the hash value of their parent node, until finally generating a unique Merkle tree root node value. During the construction process, the index information and corresponding hash values ​​of the left and right child nodes of each node are recorded to build a node relationship mapping table. The mapping table contains the position index of each node in the tree, its hash value, and the child node information connected to it.

[0026] When identity authentication is required, select the target leaf node to be verified. Based on the node relationship mapping table, determine the verification path from the target leaf node to the root node. The path contains the hash values ​​of the sibling nodes at each layer on the path from the target leaf node to the root node. Through the hash values ​​of these sibling nodes, the verifier can recalculate the hash value of the root node without knowing the specific contents of other leaf nodes.

[0027] Extract the hash values ​​of adjacent leaf nodes and the node index information of the left and right child nodes from the verification path. To achieve zero-knowledge, generate a random prime number as the homomorphic encryption key, which consists of a prime number and a random number. Use the homomorphic encryption function to encrypt the hash value on the verification path. The encryption method is to add the random number to the hash value and then take the modulus of the prime number.

[0028] For hash values ​​expressed in hexadecimal, you need to convert them to decimal values ​​before encryption. Since hash values ​​are usually long, you can process the hash values ​​in segments and encrypt each segment separately. The encrypted result may be different in length from the original hash value, but it retains the characteristics of the original hash value and does not leak the original hash value content.

[0029] The encrypted node sequence and node index information are combined to form a zero-knowledge proof. The proof contains the index of the target leaf node, the location information and encrypted hash value of each node in the verification path, and the public Merkle tree root node hash value. This information is sufficient for the verifier to verify that the requester does have the corresponding identity information, but will not disclose the specific identity information content.

[0030] The verifier recalculates the path using the same hash function and encryption function based on the publicly available Merkle tree root node value and the verification path information provided in the zero - knowledge proof, and verifies whether the calculated result is consistent with the publicly available root node hash value. If they are consistent, it proves that the requester indeed has the corresponding identity information; if not, it indicates that the verification fails.

[0031] The advantage of this method is that the verifier only needs to know the Merkle tree root node hash value and the node information on the verification path, without having to know the complete identity information content, thus protecting user privacy. At the same time, due to the use of homomorphic encryption, even if the node information on the verification path is leaked, the attacker cannot deduce the original identity information.

[0032] Through the above - mentioned method, the purpose of efficiently and reliably verifying the user's identity without disclosing the user's complete identity information is achieved. This protocol is applicable to scenarios that require protecting user privacy while also performing identity verification, such as financial transactions, access control systems, blockchain applications, etc. In practical applications, the type of hash function, encryption method, and the construction method of the Merkle tree can be adjusted according to specific requirements to meet different security and performance requirements.

[0033] In an alternative implementation, verifying the authenticity of the identity information and generating an authentication credential including a timestamp and a digital signature includes: Sending the zero - knowledge proof and the Merkle tree root node value to the verifier. The verifier decrypts the encrypted node sequence using the homomorphic encryption key, reconstructs the verification path according to the node index information, and verifies whether the reconstructed root node value is consistent with the received root node value; Receiving the verification result returned by the verifier. When the verification result indicates that the reconstructed root node value is consistent with the received root node value, confirm that the identity authentication is passed, and generate an authentication credential including a timestamp and a digital signature.

[0034] When a user needs to prove the authenticity of their identity to the verifier, the user sends the zero - knowledge proof and the Merkle tree root node value to the verifier. The zero - knowledge proof contains the encrypted node sequence and the node index information, while the Merkle tree root node value is the unique identifier of the entire identity information tree. These two parts of information are packaged into a data packet in a specific format and sent to the verifier. To ensure transmission security, the entire communication process can be encrypted using the Secure Sockets Layer (SSL) or Transport Layer Security (TLS) protocol.

[0035] After receiving the zero - knowledge proof and the Merkle tree root node value sent by the user, the verifier first verifies the integrity and format validity of the received data. After passing the verification, the verifier decrypts the encrypted node sequence using the homomorphic encryption key pre - shared or obtained through a secure channel. The decryption process applies the homomorphic decryption function to each encrypted hash value, that is, subtracts the random number from the encrypted hash value and then takes the modulus with respect to a prime number to obtain the original hash value.

[0036] After decryption is completed, the verifier reconstructs the verification path according to the node index information. The specific steps are as follows: starting from the target leaf node, combined with the decrypted sibling node hash values, calculate the parent node hash values layer by layer until the root node value is reconstructed. During the reconstruction process, according to the Merkle tree construction rules, the verifier concatenates the hash values of two adjacent nodes and then calculates the SHA - 256 hash value to obtain the parent node value, and so on until the root node.

[0037] The verifier then compares whether the reconstructed root node value is the same as the received root node value. The verification method is to directly compare whether the two hash strings are exactly the same. If they are exactly the same, it is considered that the identity verification has passed; if there are any differences, it is considered that the verification has failed. The verification result is returned to the user side through a secure channel.

[0038] The user receives the verification result returned by the verifier. When the verification result indicates that the reconstructed root node value is the same as the received root node value, it is confirmed that the identity authentication has passed. At this time, the user side or a trusted third party generates an authentication credential containing a timestamp and a digital signature.

[0039] The process of generating the authentication credential includes multiple key steps. First, create the basic information of the credential, including the user's anonymous identifier, permission level indicator, verification timestamp, etc. The timestamp adopts the standard time format, accurate to the millisecond level, and can include time zone information to ensure that the timeliness of the credential can be accurately verified.

[0040] Calculate the hash of the basic information of the credential to obtain the credential hash value. Use a secure hash algorithm such as SHA - 256 to ensure that the content of the credential cannot be tampered with. Then use asymmetric encryption technology to sign the credential hash value to generate a digital signature. The signature process encrypts the hash value using the private key, and the generated signature can be verified by the corresponding public key but cannot be forged.

[0041] The authentication credential is composed of the basic information of the credential, the timestamp, and the digital signature, forming a complete authentication credential data structure. This credential can be serialized into a specific format such as JSON or XML for easy storage and transmission. The credential can also include expiration information, indicating the valid usage time range of this credential.

[0042] The authentication credential can be used for subsequent authorization access control. Users holding valid authentication credentials can access specific resources without repeating the complete authentication process, which improves the system efficiency. At the same time, since the credential only contains an anonymous identifier instead of the complete identity information, the user privacy is protected.

[0043] After receiving the authentication credential, the verifier first checks whether the timestamp is within the valid period, and then uses the pre-obtained public key to verify the digital signature. When verifying, the basic information of the credential is extracted, its hash value is calculated, and then the digital signature is decrypted with the public key to obtain the original hash value, and the two are compared to see if they are the same. If they are the same and the timestamp is valid, the credential is considered valid.

[0044] Through zero-knowledge proof technology, identity authentication is achieved without revealing the complete identity information, and the digital signature technology is used to ensure the non-forgeability of the authentication credential. At the same time, the timestamp mechanism ensures the timeliness of the credential. Overall, it provides an identity authentication solution that takes into account privacy protection, security and reliability, and convenience of use, and is applicable to various application scenarios that require strict protection of user privacy.

[0045] In the identity authentication system, this solution effectively solves the privacy leakage risk existing in the traditional solution. Through cryptographic technology, it ensures that even if the system is invaded, the attacker cannot obtain the complete identity information of the user, and at the same time guarantees the reliability and non-repudiation of the authentication process, providing technical support for building a trusted identity authentication infrastructure.

[0046] Figure 2 The following is the zero-knowledge proof verification flow chart based on Merkle tree for the embodiments of the present invention: The figure shows the key steps of the zero-knowledge proof verification process based on Merkle tree. After receiving the zero-knowledge proof and the Merkle tree root node value, the verifier uses the same homomorphic encryption key to decrypt the encrypted node sequence. After decryption, the verifier reconstructs the verification path according to the provided node index information, and obtains a new root node value through iterative calculation. The verifier compares the calculated root node value with the received original root node value. When the two root node values are exactly the same, it indicates that the identity authentication is passed. After the authentication is passed, the system will generate an authentication credential containing the verification timestamp and digital signature as the valid credential for the successful authentication of this user's identity. This authentication process ensures both the reliability of the verification and the privacy protection of the user identity information through zero-knowledge proof technology. The entire verification process can complete the identity authentication without exposing the original identity information. This verification mechanism not only meets the security requirements but also has good privacy protection characteristics, and is an efficient and secure identity authentication solution.

[0047] In an alternative embodiment, the motion data is segmented into metadata shards, feature data shards, and evaluation result shards according to its data structure. A Bloom filter is used to establish an index identifier for each data shard, and the data shards are distributed and stored in multiple storage nodes through a circular hash space. Determining the storage location of the data shards through the consistent hashing algorithm includes: Segment the motion data according to the data structure type, including: dividing the user identifier, timestamp, and device information into metadata shards, dividing the motion trajectory data and motion posture data into feature data shards, and dividing the physiological feature data into evaluation result shards; Construct a Bloom filter index for each data shard, including: selecting multiple independent hash functions, calculating the feature values of the data shard using the multiple hash functions respectively, mapping the feature values to the corresponding positions in the multi-dimensional vector space, setting the binary values of the mapped positions to 1, and generating the Bloom filter fingerprint of the data shard; Determine the storage location of the data shard based on the consistent hashing algorithm, including: constructing a circular hash space, mapping the storage nodes to the virtual nodes of the circular hash space, calculating the hash value of the data shard, and finding the first virtual node greater than or equal to the hash value in the clockwise direction on the circular hash space as the storage location; Send the metadata shard, the feature data shard, and the evaluation result shard to their corresponding storage locations for storage, and record the corresponding relationship between the data shard and the Bloom filter fingerprint at the storage location.

[0048] Segment the motion data according to the data structure type. Motion data usually contains various types of data such as user basic information, motion trajectories, and physiological features. To improve storage and retrieval efficiency, this method divides the motion data into three types of shards: For the metadata shard, extract basic information such as the user identifier (e.g., user ID: user_12345), timestamp (e.g., 2023-10-15 08:30:25), and device information (e.g., device model: SportWatch-2000, device ID: DV87634) from the motion data. For example, a complete metadata shard can be represented as: {"user_id": "user_12345", "timestamp": "2023-10-15 08:30:25", "device_id": "DV87634", "device_model": "SportWatch-2000"}.

[0049] For feature data sharding, extract motion trajectory data (such as GPS coordinate sequences: [(39.9042, 116.4074),(39.9043, 116.4075),...]) and motion posture data (such as acceleration and angular velocity data: [{acceleration:[0.1, 0.2, 9.8], gyroscope: [0.01, 0.02, 0.03]},...]). For example, a piece of feature data sharding can be represented as: {"track_points": [(39.9042, 116.4074), (39.9043, 116.4075)], "posture_data": [{acceleration: [0.1, 0.2, 9.8], gyroscope: [0.01, 0.02,0.03]}]}.

[0050] For evaluation result sharding, extract physiological feature data such as heart rate, blood oxygen, and energy consumption. For example, a piece of evaluation result sharding can be represented as: {"heart_rate": [75, 78, 82, 85], "blood_oxygen": [98, 97, 98],"calories": 325}.

[0051] Construct a Bloom filter index for each data sharding. A Bloom filter is a space - efficient probabilistic data structure used to determine whether an element is in a set. This method selects three independent hash functions: MurmurHash, FNV, and SipHash.

[0052] Taking the metadata sharding as an example, for the user ID "user_12345", calculate three hash values respectively: MurmurHash("user_12345") = 2356782, FNV("user_12345") = 6723541, SipHash("user_12345") = 9834217. Set the Bloom filter as a bit array with a size of 8MB (about 67,108,864 bits), and calculate the results of taking the modulo of the above - mentioned hash values by the array length: 2356782 % 67108864 = 2356782, 6723541 %67108864 = 6723541, 9834217 % 67108864 = 9834217. Then set the values at the corresponding positions in the bit array to 1. Repeat the above process for other fields (timestamp, device information, etc.) in the sharding, and finally generate the Bloom filter fingerprint of this sharding.

[0053] The construction process of Bloom filters for feature data shards and evaluation result shards is similar, except for the different data fields being processed. For example, feature data shards may focus on indexing the start and end points of a trajectory, activity types, etc., while evaluation result shards may focus on indexing key data such as maximum / minimum heart rate, total energy consumption, etc.

[0054] Based on the consistent hashing algorithm, determine the storage location of data shards. First, construct a circular hash space with a 32-bit integer range (from 0 to 2^32 - 1). Assume there are 5 physical storage nodes (Node-1 to Node-5) in the system. Create 100 virtual nodes for each node and map these virtual nodes to the circular space through a hash function. For example, the identifiers of virtual nodes can be "Node-1#1", "Node-1#2", etc., and their hash values may be: Hash("Node-1#1") = 123456789, Hash("Node-1#2") = 987654321.

[0055] For the metadata shards that need to be stored, calculate their hash values, such as Hash(metadata shard) = 500000000. Then, in the circular hash space, search clockwise for the first virtual node whose hash value is greater than or equal to this value. Assume the found virtual node is "Node-3#45" (hash value is 510000000), then this metadata shard will be stored on the Node-3 physical node.

[0056] The process of determining the storage locations of feature data shards and evaluation result shards is the same as that of metadata shards. Due to the randomness of hashing, the three types of shards will be relatively evenly distributed on each storage node, achieving load balancing. When the number of storage nodes changes (adding or reducing nodes), only reallocate some data shards, without the need for global rehashing, greatly reducing the system reorganization cost.

[0057] Send the metadata shards, feature data shards, and evaluation result shards to their corresponding storage locations for storage. On the storage node, each data shard is saved together with its Bloom filter fingerprint, forming a mapping relationship, such as: {"shard_id": "meta_user_12345_20231015", "bloom_filter": [binary representation or compressed form of the bit array], "data": [shard data content]}.

[0058] Also maintain a local index table on each storage node, recording all data shard IDs stored on this node and their corresponding Bloom filter fingerprints. When querying the motion data of a certain user, the system can quickly use the Bloom filter to judge the nodes where the data may exist, avoiding global scanning and improving query efficiency.

[0059] In an alternative embodiment, constructing a circular hash space, mapping storage nodes to virtual nodes in the circular hash space, calculating the hash value of a data shard, and finding the first virtual node greater than or equal to the hash value in the clockwise direction in the circular hash space as the storage location includes: Generating a node identifier for each storage node, where the node identifier is obtained by concatenating the node network address, the node weight value, and the timestamp; Determining the number of virtual nodes for each storage node based on the node weight value, combining the virtual node sequence number with the node identifier to generate a virtual node identifier, calculating the hash value of the virtual node identifier, mapping the virtual nodes to the corresponding hash segments in the circular hash space according to the hash value, and generating a routing table containing the mapping relationship between the virtual node positions and the actual nodes; Extracting the shard identifier, shard size, and shard content from the data shard, and calculating the target hash value of the shard identifier using the same hash algorithm as the virtual node; Starting from the target hash value in the circular hash space, searching the routing table in the clockwise direction, taking the first virtual node greater than or equal to the target hash value as the primary storage location, and selecting the two adjacent virtual nodes behind it as the backup storage locations, where the primary storage location and the backup storage locations correspond to different actual storage nodes respectively.

[0060] In a distributed storage system, the generation of storage node identifiers is a key step to ensure node uniqueness. For each physical node accessing the storage cluster, its node identifier is generated. The node identifier is obtained by concatenating the node network address, the node weight value, and the timestamp. The node network address includes the IP address and the port number, represented in a standard format, such as "192.168.1.100:8080". The node weight value reflects the performance and capacity characteristics of the storage node, and a higher weight value indicates better node performance or larger capacity. The timestamp records the time when the node joins the cluster, using the standard time format. These three parts of information are connected using a specific delimiter to form a complete node identifier string. For example, a node identifier may be "192.168.1.100:8080_weight5_20240429152010", where the underscore is used as the delimiter to separate the three parts of information.

[0061] To avoid data skew problems caused by uneven distribution of nodes on the hash ring, a virtual node mechanism is introduced. The number of virtual nodes for each storage node is determined based on the node weight value. Storage nodes with higher weight values correspond to more virtual nodes, enabling them to store more data shards. The number of virtual nodes can be obtained by multiplying the reference number of virtual nodes by the node weight value. For each virtual node, the virtual node serial number and the node identifier are combined to generate a virtual node identifier. The virtual node serial number starts incrementing from zero and is combined with the node identifier through a specific rule, such as "nodeID#0" representing the first virtual node of the node.

[0062] When calculating the hash value of the virtual node identifier, hash algorithms such as SHA-256 can be used. The hash algorithm maps the virtual node identifier to a hash value of a fixed length, and this hash value determines the position of the virtual node in the circular hash space. The circular hash space can be regarded as a closed loop ranging from zero to the maximum hash value. The larger the hash value, the more backward the position on the ring. All virtual nodes are mapped to the corresponding hash segments in the circular hash space according to their respective hash values. Subsequently, a routing table containing the mapping relationship between the positions of virtual nodes and actual nodes is generated. The routing table records the hash value positions of each virtual node and the corresponding actual physical node information, facilitating the subsequent rapid positioning of the storage location of data shards.

[0063] When storing a data shard, the shard identifier, shard size, and shard content are extracted from the data shard. The shard identifier can be the unique ID of the shard or can contain information about the dataset to which the shard belongs, such as "datasetA_partition3". The shard size records the data volume size of the shard, which helps the storage system with capacity planning. The shard content is the actual data to be stored. After extracting this information, the target hash value of the shard identifier is calculated using the same hash algorithm as that of the virtual node. Using the same hash algorithm ensures that the shard and the virtual node can be compared in the same hash space.

[0064] Starting from the target hash value as the starting position in the circular hash space, search in the routing table in the clockwise direction. The first virtual node greater than or equal to the target hash value is used as the primary storage location. If the target hash value is greater than the hash values of all virtual nodes on the ring, the circular structure will wrap back to the starting point, and the virtual node with the smallest hash value on the ring is selected as the primary storage location. After determining the primary storage location, continue to select the two adjacent virtual nodes in the clockwise direction as backup storage locations. Here, it should be noted that the primary storage location and the backup storage location must correspond to different actual storage nodes to ensure data reliability. If the adjacent virtual nodes are mapped to the same actual node, continue to search for the next virtual node mapped to a different actual node.

[0065] Suppose there are multiple virtual nodes in the circular hash space, and their corresponding actual nodes are different. When the target hash value of a data shard is calculated and found to be between the hash values of two virtual nodes, the virtual node with the larger hash value is selected as the primary storage location. If the target hash value is greater than the hash values of all virtual nodes on the ring, the virtual node with the smallest hash value on the ring is selected as the primary storage location. After determining the primary storage location, continue to check the subsequent virtual nodes and select two virtual nodes corresponding to different actual nodes as backup storage locations.

[0066] Store the data shard in the actual storage node corresponding to the primary storage location, and according to the backup policy set by the system, copy the same data shard to the actual storage nodes corresponding to the backup storage locations. After each storage node receives the data shard, it persists the data according to the local storage policy and updates the local index to record the correspondence between the shard identifier and the storage location.

[0067] Through the above method, the balanced distribution and high-availability backup of data shards in the distributed storage cluster are achieved. When a node joins or leaves the storage cluster, only the storage locations of the affected data shards need to be recalculated and migrated to new locations, without affecting other data shards, greatly reducing the system rebalancing cost caused by node changes. This node mapping and positioning method based on consistent hashing has good scalability and fault tolerance and is suitable for large-scale distributed storage systems.

[0068] Figure 3 The following is the complete flowchart of the data distribution and routing mechanism based on the circular hash space in the embodiment of the present invention: This figure shows the complete process of a data distribution and routing mechanism based on a circular hash space. The left process starts from node identifier generation, constructs a unique node identifier by combining the network address, weight value, and timestamp. Based on these node identifiers, the system generates corresponding virtual nodes, and the number of virtual nodes is determined by the weight value of the node. Subsequently, the system maps these virtual nodes into the circular hash space and generates a routing table to record the mapping relationship between the virtual nodes and the actual nodes. The right process shows the data processing process, starting from extracting the shard identifier and data content, calculating the target hash value using the same hash algorithm as the virtual nodes. The system will find the first virtual node greater than or equal to the target hash value in the circular hash space in a clockwise direction as the primary storage location, and then, to achieve data redundancy and load balancing, select multiple subsequent virtual nodes corresponding to different actual nodes as backup storage locations. This design effectively solves the problems of unbalanced data distribution and data migration caused by dynamic node changes through the introduction of virtual nodes and the uniform distribution characteristics of the circular hash space, providing a scalable and efficient distributed storage solution.

[0069] In an alternative embodiment, verifying the authentication credentials and access privilege level provided by the requester and retrieving and assembling access result data of the corresponding level from the distributed storage network includes: Receiving a data access request sent by the requester, where the data access request includes authentication credentials, a privilege level identifier, and a target data index, and the authentication credentials include the digital signature and timestamp of the requester; Verifying the validity of the authentication credentials, including: checking whether the timestamp is within the allowed time window, verifying the legality of the digital signature using the public key of the requester, and confirming whether the identity identifier of the requester is in the authorized user list; Obtaining the data access rules corresponding to the privilege level identifier from the access control policy library, where the data access rules define the set of data fields and access operation types that can be accessed at different privilege levels, and determining the actual access privilege range of the requester according to the data access rules; Querying the data location mapping table in the distributed storage network based on the target data index to obtain the storage location information of the target data, where the storage location information includes multiple storage node addresses and corresponding data shard identifiers; filtering out the set of data shard identifiers allowed to be accessed from the storage location information according to the actual access privilege range of the requester, and sending a data retrieval request to the corresponding storage node; Receiving the data shard content returned by the storage node, verifying the integrity and consistency of the data shard, and reorganizing the verified data shards into complete data according to a preset assembly rule; Filtering the reorganized data according to the access privilege level of the requester, and only retaining the data fields allowed to be accessed at this privilege level to generate access result data.

[0070] When the requester needs to access data in the distributed storage network, it first sends a data access request to the data management service. This request contains three key components: authentication credentials, a privilege level identifier, and a target data index. The authentication credentials include the digital signature and timestamp of the requester for identity verification; the privilege level identifier indicates the access privilege level applied by the requester, such as "read-only level", "basic analysis level", or "full access level", etc.; the target data index indicates the specific data object that the requester hopes to access, which can be a dataset identifier or the unique identifier of a specific data item.

[0071] After the data management service receives an access request, it first verifies the validity of the authentication credentials. The verification process includes three aspects: timestamp verification, signature verification, and identity authorization verification. Timestamp verification checks whether the timestamp in the request is within the time window allowed by the system to prevent replay attacks. The system can set a reasonable time window range, such as from a few minutes to a few hours, determined according to the security requirements of the application scenario. If the timestamp has expired or is too far in advance, the request is rejected. Signature verification uses the public key of the requester to verify the legality of the digital signature, ensuring that the request has not been tampered with and indeed comes from the claimed requester. Identity authorization verification checks whether the identity identifier of the requester is in the system's authorized user list to confirm that the requester has the basic permission to access the system.

[0072] After successful verification, the data management service retrieves the data access rules corresponding to the requested permission level identifier from the access control policy library. Different sets of data fields that can be accessed and allowed operation types are predefined in the policy library. For example, the "read-only level" permission may only allow access to basic metadata fields and only support read operations; the "basic analysis level" may allow access to metadata and some feature data, supporting read and statistical analysis operations; while the "full access level" may allow access to all data fields and support all operation types. Based on the retrieved access rules, the system determines the actual permission scope of the requester in the current access request. This fine-grained permission control ensures the principle of least privilege for data access.

[0073] After determining the permission scope, based on the target data index, query the data location mapping table in the distributed storage network to obtain the storage location information of the target data. The storage location information includes multiple storage node addresses and corresponding data shard identifiers, reflecting the distribution of data in the distributed network. Data may be scattered and stored on different nodes according to the aforementioned sharding mechanism. For example, metadata shards, feature data shards, and evaluation result shards may be located on different storage nodes.

[0074] According to the actual access permission scope of the requester, filter out the set of data shard identifiers that are allowed to be accessed from the storage location information. For example, if the requester only has the "read-only level" permission, it may only be able to access metadata shards; if it has the "basic analysis level" permission, it may be able to access metadata shards and some feature data shards. After the filtering is completed, the data management service sends a data retrieval request to the corresponding storage node, and the request contains the data shard identifiers that need to be retrieved.

[0075] After receiving a retrieval request, the storage node reads the corresponding data shard content from local storage according to the shard identifier and returns it to the data management service. After receiving the data shard content returned by the storage node, the data management service needs to verify the integrity and consistency of the data shard. Integrity verification is achieved by checking whether the hash value or checksum of the data shard is consistent with the expected value, ensuring that the data has not been tampered with during transmission. Consistency verification ensures that multiple associated data shards are logically consistent, such as checking whether the timestamps are reasonably coherent and whether the associated fields match.

[0076] The verified data shards are recombined into complete data according to the preset assembly rules. The assembly rules define how to merge different types of data shards into a meaningful complete data structure. For example, the metadata shard may contain user identification and time information, the feature data shard contains location and attitude data, and the evaluation result shard contains analysis results. The assembly process recombines these scattered information according to the definition of the original data structure.

[0077] After recombination, the system finally filters the recombined data according to the access privilege level of the requester, only retaining the data fields allowed to be accessed at this privilege level to generate the final access result data. This step ensures that even if the complete data may be accessed during the internal processing of the system, the data returned to the requester still strictly adheres to the privilege restrictions. For example, for "basic analysis level" users, some sensitive physiological index data may be filtered out, and only the basic movement trajectory and statistical indicators are retained.

[0078] Finally, the data management service returns the filtered access result data to the requester and records the detailed log of this access operation, including information such as the requester's identity, access time, access content, and privilege level, for subsequent auditing and security analysis.

[0079] Through the above method, secure access control and on-demand assembly of data in a distributed storage network are achieved, which not only ensures the security and compliance of data access but also meets the differentiated access needs of users with different privileges. This method is particularly suitable for processing multi-type data with different sensitivities, such as in the fields of sports health data and enterprise data, providing an effective solution for building a secure and reliable distributed data management system.

[0080] Figure 4 The flowchart of distributed data access control for the embodiments of the present invention is as follows: The figure depicts a complete distributed data access control process. When the system receives a data access request, it first verifies the authentication credentials, privilege level identifier, and target data index information contained in the request. The authentication credentials should include the digital signature and timestamp of the requester. The system conducts various verifications on the authentication credentials, including checking the validity of the timestamp, verifying the legality of the digital signature, and confirming whether the identity identifier of the requester is in the authorized user list. Subsequently, the system retrieves the access rules corresponding to the privilege level from the access control policy library. These rules define the data field ranges that can be accessed and the allowed operation types for different privilege levels, and based on this, the actual access privilege range of the requester is determined. The system then queries the data location mapping table in the distributed storage network to obtain the storage location information of the target data, which includes multiple storage node addresses and corresponding data shard identifiers. Based on the access privilege range of the requester, the system filters out the set of data shard identifiers allowed to be accessed from the storage location information and sends a data retrieval request to the corresponding storage nodes. After receiving the data shards returned by the storage nodes, the system verifies the integrity and consistency of the data and reassembles the verified data shards into complete data according to the preset assembly rules. Finally, the system filters the reassembled data according to the access privilege level of the requester, retaining only the data fields allowed to be accessed at this privilege level, thereby generating the final access result data.

[0081] In the second aspect of the embodiments of the present invention, a motion data security management system in the metaverse intelligent sports is provided, including: The first unit is used to obtain the motion data of the user in the metaverse motion scenario and the identity information of the user, establish an identity authentication model for the user based on the zero-knowledge proof mechanism, generate a zero-knowledge proof protocol based on the Merkle tree, calculate the hash value according to the identity information to construct the leaf nodes of the Merkle tree, obtain the Merkle root node value through iterative calculation, generate a zero-knowledge proof including path proof, verify the authenticity of the identity information, and generate an authentication credential including a timestamp and a digital signature; The second unit is used to, after the authenticity of the identity information is verified, perform distributed storage on the motion data by using the sharding storage technology, including: dividing the motion data into metadata shards, feature data shards, and evaluation result shards according to the data structure of the motion data, establishing index identifiers for each data shard by using a Bloom filter, distributing and storing the data shards to multiple storage nodes through a circular hash space, and determining the storage location of the data shards through a consistent hashing algorithm; A third unit, when responding to a data access request from a third-party application, verifies the authentication credentials and access privilege level provided by the requester, retrieves and assembles access result data at the corresponding level from the distributed storage network, wherein full access privilege can obtain all motion data, and restricted access privilege can only obtain basic motion type information.

[0082] In a third aspect of the embodiments of the present invention, there is provided an electronic device, including: A processor; A memory for storing instructions executable by the processor; Wherein, the processor is configured to call the instructions stored in the memory to execute the method described above.

[0083] In a fourth aspect of the embodiments of the present invention, there is provided a computer-readable storage medium, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the method described above is implemented.

[0084] The present invention may be a method, an apparatus, a system, and / or a computer program product. The computer program product may include a computer-readable storage medium, on which computer-readable program instructions for executing various aspects of the present invention are uploaded.

[0085] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements on some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for secure management of motion data in Metaverse Intelligent Motion, characterized in that: include: Obtain the user's motion data and identity information in the Metaverse motion scene, establish the user's identity authentication model based on the zero-knowledge proof mechanism, generate a zero-knowledge proof protocol based on the Merkle tree, calculate the hash value according to the identity information to construct the Merkle tree child node, obtain the Merkle tree root node value through iterative calculation, generate a zero-knowledge proof containing a path proof, verify the authenticity of the identity information, and generate an authentication credential containing a timestamp and a digital signature; When the authenticity of the identity information is verified, the motion data is distributedly stored using shard storage technology, including: segmenting the motion data into metadata shards, feature data shards, and evaluation result shards according to the data structure of the motion data, using Bloom filters to create index identifiers for each data shard, distributing and storing the data shards to multiple storage nodes through a ring hash space, and determining the storage location of the data shards through a consistent hash algorithm; When responding to data access requests from third-party applications, verify the authentication credentials and access permission level provided by the requester, retrieve and assemble the corresponding level of access result data from the distributed storage network based on the access permission level, where full access permission can obtain all motion data, and restricted access permission can only obtain basic motion type information.

2. The method according to claim 1, characterized in that Generate a zero-knowledge proof protocol based on a Merkle tree, calculate a hash value based on the identity information to construct a Merkle tree child node, obtain the Merkle tree root node value through iterative calculation, and generate a zero-knowledge proof including a path proof, including: Splitting the identity information into a user identification field, a registration time field, and an authority level field, and calculating the SHA-256 hash values ​​of the user identification field, the registration time field, and the authority level field to form a leaf node; Arrange the leaf nodes in a preset order to construct the bottom layer of the Merkle tree, concatenate the hash values ​​of two adjacent leaf nodes, and then calculate the SHA-256 hash value to obtain the parent node value; Repeat the pairing operation on adjacent leaf nodes until a unique Merkle tree root node value is generated. During the pairing process, the index information and corresponding hash values ​​of the left and right child nodes of each leaf node are recorded to build a node relationship mapping table. Select a target leaf node that needs to be authenticated, determine a verification path from the target leaf node to the root node based on the node relationship mapping table, and extract hash values ​​of adjacent leaf nodes and node index information of left and right child nodes on the verification path; Generate a random prime number as a homomorphic encryption key, use the homomorphic encryption key to encrypt the hash value of the leaf node on the verification path, generate an encrypted node sequence, and combine the encrypted node sequence with the node index information to form a zero-knowledge proof.

3. The method according to claim 2, characterized in that Verifying the authenticity of the identity information and generating an authentication credential containing a timestamp and a digital signature includes: The zero-knowledge proof and the Merkle tree root node value are sent to the verifier, and the verifier decrypts the encrypted node sequence using the homomorphic encryption key, reconstructs the verification path according to the node index information, and verifies whether the reconstructed root node value is consistent with the received root node value; The verification result returned by the receiving verifier is confirmed to be successful when the verification result indicates that the reconstructed root node value is consistent with the received root node value, and an authentication certificate including a timestamp and a digital signature is generated.

4. The method according to claim 1, characterized in that According to the data structure of motion data, it is divided into metadata shards, feature data shards and evaluation result shards. Bloom filters are used to create index identifiers for each data shard. The data shards are distributed and stored in multiple storage nodes through a ring hash space. The storage location of the data shards is determined by the consistent hashing algorithm, including: Slice the motion data according to the data structure type, including: dividing the user identification, timestamp and device information into metadata slices, dividing the motion trajectory data and motion posture data into feature data slices, and dividing the physiological feature data into evaluation result slices; Constructing a Bloom filter index for each data shard, including: selecting multiple independent hash functions, using the multiple hash functions to respectively calculate characteristic values ​​of the data shards, mapping the characteristic values ​​to corresponding positions in the multidimensional vector space, setting the binary value of the mapped position to 1, and generating a Bloom filter fingerprint of the data shard; Determining the storage location of the data shard based on the consistent hashing algorithm includes: constructing a ring hash space, mapping the storage node to a virtual node of the ring hash space, calculating the hash value of the data shard, and finding the first virtual node greater than or equal to the hash value in a clockwise direction on the ring hash space as the storage location; The metadata slice, the feature data slice and the evaluation result slice are respectively sent to corresponding storage locations for storage, and the corresponding relationship between the data slice and the Bloom filter fingerprint is recorded in the storage location.

5. The method according to claim 4, characterized in that Construct a circular hash space, map the storage node to the virtual node of the circular hash space, calculate the hash value of the data shard, and find the first virtual node that is greater than or equal to the hash value in the circular hash space clockwise as the storage location, including: Generate a node identifier for each storage node, where the node identifier is obtained by concatenating the node network address, the node weight value, and the timestamp; Determine the number of virtual nodes of each storage node based on the node weight value, combine the virtual node sequence number with the node identifier to generate a virtual node identifier, calculate the hash value of the virtual node identifier, map the virtual node to the corresponding hash segment in the circular hash space according to the hash value, and generate a routing table containing the mapping relationship between the virtual node position and the actual node; Extracting a shard identifier, a shard size, and a shard content from the data shard, and calculating a target hash value of the shard identifier using the same hash algorithm as the virtual node; In the circular hash space, starting from the target hash value, the routing table is searched in a clockwise direction, the first virtual node that is greater than or equal to the target hash value is used as the main storage location, and the two adjacent virtual nodes thereafter are selected as backup storage locations, wherein the main storage location and the backup storage location correspond to different actual storage nodes respectively.

6. The method according to claim 1, characterized in that Verify the authentication credentials and access rights level provided by the requester, and retrieve and assemble the corresponding level of access result data from the distributed storage network according to the access rights level, including: Receiving a data access request sent by a requester, wherein the data access request includes an authentication credential, an authority level identifier, and a target data index, wherein the authentication credential includes a digital signature and a timestamp of the requester; Verifying the validity of the authentication credentials includes: checking whether the timestamp is within the allowed time window, verifying the legitimacy of the digital signature using the public key of the requester, and confirming whether the identity of the requester is in the authorized user list; Acquire a data access rule corresponding to the permission level identifier from an access control policy library, wherein the data access rule defines a set of data fields and access operation types accessible to different permission levels, and determine the actual access permission scope of the requesting party according to the data access rule; Based on the target data index, a data location mapping table in a distributed storage network is queried to obtain storage location information of the target data, wherein the storage location information includes multiple storage node addresses and corresponding data shard identifiers; based on the actual access permission scope of the requesting party, a set of data shard identifiers that are allowed to be accessed is screened from the storage location information, and a data retrieval request is sent to the corresponding storage node; Receive the data shard content returned by the storage node, verify the integrity and consistency of the data shard, and reassemble the verified data shard into complete data according to the preset assembly rules; The reorganized data is filtered according to the access permission level of the requester, and only the data fields that are allowed to be accessed by the permission level are retained to generate access result data.

7. A motion data security management system in Metaverse Intelligent Motion, used to implement the method as described in any one of claims 1 to 6, characterized in that: include: The first unit is used to obtain the user's motion data and the user's identity information in the metaverse motion scene, establish the user's identity authentication model based on the zero-knowledge proof mechanism, generate a zero-knowledge proof protocol based on the Merkle tree, calculate the hash value according to the identity information to construct the Merkle tree child node, obtain the Merkle tree root node value through iterative calculation, generate a zero-knowledge proof including the path proof, verify the authenticity of the identity information, and generate an authentication credential including a timestamp and a digital signature; The second unit is used to use the shard storage technology to distribute the motion data after the authenticity verification of the identity information is passed, including: dividing the motion data into metadata shards, feature data shards and evaluation result shards according to the data structure of the motion data, using the Bloom filter to establish an index identifier for each data shard, distributing and storing the data shards to multiple storage nodes through a ring hash space, and determining the storage location of the data shards through a consistent hash algorithm; The third unit is used to verify the authentication credentials and access permission level provided by the requester when responding to data access requests from third-party applications, and retrieve and assemble access result data of the corresponding level from the distributed storage network according to the access permission level. Full access permission can obtain all motion data, and restricted access permission can only obtain basic motion type information.

8. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images