A trusted data sharing system and data flow method based on identification resolution

Abstract

The application belongs to the technical field of data processing, and particularly relates to a trusted data sharing system and a data flow conversion method based on identification analysis. The method comprises the following steps: receiving an identification analysis request submitted by a data requester; dynamically analyzing the identification into bound metadata through a distributed node network, analyzing an authority policy, and generating an access control decision in combination with dynamic attributes of the data requester; if the decision result is rejection, returning a rejection response to the requester and triggering a blockchain notarization; if the decision result is permission, routing the data request to an external data source deployed by a data provider according to a data source address and a protocol type; returning a response of the data source to the data requester; recording an operation log; and displaying data flow and blockchain notarization records through a visualized auditing interface. Flexible access control based on dynamic attributes, efficient data routing and complete operation log recording are realized, and the safety and compliance of data sharing are guaranteed.

Description

Technical Field

[0001] This invention belongs to the field of data processing technology, specifically relating to a trusted data sharing system and data flow method based on identifier resolution. Background Technology

[0002] With the rapid development of the Industrial Internet, data sharing is becoming increasingly important in cross-organizational and cross-industry business collaboration. However, existing data sharing technologies suffer from the following major problems:

[0003] In existing technologies, data sharing typically relies on manual negotiation of data interfaces, making it impossible to dynamically discover data sources. For example, in cross-border logistics scenarios, data requesters need to negotiate interfaces with multiple data providers one by one, resulting in long data location times and low efficiency. Most data sharing solutions use static permission configurations, which are difficult to adapt to dynamic business needs. Static permission rules cannot be dynamically adjusted according to real-time business scenarios (such as user roles, geographical locations, timestamps, etc.), easily leading to problems such as permission abuse or insufficient permissions.

[0004] During data circulation, insufficient verification of data source credibility makes data susceptible to tampering or forgery. Existing technologies lack effective mechanisms to ensure data integrity and source authenticity during transmission and storage. Inconsistent identification protocols between heterogeneous systems result in poor interoperability. Different organizations and industries employing different identification systems hinder efficient data flow, creating data silos. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention proposes a trusted data sharing system and data transfer method based on identifier resolution, thereby overcoming the shortcomings of existing technologies.

[0006] In a first aspect, the present invention provides a trusted data sharing system based on identifier resolution, comprising:

[0007] The identifier resolution layer is used to receive identifier resolution requests submitted by data requesters, dynamically resolve identifiers into bound metadata through a distributed node network, and return the metadata to the trusted sharing layer; the metadata includes data source address, protocol type, and permission policy;

[0008] The trusted sharing layer includes a dynamic authorization module, an intelligent routing module, and a blockchain evidence storage module;

[0009] The dynamic authorization module is used to parse the permission policy and generate access control decisions by combining the dynamic attributes of the data requester; if the decision result is denial, a denial response is returned to the requester and blockchain notarization is triggered.

[0010] The intelligent routing module is used to route data requests to external data sources deployed by the data provider based on the data source address and protocol type when the decision result is permissible; and to return the response from the data source to the data requester.

[0011] The blockchain evidence storage module is used to record operation logs; the operation logs include the requester's identity, data identifier, operation type, timestamp, decision result, and routing path;

[0012] The application service layer provides a data sharing interface and a visual audit interface to display data flow and blockchain evidence records.

[0013] The identifier resolution layer enables dynamic resolution of identifiers. Combined with a distributed node network, this improves the efficiency and accuracy of data identifier identification, avoids single-point-of-failure risks, and enhances system reliability and scalability. The dynamic authorization module, intelligent routing module, and blockchain notarization module in the trusted sharing layer work together to achieve flexible access control based on dynamic attributes, efficient data routing, and complete operation log recording, ensuring the security and compliance of data sharing. The application service layer provides data sharing interfaces and a visual auditing interface, facilitating data sharing operations and auditing for users and improving user experience.

[0014] As a further limitation of the technical solution of the present invention, the identifier resolution layer is also used to receive the data entity registration request from the data provider, assign a unique identifier to the data entity and bind metadata to store in the distributed node network; the data entity includes at least one of industrial equipment, products, orders or data service interfaces.

[0015] The identifier resolution layer receives data entity registration requests from data providers, assigns unique identifiers to data entities, and binds metadata to be stored in a distributed node network. This enables unified management and identification of data entities, laying the foundation for subsequent data sharing. It supports various types of data entities, such as industrial equipment, products, orders, or data service interfaces, meeting the data sharing needs of different industries and scenarios.

[0016] As a further limitation of the technical solution of the present invention, the identifier resolution layer includes:

[0017] The request preprocessing module verifies the identifier format and performs URI encoding conversion on non-standard identifiers;

[0018] The distributed recursive query module first queries the local node's cache for the metadata corresponding to the identifier. If a valid record exists and has not expired, the cached metadata is directly returned to the trusted sharing layer. If the query fails or the cache expires, the corresponding metadata is obtained by recursively parsing through the distributed node network according to the hierarchical path. The hierarchical path is root node - industry node - enterprise node.

[0019] The metadata verification module verifies the completeness, timeliness, and syntactic validity of the obtained metadata and the permission policy; it then returns the verified metadata to the trusted sharing layer and updates the cache of the local node.

[0020] The identifier resolution layer comprises a request preprocessing module, a distributed recursive query module, and a metadata verification module. Each module has a clearly defined function, improving the efficiency and accuracy of identifier resolution. The request preprocessing module performs URI encoding conversion on non-standard identifiers, ensuring consistency in identifier format. The distributed recursive query module prioritizes retrieving metadata from the local node cache, improving query speed; when the cache expires, it recursively resolves metadata through the distributed node network along hierarchical paths, ensuring accurate retrieval of metadata. The metadata verification module performs integrity, timeliness, and syntactic validity checks on the retrieved metadata for permission policies, ensuring the quality and security of metadata. Verified metadata is returned to the trusted sharing layer, while the local node cache is updated, improving the efficiency of subsequent queries.

[0021] As a further limitation of the technical solution of this invention, the process of recursive parsing by the distributed recursive query module is as follows:

[0022] The identifier is broken down into a prefix and a suffix according to standard protocol rules;

[0023] The query path is determined by the node routing table maintained by the blockchain;

[0024] Based on the query path, query the root node to determine the identifier prefix;

[0025] Based on the routing information returned by the root node, recursively query the industry node and enterprise node;

[0026] Obtain metadata from enterprise nodes and inject privacy parameters and compliance statements.

[0027] The distributed recursive query module clarifies the specific process of recursive parsing. By decomposing the identifier into prefixes and suffixes, it uses the node routing table maintained by the blockchain to determine the query path and recursively queries according to the hierarchical path of root node - industry node - enterprise node. Finally, it obtains metadata from the enterprise node and injects privacy parameters and compliance statements, ensuring the accuracy and security of data parsing while meeting data privacy and compliance requirements.

[0028] As a further limitation of the technical solution of the present invention, the dynamic authorization module includes a rule extraction unit, a dynamic attribute acquisition unit, a matching processing unit, and a decision generation unit;

[0029] The rule extraction unit is used to extract access rules from the permission policy, including allowed roles, operation types, and valid time ranges;

[0030] The dynamic attribute acquisition unit is used to obtain dynamic attributes from the request context of the data requester, including: user role, request timestamp, geographical location mapped by IP address, and device security level extracted from the request header;

[0031] The matching processing unit is used to match dynamic attributes with access rules in the permission policy in real time based on the attribute-based access control model.

[0032] The decision generation unit generates an allow decision if all access rules are met; otherwise, it generates a deny decision and passes the decision result to the intelligent routing module or directly returns a deny response.

[0033] The dynamic authorization module comprises a rule extraction unit, a dynamic attribute acquisition unit, a matching processing unit, and a decision generation unit. These units work collaboratively to achieve flexible access control based on dynamic attributes. The rule extraction unit extracts access rules from the permission policy, providing a foundation for subsequent matching. The dynamic attribute acquisition unit obtains various dynamic attributes from the request context of the data requester, ensuring the real-time nature and accuracy of access control. The matching processing unit, based on an attribute-based access control model, performs real-time matching of dynamic attributes with access rules, improving matching efficiency and accuracy. The decision generation unit generates allow or deny decisions based on the matching results, ensuring the security of data sharing.

[0034] As a further limitation of the technical solution of the present invention, the matching processing unit is specifically used to convert the dynamic attributes of the requester into a unified attribute vector; expand the nested rules in the permission policy into a flattened rule condition list; use SIMD instructions to compare the attribute vector and the rule condition list in parallel; when multiple rules conflict, select the highest priority to match; and store the matching result in Redis, where the key is the hash value of the attribute vector and the TTL is aligned with the validity period of the permission policy.

[0035] The matching processing unit converts the requester's dynamic attributes into a unified attribute vector, expands the nested rules in the permission policy into a flattened list of rule conditions, and uses SIMD instructions to compare the attribute vector with the rule condition list in parallel, improving the speed and efficiency of matching. When multiple rules conflict, the highest priority rule is selected for matching, ensuring the rationality of the decision. The matching results are stored in Redis, with the key being the hash value of the attribute vector, and the TTL is aligned with the validity period of the permission policy, facilitating subsequent queries and verification, and improving the system's performance and maintainability.

[0036] As a further limitation of the technical solution of the present invention, when the intelligent routing module fails to request routing, it requests an update of the data source address from the identifier resolution layer.

[0037] When a routing request fails, the intelligent routing module requests an update to the data source address from the identifier resolution layer, ensuring the reliability and continuity of data routing. When the data source address changes, it can promptly obtain the latest address information, avoiding routing failures and improving the efficiency of data sharing.

[0038] Secondly, the present invention also provides a data transfer method for a trusted data sharing system based on identifier resolution, comprising the following steps:

[0039] Receive the identifier resolution request submitted by the data requester; dynamically resolve the identifier into bound metadata through a distributed node network, the metadata including the data source address, protocol type and permission policy; and return the metadata to the trusted sharing layer;

[0040] Parse the permission policy and generate access control decisions based on the dynamic attributes of the data requester; if the decision result is denial, return a denial response to the requester and trigger blockchain notarization.

[0041] If the decision is to allow, the data request is routed to the external data source deployed by the data provider based on the data source address and protocol type; the response from the data source is then returned to the data requester.

[0042] Record operation logs, including the requester's identity, data identifier, operation type, timestamp, decision result, and routing path;

[0043] The data flow and blockchain evidence records are displayed through a visual audit interface.

[0044] This method comprehensively describes the data flow process of a trusted data sharing system based on identifier resolution, from receiving identifier resolution requests to returning data source responses, and then to recording operation logs and displaying audit records, achieving end-to-end management of data sharing. This method ensures the security, reliability, and traceability of data sharing, meeting the data sharing needs of different industries and scenarios.

[0045] As a further limitation of the technical solution of the present invention, the step of receiving the identifier resolution request submitted by the data requester includes:

[0046] Receive data entity registration requests from data providers; assign unique identifiers to data entities and bind metadata to them, storing the data entities in a distributed node network; the data entities include at least one of industrial equipment, products, orders, or data service interfaces.

[0047] Before receiving the identifier resolution request submitted by the data requester, the system receives the data entity registration request from the data provider, assigns a unique identifier to the data entity and binds metadata to the distributed node network, providing basic data support for data sharing and ensuring the accuracy and reliability of data sharing.

[0048] As a further limitation of the technical solution of the present invention, the step of receiving an identifier resolution request submitted by a data requester and dynamically resolving the identifier into bound metadata through a distributed node network specifically includes:

[0049] Receive identifier resolution requests submitted by data requesters, verify identifier formats, and perform URI encoding conversion on non-standard identifiers;

[0050] First, query the metadata corresponding to the identifier from the cache of the local node; if a valid record exists and has not expired, return the cached metadata directly.

[0051] If the query fails or the cache expires, the corresponding metadata is obtained by recursively parsing the distributed node network according to the hierarchical path; where the hierarchical path is root node - industry node - enterprise node;

[0052] Perform integrity, timeliness, and syntactic validity checks on the acquired metadata and the permission policies.

[0053] The verified metadata is returned to the trusted sharing layer and the cache of the local node is updated.

[0054] As a further limitation of the technical solution of this invention, the recursive parsing process includes:

[0055] The identifier is broken down into a prefix and a suffix according to standard protocol rules;

[0056] The query path is determined by the node routing table maintained by the blockchain;

[0057] Query the root node to determine the identifier prefix;

[0058] Based on the routing information returned by the root node, recursively query the industry node and enterprise node;

[0059] Obtain metadata from enterprise nodes and inject privacy parameters and compliance statements.

[0060] As a further limitation of the technical solution of the present invention, the dynamic authorization step specifically includes:

[0061] Extract the access rules from the permission policy, including allowed roles, operation types, and valid time ranges;

[0062] Retrieve dynamic attributes from the request context of the data requester, including user role, request timestamp, geolocation, and device security level;

[0063] Based on the attribute-based access control model, dynamic attributes are matched with access rules in real time.

[0064] If all access rules are met, an allow decision is generated; otherwise, a deny decision is generated.

[0065] As a further limitation of the technical solution of the present invention, the real-time matching process includes:

[0066] Convert dynamic attributes into a unified attribute vector;

[0067] Expand the nested rules in the permission policy into a flattened list of rule conditions;

[0068] Use SIMD instructions to compare attribute vectors with rule condition lists in parallel;

[0069] When multiple rules conflict, the rule with the highest priority is selected for matching;

[0070] The matching results are stored in Redis, with the key being the attribute vector hash value, and the TTL is aligned with the validity period of the permission policy.

[0071] As a further limitation of the technical solution of the present invention, the method also includes:

[0072] If the routing request fails, a request to update the data source address is sent to the identifier resolution layer.

[0073] Retry using an alternative data source address.

[0074] The beneficial effects of this invention are as follows: By dynamically parsing identifiers into metadata through the identifier resolution layer, the data source can be quickly located, reducing data request waiting time and improving data sharing efficiency. The dynamic authorization module generates access control decisions based on the dynamic attributes of the data requester, enabling flexible adjustment of permissions according to real-time conditions, supporting fine-grained permission management, and meeting the needs of complex business scenarios. The blockchain evidence storage module records operation logs, including detailed information such as the requester's identity, data identifier, and operation type, ensuring the traceability of data operations and enhancing the credibility of the data sharing process. The application service layer provides a visual audit interface, allowing users to intuitively understand the data flow and operation records, facilitating the management and supervision of the data sharing process. Attached Figure Description

[0075] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0076] Figure 1 This is a schematic block diagram of a system according to an embodiment of the present invention.

[0077] Figure 2 This is a schematic flowchart illustrating a method according to an embodiment of the present invention. Detailed Implementation

[0078] To make the objectives, features, and advantages of this invention more apparent and understandable, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the specific embodiments. Obviously, the embodiments described below are only some embodiments of this invention, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0079] like Figure 1 As shown, this embodiment of the invention provides a trusted data sharing system based on identifier resolution, comprising:

[0080] The identifier resolution layer is used to receive identifier resolution requests submitted by data requesters, dynamically resolve identifiers into bound metadata through a distributed node network, and return the metadata to the trusted sharing layer; the metadata includes data source address, protocol type, and permission policy;

[0081] In this embodiment of the invention, the data source address, within the identifier resolution context, refers to the accessible interface address dynamically mapped through the identifier resolution service. The protocol types include HTTP, MQTT, and Industrial Internet of Things (IIoT) protocols. The permission policy uses JSON format and includes fields for allowed roles, valid time ranges, and permitted operation types.

[0082] The metadata data source address is dynamically generated and includes load balancing information. The specific format is: {protocol}: / / {cluster_id}.{company}.com / {endpoint}, where `cluster_id` is assigned by the identifier resolution layer based on real-time load conditions. The permission policy is encoded through a smart contract and automatically executes the contract to verify the requester's basic permissions during identifier resolution. The permission policy uses JSON-LD format and includes the following fields:

[0083] allowedActions: Allowed operation types (such as read, write);

[0084] validPeriod: Policy validity period (ISO 8601 format);

[0085] contextConstraints: Environmental constraints (such as internal network access only).

[0086] The trusted sharing layer includes a dynamic authorization module, an intelligent routing module, and a blockchain evidence storage module;

[0087] The dynamic authorization module is used to parse the permission policy and generate access control decisions by combining the dynamic attributes of the data requester; if the decision result is denial, a denial response is returned to the requester and blockchain notarization is triggered.

[0088] The intelligent routing module is used to route data requests to external data sources deployed by the data provider based on the data source address and protocol type when the decision result is permissible; and to return the response from the data source to the data requester.

[0089] The blockchain evidence storage module is used to record operation logs; the operation logs include the requester's identity, data identifier, operation type, timestamp, decision result, and routing path;

[0090] The application service layer provides a data sharing interface and a visual audit interface to display data flow and blockchain evidence records.

[0091] The identifier resolution layer enables dynamic resolution of identifiers. Combined with a distributed node network, this improves the efficiency and accuracy of data identifier identification, avoids single-point-of-failure risks, and enhances system reliability and scalability. The dynamic authorization module, intelligent routing module, and blockchain notarization module in the trusted sharing layer work together to achieve flexible access control based on dynamic attributes, efficient data routing, and complete operation log recording, ensuring the security and compliance of data sharing. The application service layer provides data sharing interfaces and a visual auditing interface, facilitating data sharing operations and auditing for users and improving user experience.

[0092] In some embodiments, the identifier resolution layer is also used to receive data entity registration requests from data providers, assign unique identifiers to the data entities and bind metadata to be stored in a distributed node network; the data entities include at least one of industrial equipment, products, orders or data service interfaces.

[0093] The identifier resolution layer receives data entity registration requests from data providers, assigns unique identifiers to data entities, and binds metadata to be stored in a distributed node network. This enables unified management and identification of data entities, laying the foundation for subsequent data sharing. It supports various types of data entities, such as industrial equipment, products, orders, or data service interfaces, meeting the data sharing needs of different industries and scenarios.

[0094] In some embodiments, the identifier resolution layer dynamically resolves identifiers through the following steps: Identifier verification: verifying whether the requested identifier conforms to the standard protocol format (Handle / OID / VAA / MA); Node query: resolving the identifier's attribution level by level from enterprise nodes → industry nodes → top-level nodes through a recursive query mechanism of a distributed node network; Metadata retrieval: obtaining metadata bound to the identifier from the target enterprise node, including data source address, protocol type, and permission policy; Expiration verification: checking the expiration field in the metadata, and returning an error response if it has expired; Result return: returning the valid metadata to the trusted sharing layer. Specifically, the identifier resolution layer includes:

[0095] The request preprocessing module verifies the identifier format and performs URI encoding conversion on non-standard identifiers;

[0096] The distributed recursive query module first queries the metadata corresponding to the identifier from the cache of the local node. If a valid record exists and has not expired, the cached metadata is directly returned to the trusted sharing layer. If the query fails or the cache expires, the corresponding metadata is obtained by recursively parsing through the distributed node network according to the hierarchical path. The hierarchical path is root node - industry node - enterprise node. When the local cache is not hit, the distributed recursive query module queries the identifier prefix attribution from the pre-configured root node (e.g., hdl-root.example.com). Based on the routing information returned by the root node, it recursively queries the industry node and enterprise node. The local node caches the query results and periodically synchronizes the routing table updates to the root node.

[0097] The metadata verification module verifies the completeness, timeliness, and syntactic validity of the obtained metadata and the permission policy; it then returns the verified metadata to the trusted sharing layer and updates the cache of the local node.

[0098] The identifier resolution layer comprises a request preprocessing module, a distributed recursive query module, and a metadata verification module. Each module has a clearly defined function, improving the efficiency and accuracy of identifier resolution. The request preprocessing module performs URI encoding conversion on non-standard identifiers, ensuring consistency in identifier format. The distributed recursive query module prioritizes retrieving metadata from the local node cache, improving query speed; when the cache expires, it recursively resolves metadata through the distributed node network along hierarchical paths, ensuring accurate retrieval of metadata. The metadata verification module performs integrity, timeliness, and syntactic validity checks on the retrieved metadata for permission policies, ensuring the quality and security of metadata. Verified metadata is returned to the trusted sharing layer, while the local node cache is updated, improving the efficiency of subsequent queries.

[0099] In some embodiments, the distributed recursive query module performs recursive parsing as follows:

[0100] The identifier is broken down into a prefix and a suffix according to standard protocol rules;

[0101] The query path is determined by the node routing table maintained by the blockchain;

[0102] Based on the query path, query the root node to determine the identifier prefix;

[0103] Based on the routing information returned by the root node, recursively query the industry node and enterprise node;

[0104] Obtain metadata from enterprise nodes and inject privacy parameters and compliance statements.

[0105] The distributed recursive query module clarifies the specific process of recursive parsing. By decomposing the identifier into prefixes and suffixes, it uses the node routing table maintained by the blockchain to determine the query path and recursively queries according to the hierarchical path of root node - industry node - enterprise node. Finally, it obtains metadata from the enterprise node and injects privacy parameters and compliance statements, ensuring the accuracy and security of data parsing while meeting data privacy and compliance requirements.

[0106] In this embodiment of the invention, the distributed recursive parsing process for obtaining metadata is as follows: The identifier is decomposed into a prefix and suffix according to standard protocol rules (e.g., hdl:10.1234 / product001 is decomposed into the prefix 10.1234 and the suffix product001); the pre-configured root node routing table is queried to determine the top-level parsing node corresponding to the prefix (e.g., prefix 10. points to hdl-root.example.com); the recursive nodes are queried downwards level by level, with the path being: top-level node → industry node → enterprise node; at the final enterprise node, it is verified whether the requester has the right to obtain the metadata of the suffix; basic metadata is obtained from the enterprise node, and the current network status information (e.g., a list of available mirror nodes) is appended.

[0107] Hierarchical routing includes: a) Each intermediate node maintains a priority list of next-hop nodes (based on real-time latency measurement); b) The network location information of the requester is transmitted using the EDNS Client Subnet protocol; c) The query path is stored on the blockchain to form an immutable resolution chain.

[0108] When recursive parsing times out (>2 seconds): automatically switch to the backup root node list; use UDP fast retransmission mechanism (retry once every 200ms); if it eventually fails, return the most recently known cached data (marked as expired but temporarily usable in STALE state).

[0109] In some embodiments, the dynamic authorization module includes a rule extraction unit, a dynamic attribute acquisition unit, a matching processing unit, and a decision generation unit;

[0110] The rule extraction unit is used to extract access rules from the permission policy, including allowed roles, operation types, and valid time ranges;

[0111] The dynamic attribute acquisition unit is used to obtain dynamic attributes from the request context of the data requester, including: user role, request timestamp, geographical location mapped by IP address, and device security level extracted from the request header;

[0112] The matching processing unit is used to match dynamic attributes with access rules in the permission policy in real time based on the attribute-based access control model.

[0113] The decision generation unit generates an allow decision if all access rules are met; otherwise, it generates a deny decision and passes the decision result to the intelligent routing module or directly returns a deny response.

[0114] The decision execution steps also include: when the decision is to allow, injecting an access token (including the scope and expiration of permissions) into the request header; and the intelligent routing module executing the route after verifying the token.

[0115] In some embodiments, the matching processing unit is specifically used to convert the dynamic attributes of the requester into a unified attribute vector; expand the nested rules in the permission policy into a flattened rule condition list; use SIMD instructions to compare the attribute vector with the rule condition list in parallel; when multiple rules conflict, select the highest priority to match; and store the matching result in Redis, where the key is the hash value of the attribute vector and the TTL is aligned with the validity period of the permission policy.

[0116] The matching processing unit converts the requester's dynamic attributes into a unified attribute vector, expands the nested rules in the permission policy into a flattened list of rule conditions, and uses SIMD instructions to compare the attribute vector with the rule condition list in parallel, improving the speed and efficiency of matching. When multiple rules conflict, the highest priority rule is selected for matching, ensuring the rationality of the decision. The matching results are stored in Redis, with the key being the hash value of the attribute vector, and the TTL is aligned with the validity period of the permission policy, facilitating subsequent queries and verification, and improving the system's performance and maintainability.

[0117] In some embodiments, when the intelligent routing module fails to request a route, it requests an update to the data source address from the identifier resolution layer.

[0118] When a routing request fails, the intelligent routing module requests an update to the data source address from the identifier resolution layer, ensuring the reliability and continuity of data routing. When the data source address changes, it can promptly obtain the latest address information, avoiding routing failures and improving the efficiency of data sharing.

[0119] The specific work process is as follows:

[0120] Data providers submit registration requests via REST API: the system generates a Handle-formatted identifier (e.g., hdl:10.1234 / device001); the metadata is signed and stored on the enterprise node, and the system records the registration event via blockchain.

[0121] Receive requester identifier resolution request (e.g., hdl:10.1234 / device001);

[0122] Local cache query process;

[0123] Recursive parsing process;

[0124] Decompose the prefix 10.1234 and the suffix device001;

[0125] Query the blockchain routing table to obtain the root node address (e.g., hdl-root.org);

[0126] The root node returns the address of the manufacturing industry node;

[0127] The industry node returns the enterprise node address;

[0128] The enterprise node returns the signed metadata.

[0129] Parse the permission policy JSON;

[0130] Attribute vectorization;

[0131] Python

[0132] user_roles = one_hot_encode(request.roles, ["admin", "maintenance"])

[0133] time_vec = [request.hour, request.minute]

[0134] SIMD parallel alignment (Intel AVX-512 instruction set);

[0135] Protocol adapter selection;

[0136] go

[0137] func Route(request) {

[0138] switch request.Protocol {

[0139] case "HTTP":

[0140] return httpClient.Do(request)

[0141] case "MQTT":

[0142] return mqtt.Publish(request.Topic, request.Data)

[0143] }

[0144] }

[0145] Failure handling involves exponential backoff and retrying (at 1s, 2s, and 4s intervals); an update request is sent to the identifier resolution layer.

[0146] like Figure 2 As shown, this embodiment of the invention also provides a data flow method for a trusted data sharing system based on identifier resolution, including the following steps:

[0147] S1. Receive the identifier resolution request submitted by the data requester; dynamically resolve the identifier into bound metadata through a distributed node network, the metadata including the data source address, protocol type and permission policy; and return the metadata to the trusted sharing layer.

[0148] S2. Parse the permission policy and generate access control decisions based on the dynamic attributes of the data requester; if the decision result is denial, return a denial response to the requester and trigger blockchain notarization.

[0149] S3. If the decision result is allowed, route the data request to the external data source deployed by the data provider according to the data source address and protocol type; return the response from the data source to the data requester.

[0150] S4. Record operation logs, including requester identity, data identifier, operation type, timestamp, decision result, and routing path;

[0151] S5. Display data flow and blockchain evidence records through a visual audit interface.

[0152] This method comprehensively describes the data flow process of a trusted data sharing system based on identifier resolution, from receiving identifier resolution requests to returning data source responses, and then to recording operation logs and displaying audit records, achieving end-to-end management of data sharing. This method ensures the security, reliability, and traceability of data sharing, meeting the data sharing needs of different industries and scenarios.

[0153] In some embodiments, the step of receiving the identifier resolution request submitted by the data requester includes:

[0154] Receive data entity registration requests from data providers; assign unique identifiers to data entities and bind metadata to them, storing the data entities in a distributed node network; the data entities include at least one of industrial equipment, products, orders, or data service interfaces.

[0155] Before receiving the identifier resolution request submitted by the data requester, the system receives the data entity registration request from the data provider, assigns a unique identifier to the data entity and binds metadata to the distributed node network, providing basic data support for data sharing and ensuring the accuracy and reliability of data sharing.

[0156] In some embodiments, the step of receiving an identifier resolution request submitted by a data requester and dynamically resolving the identifier into bound metadata through a distributed node network specifically includes:

[0157] Receive identifier resolution requests submitted by data requesters, verify identifier formats, and perform URI encoding conversion on non-standard identifiers;

[0158] First, query the metadata corresponding to the identifier from the cache of the local node; if a valid record exists and has not expired, return the cached metadata directly.

[0159] If the query fails or the cache expires, the corresponding metadata is obtained by recursively parsing the distributed node network according to the hierarchical path; where the hierarchical path is root node - industry node - enterprise node;

[0160] Perform integrity, timeliness, and syntactic validity checks on the acquired metadata and the permission policies.

[0161] The verified metadata is returned to the trusted sharing layer and the cache of the local node is updated.

[0162] In some embodiments, the recursive parsing process includes:

[0163] The identifier is broken down into a prefix and a suffix according to standard protocol rules;

[0164] The query path is determined by the node routing table maintained by the blockchain;

[0165] Query the root node to determine the identifier prefix;

[0166] Based on the routing information returned by the root node, recursively query the industry node and enterprise node;

[0167] Obtain metadata from enterprise nodes and inject privacy parameters and compliance statements.

[0168] In some embodiments, the dynamic authorization step specifically includes:

[0169] Extract the access rules from the permission policy, including allowed roles, operation types, and valid time ranges;

[0170] Retrieve dynamic attributes from the request context of the data requester, including user role, request timestamp, geolocation, and device security level;

[0171] Based on the attribute-based access control model, dynamic attributes are matched with access rules in real time.

[0172] If all access rules are met, an allow decision is generated; otherwise, a deny decision is generated.

[0173] In some embodiments, the real-time matching process includes:

[0174] Convert dynamic attributes into a unified attribute vector;

[0175] Expand the nested rules in the permission policy into a flattened list of rule conditions;

[0176] Use SIMD instructions to compare attribute vectors with rule condition lists in parallel;

[0177] When multiple rules conflict, the rule with the highest priority is selected for matching;

[0178] The matching results are stored in Redis, with the key being the attribute vector hash value, and the TTL is aligned with the validity period of the permission policy.

[0179] In some embodiments, the method further includes:

[0180] If the routing request fails, a request to update the data source address is sent to the identifier resolution layer.

[0181] Retry using an alternative data source address.

[0182] Although the present invention has been described in detail with reference to the accompanying drawings and preferred embodiments, the present invention is not limited thereto. Various equivalent modifications or substitutions can be made to the embodiments of the present invention by those skilled in the art without departing from the spirit and essence of the invention, and such modifications or substitutions should all be within the scope of the present invention. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should also be covered within the protection scope of the present invention.

Claims

1. A trusted data sharing system based on identifier resolution, characterized in that, include: The identifier resolution layer is used to receive identifier resolution requests submitted by the data requester, dynamically resolve the identifier into bound metadata through a distributed node network, and return the metadata to the trusted sharing layer. The metadata includes the data source address, protocol type, and permission policy; The identifier resolution layer includes a distributed recursive query module, which prioritizes querying the metadata corresponding to the identifier from the cache of local nodes. If a valid record exists and has not expired, the cached metadata is directly returned to the trusted sharing layer. If the query fails or the cache expires, the corresponding metadata is obtained through recursive resolution via a distributed node network according to a hierarchical path. The hierarchical path is root node - industry node - enterprise node. The recursive resolution process of the distributed recursive query module includes: decomposing the identifier into a prefix and suffix according to standard protocol rules; determining the query path through the node routing table maintained by the blockchain; querying the root node to determine the identifier prefix affix based on the query path; recursively querying industry nodes and enterprise nodes based on the routing information returned by the root node; obtaining metadata from enterprise nodes and injecting privacy parameters and compliance statements. The trusted sharing layer includes a dynamic authorization module, an intelligent routing module, and a blockchain evidence storage module; The dynamic authorization module is used to parse the permission policy and generate access control decisions by combining the dynamic attributes of the data requester; if the decision result is denial, a denial response is returned to the requester and blockchain notarization is triggered. The intelligent routing module is used to route data requests to external data sources deployed by the data provider based on the data source address and protocol type when the decision result is permissible; and to return the response from the data source to the data requester. The blockchain evidence storage module is used to record operation logs; the operation logs include the requester's identity, data identifier, operation type, timestamp, decision result, and routing path; The application service layer provides a data sharing interface and a visual audit interface to display data flow and blockchain evidence records; The dynamic licensing module includes: The rule extraction unit is used to extract access rules from the permission policy, including allowed roles, operation types, and valid time ranges; The dynamic attribute acquisition unit is used to obtain dynamic attributes from the request context of the data requester, including: user role, request timestamp, geographical location mapped by IP address, and device security level extracted from the request header; The matching processing unit is used to match dynamic attributes with access rules in the permission policy in real time based on the attribute-based access control model. The decision generation unit generates an allow decision if all access rules are met; otherwise, it generates a deny decision and passes the decision result to the intelligent routing module or directly returns a deny response.

2. The trusted data sharing system based on identifier resolution according to claim 1, characterized in that, The identifier resolution layer is also used to receive data entity registration requests from data providers, assign unique identifiers to the data entities and bind metadata to be stored in the distributed node network; the data entities include at least one of industrial equipment, products, orders or data service interfaces.

3. The trusted data sharing system based on identifier resolution according to claim 2, characterized in that, The identifier resolution layer also includes: The request preprocessing module verifies the identifier format and performs URI encoding conversion on non-standard identifiers; The metadata verification module verifies the completeness, timeliness, and syntactic validity of the obtained metadata and the permission policy; it then returns the verified metadata to the trusted sharing layer and updates the cache of the local node.

4. The trusted data sharing system based on identifier resolution according to claim 3, characterized in that, The matching processing unit is specifically used to convert the dynamic attributes of the requester into a unified attribute vector; expand the nested rules in the permission policy into a flattened rule condition list; and use SIMD instructions to compare the attribute vector and the rule condition list in parallel. When multiple rules conflict, the highest priority rule is selected for matching; the matching result is stored in Redis, where the key is the attribute vector hash value, and the TTL is aligned with the validity period of the permission policy.

5. The trusted data sharing system based on identifier resolution according to claim 4, characterized in that, When the intelligent routing module fails to request a route, it requests an update to the data source address from the identifier resolution layer.

6. A data transfer method based on the system according to any one of claims 1-5, characterized in that, Includes the following steps: Receive the identifier resolution request submitted by the data requester; The identifier is dynamically resolved into bound metadata through a distributed node network. The metadata includes the data source address, protocol type, and permission policy. And return the metadata to the trusted sharing layer; Parse the permission policy and generate access control decisions based on the dynamic attributes of the data requester; if the decision result is denial, return a denial response to the requester and trigger blockchain notarization. If the decision is to allow it, the data request will be routed to the external data source deployed by the data provider based on the data source address and protocol type. Return the response from the data source to the data requester; Record operation logs, including the requester's identity, data identifier, operation type, timestamp, decision result, and routing path; The data flow and blockchain evidence records are displayed through a visual audit interface.

7. The data flow method of the trusted data sharing system based on identifier resolution according to claim 6, characterized in that, Before receiving the identifier resolution request submitted by the data requester, the following steps are included: Receive data entity registration requests from data providers; assign unique identifiers to data entities and bind metadata to them, storing the data entities in a distributed node network; the data entities include at least one of industrial equipment, products, orders, or data service interfaces.

8. The data flow method of the trusted data sharing system based on identifier resolution according to claim 7, characterized in that, Receive the identifier resolution request submitted by the data requester; The specific steps involved in dynamically resolving an identifier into bound metadata through a distributed node network include: Receive identifier resolution requests submitted by data requesters, verify identifier formats, and perform URI encoding conversion on non-standard identifiers; First, query the metadata corresponding to the identifier from the cache of the local node; if a valid record exists and has not expired, return the cached metadata directly. If the query fails or the cache expires, the corresponding metadata is obtained by recursively parsing the distributed node network according to the hierarchical path; where the hierarchical path is root node - industry node - enterprise node; Perform integrity, timeliness, and syntactic validity checks on the acquired metadata and the permission policies. The verified metadata is returned to the trusted sharing layer, and the cache of the local node is updated.

Images