A method and system for trusted data access of digital clones

Abstract

The application relates to a digital twin trusted data authority matching access method and system, and relates to the field of trusted authentication. A DID digital identity containing a verifiable certificate is registered through a block chain, a frequent verification factor attribute combination is mined from a history verification record for user selection, and a preset verifiable expression is constructed. When the demand of a verifier coincides with the selected combination, the corresponding expression is automatically called to perform identity verification. The technical problem of high user operation frequency and low verification efficiency during digital identity verification is solved. The technical effects of reducing user operation frequency, improving the verification efficiency of a DID digital identity, and ensuring identity credibility and accurate authority matching are achieved.

Description

Technical Field

[0001] This invention relates to the field of trusted authentication, and in particular to a trusted data permission matching and access method and system for digital clones. Background Technology

[0002] In the digital age, with the rapid development of information technology and the widespread application of the Internet, Distributed Digital Identity (DID), as a new type of identity management method, is gradually becoming a key technology for solving problems such as personal and corporate identity authentication, data privacy protection, and secure access control. DID allows users to create and manage their own digital identities in a decentralized manner, without relying on traditional centralized identity authentication authorities, thereby improving the flexibility and security of identity management.

[0003] However, existing DID (Digital Identity) systems, when performing identity verification using verifiable credentials, generally employ selective or assertive omission of certain verification information to the identity-relying party. This approach has significant limitations. On one hand, each verification requires the user to manually select and omit specific identity attributes, which not only increases the user's workload and reduces the user experience but may also lead to the leakage of unnecessary personal information due to operational errors or negligence. On the other hand, because the verification process requires checking the selected identity attributes one by one, the verification efficiency is low and cannot meet the demands of modern applications with high concurrency and low latency. Furthermore, with the explosive growth of data volume and the continuous advancement of data processing technology, ensuring the security of data access and the accuracy of permission allocation has become a critical issue that urgently needs to be addressed. Existing identity verification and permission management methods are often ill-suited to this rapidly changing environment, making them prone to security risks such as permission abuse and data leakage. Summary of the Invention

[0004] This invention addresses the technical problem of high user operation frequency and low verification efficiency in digital identity verification in the prior art by providing a trusted data permission matching and access method and system for digital clones.

[0005] The technical solution of the present invention to solve the above-mentioned technical problems is as follows:

[0006] In a first aspect, the present invention provides a trusted data permission matching and access method for a digital avatar, comprising: registering a DID digital identity through a blockchain, wherein the DID digital identity includes a verifiable credential, and the verifiable credential includes an initial verification factor; whenever receiving a number of new verification factors from a number of issuing parties, performing frequent attribute combination mining based on historical verification records according to the verification factor attribute set of the new verification factors and the initial verification factor, to obtain multiple frequent verification factor attribute combinations; sending the multiple frequent verification factor attribute combinations to a user terminal for selection to obtain multiple selected verification factor attribute combinations; combining the new verification factors and the initial verification factor based on the multiple selected verification factor attribute combinations to construct multiple preset verifiable expressions; when the verifier's required verification attribute overlaps with any one of the multiple selected verification factor attribute combinations, retrieving the corresponding preset verifiable expression from the multiple preset verifiable expressions and sending it to the verifier for trusted identity verification.

[0007] Secondly, the present invention provides a trusted data permission matching and access system for digital avatars. The system includes: an identity registration module, used to register a DID digital identity via blockchain, wherein the DID digital identity includes a verifiable credential, and the verifiable credential includes an initial verification factor; an attribute mining module, used to, whenever receiving several new verification factors from several issuing parties, perform frequent attribute combination mining based on the verification factor attribute set of the several new verification factors and the initial verification factor, and based on historical verification records, obtain multiple frequent verification factor attribute combinations; an attribute selection module, used to send the multiple frequent verification factor attribute combinations to a user terminal for selection, thereby obtaining multiple selected verification factor attribute combinations; a new combination module, used to combine the several new verification factors and the initial verification factor based on the multiple selected verification factor attribute combinations to construct multiple preset verifiable expressions; and an identity verification module, used to, when the verifier's required verification attribute overlaps with any one of the multiple selected verification factor attribute combinations, retrieve the corresponding preset verifiable expression from the multiple preset verifiable expressions and send it to the verifier for trusted identity verification.

[0008] The beneficial effects of this invention are: by registering a DID digital identity containing verifiable credentials (including initial verification factors) through blockchain, and by mining frequent verification factor attribute combinations from historical verification records for users to select, a preset verifiable expression is constructed. When the verifier's needs overlap with the selected combination, the corresponding expression is automatically retrieved for identity verification, which reduces the frequency of user operations, improves the verification efficiency of DID digital identity, and ensures that identity trustworthiness and permissions are accurately matched. Attached Figure Description

[0009] Figure 1This is a flowchart illustrating a trusted data permission matching and access method for a digital clone provided by the present invention.

[0010] Figure 2 This is a schematic diagram of the structure of a trusted data permission matching and access system for digital clones provided by the present invention.

[0011] Figure labeling: Identity registration module 11, attribute mining module 12, attribute selection module 13, new combination module 14, identity verification module 15. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0014] In the description of this invention, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this invention is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed herein.

[0015] Example 1:

[0016] like Figure 1 As shown, this embodiment of the invention provides a trusted data permission matching and access method for digital clones, including:

[0017] S10: Register a DID digital identity via blockchain, wherein the DID digital identity includes a verifiable credential, and the verifiable credential includes an initial verification factor.

[0018] Distributed Digital Identity (DID) is a decentralized, user-managed and controlled digital identity that uses technologies such as blockchain to ensure the uniqueness, authenticity, and verifiability of the identity. A digital avatar is a virtual identity created by a user based on their DID. It can generate specific permission tags based on roles and business needs for authentication and permission matching during data access. In specific DID use cases, users create unique digital avatars using their digital identity (such as DID), generate permission tags based on roles and business needs, and automatically match the digital avatar with the permission tags of the data resource during data access. This is combined with multi-factor authentication, such as biometrics and device fingerprints, to verify identity and dynamically allocate access permissions according to the principle of minimum necessity. Permissions are immediately revoked after access ends, ensuring identity trustworthiness and accurate permission matching.

[0019] For example, in this scheme, a distributed digital identity (DID) is first registered via blockchain. This process not only establishes a unique identifier for the user in cyberspace but also assigns a verifiable credential to their digital identity. The verifiable credential, a key component of the DID, integrates initial verification factors that form the basis of identity verification. For instance, when a user registers a DID, their verifiable credential may contain initial biometric data (such as fingerprints or facial recognition information) or device fingerprint information as initial verification factors, which play a crucial role in subsequent identity verification. Through the immutability and decentralization of blockchain, the uniqueness, authenticity, and traceability of the DID digital identity are ensured, laying the foundation for subsequent data access permission matching.

[0020] S20: Whenever a number of new verification factors are received from a number of certificate issuers, based on the verification factor attribute set of the new verification factors and the initial verification factors, frequent attribute combination mining is performed based on historical verification records to obtain multiple frequent verification factor attribute combinations.

[0021] Optionally, whenever the system receives new verification factors from multiple issuers, it considers these new factors along with the initial verification factors to form a verification factor attribute set. This attribute set encompasses all factor attribute information that can be used for identity verification. Subsequently, based on historical verification records, data mining techniques are used to mine frequent attribute combinations within the verification factor attribute set. This process aims to identify verification factor attribute combinations that frequently co-occur in past verifications; these combinations are considered to have high practical value due to their high occurrence rate during the verification process. For example, if historical data shows that a user's biometric data (such as fingerprints) and device fingerprint information are frequently used simultaneously for identity verification, then this combination may be identified as a frequent verification factor attribute combination. Through this type of mining, the system can obtain multiple such combinations, providing more efficient and accurate support for subsequent identity verification processes.

[0022] S30: After sending the multiple frequent verification factor attribute combinations to the user terminal for selection, multiple selected verification factor attribute combinations are obtained.

[0023] Furthermore, multiple frequent verification factor attribute combinations obtained through data mining are pushed to the user's end. Upon receiving these combinations, the user can filter and select them according to their needs and business scenarios. This step ensures the user's active control over the verification factor attributes, making the identity verification process more aligned with the user's actual needs. For example, if a user primarily operates on a specific device, they might prefer to select verification factor attribute combinations that include the device's fingerprint information. After the user completes their selection, the system records and integrates these selection results, ultimately obtaining multiple selected verification factor attribute combinations. These combinations will serve as the basis for subsequently constructing preset verifiable expressions.

[0024] S40: Based on the combination of the multiple selected verification factor attributes, combine the several newly added verification factors and the initial verification factors to construct multiple preset verifiable expressions.

[0025] Subsequently, based on the multiple verification factor attribute combinations selected by the user, the received new verification factors and initial verification factors are combined. This aims to combine the selected verification factor attributes with all available verification factors to construct multiple preset verifiable expressions. Specifically, for each selected verification factor attribute combination, corresponding verification factors are selected from the new and initial verification factors, and these verification factors are combined into preset verifiable expressions using specific logic or encryption algorithms. Preset verifiable expressions may include hash values, digital signatures, or other forms of encrypted data for subsequent authentication processes. For example, if the user selects a verification factor attribute combination containing fingerprint information and device fingerprint, the system may combine the user's fingerprint data with the device fingerprint information to generate a unique preset verifiable expression, which will be used to verify the user's true identity in subsequent authentication processes. By constructing multiple such preset verifiable expressions, a flexible and efficient authentication method can be provided to users.

[0026] S50: When the verifier's required verification attribute coincides with any one of the multiple selected verification factor attribute combinations, the corresponding preset verifiable expression is retrieved from the multiple preset verifiable expressions and sent to the verifier for trusted identity verification.

[0027] Specifically, when a verifier initiates an identity verification request and specifies its required verification attributes, a matching retrieval mechanism is activated. This mechanism compares the verifier's required verification attributes with multiple pre-selected verification factor attribute combinations on the user's end to determine if there are any attribute overlaps. If the verifier's required verification attributes match any selected verification factor attribute combination, the system automatically retrieves the corresponding pre-defined verifiable expression from a pool of pre-built verifiable expressions. For example, if the verifier needs to verify a user's professional identity and device binding information, and the user has selected a verification factor attribute combination containing a professional certificate number and a unique device identifier, the system will extract the corresponding pre-defined verifiable expression (which may be jointly encrypted data of the professional certificate digital signature and the device fingerprint). Subsequently, the system sends this pre-defined verifiable expression to the verifier through a secure channel. The verifier parses and verifies the expression according to pre-defined rules, completing the trusted identity verification of the user's digital avatar. Through the automated connection between attribute matching and pre-defined expression retrieval, the identity verification process is precisely triggered and efficiently executed.

[0028] In a preferred embodiment, whenever several new verification factors are received from several certificate issuers, based on the verification factor attribute sets of the several new verification factors and the initial verification factors, and based on historical verification records, frequent attribute combination mining is performed to obtain multiple frequent verification factor attribute combinations. This includes: based on the historical verification records, traversing the verification factor attribute set to perform trigger record number percentage statistics to obtain a set of verification factor attribute frequency coefficients; based on the set of verification factor attribute frequency coefficients, filtering from the set of verification factor attribute frequency coefficients that are greater than or equal to a single item frequency coefficient threshold to obtain a set of frequent verification factor attribute combinations; and based on the historical verification records, performing frequent attribute combination mining on the set of frequent verification factor attribute combinations to obtain multiple frequent verification factor attribute combinations.

[0029] Preferably, when processing new verification factors received from multiple issuing parties, the new verification factors are first integrated with the initial verification factors to form a complete set of verification factor attributes. To improve the efficiency of verification factor combination mining and avoid indiscriminate combination analysis of all attributes, a two-stage screening and mining process will be carried out based on historical verification records. Specifically, for each attribute in the verification factor attribute set, the percentage of records that use it as a verification trigger condition is counted throughout the historical verification records, generating a set of verification factor attribute frequency coefficients. For example, if a fingerprint feature attribute is triggered 300 times in 1000 historical verifications, its frequency coefficient is 0.3; while if the device IMEI number attribute is triggered 800 times, its frequency coefficient is 0.8. Furthermore, a single-item frequency coefficient threshold (e.g., 0.5) is pre-set, and attributes with frequency coefficients higher than this threshold are selected from the verification factor attribute set to form a set of verification factor frequent attributes. Taking a threshold of 0.5 as an example, the aforementioned device IMEI number attribute will be selected, while the fingerprint feature attribute will be excluded because it does not reach the threshold. Finally, focusing on high-frequency attributes in the set, association rule mining algorithms (such as the Apriori algorithm) are used to analyze historical verification records, extract high-frequency co-occurrence patterns between attributes, and generate multiple frequent verification factor attribute combinations. For example, if the combination of "device IMEI number + user facial features" frequently appears in high-confidence verification scenarios in historical data, then this combination will be included in the result set. Through the above process, high-frequency verification attributes are prioritized, significantly narrowing the scope of combination analysis and greatly reducing computational resource consumption while ensuring the effectiveness of the mining results.

[0030] In a preferred embodiment, based on the historical verification records, frequent attribute combination mining is performed on the frequent attribute set of verification factors to obtain multiple frequent verification factor attribute combinations. This includes: enumerating and combining k items in the frequent attribute set of verification factors to obtain multiple frequent attribute combinations of k items; based on the historical verification records, traversing the multiple frequent attribute combinations of k items of verification factors to perform trigger record number percentage statistics to obtain the frequency coefficients of multiple frequent attribute combinations of k items; based on the frequency coefficients of the multiple frequent attribute combinations of k items, selecting a set of frequent k attribute combinations whose frequency coefficients are greater than or equal to the threshold of the k item frequency coefficients, where the initial value of k is 2, k is an integer, N≥k≥2, N represents the number of attributes in the frequent attribute set of verification factors, and the threshold of a single frequent coefficient < the threshold of the k item frequent coefficients < the threshold of k-1 item frequent coefficients; adding the set of frequent k attribute combinations to the multiple frequent verification factor attribute combinations, and if k < N, incrementing k and continuing to perform frequent attribute combination mining; if k = N, outputting the multiple frequent verification factor attribute combinations.

[0031] Specifically, in constructing frequent verification factor attribute combinations, the system first focuses on the set of frequent verification factor attributes and employs a progressive strategy to perform combination mining. Specifically, the system starts the enumeration process with k=2 as the initial value, combining attributes in the set of frequent verification factor attributes pairwise to generate multiple frequent two-attribute combinations. For example, if the set contains three attributes: device IMEI number, user facial features, and geographic location information, then three combinations are generated: "device IMEI number + user facial features," "device IMEI number + geographic location information," and "user facial features + geographic location information." Subsequently, based on historical verification records, these two-attribute combinations are iterated through, and the percentage of records where each combination is used as a trigger condition during the verification process is counted, calculating the frequency coefficient of multiple frequent two-attribute combinations. For example, if the "device IMEI number + user facial features" combination is triggered 200 times in 1000 historical verifications, then its frequency coefficient is 0.2.

[0032] Based on this, two frequency coefficient thresholds are set, which are higher than the single frequency coefficient threshold to ensure the reliability of the combination verification. Then, combinations with frequency coefficients greater than or equal to the thresholds are selected from all two-item combinations to form a set of frequent combinations of two attributes.

[0033] After completing the mining of two combinations, a conditional judgment is made to decide whether to continue the iteration: if the current k value is less than the number of attributes N in the set of frequent attributes of the validation factor, the k value is incremented by one, and the next round of enumeration is entered (for example, when k=3, all combinations of 3 attributes are generated), and the frequent coefficient statistics and filtering operations are repeated; if the k value has reached N, the iteration is terminated.

[0034] In each iteration, the set of frequently selected k attribute combinations is added to the final result set, which contains multiple frequent validation factor attribute combinations. To ensure the progressively strictness of combination validation, the threshold for the k-item frequency coefficient increases with the value of k, meaning the threshold for the k-item frequency coefficient is less than the threshold for the (k-1)-item frequency coefficient. This prevents low-order invalid combinations from interfering with the discovery of high-order valid combinations. For example, when k=3, the threshold might be increased to 0.4, retaining only combinations where the trigger percentage is above 40% in the "device IMEI number + user facial features + geolocation information" category. This process allows for the stratified selection of multi-order attribute combinations with high validation value, providing support for the subsequent construction of flexible and reliable validation rules.

[0035] In a preferred embodiment, based on the multiple selected verification factor attribute combinations, the several newly added verification factors and the initial verification factors are combined to construct multiple preset verifiable expressions, including: extracting the first selected verification factor attributes of the first selected verification factor attribute combination up to the Qth selected verification factor attribute of the multiple selected verification factor attribute combinations; randomly generating a candidate perturbation code set for the first selected verification factor attributes; retrieving the historical configuration perturbation code set of the first selected verification factor attributes from the on-chain database; performing outlier analysis on the candidate perturbation code set based on the historical configuration perturbation code set to obtain an outlier factor set; performing maximum value sorting on the candidate perturbation code set based on the outlier factor set to obtain a target perturbation code; performing zero-knowledge processing on the first selected verification factor of the first selected verification factor attribute according to the target perturbation code to obtain a first selected updated verification factor; until the Qth selected updated verification factor is obtained; constructing a first preset verifiable expression based on the first selected updated verification factor up to the Qth selected updated verification factor, and adding it to the multiple preset verifiable expressions.

[0036] Furthermore, in the process of constructing a preset verifiable expression, a dynamic encryption strategy is adopted for each attribute to enhance the security of the verification factors for multiple verification factor attribute combinations selected by the user.

[0037] Specifically, firstly, each attribute in the first selected verification factor attribute combination (denoted as the first selected verification factor attribute combination) is extracted. For example, it may include two attributes: "user biometrics - fingerprint feature" and "device identifier - IMEI number," and each attribute is encrypted. For the first selected verification factor attribute (such as fingerprint feature), a set of candidate perturbation codes is randomly generated, for example, a set containing 10 sets of hexadecimal random strings.

[0038] Subsequently, the historical configuration perturbation code set corresponding to the attribute is retrieved from the on-chain database. This set records the perturbation codes used for this attribute in past verifications, for example, containing 5 sets of historical perturbation codes. Then, based on the historical configuration perturbation code set, outlier analysis is performed on the candidate perturbation code set. By calculating indicators such as Hamming distance and cosine similarity between each candidate perturbation code and the historical perturbation codes, outlier factors deviating from the historical distribution are filtered out. For example, 3 sets of candidate perturbation codes with similarity to historical perturbation codes below a threshold are identified. Further, maximum value sorting is performed on the outlier factor set, such as selecting the perturbation code with the highest score based on outlier score. For example, if a certain outlier perturbation code has the highest score due to its greatest difference from historical perturbation codes, it is selected as the target perturbation code. Further still, zero-knowledge processing techniques are used to append the target perturbation code as a prefix to the original value of the first selected verification factor (such as fingerprint features). For example, the fingerprint feature value 123456 is concatenated with the target perturbation code "A7F3" to form "A7F3123456", and the concatenated data is encrypted using a zero-knowledge proof protocol (such as zk-SNARKs) to generate the first selected update verification factor. This ensures that during the verification process, it is only necessary to prove that the factor satisfies a specific attribute relationship, without revealing the original value.

[0039] Then, the above process is repeated for the remaining Q-1 selected verification factor attributes (such as IMEI number) until all Q selected updated verification factors are generated. Finally, the Q updated verification factors are combined according to preset rules, such as generating a fixed-length digest value using a hash function or constructing a hierarchical verification expression using a Merkle tree structure, to form a first preset verifiable expression, which is then added to a set of multiple preset verifiable expressions. For example, if the first selected updated verification factor is "A7F3123456" (fingerprint feature) and the second selected updated verification factor is "B9E2IMEI1234567890" (IMEI number), the concatenation result of the two may be hashed using the SHA-256 algorithm to generate a preset verifiable expression such as "0x3F8A...". Through this process, while preserving the verifiability of verification factors, the privacy of attribute values ​​is protected through dynamic perturbation codes and zero-knowledge processing techniques, effectively resisting replay attacks and data leakage risks.

[0040] In a preferred embodiment, based on the historical configuration perturbation code set, outlier analysis is performed on the candidate perturbation code set to obtain an outlier factor set, including: extracting a first candidate perturbation code from the candidate perturbation code set; adding the first candidate perturbation code to the historical configuration perturbation code set to obtain a historical configuration update perturbation code set; calculating pairwise Hamming distances on the historical configuration update perturbation code set to obtain multiple perturbation code Hamming distances; and performing LOF outlier factor analysis on the first candidate perturbation code based on the multiple perturbation code Hamming distances to obtain a first outlier factor, which is then added to the outlier factor set.

[0041] For example, during the generation of the set of outliers, dynamic outlier detection is performed for each perturbation code in the set of candidate perturbation codes to quantify the degree of difference between it and the historical configuration perturbation codes.

[0042] Specifically, the first perturbation code (denoted as the first candidate perturbation code) is extracted from the candidate perturbation code set. For example, this perturbation code is a 16-bit binary string "1011001101011100". This perturbation code is then temporarily added to the historical configuration perturbation code set, forming the historical configuration update perturbation code set. For instance, if the historical configuration perturbation code set originally had 5 perturbation codes, the set size expands to 6 after the addition. Next, pairwise Hamming distance calculations are performed on the updated perturbation code set, counting the number of differing bits for each pair of perturbation codes using a bitwise XOR operation. For example, the Hamming distance between the first candidate perturbation code and the historical perturbation code "1100001101011100" is 2 (only the 1st and 2nd bits differ), and the Hamming distance between the first candidate perturbation code and another historical perturbation code "1011001100011100" is 4 (the 8th and 12th bits differ), ultimately generating multiple Hamming distance values ​​for the perturbation codes.

[0043] Furthermore, based on the Hamming distance matrix, the Local Outlier Factor (LOF) algorithm is used to perform outlier analysis on the first candidate perturbation code. First, the Local Reachability Density (LRD) of the perturbation code is calculated, which is the reciprocal of the average reachability distance of the perturbation codes in its neighborhood. For example, if the average Hamming distance of the perturbation codes in its neighborhood is 3, then the reachability distance is 3, and the LRD is 1 / 3. Then, the average LRD of all perturbation codes in its neighborhood is calculated; for example, the average LRD of 5 perturbation codes in the neighborhood is calculated to be 0.4. Finally, the outlier factor (LOF value) is obtained by comparing the LRD of the perturbation code with the average LRD of its neighborhood. For example, if the LRD of a perturbation code is 0.2 and the mean LRD of its neighborhood is 0.4, then its LOF value is 0.5 (below the threshold of 1, indicating low outlier activity). If another perturbation code has an LRD of 0.1 and the mean LRD of its neighborhood is 0.4, then its LOF value is 0.25 (if the threshold is set to 0.3, then this perturbation code is identified as an outlier). Finally, the calculated first outlier factor is added to the outlier factor set. If the LOF value of the first candidate perturbation code is 0.25 (below the threshold), then this value is recorded, but it may not be adopted in subsequent processing because it does not meet the outlier determination criteria.

[0044] Through the above process, the local similarity between each candidate perturbation code and the historically configured perturbation codes can be dynamically quantified, providing a basis for subsequently selecting perturbation codes with high outliers, thereby ensuring the privacy protection effect of the target perturbation code in zero-knowledge processing. For example, if a candidate perturbation code is judged as an outlier due to its excessively high LOF value, then that perturbation code is more likely to be selected as the target perturbation code, thereby enhancing the unlinkability of the verification factor.

[0045] In a preferred embodiment, a first preset verifiable representation is constructed based on the first selected update verification factor up to the Qth selected update verification factor, and added to the plurality of preset verifiable representations, including: whenever several new verification factors are received from several certificate issuers, updating the verifiable credential to obtain an updated Merkle tree; configuring flawed nodes in the updated Merkle tree based on the first selected update verification factor up to the Qth selected update verification factor to obtain a flawed node set; and adding the node information corresponding to the flawed node set to the first preset verifiable representation.

[0046] Optionally, during the construction and integration of preset verifiable expressions, verifiable credentials are dynamically updated for newly added verification factors, and flaw nodes are configured based on the updated data structure to support selective disclosure verification.

[0047] Specifically, whenever the system receives new verification factors from different issuers (such as new biometric features, device identifiers, or behavioral pattern data), it first integrates these verification factors with the existing verification factors to generate an updated Verifiable Credential (VC), which is then organized using a Merkle Tree structure. For example, if the existing credential contains three verification factors—fingerprint feature, IMEI number, and login time—and the new verification factor is facial feature, then the four verification factors are used as leaf nodes to construct a new Merkle Tree, generating an updated Merkle Tree with a four-layer structure. In this tree, the hash values ​​of each pair of leaf nodes are aggregated upwards layer by layer, ultimately forming the root hash value.

[0048] Subsequently, based on the first selected update verification factor to the Qth selected update verification factor (e.g., fingerprint features, IMEI number, and facial features), the updated Merkle tree is configured with RevealNodes. Specifically, RevealNode configuration is achieved through the following steps: First, the system determines the verification factors that need to be disclosed according to preset verification rules (e.g., if the verification rule requires proof of "user identity and device binding," then the Merkle tree path corresponding to the fingerprint feature and IMEI number needs to be disclosed); then, using a hash path backtracking algorithm, the leaf nodes containing these verification factors are located in the updated Merkle tree, and all intermediate nodes in the root node path are traced upwards to form a RevealNode set. For example, if the fingerprint feature is located in the first leaf node of the left subtree of the Merkle tree, its RevealNode set includes that leaf node, its parent node (generated by hashing the fingerprint feature and another verification factor), and all intermediate nodes in the root node path. Finally, the node information (e.g., node hash value, path index) corresponding to the RevealNode set is added to the first preset verifiable expression to form a verification structure containing zero-knowledge proof capabilities. For example, in the constructed pre-defined verifiable expression, in addition to the zero-knowledge processing result of updating the verification factor (such as the encrypted value of "A7F3 fingerprint feature prefix"), a Merkel path proof of the flawed node set is also attached, so that the verifier can verify the existence of a specific verification factor by checking the consistency between the path hash value and the root hash value, without having to obtain other undisclosed verification factors.

[0049] Through the above process, dynamic integration and selective disclosure of verification factors are achieved, which not only protects user privacy (disclosing only necessary verification factors) but also ensures the integrity and immutability of verification credentials through the Merkle tree structure. For example, in cross-domain identity authentication scenarios, users can only disclose the flawed nodes of facial features and IMEI number to prove the binding relationship between their device and identity without exposing other sensitive verification factors.

[0050] In a preferred embodiment, configuring flawed nodes in the updated Merkle tree according to the first selected update verification factor up to the Qth selected update verification factor to obtain a flawed node set includes: setting initial flawed nodes based on the first selected update verification factor up to the Qth selected update verification factor; with the root node hash generation of the updated Merkle tree as the target, enumerating flawed node combinations based on the initial flawed nodes and the updated Merkle tree, and configuring multiple flawed node combinations; extracting the combination with the minimum number of nodes among the multiple flawed node combinations and setting it as the flawed node set.

[0051] Specifically, during the generation of the flawed node set, for the updated Merkle tree structure, a minimum path configuration is implemented based on the selected update verification factor to optimize the information disclosure efficiency during the verification process.

[0052] First, based on the first selected update verification factor to the Qth selected update verification factor, determine the leaf node positions of the verification factors to be disclosed in the updated Merkle tree, and use these positions to set the initial leak nodes. For example, if the first selected update verification factor is a "fingerprint feature prefix," and it is located in the first leaf node of the left subtree in the updated Merkle tree, then this node is marked as the initial leak node. If the Qth selected update verification factor is an "IMEI number prefix," and it is located in the second leaf node of the right subtree, then this node is also marked as the initial leak node.

[0053] Subsequently, with the goal of updating the root node hash generation of the Merkle tree, based on the initial flawed node, flawed node combinations are enumerated in conjunction with updating the Merkle tree structure. The enumeration process is implemented using a backtracking algorithm. Specifically, starting from the initial flawed node, the path is traced upwards to the root node, enumerating all possible intermediate node combinations to form multiple flawed node combinations. For example, if the initial flawed node is a fingerprint feature leaf node, and its path includes a parent node (generated by hashing the fingerprint feature with another verification factor) and a grandparent node (generated by hashing the parent node with another subtree node), then possible flawed node combinations include "fingerprint feature leaf node + parent node", "fingerprint feature leaf node + grandparent node", and "fingerprint feature leaf node + parent node + grandparent node", etc. The combination with the smallest number of nodes among the enumerated multiple flawed node combinations is further extracted as the flawed node set. The criterion for determining the combination with the smallest number of nodes is: under the premise of ensuring that verification can be performed by backtracking through the hash path to the root node, the combination with the fewest nodes is selected to reduce the amount of information disclosed during the verification process. For example, in the above enumerated combinations of flawed nodes, if the combination of "fingerprint feature leaf node + parent node" can be traced back to the root node through the hash path, and its number of nodes is less than that of the combination of "fingerprint feature leaf node + parent node + grandparent node", then the former is selected as the set of flawed nodes.

[0054] Through the above process, the configuration of the set of flawed nodes is minimized, which not only ensures the integrity and verifiability of the verification credentials, but also improves the level of user privacy protection by reducing the amount of information disclosed. For example, in cross-institutional identity verification scenarios, users only need to disclose the minimum set of flawed nodes corresponding to fingerprint features and IMEI numbers to complete the verification of identity binding relationship, without exposing other verification factors or intermediate node information.

[0055] The trusted data permission matching and access method for digital clones provided in this embodiment of the invention has at least the following technical effects:

[0056] 1. By mining frequent attribute combinations based on historical verification records, high-frequency verification factor attribute combinations are automatically extracted. A dynamic perturbation code generation and outlier analysis mechanism is introduced to enable verification factors to have adaptive encryption capabilities before zero-knowledge processing. For example, when adding a new biometric verification factor, high-frequency attribute combinations (such as fingerprint + IMEI number) are selected by analyzing historical verification records, and outlier perturbation codes that differ significantly from historical perturbation codes are generated. Zero-knowledge proof technology is used as a prefix for the verification factor, ensuring its verifiability while preventing reverse engineering through the dynamic perturbation mechanism, significantly improving privacy protection.

[0057] 2. By updating the leak node configuration based on the Merkle tree, a disclosure path with the minimum number of nodes is automatically generated for verification needs. For example, when verifying the relationship between a user's identity and device binding, starting from the initial leak node (such as a fingerprint feature leaf node), an enumeration algorithm is used to backtrack to the root node, filtering out the minimum leak node combination that contains only the fingerprint feature leaf node and its parent node, rather than the complete path. This reduces the amount of information disclosed while ensuring the integrity of the verification, effectively reducing the risk of privacy leakage.

[0058] 3. By dynamically updating verifiable credentials and constructing preset verifiable representations, cross-institutional integration of multi-source verification factors and precise permission matching are achieved. For example, when a user obtains new verification factors (such as facial features or behavioral pattern data) from different issuers, these factors are integrated with existing verification factors into an updated Merkle tree, and preset verifiable representations are generated based on the user-selected verification factor attribute combinations. During the verification phase, only the set of corresponding flawed nodes is disclosed according to the verifier's needs, rather than the complete credentials. This improves verification efficiency while supporting cross-domain identity authentication and ensures that verifiers only obtain necessary verification information, achieving dual protection of permissions and privacy.

[0059] Example 2:

[0060] like Figure 2As shown, based on the same inventive concept as the trusted data permission matching and access method for a digital clone provided in Embodiment 1, this embodiment of the invention also provides a trusted data permission matching and access system for a digital clone, the system comprising:

[0061] The identity registration module 11 is used to register a DID digital identity through a blockchain, wherein the DID digital identity includes a verifiable credential, and the verifiable credential includes an initial verification factor.

[0062] The attribute mining module 12 is used to receive several new verification factors from several certificate issuers, and based on the verification factor attribute set of the several new verification factors and the initial verification factors, perform frequent attribute combination mining based on historical verification records to obtain multiple frequent verification factor attribute combinations.

[0063] The attribute selection module 13 is used to send the multiple frequent verification factor attribute combinations to the user terminal for selection, and then obtain multiple selected verification factor attribute combinations.

[0064] A new combination module 14 is added, which is used to combine the several newly added verification factors and the initial verification factors based on the multiple selected verification factor attribute combinations to construct multiple preset verifiable expressions.

[0065] The authentication module 15 is used to retrieve the corresponding preset verifiable expression from the plurality of preset verifiable expressions and send it to the verifier for trusted authentication when the verifier's required verification attribute coincides with any one of the plurality of selected verification factor attribute combinations.

[0066] Furthermore, the attribute mining module 12 is also used to perform the following steps:

[0067] Based on the historical verification records, the set of verification factor attributes is traversed to count the proportion of trigger records, thereby obtaining a set of verification factor attribute frequency coefficients. Based on the set of verification factor attribute frequency coefficients, a set of verification factor frequent attributes with a frequency coefficient greater than or equal to a single frequency coefficient threshold is selected from the set of verification factor attribute sets. Based on the historical verification records, frequent attribute combination mining is performed on the set of verification factor frequent attributes to obtain multiple frequent verification factor attribute combinations.

[0068] Furthermore, the attribute mining module 12 is also used to perform the following steps:

[0069] The set of frequent attributes of the verification factor is enumerated and combined with k items to obtain multiple frequent attribute combinations of the verification factor; based on the historical verification records, the multiple frequent attribute combinations of the verification factor are traversed to perform a percentage of trigger record counts to obtain the frequency coefficients of the multiple frequent attribute combinations of the k items; based on the frequency coefficients of the multiple frequent attribute combinations of the k items, a set of frequent attribute combinations of the k items is selected from the multiple frequent attribute combinations of the verification factor whose frequency coefficients are greater than or equal to the threshold of the k item frequency coefficient, where the initial value of k is 2, k is an integer, N≥k≥2, and N represents the number of attributes in the set of frequent attribute combinations of the verification factor, and the threshold of a single frequent coefficient is < the threshold of the k item frequent coefficient is < the threshold of the k-1 item frequent coefficient; the set of frequent attribute combinations of the k items is added to the multiple frequent attribute combinations of the verification factor, and if k<N, k is incremented by one, and the frequent attribute combination mining continues; if k=N, the multiple frequent attribute combinations of the verification factor are output.

[0070] Furthermore, the newly added combination module 14 is also used to perform the following steps:

[0071] Extract the first selected verification factor attributes of the first selected verification factor attribute combination up to the Qth selected verification factor attribute from the plurality of selected verification factor attribute combinations; randomly generate a candidate perturbation code set for the first selected verification factor attribute; retrieve the historical configuration perturbation code set of the first selected verification factor attribute from the on-chain database; perform outlier analysis on the candidate perturbation code set based on the historical configuration perturbation code set to obtain an outlier factor set; perform maximum value sorting on the candidate perturbation code set based on the outlier factor set to obtain a target perturbation code; perform zero-knowledge processing on the first selected verification factor of the first selected verification factor attribute according to the target perturbation code to obtain a first selected updated verification factor; until the Qth selected updated verification factor is obtained; construct a first preset verifiable expression based on the first selected updated verification factor up to the Qth selected updated verification factor, and add it to the plurality of preset verifiable expressions.

[0072] Furthermore, the newly added combination module 14 is also used to perform the following steps:

[0073] Extract the first candidate perturbation code from the candidate perturbation code set; add the first candidate perturbation code to the historical configuration perturbation code set to obtain the historical configuration update perturbation code set; perform pairwise Hamming distance calculation on the historical configuration update perturbation code set to obtain multiple perturbation code Hamming distances; based on the multiple perturbation code Hamming distances, perform LOF outlier analysis on the first candidate perturbation code to obtain the first outlier factor, and add it to the outlier factor set.

[0074] Furthermore, the newly added combination module 14 is also used to perform the following steps:

[0075] Whenever several new verification factors are received from several certificate issuers, the verifiable credential is updated to obtain an updated Merkle tree; based on the first selected updated verification factor up to the Qth selected updated verification factor, the updated Merkle tree is configured with flawed nodes to obtain a set of flawed nodes; the node information corresponding to the set of flawed nodes is added to the first preset verifiable representation.

[0076] Furthermore, the newly added combination module 14 is also used to perform the following steps:

[0077] Initial flaw nodes are set based on the first selected update verification factor up to the Qth selected update verification factor; with the root node hash generation of the updated Merkle tree as the target, flaw node combination enumeration is performed based on the initial flaw nodes and combined with the updated Merkle tree to configure multiple flaw node combinations; the combination with the minimum number of nodes among the multiple flaw node combinations is extracted and set as the flaw node set.

[0078] Through the foregoing detailed description of a trusted data permission matching and access method for a digital clone, those skilled in the art can clearly understand the trusted data permission matching and access system for a digital clone in this embodiment. As the system disclosed in the embodiment corresponds to the method disclosed in the embodiment, the description is relatively simple, and relevant parts can be referred to the method section description.

[0079] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for trusted data permission matching and access for digital clones, characterized in that, include: Registering a DID digital identity via blockchain, wherein the DID digital identity includes verifiable credentials, and the verifiable credentials include an initial verification factor; Whenever a number of new verification factors are received from a number of certificate issuers, based on the verification factor attribute set of the new verification factors and the initial verification factors, and based on historical verification records, frequent attribute combination mining is performed to obtain multiple frequent verification factor attribute combinations. After the multiple combinations of frequently verified factor attributes are sent to the user terminal for selection, multiple selected combinations of verified factor attributes are obtained. Based on the combination of the selected verification factor attributes, the newly added verification factors and the initial verification factors are combined to construct multiple preset verifiable expressions; When the verifier's required verification attribute coincides with any one of the multiple selected verification factor attribute combinations, the corresponding preset verifiable expression is retrieved from the multiple preset verifiable expressions and sent to the verifier for trusted identity verification. Specifically, based on the multiple selected verification factor attribute combinations, the several newly added verification factors and the initial verification factors are combined to construct multiple preset verifiable expressions, including: Extract the first selected verification factor attribute of the first selected verification factor attribute combination of the plurality of selected verification factor attribute combinations up to the Qth selected verification factor attribute; Randomly generate a set of candidate perturbation codes for the first selected verification factor attribute; Retrieve the historical configuration perturbation code set of the first selected verification factor attribute from the on-chain database; Based on the historical configuration perturbation code set, outlier analysis is performed on the candidate perturbation code set to obtain the outlier factor set. Based on the set of outliers, the set of candidate perturbation codes is sorted by maximum value to obtain the target perturbation code; Based on the target perturbation code, zero-knowledge processing is performed on the first selected verification factor of the first selected verification factor attribute to obtain the first selected updated verification factor. Until the Qth selected update validation factor is obtained; Based on the first selected update verification factor up to the Qth selected update verification factor, a first preset verifiable expression is constructed and added to the plurality of preset verifiable expressions.

2. The trusted data permission matching and access method for a digital clone as described in claim 1, characterized in that, Whenever several new verification factors are received from several certificate issuers, based on the verification factor attribute set of the new verification factors and the initial verification factors, and based on historical verification records, frequent attribute combination mining is performed to obtain multiple frequent verification factor attribute combinations, including: Based on the historical verification records, the set of verification factor attributes is traversed to perform a percentage of trigger records, and a set of frequency coefficients for verification factor attributes is obtained. Based on the set of frequency coefficients of the verification factor attributes, a set of frequent verification factor attributes whose frequency coefficients are greater than or equal to the threshold of a single frequency coefficient is selected from the set of verification factor attributes. Based on the historical verification records, frequent attribute combination mining is performed on the frequent attribute set of the verification factors to obtain multiple frequent verification factor attribute combinations.

3. The trusted data permission matching and access method for a digital clone as described in claim 2, characterized in that, Based on the historical verification records, frequent attribute combination mining is performed on the frequent attribute set of the verification factors to obtain multiple frequent verification factor attribute combinations, including: The set of frequent attributes of the verification factor is enumerated and combined with k items to obtain multiple combinations of k frequent attributes of the verification factor. Based on the historical verification records, the frequency coefficient of multiple k-item frequent attribute combinations of verification factors is obtained by traversing the multiple verification factors and performing a percentage of trigger records. Based on the frequency coefficients of the multiple k-item frequent attribute combinations, a set of k-item frequent attribute combinations with frequency coefficients greater than or equal to the k-item frequent coefficient threshold is selected from the multiple verification factor k-item frequent attribute combinations. The initial value of k is equal to 2, k is an integer, N≥k≥2, N represents the number of attributes in the verification factor frequent attribute set, and the single frequent coefficient threshold < the k-item frequent coefficient threshold < the k-1 frequent coefficient threshold. The set of frequent combinations of the k attributes is added to the multiple frequent verification factor attribute combinations. If k < N, k is incremented by one, and the frequent attribute combination mining continues. If k = N, the multiple frequent verification factor attribute combinations are output.

4. The trusted data permission matching and access method for a digital clone as described in claim 1, characterized in that, Based on the historical configuration perturbation code set, outlier analysis is performed on the candidate perturbation code set to obtain a set of outlier factors, including: Extract the first candidate perturbation code from the candidate perturbation code set; Add the first candidate perturbation code to the historical configuration perturbation code set to obtain the historical configuration update perturbation code set; The pairwise Hamming distances are calculated on the set of historical configuration update perturbation codes to obtain multiple perturbation code Hamming distances; Based on the Hamming distance of the multiple perturbation codes, LOF outlier analysis is performed on the first candidate perturbation code to obtain the first outlier factor, which is then added to the outlier factor set.

5. The trusted data permission matching and access method for a digital clone as described in claim 1, characterized in that, Based on the first selected update verification factor up to the Qth selected update verification factor, a first preset verifiable expression is constructed and added to the plurality of preset verifiable expressions, including: Whenever several new verification factors are received from several certificate issuers, the verifiable certificate is updated to obtain the updated Merkle tree; Based on the first selected update verification factor up to the Qth selected update verification factor, the updated Merkle tree is configured with flawed nodes to obtain a set of flawed nodes; Add the node information corresponding to the set of flawed nodes into the first preset verifiable expression.

6. The trusted data permission matching and access method for a digital clone as described in claim 5, characterized in that, Based on the first selected update verification factor up to the Qth selected update verification factor, the updated Merkle tree is configured with flawed nodes to obtain a set of flawed nodes, including: Initial flaw nodes are set based on the first selected update verification factor up to the Qth selected update verification factor; With the goal of generating the root node hash of the updated Merkle tree, based on the initial flawed node, and combined with the updated Merkle tree, flawed node combination enumeration is performed to configure multiple flawed node combinations. Extract the combination with the minimum number of nodes from the multiple combinations of flawed nodes, and set it as the flawed node set.

7. A trusted data permission matching and access system for digital clones, characterized in that, The system is used to implement the trusted data permission matching and access method for a digital clone according to any one of claims 1-6, the system comprising: An identity registration module is used to register a DID digital identity via a blockchain, wherein the DID digital identity includes a verifiable credential, and the verifiable credential includes an initial verification factor; The attribute mining module is used to perform frequent attribute combination mining based on historical verification records whenever several new verification factors are received from several certificate issuers, based on the verification factor attribute set of the several new verification factors and the initial verification factors. The attribute selection module is used to send the multiple combinations of frequently verified factor attributes to the user terminal for selection, and then obtain multiple selected combinations of verified factor attributes. A new combination module is added, which is used to combine the several new verification factors and the initial verification factors based on the combination of the multiple selected verification factor attributes to construct multiple preset verifiable expressions; The authentication module is used to retrieve the corresponding preset verifiable expression from the plurality of preset verifiable expressions and send it to the verifier for trusted authentication when the verifier's required verification attribute coincides with any one of the multiple selected verification factor attribute combinations.

Images