Cross-trust-domain multi-source data authentication method and device, terminal equipment and storage medium

Abstract

The invention discloses a cross-trust-domain multi-source data authentication method and device, terminal equipment and a storage medium, and belongs to the field of data authentication. The method comprises the following steps: converting source data of a data generation node in a trust domain to be authenticated into a triple semantic model; calculating node credibility according to the triple semantic model, the source data type, the source data generation time, a preset attenuation factor, historical authentication times and historical response time; based on the temporary trust anchor nodes whose node trust degrees are greater than a preset trust degree threshold value, performing time-space consistency verification and data topology verification on the triple semantic model according to the topological structure data; under the condition that the verification is passed, generating a dynamic authentication token according to the dynamic confidence coefficient and the validity period calculated by the attenuation factor and the data generation time interval, and then performing to-be-authenticated trust domain data authentication; the validity period is determined according to the minimum attenuation factor and preset safety buffer time. According to the invention, the problem of low security of data authentication in the prior art can be solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data authentication, and in particular to a multi-source data authentication method and device across trust domains, a terminal device and a storage medium. BACKGROUND

[0002] In the digital era, data circulation and interaction are increasingly frequent, and business scenarios across trust domains are emerging, such as cross-department data sharing and collaborative office in government systems, which need to integrate multi-source data such as identity, social security payment and relief information of multiple departments such as household registration, social security and civil affairs to complete business handling and identity authentication. In the cross-border payment scenario in the financial field, multi-source data such as transaction parties' bank account information, transaction time, transaction location and risk assessment data need to be integrated to ensure transaction safety and compliance.

[0003] However, current multi-source data authentication across trust domains cannot accurately identify conflicting and counterfeit data. On the one hand, multi-source data comes from different trust subjects, and there are differences in data format and verification rules, which increases the difficulty of data consistency verification and makes it difficult to accurately identify conflicting data caused by incompatible data formats or transmission errors. On the other hand, with the upgrading of data counterfeiting technology, existing authentication technologies based on a single key or simple hash verification cannot distinguish counterfeit data, and it is difficult to meet the security needs of cross-trust domain businesses in cross-domain scenarios. SUMMARY

[0004] The embodiments of the present application provide a multi-source data authentication method and device across trust domains, a terminal device and a storage medium, which can effectively solve the problem of low security of cross-trust domain data authentication caused by the inability of existing technologies to accurately identify conflicting and counterfeit data.

[0005] An embodiment of the present application provides a multi-source data authentication method across trust domains, comprising:

[0006] Obtaining source data, source data type, source data generation time, historical authentication times and historical response time of data generation nodes in at least two trust domains to be authenticated, and topology structure data of the trust domains to be authenticated;

[0007] Converting the source data into a plurality of triple semantic models according to a preset data framework;

[0008] Calculating node trust degree according to the triple semantic model, the source data type, the source data generation time, a preset decay factor, the historical authentication times and the historical response time of the corresponding data generation node;

[0009] Taking the data generation node with a node trust degree greater than a preset trust degree threshold as a temporary trust anchor node;

[0010] Based on the temporary trust anchor node, the spatio-temporal consistency of the triple semantic model of each to-be-authenticated trust domain is verified according to the topology data, and data topology verification is performed;

[0011] In the case that the spatio-temporal consistency verification and the data topology verification are passed, the dynamic confidence of the triple semantic model is calculated according to the decay factor corresponding to the source data type and the data generation time interval;

[0012] According to the dynamic confidence and the validity period, a dynamic authentication token is generated, and the to-be-authenticated trust domain data authentication is performed according to the dynamic authentication token; wherein the validity period of the dynamic authentication token is determined according to the minimum decay factor in the source data and the preset security buffer time.

[0013] Further, the preset data framework is a resource description framework model;

[0014] The source data is converted into a plurality of triple semantic models according to the preset data framework, including:

[0015] It is judged whether the source data is structured data or not;

[0016] In the case that the source data is structured data, the core entity in the source data is taken as the subject, the data field is taken as the attribute, and the field value is taken as the value, and the triple semantic model is generated according to the mapping rule of the subject, the attribute and the value;

[0017] In the case that the source data is not structured data, the character entity, the time entity and the numerical value entity in the source data are identified according to the preset Transformer model, and the character entity and the time entity are taken as the candidate subject of the triple, and the numerical value entity is taken as the candidate value;

[0018] The logical association between the entities is identified according to the Transformer model, and is taken as the candidate attribute of the triple;

[0019] It is judged whether the logical association between the entities or the entities is missing in the source data; if yes, the candidate entity or the candidate attribute is completed according to the business rules of the to-be-authenticated trust domain, and the triple semantic model is generated according to the candidate value, the completed candidate entity and the candidate attribute;

[0020] If not, the triple semantic model is generated according to the candidate subject, the candidate attribute and the candidate value.

[0021] Further, the node trust degree is calculated according to the triple semantic model, the source data type, the source data generation time, the preset decay factor, the historical authentication times and the historical response time of the corresponding data generation node, including:

[0022] According to the number of correct authentications in the historical authentication times and the total number of historical authentication times, a correct authentication rate is calculated; according to the historical response time and a preset standard response time, a response compliance rate is calculated;

[0023] According to the correct authentication rate and the response compliance rate, a weighted calculation is performed to obtain a historical behavior score;

[0024] According to the source data generation time, a data generation time interval is determined, and according to the data generation time interval and a preset decay factor corresponding to the source data type, a data timeliness score is calculated;

[0025] According to the completion record of the triple semantic model, a deviation coefficient is determined;

[0026] According to the historical behavior score, the data timeliness score and the deviation coefficient, a weighted calculation is performed to obtain a node trust degree.

[0027] Further, the spatio-temporal consistency verification includes:

[0028] From the triple semantic model of each trust domain to be authenticated, a triple semantic model containing a time attribute and a location attribute is extracted as a target triple; wherein the value corresponding to the time attribute is the data record time, and the value corresponding to the location attribute is the physical location or network address of the data generation node;

[0029] Based on the topology structure data of the trust domain to be authenticated, the device type of the data generation node to which the target triple belongs is determined, and a maximum reasonable moving speed and a time tolerance threshold value are preset according to the device type;

[0030] The time attributes of at least two target triples associated with the same subject are selected to be subtracted to obtain a time difference; the location attributes are selected to be subtracted to obtain a location change amount; and the maximum reasonable location change amount is obtained by multiplying the maximum reasonable moving speed and the time difference;

[0031] In the case where the time difference is greater than or equal to the time tolerance threshold value, it is judged whether the location change amount is less than or equal to the maximum reasonable location change amount; if yes, it is determined that the triple semantic model passes the spatio-temporal consistency verification; if not, it is determined that the triple semantic model does not pass the spatio-temporal consistency verification;

[0032] In the case where the time difference is less than the time tolerance threshold value, an error compensation value is calculated according to the maximum reasonable moving speed and an error coefficient, and it is judged whether the location change amount is less than or equal to the sum of the maximum reasonable location change amount and the error compensation value; if yes, it is determined that the triple semantic model passes the spatio-temporal consistency verification; if not, it is determined that the triple semantic model does not pass the spatio-temporal consistency verification.

[0033] Further, the data topology verification includes:

[0034] Based on the topological structure data of the trust domains to be authenticated, a rule base for association between the trust domains to be authenticated is constructed; wherein, the rule base for association includes the association types and attribute constraints of data from different trust domains.

[0035] Based on the topology data, the semantic model of the triples of each trust domain to be authenticated is mapped to nodes of a graph structure; where each graph structure node includes the subject, attribute and value information of the triple;

[0036] Based on the topological data, the logical associations of the triple semantic model are mapped to the edges of the graph structure;

[0037] Traverse the graph structure to determine the number of isolated nodes without associated edges and the percentage of isolated nodes.

[0038] The association rule base is used to check whether the attribute information of the nodes corresponding to each edge of the graph structure conforms to the attribute constraints of the association rule base; if it conforms, the corresponding edge is marked as an edge without attribute conflict; if it does not conform, the corresponding edge is marked as an edge with attribute conflict.

[0039] If the proportion of isolated nodes is not greater than the preset topology threshold and no attribute conflict edges are detected, the triple semantic model is determined to pass the data topology verification.

[0040] Furthermore, based on the decay factor corresponding to the source data type and the data generation time interval, the dynamic confidence of the triple semantic model is calculated, including:

[0041] The initial confidence level is set based on the completion record of the triple semantic model;

[0042] The dynamic confidence of the triplet semantic model is calculated based on the initial confidence level, the decay factor corresponding to the source data type, and the data generation time interval.

[0043] Furthermore, the dynamic authentication token also includes data path information; the data path information includes: source data generation node identifier, triple transformation node identifier, temporary trust anchor node identifier, and verification execution node identifier;

[0044] Among them, the verification execution node is a subordinate node associated with the temporary trust anchor node, or is the same node as the temporary trust anchor node.

[0045] As an improvement to the above solution, another embodiment of the present invention provides a multi-source data authentication device across trust domains, comprising:

[0046] The Trust Domain Data Acquisition Module is used to acquire the source data, source data type, source data generation time, historical authentication count, and historical response time of the data generation nodes in at least two trust domains to be authenticated, as well as the topology data of the trust domains to be authenticated.

[0047] The triplet conversion module is used to convert source data into several triplet semantic models according to a preset data framework.

[0048] The node trust calculation module is used to calculate the node trust based on the triple semantic model, source data type, source data generation time, preset decay factor, historical authentication count of the corresponding data generation node, and historical response time.

[0049] The temporary trust anchor node determination module is used to generate nodes based on data whose node trust level is greater than a preset trust threshold, and use them as temporary trust anchor nodes.

[0050] The node verification module is used to perform spatiotemporal consistency verification and data topology verification on the triple semantic model of each trust domain to be authenticated based on temporary trust anchor nodes and topology data.

[0051] The dynamic confidence calculation module is used to calculate the dynamic confidence of the triple semantic model based on the decay factor corresponding to the source data type and the data generation time interval, provided that both the spatiotemporal consistency verification and the data topology verification have passed.

[0052] The cross-domain data authentication module is used to generate a dynamic authentication token based on the dynamic confidence level and validity period, and to authenticate the trusted domain data to be authenticated based on the dynamic authentication token; wherein, the validity period of the dynamic authentication token is determined based on the minimum decay factor in the source data and the preset security buffer time.

[0053] Another embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements a cross-trust domain multi-source data authentication method as described in the above embodiments.

[0054] Another embodiment of the present invention provides a computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform a multi-source data authentication method across trust domains as described in the above embodiment.

[0055] By implementing this invention, at least the following beneficial effects are achieved:

[0056] This invention provides a method, apparatus, terminal device, and storage medium for cross-trust domain multi-source data authentication. The method can convert source data into several triple semantic models according to a preset data framework, unifying heterogeneous source data from different trust domains into a standardized semantic model and eliminating verification obstacles caused by format differences. Then, based on temporary trust anchor nodes, spatiotemporal consistency verification and data topology verification are performed on the triple semantic models according to the topology data. Based on the unified triple semantic model, data can be verified from the two dimensions of spatiotemporal rationality and topological logic, accurately identifying conflicting data caused by format incompatibility or transmission errors, and reducing the difficulty of consistency verification. Trusted nodes are selected by calculating node trust scores. These scores are calculated based on historical authentication performance, source data generation time, and decay factors. This reduces the likelihood of forged data entering the authentication process from the outset, based on historical performance and data timeliness. Next, the credibility of triples is evaluated by calculating dynamic confidence scores. Because forged data often fails to match the timeliness decay pattern of genuine data, it is assigned low confidence scores and cannot participate in token generation. Finally, a dynamic authentication token with an expiration date is generated. Forged tokens fail authentication either due to mismatched expiration dates or insufficient confidence scores, thus meeting cross-domain business security requirements. Therefore, this method can identify forged data while excluding conflicting data, improving the security of cross-trust domain data authentication. Attached Figure Description

[0057] Figure 1 This is a flowchart illustrating a multi-source data authentication method across trust domains provided in an embodiment of the present invention;

[0058] Figure 2 This is a schematic diagram of the structure of a multi-source data authentication device across trust domains provided in an embodiment of the present invention. Detailed Implementation

[0059] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] See Figure 1 To address the problem of low security in cross-trust domain data authentication due to the difficulty in accurately identifying conflicting and forged data in existing technologies, an embodiment of the present invention provides a flowchart of a multi-source data authentication method across trust domains, comprising:

[0061] S1. Obtain the source data, source data type, source data generation time, historical authentication count, and historical response time of the data generation nodes in at least two trust domains to be authenticated, as well as the topology data of the trust domains to be authenticated.

[0062] Specifically, the trust domain to be authenticated refers to the scope of subjects that are independent of each other and have different data management rules and trust systems. For example, in a government affairs scenario, the trust domain of the household registration department (managing identity data) and the trust domain of the social security department (managing payment data) have different data formats and verification standards. Data generation nodes refer to the hardware or software units that directly generate source data, such as the ID card database server of the household registration department and the payment record collection terminal of the social security department.

[0063] In a preferred embodiment of the present invention, data is collected from at least two trusted domains through a cross-domain data interaction interface, such as a government intranet API interface. The source data of the data generation nodes includes, for example, ID card text and social security payment records; the topology data refers to the network structure of the trusted domains, such as the connection nodes between the household registration domain and the social security domain, and the data transmission path.

[0064] S2. Based on the preset data framework, convert the source data into several triplet semantic models;

[0065] Specifically, the triple semantic model represents the transformation of source data into a semantic carrier in a unified format of <subject, attribute, value>.

[0066] Preferably, the preset data framework is a resource description framework model;

[0067] Based on a pre-defined data framework, the source data is transformed into several triple semantic models, including:

[0068] Determine whether the source data is structured data;

[0069] When the source data is structured data, the core entities in the source data are taken as subjects, data fields are taken as attributes, and field values ​​are taken as values. A triple semantic model is generated according to the mapping rules of subjects, attributes and values.

[0070] When the source data is not structured, the system identifies the person entity, time entity, and numerical entity in the source data according to the preset Transformer model, and uses the person entity and time entity as candidate subjects of triples, and the numerical entity as candidate values.

[0071] Based on the Transformer model, logical relationships between entities are identified as candidate attributes for triples;

[0072] Determine whether there are missing entities or logical relationships between entities in the source data; if so, complete the candidate entities or candidate attributes according to the business rules of the trust domain to be authenticated, and generate a triple semantic model based on the candidate values, the completed candidate entities and candidate attributes.

[0073] If not, then generate a triple semantic model based on the candidate subject, candidate attribute, and candidate value.

[0074] Specifically, the Resource Description Framework (RDF) is an internationally recognized semantic data model standard. Its core uses <Subject, Predicate, Object> triples to express data relationships, adapting to the unified description of heterogeneous data across domains. Structured data represents well-organized data with fixed formats and fields, such as Excel spreadsheets and database tables, for example, a household registration department's ID card information table containing fields for name, gender, and ID number. Unstructured data represents text, voice, and other data without fixed formats, such as social security payment records, like "Zhang San paid 500 yuan in social security in Area A in May 2024." The Transformer model represents a deep learning model based on a self-attention mechanism, such as the Transformer-based BERT model, which excels at semantic understanding and entity relationship recognition, accurately extracting core entities from text, such as names, times, and logical connections, such as the relationship between Zhang San and the 500 yuan payment. Business rules represent industry standards based on trust domains. Data is supplemented based on business rules, that is, missing data items are added. For example, in government scenarios, if the social security payment record does not mention the time, the default record generation time is the payment time.

[0075] In a preferred embodiment of the present invention, for structured data, such as ID card information, where the name is the subject, gender is the attribute, and male / female is the value, it is directly mapped to an RDF triple structure of <subject, attribute, value>, for example, <Zhang San, gender, male>. For unstructured evidence, taking social security payment records as an example, natural language processing techniques, such as using a Transformer-based BERT model, are used to perform entity recognition and relation extraction on the payment record text: First, named entity recognition (NER) is used to extract core entities such as "Zhang San" (person entity), which is prioritized as the subject of the triple; "January 2024" (time entity); and "500 yuan" (numerical entity), which is prioritized as the value of the triple. Then, relation extraction techniques, such as dependency parsing and pre-trained model relation classification, are used. The logical association between "Zhang San" and "500 yuan" is identified as "social security payment amount in January 2024". As a triple attribute, if there are missing entities or relationships in the text, such as the payment time not being mentioned, the missing information is filled in by combining the business rules of social security payment records and generation time in government scenarios. For example, the record generation time is taken as the payment time, and then the missing items of the triple are filled in to form the RDF triple <Zhang San, social security payment amount in January 2024, 500 yuan>. All evidence is converted into a unified semantic model, namely the triple semantic model.

[0076] The semantic model of the triples formed in step S1 serves as the evidentiary basis for electing temporary trust anchor nodes in step S2. On one hand, the evidence source information contained in the triples, such as <Zhang San, source of social security payment records, social security department server node>, clearly identifies the corresponding generating node, such as the social security department server node. These generating nodes will serve as candidate nodes for trust calculation in the local trust network. On the other hand, the semantic completeness of the triples, such as the presence of supplementary information and the accuracy of entity relationships, indirectly affects the data timeliness and deviation coefficient calculation of the corresponding node. For example, if a node frequently generates triples with semantic supplementation, it indicates insufficient evidence completeness, potentially reducing its node trust level and ultimately providing data support for the accurate calculation of node trust in step S2.

[0077] By pre-setting a data framework and detailing the specific process of converting structured and unstructured source data into triples, structured data is directly mapped, while unstructured data uses the Transformer model to identify entities and relationships. After completion using business rules, triples are generated, achieving standardization of heterogeneous data. This solves the problem of cross-domain data format incompatibility because RDF triples serve as a unified semantic carrier, eliminating format differences between household registration structured data and social security unstructured data. Compared to traditional algorithms, the Transformer model can more accurately identify entities and relationships, reducing semantic errors in triples. Business rules complete missing information, preventing subsequent validation failures due to incomplete data.

[0078] S3. Calculate the node trust level based on the triple semantic model, source data type, source data generation time, preset decay factor, historical authentication count of the corresponding data generation node, and historical response time.

[0079] Specifically, node trust is a quantitative indicator that measures the credibility of data-generating nodes. The value range is usually [0,1]. It is calculated by taking into account factors such as the node's historical performance and data timeliness. The higher the value, the more trustworthy the node.

[0080] Preferably, the node trust level is calculated based on the triple semantic model, source data type, source data generation time, preset decay factor, historical authentication count of the corresponding data generation node, and historical response time, including:

[0081] The correct authentication rate is calculated based on the number of correct authentications in the historical authentication count and the total number of historical authentications; the response compliance rate is calculated based on the historical response time and the preset standard response time.

[0082] The historical behavior score is obtained by weighting the correct authentication rate and the response compliance rate.

[0083] The data generation time interval is determined based on the source data generation time, and the data timeliness score is calculated based on the source data generation time interval and the preset decay factor corresponding to the source data type.

[0084] Determine the bias coefficient based on the completion record of the triple semantic model;

[0085] The node trust level is calculated by weighting historical behavior scores, data timeliness scores, and deviation coefficients.

[0086] Specifically, the correct authentication rate represents the proportion of correct authentications in the historical authentication history of the data generation node out of the total number of historical authentications, reflecting the accuracy of the node's historical data. The formula is: Correct Authentication Rate = Number of Correct Authentications / Total Number of Historical Authentications. The response compliance rate represents the proportion of times the node's historical response time meets the preset standard out of the total number of historical authentications, reflecting the node's operational stability. The formula is: Response Compliance Rate = (Number of Response Time ≤ Standard Response Time) / Total Number of Historical Authentications. The historical behavior score represents a comprehensive score based on the node's historical authentication accuracy and response stability, with weights prioritized for accuracy: 0.6 for the correct authentication rate and 0.4 for the response compliance rate. The data timeliness score reflects the reliability of the source data over time, calculated based on an exponential decay model. The formula is: Data Timeliness Score = e^(-λ×t), where λ = decay factor corresponding to the source data type, and t = data generation time interval. The deviation coefficient represents the correction coefficient based on triplet completion records. The more completion items, the worse the data integrity, and the smaller the coefficient: no completion = 1, 1 completion item = 0.9, 2 or more completion items = 0.8. The source data generation time can be accurately obtained through the system clock.

[0087] Specifically, the source data types include biometric data, such as fingerprint data. Based on its strong uniqueness, high difficulty in tampering, and high information stability, an attenuation factor is set: First, the effective lifespan of this type of biometric evidence in historical authentication is statistically analyzed. For example, in government identity authentication, fingerprint information has no tampering records within 6 months and a matching success rate ≥98%. Considering the probability of biometric aging / damage, such as the probability of fingerprint recognition deviation due to wear <0.5%, an initial attenuation factor of 0.1 is set. If the source data type is device log evidence, such as server login logs, an initial attenuation factor is set based on its susceptibility to tampering, high information timeliness, and dependence on device operating status: The effective window period of this type of device log evidence in historical authentication is statistically analyzed. For example, server login logs have no tampering records within 24 hours and an associated authentication success rate ≥90%. After 72 hours, the associated authentication success rate drops below 60%. Considering the probability of device logs being tampered with, such as the probability of ordinary server logs being illegally modified ≈3%, an initial attenuation factor of 0.03 is set.

[0088] Specifically, the types of data generation nodes are categorized based on the evidence flow and processing stages, including the following: Evidence nodes: These nodes directly generate heterogeneous data sources. For example, in government scenarios, the household registration department's ID card information database node generates structured ID card evidence; the social security department's payment record server node generates unstructured social security payment evidence; in IoT scenarios, temperature sensor nodes generate device log evidence; and facial recognition terminal nodes generate biometric evidence. Data conversion nodes: For example, in government systems, cross-domain data conversion server nodes are responsible for converting heterogeneous evidence from household registration and social security departments into RDF triples; and in financial scenarios, transaction evidence parsing nodes convert unstructured transaction notes for cross-border payments into a unified semantic model.

[0089] In a preferred embodiment of the present invention, a social security data generation node has a total of 100 historical authentication attempts, with 95 correct authentications, a standard response time of 1 second, and 90 successful responses. The calculated correct authentication rate is 95 / 100 = 0.95; the calculated successful response rate is 90 / 100 = 0.9; and the historical behavior score is 0.95 × 0.6 + 0.9 × 0.4 = 0.57 + 0.36 = 0.93. The source data type is device logs, with a decay factor λ = 0.03. The source data generation time is 2024-05-20 14:00, the current time is 14:10, and t = 10 minutes. The data timeliness score is e^(-0.03 × 10) = e^(-0.3) ≈ 0.741. The triplet generated by this node is social security payment data, with only the payment time information supplemented, and a deviation coefficient of 0.9. If we set the weight of historical behavior score to 0.5, the weight of data timeliness score to 0.3, and the weight of deviation coefficient to 0.2, then the node trust level = 0.93×0.5 + 0.741×0.3 + 0.9×0.2 = 0.465 + 0.2223 + 0.18 ≈ 0.867.

[0090] First, historical behavior scores are calculated using historical authentication data. Then, a data timeliness score is calculated based on the timeliness of the source data. A deviation coefficient is determined by referring to triplet completion records. Finally, a weighted average is used to obtain the node trust score, achieving a quantitative assessment of the credibility of the data-generating nodes. This addresses the issue of subjective node trust assessment by using multi-dimensional quantitative calculations based on historical behavior, timeliness, and completeness, avoiding reliance solely on experience to judge node trustworthiness. Trustworthy nodes are precisely selected as temporary trust anchor nodes to ensure the reliability of subsequent verification processes. The timeliness score changes over time, avoiding the use of data from expired or untrustworthy nodes.

[0091] S4. Generate nodes from data whose node trust level is greater than the preset trust threshold, and use them as temporary trust anchor nodes;

[0092] Specifically, temporary trust anchor nodes refer to highly trusted nodes selected from data generation nodes. Their node trust level exceeds a preset trust level threshold. As the initiating and leading entity of the verification process in cross-domain authentication, they ensure the reliability of the verification results.

[0093] In a preferred embodiment of the present invention, a preset trust threshold is set, such as 0.8 in a government affairs scenario, and nodes with a trust level greater than the trust threshold are selected as temporary trust anchor nodes. For example, a database node in the household registration department has a trust level of 0.85, and a terminal node in the social security department has a trust level of 0.78; only the household registration node is selected as the temporary trust anchor node.

[0094] S5. Based on temporary trust anchor nodes, perform spatiotemporal consistency verification and data topology verification on the semantic model of triples of each trust domain to be authenticated according to the topology data.

[0095] Specifically, spatiotemporal consistency verification refers to the process of judging whether data conforms to physical spatiotemporal laws based on the time and location attributes of the data, such as whether the location change of the same device exceeds a reasonable range within a short period of time. Data topology verification refers to the process of abstracting data into a graph structure and verifying the rationality of the association between data by detecting isolated nodes and logically conflicting edges in the graph.

[0096] Preferably, spatiotemporal consistency verification includes:

[0097] From the semantic models of triples in each trust domain to be authenticated, extract the semantic models of triples containing time attributes and location attributes as target triples; where the value of the time attribute corresponds to the data recording time, and the value of the location attribute corresponds to the physical location or network address of the data generating node.

[0098] Based on the topology data of the trust domain to be authenticated, determine the device type of the data generation node to which the target triple belongs, and preset the maximum reasonable moving speed and time tolerance threshold according to the device type.

[0099] The time difference is obtained by subtracting the time attributes of at least two target triples associated with the same subject; the position change is obtained by subtracting the position attributes; and the maximum reasonable position change is obtained by multiplying the maximum reasonable movement speed by the time difference.

[0100] If the time difference is greater than or equal to the time tolerance threshold, determine whether the position change is less than or equal to the maximum reasonable position change; if yes, the triple semantic model is determined to pass the spatiotemporal consistency verification; if no, the triple semantic model is determined to fail the spatiotemporal consistency verification.

[0101] If the time difference is less than the time tolerance threshold, the error compensation value is calculated based on the maximum reasonable moving speed and the error coefficient. It is then determined whether the position change is less than or equal to the sum of the maximum reasonable position change and the error compensation value. If so, the triplet semantic model is determined to have passed the spatiotemporal consistency verification. If not, the triplet semantic model is determined to have failed the spatiotemporal consistency verification.

[0102] Specifically, the target triple represents a triple selected from all triples that includes time attributes, such as data recording time, and location attributes, such as node physical coordinates and IP address. It is the object of spatiotemporal consistency verification, for example, <Sensor A, location 2024-05-20 14:00, 30°N>. The maximum reasonable movement speed represents the preset speed limit based on the data generation node device type, reflecting the device's physical movement capability, such as fixed server = 0 m / s, mobile government terminal ≤ 5 m / s, sensor node ≤ 1 m / s. The time tolerance threshold represents the reasonable range of allowed data time differences, avoiding misjudgment of minor device positional errors as conflicts within a short period, such as a fixed device tolerance threshold of 30 seconds. The error coefficient represents the positional error compensation coefficient, set according to the device type: 0.05 for fixed devices and 0.1 for mobile devices, used to correct device measurement errors. The maximum reasonable positional change represents the maximum distance the device can move within the time difference, calculated as: Maximum reasonable positional change = Maximum reasonable movement speed × Time difference.

[0103] In a preferred embodiment of the present invention, triplets containing both time and location attributes are selected from the triplets in the IoT trust domain. For example, triplet 1: <Sensor A, location at 14:00 on 2024-05-20, 30°00′N>; triplet 2: <Sensor A, location at 14:01 on 2024-05-20, 30°01′N>. Based on the topology data of the trust domain, sensor A is determined to be a mobile sensor, with a preset maximum reasonable moving speed of 1 m / s, a time tolerance threshold of 60 s, and an error coefficient of 0.1. The time difference Δt = 14:01 - 14:00 = 60 s; the position change S: the straight-line distance between 30°01′N and 30°00′N is approximately 1852 m (1 minute of latitude ≈ 1852 m); the maximum reasonable position change S_max = 1 m / s × 60 s = 60 m. Since Δt = 60s (≥ time tolerance threshold 60s), we determine whether S ≤ S_max: 1852m > 60m. Therefore, the triplet 1 and 2 fail the spatiotemporal consistency verification, indicating that the position change of sensor A within a short time exceeds the reasonable range, which may be due to data errors or forgery. If Δt = 5s (< 60s): error compensation value = 1m / s × 0.1 = 0.1m; judgment standard = S_max + error compensation value = 5m + 0.1m = 5.1m; if S = 5m ≤ 5.1m, then the verification passes.

[0104] To address the difficulty in identifying spatiotemporal conflict data, this system uses quantitative analysis of speed, time, and distance to accurately identify abnormal data of the same device moving across cities in a short period of time. Parameters are set according to device type to avoid misjudgment caused by using the same standard for fixed and mobile devices. Error compensation is introduced under short time differences to prevent device measurement errors from being misjudged as conflicts.

[0105] Preferably, data topology verification includes:

[0106] Based on the topological structure data of the trust domains to be authenticated, a rule base for association between the trust domains to be authenticated is constructed; wherein, the rule base for association includes the association types and attribute constraints of data from different trust domains.

[0107] Based on the topology data, the semantic model of the triples of each trust domain to be authenticated is mapped to nodes of a graph structure; where each graph structure node includes the subject, attribute and value information of the triple;

[0108] Based on the topological data, the logical associations of the triple semantic model are mapped to the edges of the graph structure;

[0109] Traverse the graph structure to determine the number of isolated nodes without associated edges and the percentage of isolated nodes.

[0110] The association rule base is used to check whether the attribute information of the nodes corresponding to each edge of the graph structure conforms to the attribute constraints of the association rule base; if it conforms, the corresponding edge is marked as an edge without attribute conflict; if it does not conform, the corresponding edge is marked as an edge with attribute conflict.

[0111] If the proportion of isolated nodes is not greater than the preset topology threshold and no attribute conflict edges are detected, the triple semantic model is determined to pass the data topology verification.

[0112] Specifically, the association rule base represents a set of rules built based on the business logic of the trust domain. It includes data association types, such as associating identity data and social security data through ID card numbers, and attribute constraints, such as the requirement that an employee's social security participation age be ≥18 years old, which serves as the basis for judging the rationality of data association. The graph structure represents a topological structure mapping triples to nodes and edges. A node represents a single triple, such as <Zhang San, age, 18 years old>, and an edge represents the logical association between triples, such as the association between age and participation type. An isolated node represents a node in the graph structure without any associated edges, indicating that the triple has no logical association with other data. For example, an isolated "Li Si, payment amount, 300 yuan, no identity data association" may be invalid or forged data. An attribute conflict edge represents an edge where the attribute values ​​of two associated nodes violate the constraints of the association rule base. For example, the association edge between <Zhang San, age, 16 years old> and <Zhang San, participation type, employee social security> violates the attribute constraint of age ≥18 years old. The preset topology threshold represents the upper limit of the allowed proportion of isolated nodes. It is set according to the number of trusted domains. For example, when the number of domains is ≥3, the threshold is ≤20%, and when the number of domains is <3, the threshold is ≤10%, so as to avoid a small number of isolated nodes affecting the overall verification results.

[0113] In a schematic scenario of cross-border payment transaction verification, each transaction-related piece of evidence is abstracted as a node, such as the transaction initiator's information, transaction amount, and transaction time. The logical relationships between transaction evidence are abstracted as edges, such as the relationship between the transaction initiator and the transaction amount. Graph neural network techniques, such as the GraphSAGE algorithm, are used to detect contradictory subgraphs where the proportion of isolated nodes exceeds a threshold θ or where there are conflicting edges. The determination of conflicting attributes is based on the business rules or logical constraints corresponding to the evidence-related edge: First, clarify the core attributes of the evidence-related edge. For example, the "amount-time" edge between node B "$100,000" and node C "2024-05-21 14:30" has the core attributes of "transaction amount threshold" and "transaction time window". Then, call the preset rule library of the corresponding scenario, such as the rule "no cross-border transfers exceeding $50,000 after 17:00" in the cross-border payment scenario. If the attributes of the related edge contradict the preset rules, such as "$100,000" exceeding the "$50,000 threshold", and "14:30" is "before 17:00", but the subsequent supplementary rule "no transfers exceeding $80,000 after 15:00 on non-working days", and 2024-05-21 is a Saturday, "14:30" exceeds the constraint of "before 15:00", then the related edge is determined to be a conflicting attribute edge. For example, in a government affairs scenario, the "age-insurance type" association edge between "insured person's age (node ​​D: 16 years old)" and "insurance type (node ​​E: employee social security)" is an attribute conflict edge because the preset rule "the age for employee social security participation must be ≥18 years old" is 16 years old, which conflicts with the rule.

[0114] In a preferred embodiment of the present invention, in a cross-domain government affairs scenario, the rule base includes: Association type: Household registration data and social security payment data are associated through ID card numbers; Attribute constraints: Employee social security participation age ≥ 18 years old, social security payment amount ≥ minimum payment standard. The triples <Zhang San, ID card number, 110XXXX>, <Zhang San, age, 19 years old>, <Zhang San, participation type, employee social security>, and <Zhang San, 2024-05 payment amount, 500 yuan> are mapped to nodes 1, 2, 3, and 4 respectively; Node 1 and Node 2 (associated with the same subject Zhang San), Node 1 and 3 (associated with ID card number and participation type), and Node 3 and 4 (associated with participation type and payment amount) are mapped to edges 1, 2, and 3 respectively. Total number of nodes = 4, number of isolated nodes = 0 (all nodes are associated with edges); percentage of isolated nodes = 0 / 4 = 0%. Edge 2 (nodes 1-3) was checked and found to have no attribute constraint conflicts; Edge 3 (nodes 3-4) was checked: the insurance type is employee social security, the payment amount is 500 yuan ≥ 300 yuan (benchmark), and there are no conflicts; there are no attribute conflict edges. The proportion of isolated nodes is 0% ≤ preset topology threshold 10% (number of domains = 2), and there are no attribute conflict edges, therefore all triple semantic models are determined to pass the data topology verification.

[0115] By using graph structures and rule bases, logical errors such as contradictions between age and insurance type can be accurately identified, solving the problem of difficulty in identifying data logical relationship conflicts; the association rule base can be adjusted according to the scenario (such as government affairs and finance), and has strong versatility; the control of the proportion of isolated nodes prevents irrelevant invalid data from entering subsequent processes.

[0116] S6. If both the spatiotemporal consistency verification and the data topology verification are passed, calculate the dynamic confidence of the triplet semantic model based on the decay factor corresponding to the source data type and the data generation time interval.

[0117] Specifically, dynamic confidence represents the credibility index of triples that decays over time, reflecting the combined state of data timeliness and initial credibility. If the value is below a threshold, the data is unusable.

[0118] Preferably, the dynamic confidence of the triple semantic model is calculated based on the decay factor corresponding to the source data type and the data generation time interval, including:

[0119] The initial confidence level is set based on the completion record of the triple semantic model;

[0120] The dynamic confidence of the triplet semantic model is calculated based on the initial confidence level, the decay factor corresponding to the source data type, and the data generation time interval.

[0121] Specifically, the initial confidence level represents the initial confidence level set based on the triplet completion record, reflecting the completeness of the data at the time of generation. Data without completion has the highest initial confidence level; for example, no completion = 0.95, one completion = 0.9, and two or more completions = 0.85. The dynamic confidence level represents the triplet confidence level that decays over time, combining the initial confidence level and data timeliness. The formula is: Dynamic Confidence Level = Initial Confidence Level × e^(-λ × t), where λ = source data type decay factor, and t = data generation time interval. A value ≥ 0.7 is considered reliable.

[0122] In a preferred embodiment of the present invention, the triple to be calculated is <Wang Wu, 2024-05 social security payment amount, 400 yuan>; this triple is converted from unstructured text, only the payment time information is supplemented; the initial confidence level = 0.9. The source data type is social security text data, with a corresponding decay factor λ = 0.04, the source data generation time is 2024-05-20 12:00, the current time is 12:20, t = 20 minutes; the dynamic confidence level = 0.9 × e^(-0.04 × 20) = 0.9 × e^(-0.8) ≈ 0.9 × 0.449 ≈ 0.404; 0.404 < the preset confidence lower limit of 0.7, so it is marked as low confidence evidence and will not participate in subsequent token generation.

[0123] Through a dual mechanism of spatiotemporal consistency verification and data topology verification, qualified source data without spatiotemporal conflicts or logical contradictions is screened out. Only data that passes verification is included in the dynamic confidence calculation; conflicting / contradictory evidence that fails verification is excluded and does not participate in the confidence calculation. Secondly, the verification results assign an initial confidence basis to qualified data. For example, in cross-border payment scenarios, user fingerprint data and payment server log data that pass dual verification will obtain an initial confidence level based on their conflict-free performance during the verification process. For example, the initial confidence level for fingerprint evidence is set to 0.95, and the initial confidence level for server log evidence is set to 0.9. Finally, the confidence decay model dynamically adjusts the decay rate according to the type of evidence, based on the qualified data type that has passed verification and the initial confidence level. For example, for biometric evidence λ... A =0.1, Device log evidence λ B =0.03. Combining the time interval from the data generation time to the present, the dynamic confidence level of each qualified data is calculated. For example, the dynamic confidence level of fingerprint evidence = 0.95×e^(-0.1t), and the dynamic confidence level of server log evidence = 0.9×e^(-0.03t). Finally, confidence level data is provided to support the generation of dynamic authentication tokens.

[0124] Dynamic confidence decays over time, preventing old data from still being considered highly reliable; specific numerical values ​​intuitively reflect the data's reliability, facilitating subsequent token generation and filtering; different types of data have different decay factors, making the assessment more accurate.

[0125] S7. Generate a dynamic authentication token based on the dynamic confidence level and validity period, and authenticate the data of the trust domain to be authenticated based on the dynamic authentication token; wherein, the validity period of the dynamic authentication token is determined based on the minimum decay factor in the source data and the preset security buffer time.

[0126] Specifically, the dynamic authentication token is an authentication credential containing data credibility, validity period, and traceability information. It is used to verify data legitimacy in cross-domain transactions, and its validity period is dynamically adjusted based on data decay characteristics. The validity period of the dynamic authentication token is set to min(1 / λ). i )+t0, where λ i The minimum decay factor for evidence used in authentication is t0, which is a preset security buffer time that can be set to 30 minutes according to security requirements. A dynamic authentication token is generated, which carries the data path (recording the entire process nodes from evidence acquisition to authentication), dynamic confidence level and validity period, and is used for subsequent identity authentication, decision-making or transaction verification and other operations.

[0127] Specifically, the dynamic authentication token also includes data path information; the data path information includes: source data generation node identifier, triplet transformation node identifier, temporary trust anchor node identifier, and verification execution node identifier;

[0128] Among them, the verification execution node is a subordinate node associated with the temporary trust anchor node, or is the same node as the temporary trust anchor node.

[0129] Preferably, the data path information records traceability information of the entire process of triple generation and authentication, including the unique IDs of the source data generation node, triple transformation node, temporary trust anchor node, and verification execution node, such as server IP and terminal number, facilitating subsequent auditing and problem localization. The verification execution node represents the node that specifically performs spatiotemporal consistency verification and data topology verification. It has two forms: one is a subordinate node of the temporary trust anchor node, such as a verification server under the temporary trust anchor node; the other is the temporary trust anchor node itself, as it also has verification functionality. After receiving a token for cross-domain business, if there is doubt about the data source, the data path information can be used to trace back, querying the original source data record from the generation node and the transformation log from the transformation node to confirm the data's legality.

[0130] In a preferred embodiment of the present invention, in the cross-domain business of social security enrollment verification, the recipient verifies the validity period and dynamic confidence level of the dynamic authentication token; if the verification meets the standards, the data legality is recognized. Structured data of Zhang San's ID card is obtained from the household registration domain (i.e., the data generation node is the ID card database server), generated on 2024-05-20 14:00, with 100 historical authentications, 98 correct, and an average response time of 0.5 seconds. Unstructured payment records of Zhang San are obtained from the social security domain (i.e., the data generation node is the payment terminal), generated on 2024-05-20 14:05, with 80 historical authentications, 75 correct, and an average response time of 0.6 seconds. Simultaneously, the topological structure data of both domains is obtained. The household registration domain data is converted into a triple semantic model <Zhang San, ID number, 110XXXX>; the social security data is converted into a triple semantic model <Zhang San, May 2024 payment amount, 500 yuan>. The household registration node achieved a correct authentication rate of 98% and a response compliance rate of 100%. Historical behavior score = 0.98 × 0.5 + 1 × 0.3 = 0.79; data timeliness score (t = 5 minutes, λ = 0.05) = e^(-0.05 × 5) = 0.778; no-completion bias coefficient = 1; total trust level = 0.79 × 0.5 + 0.778 × 0.3 + 1 × 0.2 ≈ 0.82 (> threshold 0.8, selected as anchor node). Then, dual verification was performed: spatiotemporal verification: a 5-minute time difference between the two data points, a physical distance of 10km between the household registration and social security nodes, a fixed server (movement speed 0), and a location change of 0 ≤ 0 (passed); topological verification: both ternary pairs consisted of "Zhang San," with edges representing "identity-payment association," and no isolated nodes or conflicts (passed). Initial confidence level 0.95, t = 5 minutes, λ = 0.05, dynamic confidence level = 0.95 × e^(-0.05 × 5) ≈ 0.74. The validity period of the generated token = 0.05 × 60 + 30 = 33 minutes. The token contains a confidence level of 0.74 and a validity period. After verifying the token, the social security department recognizes Zhang San's identity and payment data, completing the enrollment review.

[0131] By using an evidence description framework, structured and unstructured heterogeneous evidence is transformed into a unified semantic model, which is compatible with multiple types of data such as ID card information and social security payment records. It is applicable to various scenarios, including cross-departmental authentication in government systems, collaboration of IoT devices, and verification of cross-border payment transactions. This greatly improves the system's ability to process evidence with different trust domains and data structures, reduces authentication barriers caused by data heterogeneity, and enhances the versatility and scalability of the solution.

[0132] This invention dynamically elects temporary trust anchor nodes and calculates node trust levels by combining timeliness and inter-domain deviation factors. It abandons the traditional model that relies on fixed certificates or centralized certification authorities. Simultaneously, it dynamically adjusts the trust decay rate according to the source data type, generating dynamic authentication tokens with expiration dates. This allows the authentication process to adapt to changes in evidence and the dynamic adjustment of the trust environment in real time, effectively resisting security threats such as Sybil attacks and significantly improving the security and reliability of authentication. Through a dual verification mechanism of spatiotemporal consistency verification and data topology verification, the former can effectively detect spatiotemporal conflicts between evidence, such as contradictions in IoT device location information, while the latter uses graph neural network technology to identify contradictory subgraphs in the evidence association graph, such as logical contradictions in cross-border payment transaction evidence. Compared to traditional simple majority voting verification methods, it can more accurately identify forged evidence chains and conflicting evidence, improving the accuracy of evidence authentication, reducing misjudgments and false positives, and ensuring the credibility of authentication results.

[0133] By implementing this embodiment, source data is converted into several triple semantic models according to a preset data framework, unifying heterogeneous source data from different trust domains into a standardized semantic model and eliminating verification obstacles caused by format differences. Then, based on temporary trust anchor nodes, spatiotemporal consistency verification and data topology verification are performed on the triple semantic models according to the topology data. Based on a unified triple semantic model, data can be verified from both spatiotemporal rationality and topological logic dimensions, accurately identifying conflicting data caused by format incompatibility or transmission errors, reducing the difficulty of consistency verification. Trusted nodes are selected by calculating node trust scores. The node trust score is calculated by combining historical authentication performance, source data generation time, and decay factor. Based on historical performance and data timeliness, the possibility of forged data entering the authentication process can be reduced from the source. Then, the credibility of triples is evaluated by calculating dynamic confidence scores. Because forged data often cannot match the timeliness decay law of real data, it will be assigned low confidence scores and cannot participate in token generation. Finally, a dynamic authentication token with an expiration date is generated. Forged tokens either fail authentication due to mismatched expiration dates or insufficient confidence scores, thus meeting the security requirements of cross-domain business. Therefore, the ability to identify forged data while excluding conflicting data improves the security of cross-trust domain data authentication.

[0134] See Figure 2 This is a schematic diagram of the structure of a multi-source data authentication device across trust domains provided in an embodiment of the present invention, comprising:

[0135] The Trust Domain Data Acquisition Module is used to acquire the source data, source data type, source data generation time, historical authentication count, and historical response time of the data generation nodes in at least two trust domains to be authenticated, as well as the topology data of the trust domains to be authenticated.

[0136] The triplet conversion module is used to convert source data into several triplet semantic models according to a preset data framework.

[0137] The node trust calculation module is used to calculate the node trust based on the triple semantic model, source data type, source data generation time, preset decay factor, historical authentication count of the corresponding data generation node, and historical response time.

[0138] The temporary trust anchor node determination module is used to generate nodes based on data whose node trust level is greater than a preset trust threshold, and use them as temporary trust anchor nodes.

[0139] The node verification module is used to perform spatiotemporal consistency verification and data topology verification on the triple semantic model of each trust domain to be authenticated based on temporary trust anchor nodes and topology data.

[0140] The dynamic confidence calculation module is used to calculate the dynamic confidence of the triple semantic model based on the decay factor corresponding to the source data type and the data generation time interval, provided that both the spatiotemporal consistency verification and the data topology verification have passed.

[0141] The cross-domain data authentication module is used to generate a dynamic authentication token based on the dynamic confidence level and validity period, and to authenticate the trusted domain data to be authenticated based on the dynamic authentication token; wherein, the validity period of the dynamic authentication token is determined based on the minimum decay factor in the source data and the preset security buffer time.

[0142] This invention provides a multi-source data authentication device across trust domains. The device comprises: a trust domain data acquisition module, which acquires source data, source data type, source data generation time, historical authentication counts, and historical response times of data generation nodes in at least two trust domains to be authenticated, as well as the topological structure data of the trust domains; a triple conversion module, which converts the source data into several triple semantic models according to a preset data framework; a node trust calculation module, which calculates the node trust based on the triple semantic model, source data type, source data generation time, a preset decay factor, the historical authentication counts of the corresponding data generation node, and historical response times; and a temporary trust anchor node determination module, which identifies data with a node trust greater than a preset trust threshold. The system uses nodes as temporary trust anchor nodes. In the node verification module, based on the temporary trust anchor nodes, it performs spatiotemporal consistency verification and data topology verification on the triple semantic models of each trust domain to be authenticated according to the topology data. According to the dynamic confidence calculation module, if both the spatiotemporal consistency verification and data topology verification pass, it calculates the dynamic confidence of the triple semantic model according to the decay factor corresponding to the source data type and the data generation time interval. Finally, in the cross-domain data authentication module, it generates a dynamic authentication token based on the dynamic confidence and validity period, and uses the dynamic authentication token to authenticate the data of the trust domain to be authenticated. The validity period of the dynamic authentication token is determined according to the minimum decay factor in the source data and the preset security buffer time. Based on a pre-defined data framework, source data is converted into several triple semantic models, unifying heterogeneous source data from different trust domains into a standardized semantic model, eliminating verification obstacles caused by format differences. Then, based on temporary trust anchor nodes, spatiotemporal consistency verification and data topology verification are performed on the triple semantic models according to the topology data. This allows for data verification from both spatiotemporal rationality and topological logic dimensions, accurately identifying conflicting data caused by format incompatibility or transmission errors, and reducing the difficulty of consistency verification. Trusted nodes are selected by calculating node trust scores. Node trust scores are calculated by combining historical authentication performance, source data generation time, and decay factors. Based on historical performance and data timeliness, the possibility of forged data entering the authentication process can be reduced from the source. Then, the credibility of triples is evaluated by calculating dynamic confidence scores. Because forged data often fails to match the timeliness decay pattern of real data, it will be assigned low confidence scores and cannot participate in token generation. Finally, a dynamic authentication token with an expiration date is generated. Forged tokens either fail authentication due to mismatched expiration dates or insufficient confidence scores, meeting the security requirements of cross-domain business. Therefore, the ability to identify forged data while excluding conflicting data improves the security of cross-trust domain data authentication.

[0143] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0144] Those skilled in the art will understand that, for convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0145] Another embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements a multi-source data authentication method across trust domains as described in the above embodiments. The terminal device may be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. The terminal device may include, but is not limited to, a processor and a memory.

[0146] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting various parts of the terminal device via various interfaces and lines.

[0147] The memory can be used to store the computer program. The processor implements various functions of the terminal device by running or executing the computer program stored in the memory and calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function, etc.; the data storage area may store data created based on the use of the mobile phone, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0148] Another embodiment of the present invention provides a computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform a multi-source data authentication method across trust domains as described in the above embodiment.

[0149] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When executed by a processor, the computer program can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0150] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for multi-source data authentication across trust domains, characterized in that, include: Obtain the source data, source data type, source data generation time, historical authentication count, and historical response time of the data generation nodes in at least two trust domains to be authenticated, as well as the topology data of the trust domains to be authenticated; Based on the preset data framework, the source data is converted into several triple semantic models; The node trust level is calculated based on the triple semantic model, source data type, source data generation time, preset decay factor, historical authentication count of the corresponding data generation node, and historical response time. Data with a trust level greater than a preset trust threshold will generate a node and serve as a temporary trust anchor node. Based on temporary trust anchor nodes, spatiotemporal consistency verification and data topology verification are performed on the semantic models of triples of each trust domain to be authenticated according to the topology data. If both the spatiotemporal consistency verification and the data topology verification are passed, the dynamic confidence of the triple semantic model is calculated based on the decay factor corresponding to the source data type and the data generation time interval. A dynamic authentication token is generated based on the dynamic confidence level and validity period, and the data of the trust domain to be authenticated is authenticated based on the dynamic authentication token; wherein, the validity period of the dynamic authentication token is determined based on the minimum decay factor in the source data and the preset security buffer time.

2. The method for cross-trust domain multi-source data authentication as described in claim 1, characterized in that, The default data framework is the resource description framework model; Based on a pre-defined data framework, the source data is transformed into several triple semantic models, including: Determine whether the source data is structured data; When the source data is structured data, the core entities in the source data are taken as subjects, data fields are taken as attributes, and field values ​​are taken as values. A triple semantic model is generated according to the mapping rules of subjects, attributes and values. When the source data is not structured, the system identifies the person entity, time entity, and numerical entity in the source data according to the preset Transformer model, and uses the person entity and time entity as candidate subjects of triples, and the numerical entity as candidate values. Based on the Transformer model, logical relationships between entities are identified as candidate attributes for triples; Determine whether there are missing entities or logical relationships between entities in the source data; if so, complete the candidate entities or candidate attributes according to the business rules of the trust domain to be authenticated, and generate a triple semantic model based on the candidate values, the completed candidate entities and candidate attributes. If not, then generate a triple semantic model based on the candidate subject, candidate attribute, and candidate value.

3. The method for cross-trust domain multi-source data authentication as described in claim 2, characterized in that, Based on the triple semantic model, source data type, source data generation time, preset decay factor, historical authentication count of the corresponding data generation node, and historical response time, the node trust level is calculated, including: The correct authentication rate is calculated based on the number of correct authentications in the historical authentication count and the total number of historical authentications; the response compliance rate is calculated based on the historical response time and the preset standard response time. The historical behavior score is obtained by weighting the correct authentication rate and the response compliance rate. The data generation time interval is determined based on the source data generation time, and the data timeliness score is calculated based on the source data generation time interval and the preset decay factor corresponding to the source data type. Determine the bias coefficient based on the completion record of the triple semantic model; The node trust level is obtained by weighting historical behavior scores, data timeliness scores, and deviation coefficients.

4. The method for cross-trust domain multi-source data authentication as described in claim 3, characterized in that, Spatiotemporal consistency verification includes: From the semantic models of triples in each trust domain to be authenticated, extract the semantic models of triples containing time attributes and location attributes as target triples; where the value of the time attribute corresponds to the data recording time, and the value of the location attribute corresponds to the physical location or network address of the data generating node. Based on the topology data of the trust domain to be authenticated, determine the device type of the data generation node to which the target triple belongs, and preset the maximum reasonable moving speed and time tolerance threshold according to the device type. The time difference is obtained by subtracting the time attributes of at least two target triples associated with the same subject; the position change is obtained by subtracting the position attributes; and the maximum reasonable position change is obtained by multiplying the maximum reasonable movement speed by the time difference. If the time difference is greater than or equal to the time tolerance threshold, determine whether the position change is less than or equal to the maximum reasonable position change; if yes, the triple semantic model is determined to pass the spatiotemporal consistency verification; if no, the triple semantic model is determined to fail the spatiotemporal consistency verification. If the time difference is less than the time tolerance threshold, the error compensation value is calculated based on the maximum reasonable moving speed and the error coefficient. It is then determined whether the position change is less than or equal to the sum of the maximum reasonable position change and the error compensation value. If so, the triplet semantic model is determined to have passed the spatiotemporal consistency verification. If not, the triplet semantic model is determined to have failed the spatiotemporal consistency verification.

5. The method for cross-trust domain multi-source data authentication as described in claim 4, characterized in that, Data topology verification includes: Based on the topological structure data of the trust domains to be authenticated, a rule base for association between the trust domains to be authenticated is constructed; wherein, the rule base for association includes the association types and attribute constraints of data from different trust domains. Based on the topology data, the semantic model of the triples of each trust domain to be authenticated is mapped to nodes of a graph structure; where each graph structure node includes the subject, attribute and value information of the triple; Based on the topological data, the logical associations of the triple semantic model are mapped to the edges of the graph structure; Traverse the graph structure to determine the number of isolated nodes without associated edges and the percentage of isolated nodes. The association rule base is used to check whether the attribute information of the nodes corresponding to each edge of the graph structure conforms to the attribute constraints of the association rule base; if it conforms, the corresponding edge is marked as an edge without attribute conflict; if it does not conform, the corresponding edge is marked as an edge with attribute conflict. If the proportion of isolated nodes is not greater than the preset topology threshold and no attribute conflict edges are detected, the triple semantic model is determined to pass the data topology verification.

6. The method for cross-trust domain multi-source data authentication as described in claim 5, characterized in that, Based on the decay factor corresponding to the source data type and the data generation time interval, the dynamic confidence of the triple semantic model is calculated, including: The initial confidence level is set based on the completion record of the triple semantic model; The dynamic confidence of the triplet semantic model is calculated based on the initial confidence level, the decay factor corresponding to the source data type, and the data generation time interval.

7. The method for cross-trust domain multi-source data authentication as described in claim 6, characterized in that, The dynamic authentication token also includes data path information; the data path information includes: source data generation node identifier, triplet transformation node identifier, temporary trust anchor node identifier, and verification execution node identifier; Among them, the verification execution node is a subordinate node associated with the temporary trust anchor node, or is the same node as the temporary trust anchor node.

8. A multi-source data authentication device across trust domains, characterized in that, include: The Trust Domain Data Acquisition Module is used to acquire the source data, source data type, source data generation time, historical authentication count, and historical response time of the data generation nodes in at least two trust domains to be authenticated, as well as the topology data of the trust domains to be authenticated. The triplet conversion module is used to convert source data into several triplet semantic models according to a preset data framework. The node trust calculation module is used to calculate the node trust based on the triple semantic model, source data type, source data generation time, preset decay factor, historical authentication count of the corresponding data generation node, and historical response time. The temporary trust anchor node determination module is used to generate nodes based on data whose node trust level is greater than a preset trust threshold, and use them as temporary trust anchor nodes. The node verification module is used to perform spatiotemporal consistency verification and data topology verification on the triple semantic model of each trust domain to be authenticated based on temporary trust anchor nodes and topology data. The dynamic confidence calculation module is used to calculate the dynamic confidence of the triple semantic model based on the decay factor corresponding to the source data type and the data generation time interval, provided that both the spatiotemporal consistency verification and the data topology verification have passed. The cross-domain data authentication module is used to generate a dynamic authentication token based on the dynamic confidence level and validity period, and to authenticate the trusted domain data to be authenticated based on the dynamic authentication token; wherein, the validity period of the dynamic authentication token is determined based on the minimum decay factor in the source data and the preset security buffer time.

9. A terminal device, characterized in that, The system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements a multi-source data authentication method across trust domains as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform a multi-source data authentication method across trust domains as described in any one of claims 1 to 7.

Images