Distributed data use control method and system based on DID and verifiable certificate

Abstract

The invention discloses a distributed data use control method and system based on a DID and a verifiable credential, a storage medium and an electronic device, and the method comprises the steps: carrying out the identity verification of a data user based on a DID, carrying out the authentication of the identity through a verifiable credential issued by an authority, and carrying out the verification of the identity through the verifiable credential; the privacy information range is controlled by adopting a selective disclosure mechanism; generating data authorization information based on the verifiable certificate, establishing an encrypted point-to-point data transmission channel in combination with the DID identifiers of the authorizer and the authorized person, and executing encrypted transmission and encrypted storage of data; and verifying the identity of a data user based on a DID signature mechanism, carrying out tamper-proof verification on a use strategy in the authorization certificate, and carrying out compliance judgment on an authorization range, strategy content and a decryption condition. According to the method provided by the invention, identity credibility right confirmation in a distributed environment is realized, the security and compliance of data exchange are improved, and security autonomy and verifiable control in a data use stage are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data security and distributed identity authentication, and in particular to a distributed data use control method and system based on DID and verifiable credentials, a storage medium and an electronic device. BACKGROUND

[0002] With the rapid development of big data, cloud computing and blockchain technology, data has become an important production factor driving the social economy. In view of the security and trust problems of data resources in the process of collection, circulation, sharing and use, the academic and industrial circles have proposed various access control and identity authentication mechanisms. Traditional data use control usually relies on centralized identity management and access authorization system, and realizes data right division through access control list (ACL) or role-based access control (RBAC) model. However, with the increasing demand for cross-domain data sharing, the centralized identity management system exposes problems such as privacy leakage, single point of trust and authorization non-traceability, and it is difficult to meet the requirements of identity autonomy and data verifiability in a distributed environment. In recent years, the proposal of distributed digital identity (DID) and verifiable credential (VC) technology provides a new idea for building a decentralized and verifiable data use control system.

[0003] The existing data use control system based on centralized architecture has many limitations. In the identity authentication link, it relies on centralized identity service or third-party trust agency, and user identity information needs to be stored and verified centrally. Once the central node is attacked or data is leaked, global trust will be invalid, and distributed autonomous management of identity cannot be realized. The existing data authorization mode is mostly authorized by platform-issued access tokens or policy description files. These authorization files lack verifiability and tamper-proof mechanism, the authorization chain is short and non-traceable, and it is difficult to ensure the authenticity of authorization and the consistency of policy. In the process of data transmission and use, most systems still use centralized encryption channels or platform transit mechanism, the transmission path transparency is low, the data ownership and use right boundary is not clear, and point-to-point trusted transmission and decryption control cannot be realized. The current technology lacks unified verification standard and integrity detection means for data use policy execution, and the policy often relies on application layer logic control in the use link, which has the risk of being tampered with or bypassed. Therefore, the existing technology cannot realize a security mechanism that integrates identity authentication, authorized transmission and policy verification in a distributed environment based on distributed identity DID and verifiable credentials VC, and cannot guarantee the trustworthiness and verifiability of identity authentication, authorized transmission and policy execution in the whole life cycle of data. SUMMARY

[0004] In view of the above problems, the present application is proposed.

[0005] Therefore, the present application solves the technical problems of the existing data use control technology, including poor identity management centralization, low authorization credential reliability, insufficient data transmission and policy verification mechanism, and how to implement identity authentication, data authorization transmission and use policy reliable control based on DID and verifiable credentials in a distributed environment.

[0006] To solve the above technical problems, the present application provides the following technical solutions: a distributed data use control method based on DID and verifiable credentials, including identity authentication of data users based on distributed identity DID, identity authentication based on verifiable identity credentials issued by an authoritative agency, and control of the range of private information using a selective disclosure mechanism; generation of data authorization information based on verifiable credentials, establishment of an encrypted peer-to-peer data transmission channel combining the DID identifiers of the authorized person and the authorized person, and execution of encrypted transmission and encrypted storage of data; identity authentication of data users based on the DID signature mechanism, and tamper-proof verification of the use policy in the authorization credential, and compliance judgment of the authorization range, policy content and decryption conditions.

[0007] Alternatively, in the above method embodiments of the present application, the identity authentication of data users based on distributed identity DID includes that the data user generates an identity request message through a local DID control unit, including a distributed identity identifier, a timestamp, a random challenge code and credential index information; after receiving the request, a decentralized identity resolution network is accessed to retrieve the corresponding identity document, the identity document including user public key information and signature algorithm identifier; the data owner uses the public key in the identity document to perform signature verification on the request message, compares the message content and the signature result, judges whether the timestamp is within the allowed deviation range, and when the verification result is true, enters the credential authentication and authorization generation process, otherwise the request is rejected; the data user selects to disclose part of the credential information, performs chain verification on the signature of the credential issuer, confirms the source and integrity of the credential, and marks the identity authentication as successful when the verification is passed.

[0008] Alternatively, in the above method embodiments of the present application, the identity authentication based on the verifiable identity credential issued by the authoritative agency includes that the verifiable credential includes an issuer identifier, a holder identifier, a declaration field and a digital signature field; the issuer identifier is extracted by parsing the credential header information and obtaining the issuer public key through the decentralized identity network; the signature result is verified using the issuer public key by calculating the digest value of the credential content; when the verification result is consistent and the credential is within the valid period, the credential is determined to be valid; the current credential status is determined by checking the credential revocation list, and if any of the checks fails, the request is rejected; independent verification is performed on the client and the server, and the results are compared, if the verification results of both ends are consistent, the verification passed flag is retained, if not, the process is aborted.

[0009] Optionally, in the above-mentioned method embodiments of the present application, the generating of the data authorization information based on the verifiable credential comprises: after the identity verification is passed, the data owner generates a data authorization credential according to the meta information of the target data, the meta information including data number, storage path, access time limit and usage range; the data authorization credential including authorized party identifier, authorized party identifier, authorization time and policy description; performing an abstract calculation on the authorized content and signing using the private key of the authorized party; the authorization credential is stored in the distributed credential warehouse in the form of structured data and is transmitted to the identity endpoint of the authorized party; the authorized party receives and verifies the validity of the signature using the public key of the authorized party, checks the validity period of the credential, and when the verification is successful, triggers the transmission preparation unit, and when the verification fails, terminates the process and records the log.

[0010] Optionally, in the above-mentioned method embodiments of the present application, the establishing of the encrypted point-to-point data transmission channel comprises: the data owner node reads the public key information from the identity document of the data user, and generates a random symmetric key for encrypting the data content; the data owner uses the random symmetric key to perform an encryption operation on the data, and uses the public key of the data user to encrypt the key; the encrypted data packet is transmitted to the data user through the distributed identity communication channel, and the data user receives and decrypts the key using the private key, and decrypts the data content using the key; after the transmission is completed, a confirmation message is generated, and the communication parties use their own private keys to sign the message, and the signature result is uploaded to the distributed ledger, and if it is detected that the message is repeated or the signature verification is inconsistent, a key renegotiation process is performed.

[0011] Optionally, in the above-mentioned method embodiments of the present application, the verifying of the identity of the data user based on the DID signature mechanism comprises: in the data use stage, a random challenge code is generated and sent to the data user, the data user uses the distributed identity private key to generate a digital signature of the challenge code and time information, and returns the signature result, and the signature is verified using the user public key; according to the signature verification result and the time stamp deviation, the verification state is determined, and when the verification is successful, a unique session identifier is generated and bound with the authorization credential, all use requests need to carry the unique session identifier, and if the signature is invalid or the identifier does not match, the access is terminated and the event is recorded.

[0012] Optionally, in the above-mentioned method embodiments of the present application, the anti-tampering verification of the use policy in the authorization credential comprises parsing the policy field after receiving the authorization credential, extracting the access times, validity period, encryption identifier and use description, calculating the policy digest value and comparing it with the original digest registered in the block chain, if consistent, confirming that the policy has not been modified; judging the policy logic, checking whether the current time is within the validity period and whether the use times are less than the maximum limit, if the conditions are met, calling the data decryption unit to perform decryption on the target data; if any condition is not met or the digest is inconsistent, rejecting the request and recording the event, writing the verification result and credential digest into the distributed ledger for auditing and tracing.

[0013] The present application has the following beneficial effects: The distributed data use control method based on DID and verifiable credential provided by the present application performs data user identity verification based on distributed identity DID, identity authentication based on the verifiable identity credential issued by the authority, and privacy information range control based on the selective disclosure mechanism, realizes identity trusted authentication in a distributed environment, and enhances the trust decentralization ability of the system and the anti-counterfeiting and anti-tampering ability of identity authentication; generates data authorization information based on the verifiable credential, establishes an encrypted point-to-point data transmission channel combining the DID identifiers of the authorized person and the authorized person, performs encrypted transmission and encrypted storage of data, realizes the trusted closed-loop connection from "identity authentication" to "data transmission", and makes the data keep in a safe, controllable and verifiable state in the whole life cycle; verifies the data user identity based on the DID signature mechanism, and performs anti-tampering verification on the use policy in the authorization credential, judges the compliance of the authorization range, policy content and decryption condition, realizes the safe autonomy and verifiable control in the data use stage, and ensures that the data access behavior is executed in a closed loop under the framework of trusted identity and authorization policy. Therefore, the present application realizes distributed identity trusted authentication, authorization transmission safe closed-loop control and anti-tampering verification of data use policy, solves the problems of identity authentication relying on centralization, lack of verifiable mechanism for data authorization and untraceable use policy execution in the prior art, and improves the safety, credibility and controllability of the distributed data use process.

[0014] The technical solutions of the present application will be further described in detail below by means of the accompanying drawings and embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0015] The above and other objects, features and advantages of the present application will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. The drawings provided in the specification and the contents of the specification are to provide further understanding of the embodiments of the present application, and constitute a part of the specification. The drawings are used to explain the present application together with the embodiments of the present application, and do not constitute a limitation of the present application. In the drawings, the same reference numerals generally represent the same components or steps.

[0016] Figure 1 This is a flowchart illustrating a method provided by an exemplary embodiment of the present invention.

[0017] Figure 2 This is a schematic diagram of the system provided by an exemplary embodiment of the present invention. Detailed Implementation

[0018] Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments of the present invention. It should be understood that the present invention is not limited to the exemplary embodiments described herein.

[0019] It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0020] Those skilled in the art will understand that the terms "first," "second," etc., in the embodiments of the present invention are only used to distinguish different steps, devices, or modules, and do not represent any specific technical meaning, nor do they indicate a necessary logical order between them.

[0021] It should also be understood that in the embodiments of the present invention, "multiple" can refer to two or more, and "at least one" can refer to one, two or more.

[0022] It should also be understood that any component, data or structure mentioned in the embodiments of the present invention can generally be understood as one or more unless explicitly defined or given contrary instructions in the context.

[0023] refer to Figure 1 As an embodiment of the present invention, a distributed data usage control method based on DID and verifiable credentials is provided, comprising:

[0024] Step 101: Verify data user identity based on Distributed Identifier (DID), confirm identity through verifiable identity credentials issued by an authoritative institution, and control the scope of privacy information through a selective disclosure mechanism.

[0025] Furthermore, data user authentication based on Distributed Identifier (DID) includes the following steps: The data user generates an identity request message through a local DID control unit, including a distributed identity identifier, timestamp, random challenge code, and credential index information. Upon receiving the request, the user accesses a decentralized identity resolution network to retrieve the corresponding identity document, which includes the user's public key information and signature algorithm identifier. The data owner uses the public key in the identity document to sign and verify the request message, comparing the message content with the signature result and determining if the timestamp is within the allowable deviation range. If the verification result is true, the user proceeds to the credential confirmation and authorization generation process; otherwise, the request is rejected. The data user chooses to disclose partial credential information, performs chain verification of the credential issuer's signature, confirms the source and integrity of the credential, and marks successful identity authentication upon successful verification.

[0026] It should be noted that identity verification through verifiable identity credentials issued by an authoritative institution includes: an issuer identifier, a holder identifier, a declaration field, and a digital signature field; parsing the credential header information and extracting the issuer identifier, obtaining the issuer's public key through a decentralized identity network; calculating the digest value of the credential content and verifying the signature result using the issuer's public key; if the verification results are consistent and the credential is within its validity period, the credential is deemed valid; checking the credential revocation list to determine the current credential status, if any verification fails, the request is rejected; independent verification is performed on the client and server, and the results are compared. If the verification results on both ends are consistent, the verification pass mark is retained; if they are inconsistent, the process is terminated.

[0027] It should also be noted that during the data user authentication process based on Distributed Identifier (DID), the DID control unit generates an identity request message according to a pre-defined privacy disclosure policy. The message is encapsulated in a JSON-LD structure and includes an identity identifier field, a signature algorithm identifier, a public key pointer, a timestamp, and a random challenge code. After receiving the request, the system calls the identity resolution node through a decentralized identity resolution protocol to retrieve the corresponding DID document. The parsed public key and signature algorithm type are used to verify the digital signature of the message. If the verification result is consistent with the message content and the timestamp deviation is less than a preset threshold, the system will generate an authentication token and record it in the local log. At the same time, this token will be used as the trigger condition for starting the authorization credential generation module. If the signature verification fails or the timestamp exceeds the range, the system will reject the request and return an error status code. Data users can set the scope of disclosure fields based on the privacy policy, and only disclose the credential index and minimum identity information fields when necessary, thereby achieving synchronous processing of authentication and information disclosure control.

[0028] It should also be noted that by using Distributed Identifiers (DIDs) for data user authentication and combining this with Verifiable Credentials (VCs) issued by authoritative institutions to complete identity verification and signature validity verification, a multi-layered verification mechanism is implemented to verify the authenticity of the identity, the legality of the credential, and the trustworthiness of the issuer. This mechanism does not rely on a centralized identity authentication server but utilizes a decentralized identity resolution network to perform public key verification of identity information, allowing the identity verification process to proceed independently of any third-party trusted node. By introducing timestamps and random challenge codes into the identity request message, the system can prevent replay attacks and identity forgery risks. The chained signature verification structure ensures the integrity and immutability of the credential throughout its entire lifecycle of issuance, transmission, and use. Technically, it achieves distributed autonomy and traceable verification of identity verification, fundamentally eliminating the single point of trust problem of traditional centralized authentication models. It establishes a trusted identity verification model based on the DID system, improving the system's authentication security, trustworthiness, and privacy protection capabilities in a distributed environment, and providing a trusted identity foundation for subsequent authorization and data transmission.

[0029] Step 102: Generate data authorization information based on verifiable credentials, establish an encrypted point-to-point data transmission channel by combining the DID identifiers of the authorizing and authorized parties, and perform encrypted data transmission and encrypted storage.

[0030] Furthermore, the generation of data authorization information based on verifiable credentials includes the following steps: After identity verification, the data owner generates a data authorization credential based on the metadata of the target data. The metadata includes the data number, storage path, access time limit, and scope of use. The data authorization credential includes the authorizing party identifier, the authorized party identifier, the authorization time, and a policy description. A digest is calculated on the authorized content and signed using the authorizing party's private key. The authorization credential is stored in a distributed credential repository in structured data form and transmitted to the authorized party's identity endpoint. Upon receiving the credential, the authorized party verifies the signature validity using the authorizing party's public key and checks the credential validity period. If the verification is successful, a transmission preparation unit is triggered; if the verification fails, the process is terminated and a log is recorded.

[0031] It should be noted that establishing an encrypted peer-to-peer data transmission channel includes: the data owner node reading public key information from the data user's identity document and generating a random symmetric key for encrypting the data content; the data owner using the random symmetric key to encrypt the data and encrypting the key using the data user's public key; the encrypted data packet being transmitted to the data user through a distributed identity communication channel; the data user receiving the data, decrypting the key using their private key, and then decrypting the data content using the key; after transmission, an acknowledgment message being generated; both communicating parties signing the message using their respective private keys; the signing result being uploaded to the distributed ledger; and if message duplication or signature verification mismatch is detected, a key renegotiation process is executed.

[0032] It should also be noted that a preferred scheme for generating data authorization information based on verifiable credentials specifically includes the following steps: When generating data authorization information based on verifiable credentials, after successful identity verification, the system calls the authorization generation module to construct an authorization credential object based on data metadata. This metadata includes data number, data path, access permissions, validity period, and usage limit. The system assigns a unique identifier to the authorization credential and defines the available operation types and restrictions in the policy description field. The generated authorization credential is signed by the authorizing party's private key and stored in a distributed credential repository, while simultaneously generating a credential hash index for subsequent verification. The authorization credential supports an incremental update mechanism; when the authorized content changes, the system adds extended fields to the original credential to form a new version credential and updates the hash index chain, retaining historical versions for traceability. After receiving the credential, the authorized party node uses the authorizing party's public key to verify the signature validity. Upon successful verification, the transmission preparation module is triggered to prepare for key negotiation and encrypted channel establishment.

[0033] It should also be noted that a preferred scheme for establishing an encrypted peer-to-peer data transmission channel specifically includes the following steps: When establishing an encrypted peer-to-peer data transmission channel, the data owner node calls the key management module to read the public key from the user's DID document and generate a random symmetric key for data encryption. The system uses an elliptic curve cryptography (ECC)-based key negotiation mechanism to complete the key exchange. Subsequently, the generated symmetric key is used to encrypt the data file, and the symmetric key is encrypted with the user's public key and appended to the data packet header. The data packet is sent to the user endpoint via a distributed identity communication protocol. The receiving end uses its private key to decrypt the symmetric key and completes the data decryption. After the transmission is completed, both parties generate an acknowledgment message, sign it with their respective private keys, and exchange the signature results. The system writes the acknowledgment message digest, transmission timestamp, and node identifier into the distributed ledger. If a signature mismatch or message duplication is detected during the verification phase, the system automatically triggers a key renegotiation process and regenerates a new session key. The old key then becomes invalid and is destroyed from memory.

[0034] It should also be noted that by generating data authorization information based on verifiable credentials and establishing an encrypted peer-to-peer transmission channel according to the DID identifier in the authorization credential, the system achieves strong binding control between authorization and data transmission. This step associates the authorization credential issued by the data owner with the data circulation behavior. The authorization credential contains data metadata, access time limits, and policy descriptions, and is signed with the authorizing party's private key to ensure that the certificate cannot be forged. During transmission, the system adopts a hybrid encryption mechanism: the data content is encrypted with a randomly generated symmetric key, and the key itself is encrypted with the receiver's public key, ensuring the confidentiality of the transmitted data and the security of the transmission channel. At the same time, both communicating parties generate an acknowledgment message through private key signing and write it into the distributed ledger, realizing two-way verification and traceability of the transmission behavior. This design ensures that data transmission only takes place under a valid authorization relationship, preventing unauthorized access and man-in-the-middle attacks, and realizing a closed-loop linkage of authorization credentials, identity authentication, and encrypted communication. This makes the data transmission process in a distributed environment trustworthy, traceable, and tamper-proof, improving the security and compliance of data exchange.

[0035] Step 103: Verify the identity of the data user based on the DID signature mechanism, and perform anti-tampering verification on the usage policy in the authorization certificate, and make compliance judgment on the authorization scope, policy content and decryption conditions.

[0036] Furthermore, verifying the identity of data users based on the DID signature mechanism includes the following steps: During the data usage phase, a random challenge code is generated and sent to the data user. The data user uses a distributed identity private key to generate a digital signature based on the challenge code and time information, and returns the signature result. The signature is then verified using the user's public key. The verification status is determined based on the signature verification result and the timestamp deviation. If the verification is successful, a unique session identifier is generated and bound to the authorization credential. All usage requests must carry the unique session identifier. If the signature is invalid or the identifier does not match, access is terminated and the event is recorded.

[0037] It should be noted that the tamper-proof verification of the usage policy in the authorization certificate includes: after receiving the authorization certificate, parsing the policy fields, extracting the access count, validity period, encryption identifier, and usage description, calculating the policy digest value and comparing it with the original digest registered on the blockchain. If they match, it is confirmed that the policy has not been modified; judging the policy logic, checking whether the current time is within the validity period and whether the number of uses is lower than the maximum limit. If the conditions are met, the data decryption unit is called to decrypt the target data; if any condition is not met or the digest is inconsistent, the request is rejected and the event is recorded. The verification result and the certificate digest are written into the distributed ledger for auditing and traceability.

[0038] It should be noted that a preferred scheme for verifying the identity of data users based on the DID signature mechanism specifically includes the following steps: During the process of verifying the identity of data users and generating a unique session identifier based on the DID signature mechanism, the system generates a random challenge code during the data usage phase and sends the challenge request to the data user node. The user node uses its local private key to sign the challenge code and time information, and returns the signature result to the verification module. The system verifies the correctness of the signature and the legality of the timestamp using the public key in the user's DID document. Once the verification is successful, a unique session identifier is immediately generated. The session identifier is calculated by using the authorization credential hash and the random number seed through a hash function and is registered on the blockchain to form a mapping relationship. The system binds the session identifier to the authorization credential, and each access request must carry this identifier. The session identifier has an expiration date and a usage counter. When the preset threshold is exceeded or there is no activity after the timeout, the system automatically terminates the current session and enters the credential re-authentication process. All session state changes are synchronously recorded in the distributed ledger for subsequent auditing.

[0039] It should also be noted that a preferred scheme for tamper-proof verification of the usage policy in the authorization certificate specifically includes the following steps: When performing tamper-proof verification of the usage policy in the authorization certificate, the system first parses the certificate structure, extracts the policy fields, and calculates the policy digest value. The system then submits the digest value and certificate ID to the consortium blockchain node for registration via a blockchain interface call. During the verification phase, the policy digest is recalculated and compared with the registered value on the chain. If the comparison matches, the system enters the policy logic judgment process, performing logical operations to judge conditions such as access count, validity period, usage restrictions, and encryption identifier. The system sets an access counter and a time controller. When the conditions are met, the decryption module is called to complete the data decryption operation. If the policy digest is inconsistent with the on-chain record or the logical judgment result is not met, the system interrupts the access request, locks the decryption module, and generates an event record containing the certificate identifier, node address, time information, and digest difference information. The system writes the event record into the audit block through the ledger for subsequent traceability and verification by regulatory nodes.

[0040] It should also be noted that by verifying the identity of data users and generating unique session identifiers based on the DID signature mechanism, and simultaneously performing integrity and anti-tampering checks on the usage policies in the authorization credentials, dynamic verification and behavior-level control are achieved during the data usage phase. Before data access, a random challenge code is generated, which the data user signs using their private key to generate a response. The system uses the public key to verify the signature, thereby confirming the validity of the user's identity in real time. Subsequently, the system generates a unique session identifier and binds it to the authorization credentials, making each data usage behavior traceable. Regarding policy verification, the system calculates the policy digest and compares it with the original digest registered on the blockchain to detect whether the policy has been modified or forged. Simultaneously, it automatically judges conditions such as the number of accesses, validity period, and purpose description in the policy logic, dynamically controlling the data decryption and access scope based on the verification results. This ensures the consistency and immutability of policy execution, prevents unauthorized use and illegal data decryption, and achieves dynamic identity verification, trusted execution of authorization policies, and traceable behavior control during the data usage phase. This ensures that data usage behavior operates securely and compliantly within the authorized scope, further improving the system's full lifecycle security loop.

[0041] Reference Figure 2 As an embodiment of the present invention, a distributed data usage control system based on DID and verifiable credentials is provided, including an identity verification module 21, an authorization transmission execution module 22, and a policy verification control module 23.

[0042] The identity verification module 21 is used to verify the identity of data users based on the Distributed Identifier (DID), confirm the identity through verifiable identity credentials issued by an authoritative institution, and control the scope of privacy information using a selective disclosure mechanism; the authorized transmission execution module 22 is used to generate data authorization information based on verifiable credentials, establish an encrypted point-to-point data transmission channel by combining the DID identifiers of the authorizer and the authorized person, and execute encrypted transmission and encrypted storage of data; the policy verification and control module 23 is used to verify the identity of data users based on the DID signature mechanism, verify the anti-tampering policy in the authorization credentials, and make compliance judgments on the scope of authorization, policy content, and decryption conditions.

[0043] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0044] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For system embodiments, since they largely correspond to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0045] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0046] The methods and apparatus of this disclosure may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the methods is for illustrative purposes only, and the steps of the methods of this disclosure are not limited to the order specifically described above unless otherwise specifically stated. Furthermore, in some embodiments, this disclosure may also be implemented as a program recorded on a recording medium, the program including machine-readable instructions for implementing the methods according to this disclosure. Thus, this disclosure also covers recording media storing programs for performing the methods according to this disclosure.

[0047] It should also be noted that in the apparatus, devices, and methods of this disclosure, the components or steps are decomposable and / or recombinable. Such decomposition and / or recombination should be considered equivalent to the present disclosure. The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0048] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A distributed data use control method based on DID and verifiable credentials, characterized by, The application comprises the following steps: Identity authentication of data users based on distributed identity DID, identity authentication by verifiable identity certificate issued by an authority, and control of the range of private information by a selective disclosure mechanism; Generation of data authorization information based on verifiable certificate, establishment of an encrypted point-to-point data transmission channel by combining the DID identity of the authorized party and the authorized party, and execution of encrypted transmission and encrypted storage of data; Identity authentication of data users based on DID signature mechanism, anti-tampering verification of the use strategy in the authorization certificate, and compliance judgment of the authorization range, strategy content and decryption conditions.

2. The DID and verifiable credential based distributed data usage control method of claim 1, wherein: The identity authentication of data users based on distributed identity DID comprises the following steps: A data user generates an identity request message through a local DID control unit, including a distributed identity, a timestamp, a random challenge code and certificate index information; After receiving the request, a decentralized identity resolution network is accessed to retrieve the corresponding identity document, which includes user public key information and signature algorithm identification; The data owner uses the public key in the identity document to perform signature verification on the request message, compares the message content and the signature result, and judges whether the timestamp is within the allowed deviation range. If the verification result is true, the certificate authentication and authorization generation process is entered, otherwise the request is rejected; The data user selects to disclose part of the certificate information, performs chain verification on the signature of the certificate issuer, confirms the source and integrity of the certificate, and marks the identity authentication as successful if the verification is passed.

3. The DID and verifiable credential based distributed data usage control method of claim 2, wherein: The identity authentication by the verifiable identity certificate issued by the authority comprises the following steps: The verifiable certificate includes issuer identification, holder identification, declaration field and digital signature field; The issuer identification is extracted by parsing the certificate header information and obtaining the issuer public key through the decentralized identity network; The signature result is verified using the issuer public key by calculating the digest value of the certificate content; If the verification result is consistent and the certificate is within the valid period, the certificate is determined to be valid; The current certificate status is determined by checking the certificate revocation list, and if any of the checks fails, the request is rejected; Independent verification is performed on the client and server, and the results are compared. If the verification results of both ends are consistent, the verification is marked as passed, otherwise the process is terminated.

4. The DID and verifiable credential based distributed data usage control method of claim 3, wherein: The generation of data authorization information based on verifiable certificate comprises the following steps: After identity authentication, the data owner generates a data authorization certificate according to the meta information of the target data, which includes data number, storage path, access time limit and use range. The data authorization certificate includes authorized party identification, authorized party identification, authorization time and strategy description; The authorization content is executed by calculating the digest and signing with the authorized party's private key. The authorization certificate is stored in the distributed certificate warehouse in a structured data form and transmitted to the authorized party's identity endpoint; The authorized party receives it and verifies the signature validity using the authorized party's public key, and checks the certificate validity period. If the verification is successful, the transmission preparation unit is triggered, and if the verification fails, the process is terminated and the log is recorded.

5. The DID and verifiable credential based distributed data usage control method of claim 4, wherein: The establishment of an encrypted point-to-point data transmission channel comprises the following steps: The data owner node reads the public key information from the data user's identity document and generates a random symmetric key for encrypting the data content; The data owner performs an encryption operation on the data using a random symmetric key and encrypts the key using the public key of the data user; The encrypted data packet is transmitted to the data user through a distributed identity communication channel, and the data user receives it, decrypts the key using the private key, and decrypts the data content using the key; After the transmission is completed, a confirmation message is generated, and the communication parties sign the message using their respective private keys, and the signature result is uploaded to the distributed ledger. If it is detected that the message is repeated or the signature verification is inconsistent, the key renegotiation process is performed.

6. The DID and verifiable credential based distributed data usage control method of claim 5, wherein: The DID signature mechanism is used to verify the identity of the data user, In the data usage stage, a random challenge code is generated and sent to the data user, the data user generates a digital signature of the challenge code and time information using the distributed identity private key, and returns the signature result, which is verified using the user's public key; According to the signature verification result and the time stamp deviation, the verification state is determined, and when the verification is successful, a unique session identifier is generated and bound with the authorization credential. All use requests must carry the unique session identifier. If the signature is invalid or the identifier does not match, the access is terminated and the event is recorded.

7. The DID and verifiable credential based distributed data usage control method of claim 6, wherein: The use strategy in the authorization credential is verified for tamper-proofing, including After receiving the authorization credential, the strategy field is parsed, the access times, validity period, encryption identifier and purpose description are extracted, the strategy digest value is calculated and compared with the original digest registered on the blockchain. If they are consistent, it is confirmed that the strategy has not been modified; The strategy logic is judged to check whether the current time is within the valid period and whether the use times are less than the maximum limit. If the conditions are met, the data decryption unit is called to perform decryption on the target data; If any condition is not met or the digest is not consistent, the request is rejected and the event is recorded. The verification result and the credential digest are written into the distributed ledger for auditing and tracing.

8. A distributed data usage control system based on DID and verifiable credentials, employing the method of any one of claims 1 to 7, characterized in that: It includes an identity verification module, an authorized transmission execution module, and a strategy verification control module. The identity verification module is used to verify the identity of the data user based on the distributed identity DID, and the identity is verified by the verifiable identity credential issued by the authority, and the privacy information range is controlled by the selective disclosure mechanism; The authorized transmission execution module is used to generate data authorization information based on the verifiable credential, establish an encrypted point-to-point data transmission channel based on the DID identifiers of the authorized person and the authorized person, and perform encrypted transmission and encrypted storage of data; The strategy verification control module is used to verify the identity of the data user based on the DID signature mechanism, and to verify the use strategy in the authorization credential for tamper-proofing. The authorization range, strategy content and decryption conditions are judged for compliance.

9. An electronic device, comprising: The electronic device includes a memory and a processor coupled to the memory; the memory stores program instructions, and the program instructions are executed by the processor to perform the method of any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer program makes the electronic device execute the method of any one of claims 1 to 7 when the computer program runs on the electronic device.

Images