Data use permission verification method, system and equipment for protecting use mode and medium

Abstract

The invention relates to a data use permission verification method, system and device for protecting a use mode and a medium, an authorized data holder constructs a holding certification by using a certification algorithm based on a data use mode and a corresponding signature synchronized by a data user, and locally records the data use mode; and the supervisor confirms whether the data user uses the related data or not on the premise of ensuring that the data use mode is not open based on the holding proof. Compared with the prior art, whether the data is used or not can be published so as to meet transparency and supervision, and meanwhile, how the data is used is protected so as to protect commercial or technical privacy of a data user.

Description

Technical Field

[0001] This invention relates to the field of data access permission verification, and in particular to a data access permission verification method, system, device and medium for protecting usage methods. Background Technology

[0002] With the development of data as a fundamental element, the value of data is increasingly prominent in cross-institutional and cross-industry sharing and transactions. However, data often contains sensitive information, such as personal privacy or trade secrets. During data circulation, it is crucial to ensure the verifiability of data usage while protecting the privacy of data users' methods. This is a core requirement in data usage scenarios. Traditional access control methods rely on centralized permission management to control data access, but data still needs to be exposed to users, making it difficult to simultaneously guarantee the privacy requirements of data providers. Furthermore, cross-institutional collaboration is weak, and there is a lack of publicly verifiable data usage records. Chinese patent CN111914293A discloses a data access permission verification method, apparatus, computer equipment, and storage medium. The method includes: a first server creating an access message, encrypting and digitally signing the access message, sending it to a blockchain, and sending a data access request to a second server; the second server receiving the request retrieves the access message from the first server in the blockchain, performs signature verification and decryption on the access message, generates a decrypted access message, performs permission review on the decrypted access message, generates an authorization result, encrypts and digitally signs the authorization result, sends it to the blockchain, and sends an access response to the first server; the first server receiving the response retrieves the authorization result from the blockchain, performs signature verification and decryption on the authorization result, generates a decrypted authorization result, and determines whether to grant data access based on the decrypted authorization result. While this method can reduce security risks during data sharing, it is limited to controlling data access through permission management. However, during data circulation and use, the data-elemental ecosystem requires the disclosure of "whether the data is used" to meet transparency and regulatory requirements, while simultaneously protecting "how the data is used" to protect the commercial or technical privacy of data users. This is a reasonable need that urgently needs to be addressed. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of the existing technology, which cannot verify data usage behavior while protecting the privacy of the user's usage method. It provides a data usage permission verification method, system, device, and medium that protects the usage method. Its core idea is to disclose whether the data is used to ensure transparency and regulatory oversight; to hide the specific data usage method to protect the user's business or technical privacy; and to combine "proof of possession" to achieve verifiable and trustworthy circulation of data usage without disclosing sensitive information.

[0004] The objective of this invention can be achieved through the following technical solutions: According to a first aspect of the present invention, a data usage permission verification method for protecting usage methods is provided. An authorized data holder constructs a holding certificate based on the data usage method synchronized by the data user and the corresponding signature using a proof algorithm, and records the data usage method locally. The regulator confirms whether the data user is using the relevant data based on the holding certificate, provided that the data usage method is not disclosed.

[0005] The method includes the following steps: Data publishing: The data holder calculates the corresponding data fingerprint for each piece of data it publishes, generates a public-private key pair for the data holder, binds the data fingerprint and the public key in the public-private key pair, and publishes it to a trusted platform; Data Authorization: The data user generates a public-private key pair. When the data holder authorizes the data user to use the data it publishes, the data holder uses the data fingerprint corresponding to the data in the private key pair of the data holder's public-private key pair and the public key in the data user's public-private key pair to generate an authorization signature. The authorization signature, the data fingerprint and the public key in the data user's public-private key pair are bound together and published to the trusted platform. Data users use data as follows: Data users define and configure data usage methods according to the data usage protocol, sign the data usage method using the private key in their public-private key pair to obtain a usage method signature, and synchronize the data usage method and usage method signature to the data holder. Data users and data holders interact, using data according to the defined usage method. Data holders construct a holding certificate based on the public key in the data user's public-private key pair, the data usage method, and the usage method signature, and record the data usage method locally. Data holders bind the holding certificate with the public key in the data user's public-private key pair and publish it to a trusted platform. Data oversight: Regulators obtain relevant data through trusted platforms to determine whether data users have access rights to the data and whether they are using the relevant data.

[0006] The determination of whether the data user has access to the data specifically involves the following steps: The regulator uses the data fingerprint and the public key in the data user's public-private key pair to form the message in the digital signature. The regulator then uses the public key in the data user's public-private key pair to verify the legality of the authorized signature. If the authorized signature is legal, then the data user has access to the data corresponding to the data fingerprint.

[0007] The determination of whether the data user has used the relevant data specifically involves the following steps: each time the data user uses the data, the data holder generates and publishes a corresponding holding certificate after the use is completed. The regulator verifies the legality of the holding certificate. If the holding certificate is legal, it indicates that the data user has used the relevant data.

[0008] According to a second aspect of the present invention, a data usage permission verification system for protecting usage methods is provided, comprising a data holder, a data user, and a regulator, wherein the authorized data holder constructs a holding certificate based on the data usage method synchronized by the data user and the corresponding signature using a proof algorithm, and records the data usage method locally, and the regulator confirms whether the data user uses the relevant data based on the holding certificate, provided that the data usage method is not disclosed.

[0009] The system includes: Data publishing module: The data holder calculates the corresponding data fingerprint for each piece of data it publishes, generates a public-private key pair for the data holder, binds the data fingerprint and the public key in the public-private key pair for the data holder, and publishes it to the trusted platform; Data authorization module: The data user generates a public-private key pair. When the data holder authorizes the data user to use the data it publishes, the data holder uses the data fingerprint corresponding to the data in the private key pair of the data holder's public-private key pair and the public key in the data user's public-private key pair to generate an authorization signature. The authorization signature, data fingerprint and public key in the data user's public-private key pair are bound together and published to the trusted platform. The data user uses the data module as follows: The data user defines and configures the data usage method according to the data usage protocol, signs the data usage method using the private key in the data user's public-private key pair to obtain a usage method signature, and synchronizes the data usage method and usage method signature to the data holder; The data user and the data holder interact and use the data according to the data usage method; The data holder constructs a holding certificate based on the public key in the data user's public-private key pair, the data usage method, and the usage method signature, and records the data usage method locally; The data holder binds the holding certificate with the public key in the data user's public-private key pair and publishes it to the trusted platform; Data supervision module: The regulator obtains relevant data through a trusted platform to determine whether the data user has the right to access the data and whether the data user is using the relevant data.

[0010] The determination of whether the data user has access to the data specifically involves the following steps: The regulator uses the data fingerprint and the public key in the data user's public-private key pair to form the message in the digital signature. The regulator then uses the public key in the data user's public-private key pair to verify the legality of the authorized signature. If the authorized signature is legal, then the data user has access to the data corresponding to the data fingerprint.

[0011] The determination of whether the data user has used the relevant data specifically involves the following steps: each time the data user uses the data, the data holder generates and publishes a corresponding holding certificate after the use is completed. The regulator verifies the legality of the holding certificate. If the holding certificate is legal, it indicates that the data user has used the relevant data.

[0012] According to a third aspect of the present invention, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method described thereon.

[0013] According to a fourth aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method described thereon.

[0014] Compared with the prior art, the present invention has the following beneficial effects: 1. Achieve separate disclosure of data usage facts from the content of data usage.

[0015] This invention is the first to propose a design that treats "whether the data is used" as public information, while protecting "how the data is used" as the user's private information. By utilizing a dual digital signature and possession proof mechanism, this invention achieves publicly verifiable data usage behavior without disclosing the privacy of the usage method, thus satisfying both the requirements for transparent supervision and the user's confidentiality needs.

[0016] 2. Construct a dual-signature trusted binding mechanism for the data authorization link.

[0017] This invention utilizes traditional digital signatures to form an authorization chain of "data → data key → user key", making the data authorization process and subsequent use traceable and non-repudiable, significantly improving the credibility of data authorization management and preventing users from impersonating, sub-authorizing, or denying use.

[0018] 3. Introduce proof of ownership to ensure verifiability of the content while maintaining confidentiality.

[0019] This invention employs a "Proof of Possession" technology based on digital signatures. It generates a proof of possession simultaneously by signing the data usage method as a message, enabling third parties to verify its authenticity and legitimacy without needing to know the content used or the specific signature value. Compared to schemes based on plaintext or encrypted on-chain data storage, this invention achieves "zero-leakage verifiability," further reducing the risk of data leakage.

[0020] 4. It strikes a balance between openness and transparency and privacy protection, and is compatible with blockchain regulatory and privacy compliance requirements.

[0021] This invention supports storing proof of use on the blockchain, enabling regulators and auditors to verify whether a user has used certain data, but still not to know how the data was used. This mechanism simultaneously meets the requirements of data security compliance and the privacy and confidentiality requirements of commercial applications, possessing good versatility and promotional value. Attached Figure Description

[0022] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a schematic diagram of the data authorization process of the present invention; Figure 3 This is a schematic diagram illustrating the data usage process of the present invention. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0024] Unless otherwise defined, the technical or scientific terms used in this application shall have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms “a,” “an,” “an,” “the,” and similar words used in this application do not indicate quantity limitation and may indicate singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units not listed, or may include other steps or units inherent to these processes, methods, products, or devices. The terms “connected,” “linked,” “coupled,” and similar words used in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following objects are in an "or" relationship. The terms "first," "second," and "third" used in this application are merely to distinguish similar objects and do not represent a specific ordering of the objects.

[0025] This embodiment provides a data usage permission verification method that protects usage patterns. The authorized data holder constructs a holding certificate based on the data usage patterns and corresponding signatures synchronized by the data user, and records the data usage patterns locally. The regulator confirms whether the data user is using the relevant data based on the holding certificate, while ensuring that the data usage patterns are not disclosed.

[0026] Specifically, such as Figure 1 As shown, the method includes the following steps: S1, Data Release.

[0027] For data holder H, each time it publishes a piece of data The following operations will be performed: S11, Calculate the corresponding data fingerprint , Indicates hash calculation; S12, generate a public / private key pair held by the parties. ,in, For the holder of the public key, The public-private key pair generated in this step is no different from the public-private key pair in traditional digital signature systems, as it is the private key held by the holder. S13, the data fingerprint and the public key in the public-private key pair between the two parties Bind and publish to a trusted platform.

[0028] S2, Data Authorization.

[0029] Generate a pair of public and private keys using the formula U. ,in, For the public key of the user U, This is the private key of the user U.

[0030] When data holder H authorizes data user U to use the data it publishes. At times, such as Figure 2 As shown, the following operations will be performed: S21, the data holder H uses the private key from the data holder's public-private key pair. Data Corresponding data fingerprint and the public key in the public-private key pair. Generate Authorization Signature In this step, the authorized signature indicates: holding and Users corresponding to the private key can use data fingerprints. Data; S22, Authorize Signature Data fingerprint and the public key in the public-private key pair. After binding, it is published to a trusted platform.

[0031] S3 uses data in a numerical format.

[0032] like Figure 3 As shown, the process of using data by a data provider includes the following steps: S31, User U defines and configures data according to the user protocol. How to use This usage method It is a secret of the user and needs to be kept confidential from all parties other than the user. S32, using the private key in the public-private key pair of the data party U. Data usage Perform the signing to obtain the usage signature. ; S33, using the data method with the data square U. and usage signature Synchronously provide data to the data holder H; S34, the data provider U and the data holder H interact according to the data usage method. Use data; S35, the data holder H is based on the public key in the public-private key pair of the data holders. Data usage methods and usage signature Build proof of ownership Used to prove that you have a pair of public keys that match your own. Associated message-signature pairs, and record data usage locally. ; S36, Holder H will hold proof and the public key in the public-private key pair. After binding, it is published to a trusted platform.

[0033] S4, Data Regulation.

[0034] S41, Regulators obtain data fingerprints through trusted platforms. With data public key ; S42, the regulator uses signatures on a trusted platform. and data fingerprints public key of the user Determine if user U has data Access permissions: Specifically, regulators use data fingerprints and the public key in the public-private key pair. The two together form the message in the digital signature, using the public key from the public-private key pair held by the data holder. Verify the validity of the authorization signature. If the authorization signature is valid, the user party possesses the data fingerprint. Access permissions for the corresponding data.

[0035] S43, Regulators review the certificates held on trusted platforms. To determine if user U has used data D: Each time the user uses the data, the data holder generates and publicly discloses a corresponding ownership certificate after the use is completed. The regulator verifies the legality of the certificate of ownership. If the certificate of ownership is legal, it indicates that the data user has used the relevant data.

[0036] In one preferred embodiment, the regulator, data holder, and data user may, under certain circumstances, disclose the data usage methods to both the data holder and the data user. To review the method of data usage.

[0037] The above is an introduction to the method embodiments. The following system embodiments will further illustrate the solution of the present invention.

[0038] A data access permission verification system for protecting usage methods includes a data holder, a data user, and a regulator. The system includes: Data publishing module: The data holder calculates the corresponding data fingerprint for each piece of data it publishes, generates a public-private key pair for the data holder, binds the data fingerprint and the public key in the public-private key pair for the data holder, and publishes it to the trusted platform; Data authorization module: The data user generates a public-private key pair. When the data holder authorizes the data user to use the data it publishes, the data holder uses the data fingerprint corresponding to the data in the private key pair of the data holder's public-private key pair and the public key in the data user's public-private key pair to generate an authorization signature. The authorization signature, data fingerprint and public key in the data user's public-private key pair are bound together and published to the trusted platform. The data user uses the data module as follows: The data user defines and configures the data usage method according to the data usage protocol, signs the data usage method using the private key in the data user's public-private key pair to obtain a usage method signature, and synchronizes the data usage method and usage method signature to the data holder; The data user and the data holder interact and use the data according to the data usage method; The data holder constructs a holding certificate based on the public key in the data user's public-private key pair, the data usage method, and the usage method signature, and records the data usage method locally; The data holder binds the holding certificate with the public key in the data user's public-private key pair and publishes it to the trusted platform; Data supervision module: The regulator obtains relevant data through a trusted platform to determine whether the data user has the right to access the data and whether the data user is using the relevant data.

[0039] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the described module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0040] The electronic device of this invention includes a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in read-only memory (ROM) or loaded from a storage unit into random access memory (RAM). The RAM may also store various programs and data required for device operation. The CPU, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0041] Multiple components in the device are connected to the I / O interface, including: input units such as keyboards and mice; output units such as various types of displays and speakers; storage units such as disks and optical discs; and communication units such as network interface cards (NICs), modems, and wireless transceivers. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0042] The processing unit executes the various methods and processes described above, such as methods S1 to S4. For example, in some embodiments, methods S1 to S4 may be implemented as computer software programs tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on the device via ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the CPU, one or more steps of methods S1 to S4 described above may be performed. Alternatively, in other embodiments, the CPU may be configured to execute methods S1 to S4 by any other suitable means (e.g., by means of firmware).

[0043] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0044] The program code used to implement the methods of the present invention can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0045] In the context of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0046] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method of verifying a data usage right of a usage mode, characterized by, The authorized data holder constructs a possession proof by using a proof algorithm based on the data usage mode and the corresponding signature synchronized by the data user, and records the data usage mode locally, and the supervisor confirms whether the data user uses the relevant data based on the possession proof under the premise that the data usage mode is not disclosed.

2. The method of claim 1, wherein The method comprises the following steps: Data publishing: the data holder calculates a corresponding data fingerprint for each piece of data published by the data holder, and generates a pair of data holder public and private keys, binds the data fingerprint and the public key in the data holder public and private key pair, and publishes to a trusted platform; Data authorization: the data user generates a pair of data user public and private keys, and when the data holder authorizes the data user to use the data published by the data holder, the data holder uses the private key in the data holder public and private key pair to generate an authorization signature for the data fingerprint corresponding to the data and the public key in the data user public and private key pair, binds the authorization signature, the data fingerprint and the public key in the data user public and private key pair, and publishes to the trusted platform; Data usage: the data user uses the data according to the data usage mode defined and configured by the data usage protocol, signs the data usage mode by using the private key in the data user public and private key pair to obtain a usage mode signature, and synchronizes the data usage mode and the usage mode signature to the data holder; the data user and the data holder interact, and use the data according to the data usage mode; the data holder constructs a possession proof based on the public key in the data user public and private key pair, the data usage mode and the usage mode signature, and records the data usage mode locally; the data holder binds the possession proof and the public key in the data user public and private key pair, and publishes to the trusted platform; Data supervision: the supervisor obtains the relevant data through the trusted platform, determines whether the data user has the access right of the data, and whether the data user uses the relevant data.

3. The method of claim 2, wherein The supervisor verifies the legality of the authorization signature by taking the data fingerprint and the public key in the data user public and private key pair as the message in the digital signature, and using the public key in the data holder public and private key pair, and if the authorization signature is legal, the data user has the access right of the data corresponding to the data fingerprint.

4. The method of claim 2, wherein The supervisor verifies the legality of the possession proof, and if the possession proof is legal, it indicates that the data user uses the relevant data.

5. A data usage rights protection system of use, characterized by, The system comprises:

6. The system according to claim 5, wherein A data publishing module: the data holder calculates a corresponding data fingerprint for each piece of data published by the data holder, and generates a pair of data holder public and private keys, binds the data fingerprint and the public key in the data holder public and private key pair, and publishes to a trusted platform; ​ The data authorization module generates a pair of public and private keys of the data user, and when the data holder authorizes the data user to use the data published by the data user, the data holder generates an authorization signature by using the private key of the data holder public and private key pair, a data fingerprint corresponding to the data, and the public key of the data user public and private key pair, and publishes the authorization signature, the data fingerprint, and the public key of the data user public and private key pair to the trusted platform after binding them; The data user uses the data module: the data user signs the data usage mode by using the private key of the data user public and private key pair according to the data usage mode defined and configured by the data usage protocol, obtains a usage mode signature, and synchronizes the data usage mode and the usage mode signature to the data holder; the data user and the data holder interact, and use the data according to the data usage mode; the data holder constructs a possession proof based on the public key of the data user public and private key pair, the data usage mode, and the usage mode signature, and records the data usage mode locally; the data holder publishes the possession proof and the public key of the data user public and private key pair to the trusted platform after binding them; The data supervision module: the supervision party obtains the relevant data through the trusted platform, determines whether the data user has the access right of the data, and whether the data user uses the relevant data.

7. The method of claim 6, wherein the method further comprises: The method for determining whether the data user has the access right of the data specifically comprises the following steps: the supervision party uses the public key of the data holder public and private key pair to verify the legality of the authorization signature according to the data fingerprint and the public key of the data user public and private key pair, and if the authorization signature is legal, the data user has the access right of the data corresponding to the data fingerprint.

8. The method of claim 6, wherein the method is characterized by: The method for determining whether the data user uses the relevant data specifically comprises the following steps: the data holder generates and publishes a corresponding possession proof after the data user uses the data once, and the supervision party verifies the legality of the possession proof, and if the possession proof is legal, it indicates that the data user uses the relevant data.

9. An electronic device comprising a memory and a processor, said memory having stored thereon a computer program, characterized in that, The processor executes the program to realize the method of any one of claims 1-4.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to realize the method of any one of claims 1-4.

Images