Zero-knowledge proof sensitive data access verification method based on AI enhancement

Abstract

The invention discloses a zero-knowledge proof sensitive data access verification method based on AI enhancement, and relates to the technical field of sensitive data access verification, and the method comprises the steps: evaluating the access risk degree of an access request, and obtaining risk data of a risk request; analyzing the request verification intensity of the risk request to the sensitive data access; analyzing the attestation environment adaptability of the zero-knowledge attestation algorithm to the risk request to obtain a to-be-selected zero-knowledge attestation algorithm, and evaluating the attestation excellence degree of the to-be-selected zero-knowledge point algorithm to the risk request under the performance and security collaborative constraint in combination with verification intensity data to obtain an optimal zero-knowledge attestation algorithm; according to the method, the optimal zero-knowledge proof algorithm is used for carrying out access verification on the risk request, and the access of the user to the sensitive data is controlled, so that the user experience is enhanced, the cost overhead in the access verification process is reduced, and the probability of sensitive data leakage is greatly reduced.

Description

Technical Field

[0001] This invention relates to the field of sensitive data access verification technology, specifically to an AI-enhanced zero-knowledge proof-based sensitive data access verification method. Background Technology

[0002] In data-driven business environments, access control and permission verification for sensitive data are crucial and are core components of ensuring data security and compliance. Traditional data access verification primarily relies on roles and attributes for access control. Role-based access control (RBAC) grants permissions to roles and then assigns those permissions to corresponding users. However, not only are user role permission configurations easily exposed, but this method of permission allocation only expresses static permissions and cannot be dynamically adjusted. Attribute-based access control, on the other hand, determines permissions by evaluating user attributes, enabling dynamic adjustment of user permissions. However, it relies on plaintext data during verification, which increases the risk of data leakage.

[0003] Zero-knowledge proofs are cryptographic tools that allow the validity of a proposition to be proven between mutually untrusted communication algorithms without revealing any additional information. However, they can be a major security vulnerability in the verification of sensitive data. Traditional verification methods follow a pattern of obtaining information first and then determining permissions, meaning that the verifier must obtain sensitive data to make a decision during access verification. Zero-knowledge proofs allow the verifier to confirm user permissions without obtaining any sensitive data. However, existing methods using zero-knowledge proofs to verify sensitive data cannot dynamically adjust verification strategies or effectively confirm the strength of access verification. This results in rigid verification logic in the actual access verification of sensitive data, making it impossible to achieve dynamic risk assessment and adjustment of verification strategies. This not only degrades the user experience and increases the cost of the verification process, but may even lead to the leakage of sensitive data. Summary of the Invention

[0004] The purpose of this invention is to provide an AI-enhanced zero-knowledge proof-based method for verifying access to sensitive data, in order to solve the problems raised in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: an AI-enhanced zero-knowledge proof-based method for verifying access to sensitive data, the method comprising: Step S1: Obtain the access request records of users' access requests to sensitive data, assess the access risk level of the access requests, and obtain risk data of risky requests; Step S2: Based on the risk data, analyze the verification strength of risk requests for accessing sensitive data, and obtain verification strength data; Step S3: Obtain historical request proof records of zero-knowledge proof algorithms from the zero-knowledge proof algorithm library in the platform, analyze the adaptability of zero-knowledge proof algorithms to the proof environment of risky requests, obtain candidate zero-knowledge proof algorithms, and combine verification strength data to evaluate the excellence of candidate zero-knowledge point algorithms in proving risky requests under the joint constraints of performance and security, and obtain the optimal zero-knowledge proof algorithm. Step S4: Use the optimal zero-knowledge proof algorithm to verify access to risky requests and control user access to sensitive data.

[0006] Furthermore, step S3 includes: Obtain a pre-defined zero-knowledge proof algorithm library from the platform, extract each pre-defined zero-knowledge proof algorithm from the library, analyze the adaptability of the zero-knowledge proof algorithm to the proof environment of risky requests, and obtain candidate zero-knowledge proof algorithms. Obtain all candidate zero-knowledge proof algorithms for the user's risky requests within the current period, and obtain the average value μ of the proof environment similarity between each historical request proof record and access request record of the candidate zero-knowledge proof algorithm. △ Calculate the weighted estimates of various performance metrics of the candidate zero-knowledge proof algorithms when verifying access to risky requests; Calculate the proof excellence value U of the candidate zero-knowledge proof algorithms for risky requests under the joint constraints of performance and security, and obtain the maximum value U of the proof excellence value U of each candidate zero-knowledge proof algorithm for risky requests. max and U max The candidate zero-knowledge proof algorithm is selected as the optimal zero-knowledge proof algorithm for verifying access to risky requests under the joint constraints of performance and security. By obtaining the candidate zero-knowledge proof algorithm through the above steps, the selected candidate zero-knowledge proof algorithm can perform better in the process of access verification of risky requests, reduce problems such as proof generation timeout and verification delay caused by algorithm incompatibility, significantly improve the verification success rate and response speed, and obtain the optimal zero-knowledge proof algorithm that can ensure both the security of sensitive data and the efficiency of access verification by assessing the excellence of the candidate zero-knowledge proof algorithm under the joint constraints of performance and security.

[0007] Furthermore, step S3, which analyzes the adaptability of the zero-knowledge proof algorithm to the proof environment of risky requests, specifically includes the following process: Retrieve historical request proof records of preset zero-knowledge proof algorithms from the platform, obtain the values ​​of various proof environment parameters in the historical request proof records, construct the proof environment vector of the historical request proof records, and obtain the proof environment vector of the access request records of the user's risky requests in the current period. Calculate the average value μ of the proof environment similarity between each historical request proof record and access request record of a certain zero-knowledge proof algorithm, set the proof environment threshold μ´, and when μ>μ´, determine that a certain zero-knowledge proof algorithm has proof environment adaptation for the user's risky request in the current period, and record the certain zero-knowledge proof algorithm as the candidate zero-knowledge proof algorithm for the user's risky request in the current period.

[0008] Furthermore, the specific calculation process for proving the excellent value U in step S3 includes: Obtain the maximum and minimum weighted estimates of various performance metrics for each candidate zero-knowledge proof algorithm when verifying access to risky requests, and record them as the worst and ideal values ​​of each performance metric. Calculate the group utility value Z and individual difference value R of the candidate zero-knowledge proof algorithms, and calculate the performance equivalence G of the candidate zero-knowledge proof algorithms; Set the minimum threshold V for proof strength. min Given the feature security value β, obtain the verification strength data of the risky request, extract the proof strength level V´ of the risky request from the verification strength data, and obtain the average proof strength level V of the historical risky requests in the historical request proof records of the candidate zero-knowledge proof algorithms. ◇ ; When V min When the security score S of each candidate zero-knowledge proof algorithm for a risky request is greater than or equal to V, then the security score S of the candidate zero-knowledge proof algorithm for a risky request is calculated as S = V. ◇ / N, where N is the maximum value of the proof strength level; Calculate the proof excellence value U = λs × S + λ for risky requests using candidate zero-knowledge proof algorithms under the combined constraints of performance and security. G ×G, where λs is the preset safety bias coefficient, λ G Here are the preset performance bias coefficients, where λs and λ G All are greater than 0, λs+λ G =1.

[0009] Furthermore, step S2 includes: The platform retrieves preset proof strength levels, risk data for risk requests, and sensitivity levels for sensitive data from the risk data. The platform presets proof strength levels for risk requests as 1, 2, ..., N, where N is a preset integer. If the sensitivity level of sensitive data is greater than the preset sensitivity level threshold, the risk proof strength level is set to N, which serves as the proof strength level of the user's risk request in the current period. Otherwise, the frequency risk value, device risk value, network environment risk value, and comprehensive risk value of the risk request are obtained from the risk data and recorded as the risk parameters of the risk request. The verification strength of the user's risk request to access sensitive data in the current period is analyzed to obtain the verification strength data.

[0010] Furthermore, the specific process of analyzing the verification strength of user requests for access to sensitive data in the current period in step S2 includes: Set a feature value m, divide the range from 0 to 1 into m equal numerical ranges, count the number of times each risk parameter value of a risk request falls within a different numerical range, calculate the probability distribution value of the risk request in each numerical range, and calculate the platform's strength stability value C for the risk request. The specific calculation formula is as follows: , Where, p i Let be the probability distribution value of the risk request in the i-th numerical range; Calculate the intensity harmonic value T of the risk request, calculate the harmonic constant ζ of the risk request = (m+1) / 2, and calculate the verification intensity value V of the risk request based on the intensity harmonic value T, the harmonic constant ζ, and the intensity stability value C. The verification strength value V is rounded up to obtain V'. The value corresponding to V' is taken as the proof strength level of the user's risk request in the current period. The proof strength levels of the user's risk requests in the current period are aggregated to obtain the verification strength data of the risk request.

[0011] Furthermore, step S1 includes; The sensitivity level of sensitive data in the platform is obtained, and a sensitivity level threshold is set. When the sensitivity level of sensitive data is greater than the preset sensitivity level threshold, it is determined that the user's access request to sensitive data in the current period is risky and the access request is recorded as a risky request. Conversely, the access request record of the user's access request to sensitive data in the platform is obtained, and the access risk level of the access request is evaluated based on the access request record to obtain the risk data of the risky request.

[0012] Furthermore, the specific process for assessing the access risk level of the access request in step S1 includes: Set the unit duration, obtain the total number of access requests A initiated by the user in the access request record, divide the total duration of the access request record by the unit duration to obtain the characteristic duration value T´ of the access request record, and calculate the request frequency value B=A / T´ of the user in the access request record. Obtain the user's historical access request records within a historical period from the platform, and extract the average value μ of the user's request frequency from the historical access request records. a and standard deviation σ a Calculate the user request frequency threshold B´=μ a +k×σ a , where k is a preset weighting coefficient; Calculate the frequency risk value of access requests E=min(1,B / B´), obtain the total number of times the user logs into the platform using the device in the current period from the access request records, obtain the network type of the network used by the user to log into the platform in the current period from the access request records, and calculate the device risk value F and network environment risk value H of the access requests. Based on the frequency risk value E, the device risk value F, and the network environment risk value H, the risk data of the user's access request in the current period is determined as to whether the request is risky.

[0013] Furthermore, the specific process of determining whether a user's access request within the current period is risky in step S1 includes: When the frequency risk value E, the device risk value F, and the network environment risk value H are all less than the corresponding preset thresholds, the comprehensive risk value D of the access request is calculated, and the comprehensive risk threshold d is set. When D > d, it is determined that the user's access request to sensitive data in the current period is risky, and the access request is recorded as a risky request. Otherwise, it is determined that the access request is not risky. When the frequency risk value E, the device risk value F, or the network environment risk value H is greater than the corresponding preset threshold, the access request is determined to be risky and recorded as a risky request. The sensitivity level of sensitive data and the frequency risk value E, device risk value F, network environment risk value H, and comprehensive risk value D of access requests are obtained and aggregated to obtain risk data of risk requests.

[0014] Furthermore, step S4 includes: Obtain the optimal zero-knowledge proof algorithm for verifying the user's risky requests within the current period, use the optimal zero-knowledge proof algorithm to perform zero-knowledge proof on the risky requests, and obtain proof π. After the server in the platform accepts the proof π, it performs access verification on the user's risky request, obtains a verification boolean value, and determines whether the platform should refuse the user's risky request based on the verification boolean value. When the platform determines that a user's risk request is to be denied access, it will refuse the user's access to sensitive data on the platform. Otherwise, it will generate a temporary access token, which the user can use to access sensitive data within the platform.

[0015] Compared with existing technologies, the beneficial effects of this invention are as follows: Users do not need to submit any passwords, authorization credentials, or data content during the access verification process for sensitive data on the platform. They only need to prove their legitimate permissions to the system through zero-knowledge proofs, fundamentally eliminating the risk of sensitive information leakage. Furthermore, by assessing the risk of multi-factor access requests, it accurately identifies risky requests with access risks. Adaptive verification strength determination allows for dynamic adjustment of verification strength based on user behavior, environmental risks, and data sensitivity. In addition, it evaluates the excellence of candidate zero-knowledge proof algorithms for risky requests under performance and security constraints, obtaining the optimal zero-knowledge proof algorithm for access verification of risky requests. Combined with AI enhancement technology and the optimal zero-knowledge proof algorithm, it achieves access verification of risky requests, not only enhancing the user experience but also reducing the cost of the access verification process and significantly lowering the probability of sensitive data leakage. Attached Figure Description

[0016] Figure 1 This is a flowchart of the AI-enhanced zero-knowledge proof-based sensitive data access verification method of the present invention; Figure 2 This is a flowchart illustrating the risk assessment process of the AI-enhanced zero-knowledge proof-based sensitive data access verification method of this invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example: Figures 1-2 As shown, this invention provides a technical solution: an AI-enhanced zero-knowledge proof-based method for verifying access to sensitive data, the method comprising: Step S1: Obtain the access request records of users' access requests to sensitive data, assess the access risk level of the access requests, and obtain risk data of risky requests; Step S1 includes: The sensitivity level of sensitive data in the platform is obtained, and a sensitivity level threshold is set. When the sensitivity level of sensitive data is greater than the preset sensitivity level threshold, it is determined that the user's access request to sensitive data in the current period is risky and the access request is recorded as a risky request. Conversely, the access request record of the user's access request to sensitive data in the platform is obtained, and the access risk level of the access request is evaluated based on the access request record to obtain the risk data of the risky request. For example, sensitive data on the platform includes internal notifications, employee personal information, customer contact information, source code, keys, and other data. For example, the sensitivity level of sensitive data is divided into three levels: Level 1 is internal sensitive data, Level 2 is internal highly sensitive data, and Level 3 is core confidential data. The sensitivity level threshold is generally set to Level 3. When the sensitive data is Level 3 core confidential data, any access request from the user is directly judged to be risky and recorded as a risk request. The specific process for assessing the access risk level of the access request in step S1 includes: Set the unit duration, obtain the total number of access requests A initiated by the user in the access request record, divide the total duration of the access request record by the unit duration to obtain the characteristic duration value T´ of the access request record, and calculate the request frequency value B=A / T´ of the user in the access request record. For example, access request records are specifically the records generated from the time a user logs in to the time a user initiates an access request for sensitive data within the platform during the current period; Obtain the user's historical access request records within a historical period from the platform, and extract the average value μ of the user's request frequency from the historical access request records. a and standard deviation σ a Calculate the user request frequency threshold B´=μ a +k×σ a , where k is a preset weighting coefficient; Calculate the frequency risk value of access requests E=min(1,B / B´), obtain the total number of times the user logs into the platform using the device in the current period from the access request records, obtain the network type of the network used by the user to log into the platform in the current period from the access request records, and calculate the device risk value F and network environment risk value H of the access requests. For example, the specific calculation process for the equipment risk value F is as follows: Get the device that logged in from the user's access request records in the current period. Get the total number of times the device logged in to the user's login platform from the device data. Set a login count threshold. When the total number of times a device logged in to the user's login platform is greater than the preset login count threshold, the device that the user logged in to in the current period is determined to be a frequently used device. The device risk level f of the user's access request in the current period is set to 1. When the total number of times a device logged in to the user's login platform is greater than or equal to 2 and less than the login count threshold, the device risk level f of the user's access request in the current period is set to 2. When the total number of times a device logged in to the user's login platform is less than 2, the device risk level f of the user's access request in the current period is set to 3. Calculate the device risk value F=(f-1) / 2. For example, the specific calculation process for the network environment risk value H is as follows: Obtain the network type used by the user to log in to the platform during the current period, and set the network risk level h of the user's access requests during the current period based on the network type, specifically: When a user logs into the platform using an internal network during the current period, the network risk level h is 1; when a user logs into the platform using an external VPN during the current period, the network risk level h is 2; when a user logs into the platform using public WiFi during the current period, the network risk level h is 3; and when a user logs into the platform using a proxy / anonymous network during the current period, the network risk level h is 4. Based on the network risk level h, calculate the network risk value H = (h-1) / 3; Based on the frequency risk value E, the device risk value F, and the network environment risk value H, the risk data of the user's access request in the current period is determined as to whether the request is risky. The specific process of determining whether a user's access request within the current period is risky in step S1 includes: When the frequency risk value E, the device risk value F, and the network environment risk value H are all less than the corresponding preset thresholds, the comprehensive risk value D of the access request is calculated, and the comprehensive risk threshold d is set. When D > d, it is determined that the user's access request to sensitive data in the current period is risky, and the access request is recorded as a risky request. Otherwise, it is determined that the access request is not risky. For example, the specific calculation process for the comprehensive risk value D is as follows: The frequency risk value E, equipment risk value F, and network environment risk value H are normalized respectively, and the comprehensive risk value D=γ is calculated. E ×E+γ F ×F+γ H ×H, where γ E γ F and γ H γ represents the preset frequency weighting coefficient, device weighting coefficient, and network environment weighting coefficient. E +γ F +γ H =1, γ E γ F and γ H All are greater than 0; When the frequency risk value E, the device risk value F, or the network environment risk value H is greater than the corresponding preset threshold, the access request is determined to be risky and recorded as a risky request. The sensitivity level of sensitive data and the frequency risk value E, device risk value F, network environment risk value H, and comprehensive risk value D of access requests are obtained and aggregated to obtain risk data of risk requests.

[0019] Step S2: Based on the risk data, analyze the verification strength of risk requests for accessing sensitive data, and obtain verification strength data; Step S2 includes: The platform retrieves preset proof strength levels, risk data for risk requests, and sensitivity levels for sensitive data from the risk data. The platform presets proof strength levels for risk requests as 1, 2, ..., N, where N is a preset integer. When the sensitivity level of sensitive data is greater than the preset sensitivity level threshold, the risk proof strength level is set to N, which serves as the proof strength level of the user's risk request in the current period. Otherwise, the frequency risk value, device risk value, network environment risk value, and comprehensive risk value of the risk request are obtained from the risk data and recorded as the risk parameters of the risk request. The verification strength of the user's risk request to access sensitive data in the current period is analyzed to obtain the verification strength data. For example, the frequency risk value, equipment risk value, network environment risk value, and comprehensive risk value obtained from risk data are all normalized and range from 0 to 1. The specific process of analyzing the verification strength of user requests for access to sensitive data in the current period in step S2 includes: Set a feature value m, divide the range from 0 to 1 into m equal numerical ranges, count the number of times each risk parameter value of a risk request falls within a different numerical range, calculate the probability distribution value of the risk request in each numerical range, and calculate the platform's strength stability value C for the risk request. The specific calculation formula is as follows: , Where, p i Let be the probability distribution value of the risk request in the i-th numerical range; For example, to calculate the probability distribution values ​​for each numerical range, the specific calculation process is as follows: In a specific embodiment, the feature value m is 3. Therefore, according to the values ​​from low to high, 0 to 1 is divided into 3 equal value ranges, resulting in three value ranges: low, medium and high. The low value range is [0, 1 / 3), the medium value range is [1 / 3, 2 / 3), and the high value range is [2 / 3, 1]. The frequency risk value, device risk value, network environment risk value, and comprehensive risk value of risk requests are obtained, and the total number of times they fall into the low, medium, and high value ranges are obtained. The characteristic counts of the low, medium, and high value ranges are obtained. The characteristic counts of the low, medium, and high value ranges are divided by 4 to obtain the probability distribution values ​​of the low, medium, and high value ranges. Calculate the intensity harmonic value T of the risk request, calculate the harmonic constant ζ of the risk request = (m+1) / 2, and calculate the verification intensity value V of the risk request based on the intensity harmonic value T, the harmonic constant ζ, and the intensity stability value C. For example, the specific calculation process for the intensity harmonic value T is as follows: In practice, the risk parameters for a risk request are frequency risk value, device risk value, network environment risk value, and comprehensive risk value. Therefore, the total number of risk parameters for a risk request is 4. Obtain the sum of the reciprocals of the frequency risk value, device risk value, network environment risk value, and comprehensive risk value in the risk request, and get the risk reciprocal sum b. Calculate the intensity harmonic value T = 4 / b. For example, the specific formula for calculating the verification strength value V is: , Where k is the preset elastic coefficient, k>0; δ is the preset strength stability adjustment coefficient, 1>δ>0; The verification strength value V is rounded up to obtain V'. The value corresponding to V' is taken as the proof strength level of the user's risk request in the current period. The proof strength levels of the user's risk requests in the current period are aggregated to obtain the verification strength data of the risk request.

[0020] Step S3: Obtain historical request proof records of zero-knowledge proof algorithms from the zero-knowledge proof algorithm library in the platform, analyze the adaptability of zero-knowledge proof algorithms to the proof environment of risky requests, obtain candidate zero-knowledge proof algorithms, and combine verification strength data to evaluate the excellence of candidate zero-knowledge point algorithms in proving risky requests under the joint constraints of performance and security, and obtain the optimal zero-knowledge proof algorithm. Step S3 includes: Obtain a pre-defined zero-knowledge proof algorithm library from the platform, extract each pre-defined zero-knowledge proof algorithm from the library, analyze the adaptability of the zero-knowledge proof algorithm to the proof environment of risky requests, and obtain candidate zero-knowledge proof algorithms. For example, various zero-knowledge proof algorithms include ZK-SNARKs, Bulletproofs, and ZK-STARKs; Obtain all candidate zero-knowledge proof algorithms for the user's risky requests within the current period, and obtain the average value μ of the proof environment similarity between each historical request proof record and access request record of the candidate zero-knowledge proof algorithm.△ Calculate the weighted estimates of various performance metrics of the candidate zero-knowledge proof algorithms when verifying access to risky requests; For example, the performance metrics of zero-knowledge proof algorithms include proof generation time, verification time, proof size, and memory consumption. For example, calculating the weighted estimate q of the α-th performance metric of the candidate zero-knowledge proof algorithm when performing access verification on risky requests. α : , Among them, I α ε is the average of the α-th performance metric in the historical request proof records of the candidate zero-knowledge proof algorithm; ε is a preset small constant for characteristics, and the setting of ε can avoid weighted estimation of q. α The denominator is 0; Calculate the proof excellence value U of the candidate zero-knowledge proof algorithms for risky requests under the joint constraints of performance and security, and obtain the maximum value U of the proof excellence value U of each candidate zero-knowledge proof algorithm for risky requests. max and U max The candidate zero-knowledge proof algorithm is selected as the optimal zero-knowledge proof algorithm for verifying access to risky requests under the joint constraints of performance and security. The specific process of analyzing the adaptability of the zero-knowledge proof algorithm to the proof environment of risky requests in step S3 includes: Retrieve historical request proof records of preset zero-knowledge proof algorithms from the platform, obtain the values ​​of various proof environment parameters in the historical request proof records, construct the proof environment vector of the historical request proof records, and obtain the proof environment vector of the access request records of the user's risky requests in the current period. For example, the specific process of constructing the proof environment vector of historical request proof records is as follows: The values ​​of various proof environment parameters are obtained from the historical request proof records. These parameters include the device computing power score and network bandwidth score of a device logged in by the user in the access request records of the current period. The values ​​of various proof environment parameters obtained from the historical proof request records are normalized, and the various proof environment parameters of the historical proof request records are sorted according to a preset order to obtain the proof environment vector of the historical proof request records. For example, the values ​​of environmental parameters such as the device's computing power score and network bandwidth score are all scored by the platform according to a preset scoring standard table; Calculate the average value μ of the proof environment similarity between each historical request proof record and access request record of a certain zero-knowledge proof algorithm, set the proof environment threshold μ´, and when μ>μ´, determine that a certain zero-knowledge proof algorithm has proof environment adaptation for the user's risky request in the current period, and record the certain zero-knowledge proof algorithm as the candidate zero-knowledge proof algorithm for the user's risky request in the current period. For example, to calculate the proof environment similarity value Q between the historical request proof records and the access request records of a certain zero-knowledge proof algorithm: , Where σ is a preset similarity bandwidth parameter, where 1>σ>0; L is the proof environment vector of the access request record; L △ The proof context vector for a certain zero-knowledge proof algorithm's history of request proof records; The specific calculation process for proving the excellent value U in step S3 includes: Obtain the maximum and minimum weighted estimates of various performance metrics for each candidate zero-knowledge proof algorithm when verifying access to risky requests, and record them as the worst and ideal values ​​of each performance metric. Calculate the group utility value Z and individual difference value R of the candidate zero-knowledge proof algorithms, and calculate the performance equivalence G of the candidate zero-knowledge proof algorithms; For example, the specific formula for the group utility value Z of the candidate zero-knowledge proof algorithm is: , Where M is the total number of performance metrics among the candidate zero-knowledge proof algorithms; r (▽,y) Let r be the ideal value of the y-th performance metric among the candidate zero-knowledge proof algorithms; (△,y) Let q be the worst value of the y-th performance metric among the candidate zero-knowledge proof algorithms; y Let y be the weighted estimate of the performance metric of the candidate zero-knowledge proof algorithm; For example, the individual difference value R of the candidate zero-knowledge proof algorithm is calculated using the following formula: , For example, calculating the performance distribution G of the candidate zero-knowledge proof algorithms: , Where η is the preset compromise coefficient, 1>η>0; Z´ is the maximum value of the group utility value among all candidate zero-knowledge proof algorithms; Z △ R' represents the minimum group utility value among all candidate zero-knowledge proof algorithms; R' represents the maximum individual difference value among all candidate zero-knowledge proof algorithms; R △ This represents the minimum value of individual differences among all candidate zero-knowledge proof algorithms. Set the minimum threshold V for proof strength. min Given the feature security value β, obtain the verification strength data of the risky request, extract the proof strength level V´ of the risky request from the verification strength data, and obtain the average proof strength level V of the historical risky requests in the historical request proof records of the candidate zero-knowledge proof algorithms. ◇ ; When V min When the security score S of each candidate zero-knowledge proof algorithm for a risky request is greater than or equal to V, then the security score S of the candidate zero-knowledge proof algorithm for a risky request is calculated as S = V. ◇ / N, where N is the maximum value of the proof strength level; For example, the feature security value β is set to 1 in a specific embodiment; Calculate the proof excellence value U = λs × S + λ for risky requests using candidate zero-knowledge proof algorithms under the combined constraints of performance and security. G ×G, where λs is the preset safety bias coefficient, λ G Here are the preset performance bias coefficients, where λs and λ G All are greater than 0, λs+λ G =1.

[0021] Step S4: Use the optimal zero-knowledge proof algorithm to verify access to risky requests and control user access to sensitive data.

[0022] Step S4 includes: Obtain the optimal zero-knowledge proof algorithm for verifying the user's risky requests within the current period, use the optimal zero-knowledge proof algorithm to perform zero-knowledge proof on the risky requests, and obtain proof π. For example, using the optimal zero-knowledge proof algorithm to perform zero-knowledge proof on a risky request, we obtain proof π. The specific process is as follows: The platform retrieves the user's local credentials data for the current period. This local credentials data includes role tokens (such as "administrator"), attribute credentials (such as "department = R&D", "project = data platform"), etc. And convert the local credential data into a witness, i.e., a private input that satisfies circuit constraints; The platform uses the optimal zero-knowledge proof algorithm to generate proof π; After the server in the platform accepts the proof π, it performs access verification on the user's risky request, obtains a verification boolean value, and determines whether the platform should refuse the user's risky request based on the verification boolean value. For example, after receiving the proof π, the platform uses the pre-stored verification key and circuit description to call the verification function to verify the user's risky request for access and obtain a verification boolean value. When the verification boolean value is True, the platform determines that it accepts the user's risky request for access; when the verification boolean value is False, the platform determines that it rejects the user's risky request for access. When the platform determines that a user's risk request is to be denied access, it will refuse the user's access to sensitive data on the platform. Otherwise, it will generate a temporary access token, which the user can use to access sensitive data within the platform.

[0023] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A sensitive data access verification method based on AI-enhanced zero-knowledge proof, characterized in that, The method includes: Step S1: Obtain the access request records of users' access requests to sensitive data, assess the access risk level of the access requests, and obtain risk data of risky requests; Step S2: Based on the risk data, analyze the verification strength of risk requests for accessing sensitive data, and obtain verification strength data; Step S3: Obtain historical request proof records of zero-knowledge proof algorithms from the zero-knowledge proof algorithm library in the platform, analyze the adaptability of zero-knowledge proof algorithms to the proof environment of risky requests, obtain candidate zero-knowledge proof algorithms, and combine verification strength data to evaluate the excellence of candidate zero-knowledge point algorithms in proving risky requests under the joint constraints of performance and security, and obtain the optimal zero-knowledge proof algorithm. Step S4: Use the optimal zero-knowledge proof algorithm to verify access to risky requests and control user access to sensitive data.

2. The AI-enhanced zero-knowledge proof-based sensitive data access verification method according to claim 1, characterized in that, Step S3 includes: Obtain a pre-defined zero-knowledge proof algorithm library from the platform, extract each pre-defined zero-knowledge proof algorithm from the library, analyze the adaptability of the zero-knowledge proof algorithm to the proof environment of risky requests, and obtain candidate zero-knowledge proof algorithms. Obtain all candidate zero-knowledge proof algorithms for the user's risky requests within the current period, and obtain the average value μ of the proof environment similarity between each historical request proof record and access request record of the candidate zero-knowledge proof algorithm. △ Calculate the weighted estimates of various performance metrics of the candidate zero-knowledge proof algorithms when verifying access to risky requests; Calculate the proof excellence value U of the candidate zero-knowledge proof algorithms for risky requests under the joint constraints of performance and security, and obtain the maximum value U of the proof excellence value U of each candidate zero-knowledge proof algorithm for risky requests. max and U max The proposed zero-knowledge proof algorithm is selected as the optimal zero-knowledge proof algorithm for verifying access to risky requests under the constraints of performance and security.

3. The AI-enhanced zero-knowledge proof-based sensitive data access verification method according to claim 2, characterized in that, The specific process of analyzing the adaptability of the zero-knowledge proof algorithm to the proof environment of risky requests in step S3 includes: Retrieve historical request proof records of preset zero-knowledge proof algorithms from the platform, obtain the values ​​of various proof environment parameters in the historical request proof records, construct the proof environment vector of the historical request proof records, and obtain the proof environment vector of the access request records of the user's risky requests in the current period. Calculate the average value μ of the proof environment similarity between each historical request proof record and access request record of a certain zero-knowledge proof algorithm, set the proof environment threshold μ´, and when μ>μ´, determine that a certain zero-knowledge proof algorithm has proof environment adaptation for the user's risky request in the current period, and record the certain zero-knowledge proof algorithm as the candidate zero-knowledge proof algorithm for the user's risky request in the current period.

4. The AI-enhanced zero-knowledge proof-based sensitive data access verification method according to claim 3, characterized in that, The specific calculation process for proving the excellent value U in step S3 includes: Obtain the maximum and minimum weighted estimates of various performance metrics for each candidate zero-knowledge proof algorithm when verifying access to risky requests, and record them as the worst and ideal values ​​of each performance metric. Calculate the group utility value Z and individual difference value R of the candidate zero-knowledge proof algorithms, and calculate the performance equivalence G of the candidate zero-knowledge proof algorithms; Set the minimum threshold V for proof strength. min Given the feature security value β, obtain the verification strength data of the risky request, extract the proof strength level V´ of the risky request from the verification strength data, and obtain the average proof strength level V of the historical risky requests in the historical request proof records of the candidate zero-knowledge proof algorithms. ◇ ; When V min When the security score S of each candidate zero-knowledge proof algorithm for a risky request is greater than or equal to V, then the security score S of the candidate zero-knowledge proof algorithm for a risky request is calculated as S = V. ◇ / N, where N is the maximum value of the proof strength level; Calculate the proof excellence value U = λs × S + λ for risky requests using candidate zero-knowledge proof algorithms under the combined constraints of performance and security. G ×G, where λs is the preset safety bias coefficient, λ G Here are the preset performance bias coefficients, where λs and λ G All are greater than 0, λs+λ G =1.

5. The AI-enhanced zero-knowledge proof-based sensitive data access verification method according to claim 1, characterized in that, Step S2 includes: The platform retrieves preset proof strength levels, risk data for risk requests, and sensitivity levels for sensitive data from the risk data. The platform presets proof strength levels for risk requests as 1, 2, ..., N, where N is a preset integer. If the sensitivity level of sensitive data is greater than the preset sensitivity level threshold, the risk proof strength level is set to N, which serves as the proof strength level of the user's risk request in the current period. Otherwise, the frequency risk value, device risk value, network environment risk value, and comprehensive risk value of the risk request are obtained from the risk data and recorded as the risk parameters of the risk request. The verification strength of the user's risk request to access sensitive data in the current period is analyzed to obtain the verification strength data.

6. The AI-enhanced zero-knowledge proof-based sensitive data access verification method according to claim 5, characterized in that, The specific process of analyzing the verification strength of a user's risky requests to access sensitive data in the current period in step S2 includes: Set a feature value m, divide the range from 0 to 1 into m equal numerical ranges, count the number of times each risk parameter value of a risk request falls within a different numerical range, calculate the probability distribution value of the risk request in each numerical range, and calculate the platform's strength stability value C for the risk request. The specific calculation formula is as follows: ， Where, p i Let be the probability distribution value of the risk request in the i-th numerical range; Calculate the intensity harmonic value T of the risk request, calculate the harmonic constant ζ of the risk request = (m+1) / 2, and calculate the verification intensity value V of the risk request based on the intensity harmonic value T, the harmonic constant ζ, and the intensity stability value C. The verification strength value V is rounded up to obtain V'. The value corresponding to V' is taken as the proof strength level of the user's risk request in the current period. The proof strength levels of the user's risk requests in the current period are aggregated to obtain the verification strength data of the risk request.

7. The AI-enhanced zero-knowledge proof-based sensitive data access verification method according to claim 1, characterized in that, Step S1 includes: The sensitivity level of sensitive data in the platform is obtained, and a sensitivity level threshold is set. When the sensitivity level of sensitive data is greater than the preset sensitivity level threshold, it is determined that the user's access request to sensitive data in the current period is risky and the access request is recorded as a risky request. Conversely, the access request record of the user's access request to sensitive data in the platform is obtained, and the access risk level of the access request is evaluated based on the access request record to obtain the risk data of the risky request.

8. The AI-enhanced zero-knowledge proof-based sensitive data access verification method according to claim 7, characterized in that, The specific process for assessing the access risk level of the access request in step S1 includes: Set the unit duration, obtain the total number of access requests A initiated by the user in the access request record, divide the total duration of the access request record by the unit duration to obtain the characteristic duration value T´ of the access request record, and calculate the request frequency value B=A / T´ of the user in the access request record. Obtain the user's historical access request records within a historical period from the platform, and extract the average value μ of the user's request frequency from the historical access request records. a and standard deviation σ a Calculate the user request frequency threshold B´=μ a +k×σ a , where k is a preset weighting coefficient; Calculate the frequency risk value of access requests E=min(1,B / B´), obtain the total number of times the user logs into the platform using the device in the current period from the access request records, obtain the network type of the network used by the user to log into the platform in the current period from the access request records, and calculate the device risk value F and network environment risk value H of the access requests. Based on the frequency risk value E, the device risk value F, and the network environment risk value H, the risk data of the user's access request in the current period is determined as to whether the request is risky.

9. The AI-enhanced zero-knowledge proof-based sensitive data access verification method according to claim 8, characterized in that, The specific process for determining whether a user's access request within the current period is risky in step S1 includes: When the frequency risk value E, the device risk value F, and the network environment risk value H are all less than the corresponding preset thresholds, the comprehensive risk value D of the access request is calculated, and the comprehensive risk threshold d is set. When D > d, it is determined that the user's access request to sensitive data in the current period is risky, and the access request is recorded as a risky request. Otherwise, it is determined that the access request is not risky. When the frequency risk value E, the device risk value F, or the network environment risk value H is greater than the corresponding preset threshold, the access request is determined to be risky and recorded as a risky request. The sensitivity level of sensitive data and the frequency risk value E, device risk value F, network environment risk value H, and comprehensive risk value D of access requests are obtained and aggregated to obtain risk data of risk requests.

10. The AI-enhanced zero-knowledge proof-based sensitive data access verification method according to claim 1, characterized in that, Step S4 includes: Obtain the optimal zero-knowledge proof algorithm for verifying the user's risky requests within the current period, use the optimal zero-knowledge proof algorithm to perform zero-knowledge proof on the risky requests, and obtain proof π. After the server in the platform accepts the proof π, it performs access verification on the user's risky request, obtains a verification boolean value, and determines whether the platform should refuse the user's risky request based on the verification boolean value. When the platform determines that a user's risk request is to be denied access, it will refuse the user's access to sensitive data on the platform. Otherwise, it will generate a temporary access token, which the user can use to access sensitive data within the platform.

Images