Method and device for generating and verifying data property right attribution certificate

Abstract

The application relates to a data property right ownership proof generation and verification method and device. The method comprises the following steps: in response to a data generation moment, generating a property right stamp object for the data by a preset property right stamp generation logic in a secure environment of a local device generating the data; and inseparably binding the property right stamp object and the data to generate protected data carrying an ownership proof. The property right stamp object at least comprises a producer identity, a generation time stamp, a generation device fingerprint, a hash value generated based on data content and preset ownership rule information, and the ownership rule information is used for defining a use constraint on the data. The method generates a five-element cryptography property right stamp in a local secure environment at a data generation moment and strongly binds the five-element cryptography property right stamp with the data, so that any third party can independently verify data ownership and integrity offline, data ownership is technically forced to belong to the data producer, and a reliable basis is provided for data whole-life-cycle compliance management and value distribution.

Description

Technical Field

[0001] This application relates to the fields of data security and data management technology, and in particular to a method and apparatus for generating and verifying data ownership certificates. Background Technology

[0002] With the rapid development of big data, cloud computing, and artificial intelligence technologies, data has become a core factor of production. Individuals generate massive amounts of data in their daily lives and work through various smart devices and application platforms, such as browsing history, location data, health indicators, and consumption preferences. This data contains immense value, but a serious asymmetry exists between data producers, controllers, and processors regarding data ownership.

[0003] Currently, the definition of data ownership mainly relies on legal principles, such as the Personal Information Protection Law or the EU's General Data Protection Regulation (GDPR). These regulations clearly stipulate that data subjects have the right to know, decide, access, correct, and delete their personal data. However, these legal rights lack effective enforcement mechanisms at the technical level. In traditional data management, once data is generated and collected by a platform, the data generator essentially loses control over the subsequent flow and use of the data. Existing technologies, such as data watermarking, are mainly used to trace the source of data leaks, focusing on copyright tracking after data distribution rather than establishing ownership at the moment of data generation. Digital rights management (DRM) technology targets established content products, such as movies, music, and e-books, aiming to control their copying and dissemination; its model is not suitable for raw, unstructured personal data. Blockchain-based evidence storage technology can ensure the immutability of stored information afterward, but it does not define the ownership relationship of the stored content and often requires hashing the data on the blockchain, failing to solve the problem of real-time ownership confirmation at the moment of data generation. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer equipment, and storage medium for generating and verifying data ownership certificates that can attach an immutable cryptographic ownership certificate to data the moment it is generated, and allow any third party to independently verify the certificate.

[0005] A method for generating and verifying data ownership certificates, comprising: In response to the moment the data is generated, a property stamp object is generated for the data in the secure environment of the local device that generated the data, through a preset property stamp generation logic; The title stamp object is inseparably bound to the data to generate protected data carrying proof of ownership. The ownership stamp object includes at least the generator's identity identifier, generation timestamp, generation device fingerprint, hash value generated based on data content, and preset ownership rule information, which is used to define the constraints on the use of the data.

[0006] A device for generating and verifying data ownership certificates, the device comprising: The property stamp generation module is used to generate a property stamp object for the data at the moment of data generation in the secure environment of the local device, through a preset property stamp generation logic. The property stamp object includes at least the generator's identity identifier, generation timestamp, generation device fingerprint, hash value generated based on the data content, and preset ownership rule information. The binding module is used to bind the property stamp object to the data in an inseparable manner in order to generate protected data carrying proof of ownership; The verification module provides independent verification capabilities to any third party. These capabilities include extracting the property stamp object from the protected data, recalculating the hash value of the data content and comparing it with the record hash value, and verifying the signature validity of the property stamp object using the producer's identity.

[0007] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps: In response to the moment the data is generated, a property stamp object is generated for the data in the secure environment of the local device that generated the data, through a preset property stamp generation logic; The title stamp object is inseparably bound to the data to generate protected data carrying proof of ownership. The ownership stamp object includes at least the generator's identity identifier, generation timestamp, generation device fingerprint, hash value generated based on data content, and preset ownership rule information, which is used to define the constraints on the use of the data.

[0008] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, performs the following steps: In response to the moment the data is generated, a property stamp object is generated for the data in the secure environment of the local device that generated the data, through a preset property stamp generation logic; The title stamp object is inseparably bound to the data to generate protected data carrying proof of ownership. The ownership stamp object includes at least the generator's identity identifier, generation timestamp, generation device fingerprint, hash value generated based on data content, and preset ownership rule information, which is used to define the constraints on the use of the data.

[0009] The aforementioned method and apparatus for generating and verifying data ownership certificates generate a property stamp object containing the producer's identity, timestamp, device fingerprint, data hash, and ownership rules within the secure environment of the local device at the instant the data is generated, and binds it inseparably to the data. This mechanism advances the confirmation of the data producer's identity to the very beginning of the data lifecycle and ensures the unforgeability, immutability, and strong correlation with the original data through cryptographic means. Since the property stamp object is self-contained and self-verifiable, any third party subsequently acquiring the data can independently verify the integrity of the data ownership offline without relying on any centralized server or data generation platform. This solution technically enforces the principle that data belongs to the producer, providing a solid, reliable, and independently verifiable technical foundation for the compliant management and value allocation of data elements throughout their entire lifecycle, including collection, circulation, transaction, and use. It effectively solves the problems raised in the background technology, such as unclear data ownership, difficulty in establishing rights, and reliance on centralized platforms for verification. Attached Figure Description

[0010] Figure 1 This is an application scenario diagram of a method for generating and verifying data ownership certificates in one embodiment; Figure 2 This is a flowchart illustrating the method for generating and verifying data ownership certificates in one embodiment; Figure 3 This is a structural block diagram of a data ownership certificate generation and verification device in one embodiment; Figure 4 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0011] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0012] The method for generating and verifying data ownership certificates provided in this application can be applied to, for example... Figure 1In the application environment shown, in a typical application scenario, the data producer generates data through various applications on terminal 102, such as taking photos through a camera application, recording heart rate data through a health monitoring application, and writing text through a document editing application. The solution in this application is integrated as a low-level system service or software development kit into the operating system or specific application of terminal 102. This solution is triggered the instant data is generated, such as when the shutter is pressed, sensor readings are updated, or a file is saved. The secure environment of terminal 102, such as a trusted execution environment or a secure chip, then generates a property stamp object containing the data producer's public key, a high-precision timestamp, a device fingerprint, a data content hash value, and preset ownership rules, and signs it with the user's private key. Subsequently, this property stamp object is bound to the original data file or data stream, forming protected data carrying ownership proof. This protected data can be stored locally or transmitted over a network to server 104 or other terminals. When server 104 or any third party wishes to use or process the data, it can first execute an independent verification process. This involves extracting the ownership stamp object, recalculating the hash, and verifying the signature, confirming the ownership and integrity of the data without relying on terminal 102 or any centralized service. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. Server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0013] In one embodiment, such as Figure 2 As shown, a method for generating and verifying data ownership certificates is provided, which can be applied to... Figure 1 Taking the terminal in the example, the following content will be used for explanation: Step 202: In response to the moment the data is generated, in the secure environment of the local device that generated the data, a property stamp object is generated for the data through a preset property stamp generation logic.

[0014] The moment of data generation refers to the instant when data is first created or collected on the local device. Examples include the moment a camera sensor captures a frame and generates an image file, the moment a user clicks to save a document, or the moment an application collects a sensor reading via an API and prepares to store it. The secure environment of the local device refers to an isolated area on the device that ensures the confidentiality and integrity of code and data. Examples include a trusted execution environment under the ARM architecture, a secure enclave on Apple devices, or a dedicated hardware security module. Executing the proprietary stamp generation logic within this secure environment ensures that core operations, especially cryptographic operations involving user private keys, are protected from interference and theft by other malware or the operating system on the device. The preset proprietary stamp generation logic is a program module pre-deployed in the secure environment. It is configured to be invoked the instant the data is generated and assemble a data structure, namely a proprietary stamp object, according to a predetermined process. This proprietary stamp object is a data set containing specific fields of information, including at least the generator's identity, a generation timestamp, a generating device fingerprint, a hash value generated based on the data content, and preset ownership rules. The ownership rules define the usage constraints for subsequent access, copying, transmission, analysis, commercialization, and other specific operations on the data.

[0015] Step 204: Inseparably bind the property stamp object to the data to generate protected data carrying proof of ownership.

[0016] After the title stamp object is generated, this method does not simply store it as an independent file. Instead, it uses technical means to establish a strong logical association between the title stamp object and the original data, ensuring that any access to or processing of the data necessarily involves or is aware of the existence of the title stamp object. This binding method aims to ensure that the ownership certificate of the data flows along with the data itself, and any entity that obtains a copy of the data also obtains its title stamp object. The final product generated is the protected data, which is a logical whole containing the original data content and the title stamp object, and its format depends on the specific binding method.

[0017] In this embodiment, by precisely timing the generation of the property stamp object to the moment the data is generated and completing this process within the secure environment of the local device, a trustworthy and cryptographically strong association is established between the data and its producer from the very beginning. This association is solidified through a five-element property stamp structure comprising the producer's identity, timestamp, device fingerprint, data hash, and ownership rules. Subsequent inseparable binding operations make this ownership proof an integral part of the data. Therefore, this method technically establishes a traceable and verifiable property boundary for personal data, laying a solid technical foundation for the division of rights and responsibilities in subsequent data flow, use, and transactions.

[0018] In one embodiment, the producer identity includes a user public key generated by the national cryptographic algorithm SM2 or the Elliptic Curve Digital Signature Algorithm ECDSA, and the user private key corresponding to the user public key is configured to be stored and used only within the secure zone of the local device for cryptographic signing of the property stamp object.

[0019] In this embodiment, the producer identity is implemented using asymmetric cryptography. The producer identity itself is the user's public key, which can be generated using the SM2 algorithm or ECDSA algorithm. The private key paired with the public key serves as the core secret for proving data ownership, and its security is paramount. Therefore, the private key is strictly limited to being generated, stored, and used only within the secure zone of the local device, such as a trusted execution environment, secure element, or hardware security module, and never leaves this secure zone in plaintext. Once the property stamp object is assembled, the generation logic calls the private key within the secure zone to digitally sign the entire content of the property stamp object or a combination of key fields. This signature value can be stored as part of the property stamp object. This design achieves two key security objectives: first, the private key is never exposed, greatly reducing the risk of identity misuse due to private key leakage; second, since the private key is controlled only by the producer and resides on their personal device, no third party can forge a valid property stamp object signed by that private key, thus ensuring the non-repudiation of the property stamp object and the authenticity of data ownership. In the subsequent verification process, the verifier only needs to use the producer's identity identifier publicly disclosed in the property stamp object to verify the validity of the signature, without having to access the private key.

[0020] This embodiment significantly enhances the security and credibility of ownership proof by explicitly defining the cryptographic implementation of the producer's identity and employing a hardware-level isolation protection strategy for the private key. It effectively prevents identity forgery and man-in-the-middle attacks, providing core security guarantees for the reliability of the entire data ownership system.

[0021] In one embodiment, the hash value generated based on the data content is calculated by using the SHA-256 hash algorithm on the original content of the data; after the property stamp object is inseparably bound to the data, any modification to the data will result in a recalculated hash value that is inconsistent with the hash value in the property stamp object.

[0022] This embodiment specifically defines the algorithm for generating the hash value of the data content in the property stamp object and its function. At the moment the data is generated, the property stamp generation logic reads the complete original data content and performs a one-way calculation using the SHA-256 secure hash algorithm to generate a fixed-length hash value. The characteristics of the SHA-256 algorithm mean that even a change in a single bit of the original data will cause a significant and unpredictable change in the calculated hash value—the avalanche effect. After the property stamp object is bound to the data, any modification to the data content, whether unintentional data corruption or malicious content tampering, will cause the recalculated hash value based on the modified data to mismatch with the original hash value stored in the property stamp object. This mechanism provides a highly efficient and reliable technical means for data integrity verification. The verifier does not need to compare the massive original data file itself; they only need to compare whether the two hash values ​​are consistent to determine whether the data has undergone any changes since the property stamp was generated.

[0023] This embodiment adopts the industry-standard and highly secure SHA-256 hash algorithm, and uses data hash as one of the core elements of the property stamp. It establishes an unbreakable cryptographic binding relationship between data content and ownership proof, ensuring data integrity and tamper resistance. This makes the property stamp not only a declaration of ownership, but also proof that the data has not been contaminated.

[0024] In one embodiment, the generated timestamp is a high-precision timestamp, and the multi-source confirmed timestamp is jointly confirmed and generated by the local device time, the network time source, and an optional blockchain timestamp service.

[0025] This embodiment further refines the method for obtaining the timestamp to improve its reliability and accuracy. The timestamp is used to record the precise moment of data generation, which is crucial for determining the order of data ownership and resolving potential ownership disputes. To prevent the unreliability of a single time source—for example, the local device time might be maliciously recalled by the user, or the network time protocol server might be subject to a man-in-the-middle attack—this method employs a multi-source confirmation strategy. Specifically, when obtaining the timestamp, the ownership stamp generation logic simultaneously or sequentially obtains time information from the local device clock and one or more trusted network time protocol servers. Where conditions permit, a notarization transaction containing a data hash can be initiated to the public blockchain network, and the time when the transaction is confirmed by the blockchain network can be used as an auxiliary reference timestamp. The generation logic compares and arbitrates the data from multiple time sources, using strategies such as median, weighted average, or taking the latest value, to generate a final timestamp with nanosecond-level precision, which is then recorded in the ownership stamp object. Nanosecond-level precision ensures that, in high-concurrency data generation scenarios, the ownership stamps of different data items are unique and distinguishable in the time dimension.

[0026] This embodiment overcomes the shortcomings of single time sources being easily tampered with or having deviations by introducing a multi-source confirmation and nanosecond-level precision timestamp generation mechanism. It greatly enhances the objectivity, accuracy, and non-repudiation of the time information in the property rights stamp, providing a solid basis for the time-series proof of data property rights.

[0027] In one embodiment, the attribution rule information includes four basic types: exclusive, authorized sharing, public, and paid. It also supports further subdivision of application scenario authorization under the basic types. The application scenario authorization includes at least training artificial intelligence models, statistical analysis, business analysis, and academic research.

[0028] This embodiment elaborates on the attribution rule information, one of the five elements of a property stamp. Attribution rule information is a set of metadata pre-defined by the data producer to guide and constrain the behavior of subsequent data processors. It clearly defines the usage permissions and restrictions of the data from its inception. This information includes at least four basic types: exclusive, meaning the data is for the producer's exclusive use only, and any unauthorized access or use is prohibited; authorized sharing, meaning the producer allows specific individuals or groups to use the data under specific conditions; public, meaning the producer contributes the data to the public domain, allowing anyone to use it freely without infringing on other rights; and paid, meaning any use of the data requires payment to the producer. To provide more granular control, this method supports further subdivision of application scenario authorization under the basic types. For example, when the basic type is authorized sharing or paid, the producer can further specify whether the data is allowed or prohibited for use in specific scenarios such as training artificial intelligence models, statistical analysis, business analysis, or academic research. This fine-grained authorization management allows data producers to flexibly define the boundaries of their data usage according to their own wishes and the sensitivity of the data.

[0029] This embodiment defines a multi-level ownership rule information structure, which closely integrates data usage rights management with property rights declaration. It achieves a leap from simple binary division of permissions to refined and scenario-based authorization management, providing data producers with direct and effective technical tools to exercise their control and decision-making rights over their personal data. It also lays the foundation for building a compliant and orderly data circulation ecosystem.

[0030] In one embodiment, the ownership stamp object is inseparably bound to the data, specifically including at least one of the following methods: For file formats that support metadata embedding, the property stamp object is embedded as metadata into the file structure. For example, for image formats such as JPEG, PNG, and TIFF, the property stamp object can be serialized into text or binary data blocks of a specific format and written into the file's EXIF, IPTC, or XMP metadata segment; for audio formats such as MP3 and AAC, it can be written into ID3 tags; and for document formats such as PDF and DOCX, it can be written into their custom attributes or extended XML structures. The advantage of this approach is that the property stamp becomes part of the file format, resulting in good compatibility and ease of reading by software that supports the format.

[0031] For data streams that do not support metadata embedding, the data and the title stamp object are encapsulated in the same container format. For raw data streams continuously generated by sensors, video streams, or proprietary format files whose metadata cannot be modified, a custom container format can be created or an existing general-purpose container format such as Matroska can be used. The container format can divide the data stream into multiple tracks or data blocks, and the title stamp object can be encapsulated as an independent synchronous data track in the file header or a specific data block. When the receiver parses the container, it can obtain both the data stream and the associated title stamp object simultaneously.

[0032] This approach separates the property stamp object from the data and establishes a strong association between them using a globally unique identifier. Any data access request is configured to force the synchronous return of its associated property stamp object. This method is suitable for scenarios where data and property stamps need to be physically stored separately due to system architecture or performance reasons. When a property stamp is generated, the system simultaneously generates a globally unique identifier and records it in both the property stamp object and the data object's storage records. In the data management system, when any access request for that data is received, the system's data access interface layer is forced to retrieve and return the associated property stamp object from the property stamp repository based on this globally unique identifier while performing data read operations. If the corresponding property stamp object cannot be retrieved, the access request can be directly rejected or an error message can be returned. This method logically enforces the inseparable relationship between data and property stamps.

[0033] This embodiment provides a variety of binding strategies adaptable to different data formats and system architectures, ensuring the broad applicability of this method. Whether it's structured files, unstructured data streams, or a separate storage architecture, there are corresponding technical means to ensure a strong association between the ownership stamp and the data. This ensures that any legitimate access to the data cannot bypass the perception and verification of its ownership proof, thus achieving truly inseparable binding.

[0034] In one embodiment, the method further includes an independent verification process for the protected data, which is performed offline by any third party without relying on the data-generating platform or centralized system, including: Extracting the title stamp object from the protected data. After obtaining the protected data, the verifier first needs to perform the corresponding reverse operation to extract the title stamp object based on its binding method. For example, reading from the file metadata segment or parsing the corresponding track data from the container format. If extraction fails, it indicates that the data format is invalid or the title stamp has been lost.

[0035] The hash value of the current data content is recalculated and compared with the hash value recorded in the property stamp object. The verifier uses the same SHA-256 hash algorithm as when it was generated to calculate a hash value for the current data content. This hash value is then compared bit by bit with the original hash value read from the property stamp object. If they are exactly the same, it proves that the data has not been tampered with since the property stamp was generated; if they are inconsistent, the verification fails, indicating that the data integrity has been compromised.

[0036] The validity of the signature on the property stamp object is verified using the producer's identity identifier within the property stamp object. The verifier extracts the producer's identity identifier, i.e., the user's public key, from the property stamp object and uses this public key and the corresponding digital signature algorithm to verify the digital signature on the property stamp object. This verification process confirms whether the property stamp object was indeed issued by the producer holding the corresponding private key.

[0037] If the hash values ​​match and the signature verification passes, the data ownership is determined to be genuine and unaltered. Only when both core verification steps are successfully completed can the verifier be certain that: first, the data content currently held is completely consistent with the data at the time of its creation and has not been tampered with; second, the data's ownership stamp was issued by its claimed creator. When both conditions are met simultaneously, a positive determination can be made regarding the data's ownership and integrity.

[0038] This embodiment details an independent, offline, and decentralized verification process, which is one of the core advantages of this method. This verification process does not rely on any third-party proof services or online verification interfaces of data generation platforms; any entity that obtains a copy of the data can complete the process independently. This characteristic frees data ownership verification from being limited to specific technology platforms or commercial entities, greatly enhancing the credibility, robustness, and universality of this solution, and providing key technical support for building an open, mutually trusted, and self-verifiable data circulation network.

[0039] It should be understood that, although Figure 2The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0040] In one embodiment, such as Figure 3 As shown, a device for generating and verifying data ownership certificates is provided, including: a property stamp generation module 302, a binding module 304, and a verification module 306, wherein: The property stamp generation module 302 is used to generate a property stamp object for the data at the moment of data generation in the secure environment of the local device through a preset property stamp generation logic. The property stamp object includes at least the generator's identity identifier, generation timestamp, generation device fingerprint, hash value generated based on the data content, and preset ownership rule information.

[0041] Binding module 304 is used to bind the property stamp object to the data inseparably to generate protected data carrying ownership proof.

[0042] Verification module 306 is used to provide independent verification capabilities to any third party. The independent verification capabilities include extracting the property stamp object from the protected data, recalculating the hash value of the data content and comparing it with the hash value of the record, and verifying the signature validity of the property stamp object using the producer's identity.

[0043] In one embodiment, the producer identity generated in the property stamp generation module includes a user public key generated by the national cryptographic SM2 algorithm or ECDSA, and the user private key corresponding to the user public key is configured to be stored and used only in the secure zone of the local device for cryptographic signing of the property stamp object.

[0044] In one embodiment, the property stamp generation module is used to calculate the original content of the data using the SHA-256 hash algorithm to obtain a hash value generated based on the data content.

[0045] In one embodiment, the timestamp generated in the property stamp generation module is a high-precision timestamp, and the multi-source confirmed timestamp is jointly confirmed and generated by the local device time, the network time source, and the optional blockchain timestamp service.

[0046] In one embodiment, the ownership rule information preset in the property stamp generation module includes four basic types: exclusive, authorized sharing, public, and paid. It also supports application scenario authorization under the basic types, and the application scenario authorization includes at least training artificial intelligence models, statistical analysis, business analysis, and academic research.

[0047] In one embodiment, the binding module is specifically used to perform at least one of the following operations: for file formats that support metadata embedding, embed the property stamp object as metadata into the file structure of the data; for data streams that do not support metadata embedding, encapsulate the data and the property stamp object in the same container format; store the property stamp object and the data separately, and establish a strong association between the two through a globally unique identifier, and configure any access request to the data to force the synchronous return of its associated property stamp object.

[0048] In one embodiment, the verification module is specifically used to extract the property stamp object from the protected data; recalculate the hash value of the current data content and compare it with the hash value recorded in the property stamp object; use the producer identity identifier in the property stamp object to verify the validity of the signature of the property stamp object; and when the hash value comparison is consistent and the signature verification is successful, determine that the ownership of the data is genuine and has not been tampered with.

[0049] Specific limitations regarding the device for generating and verifying data ownership certificates can be found in the limitations on the methods for generating and verifying data ownership certificates described above, and will not be repeated here. Each module in the aforementioned device for generating and verifying data ownership certificates can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0050] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 4As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When executed by the processor, the computer program implements a method for generating and verifying proof of data ownership. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0051] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0052] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to perform the following steps: In response to the moment the data is generated, a property stamp object is generated for the data in the secure environment of the local device that generated the data, through a preset property stamp generation logic; The title stamp object is inseparably bound to the data to generate protected data carrying proof of ownership. The ownership stamp object includes at least the generator's identity identifier, generation timestamp, generation device fingerprint, hash value generated based on data content, and preset ownership rule information, which is used to define the constraints on the use of the data.

[0053] In one embodiment, when the processor executes the computer program, it further implements the following steps: materializing the producer identity into a user public key generated by the national cryptographic SM2 algorithm or the Elliptic Curve Digital Signature Algorithm ECDSA, and configuring the user private key corresponding to the user public key to be stored and used only in the secure zone of the local device for cryptographic signing of the property stamp object.

[0054] In one embodiment, when the processor executes the computer program, it further performs the following steps: calculating the original content of the data using the SHA-256 hash algorithm to obtain a hash value generated based on the data content.

[0055] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor: In response to the moment the data is generated, a property stamp object is generated for the data in the secure environment of the local device that generated the data, through a preset property stamp generation logic; The title stamp object is inseparably bound to the data to generate protected data carrying proof of ownership. The ownership stamp object includes at least the generator's identity identifier, generation timestamp, generation device fingerprint, hash value generated based on data content, and preset ownership rule information, which is used to define the constraints on the use of the data.

[0056] In one embodiment, when the computer program is executed by the processor, it further implements the following steps: materializing the producer identity into a user public key generated by the national cryptographic SM2 algorithm or the Elliptic Curve Digital Signature Algorithm ECDSA, and configuring the user private key corresponding to the user public key to be stored and used only in the secure zone of the local device for cryptographic signing of the property stamp object.

[0057] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: calculating the original content of the data using the SHA-256 hash algorithm to obtain a hash value generated based on the data content.

[0058] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory, programmable read-only memory, electrically programmable read-only memory, electrically erasable programmable read-only memory, or flash memory. Volatile memory can include random access memory or external cache memory. By way of illustration and not limitation, random access memory is available in various forms, such as static random access memory, dynamic random access memory, synchronous dynamic random access memory, dual data rate synchronous dynamic random access memory, enhanced synchronous dynamic random access memory, synchronous link dynamic random access memory, memory bus direct random access memory, direct memory bus dynamic random access memory, and memory bus dynamic random access memory, etc.

[0059] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for generating and verifying data ownership certificates, characterized in that, include: In response to the moment the data is generated, in the secure environment of the local device that generated the data, a property stamp object is generated for the data through a preset property stamp generation logic; The property stamp object is inseparably bound to the data to generate protected data carrying proof of ownership; The property stamp object includes at least the generator's identity identifier, the generation timestamp, the generation device fingerprint, a hash value generated based on the data content, and preset ownership rule information. The ownership rule information is used to define the usage constraints on the data.

2. The method according to claim 1, characterized in that, The producer identity includes a user public key generated by the national cryptographic SM2 algorithm or the Elliptic Curve Digital Signature Algorithm ECDSA. The user private key corresponding to the user public key is configured to be stored and used only within the secure zone of the local device for cryptographic signing of the property stamp object.

3. The method according to claim 1, characterized in that, The hash value generated based on the data content is obtained by calculating the original content of the data using the SHA-256 hash algorithm; Once the property stamp object is inseparably bound to the data, any modification to the data will result in a recalculated hash value that is inconsistent with the hash value in the property stamp object.

4. The method according to claim 1, characterized in that, The generated timestamp is a high-precision timestamp, and the multi-source confirmed timestamp is jointly confirmed and generated by the local device time, the network time source, and an optional blockchain timestamp service.

5. The method according to claim 1, characterized in that, The attribution rules information includes four basic types: exclusive, authorized sharing, public, and paid. It also supports further subdivision of application scenario authorization under the basic types. The application scenario authorization includes at least training artificial intelligence models, statistical analysis, business analysis, and academic research.

6. The method according to claim 1, characterized in that, The process of binding the property stamp object to the data in an inseparable manner specifically includes at least one of the following methods: For file formats that support metadata embedding, the property stamp object is embedded as metadata into the file structure of the data; For data streams that do not support metadata embedding, the data and the property stamp object are encapsulated in the same container format; The property stamp object is stored separately from the data, and a strong association is established between the two through a globally unique identifier. Any access request to the data is configured to force the synchronous return of its associated property stamp object.

7. The method according to any one of claims 1 to 6, characterized in that, It also includes an independent verification process for the protected data, which is performed offline by any third party without relying on the data-generating platform or centralized system, including: Extract the property stamp object from the protected data; Recalculate the hash value of the current data content and compare it with the hash value recorded in the property stamp object; The validity of the signature of the property stamp object is verified using the producer's identity identifier in the property stamp object. If the hash values ​​match and the signature verification passes, it is determined that the ownership of the data is genuine and has not been tampered with.

8. A device for generating and verifying data ownership certificates, characterized in that, The device includes: The property stamp generation module is used to generate a property stamp object for the data at the moment of data generation in the secure environment of the local device through a preset property stamp generation logic; the property stamp object includes at least the generator identity identifier, generation timestamp, generation device fingerprint, hash value generated based on the data content, and preset ownership rule information; The binding module is used to bind the property stamp object to the data in an inseparable manner to generate protected data carrying ownership proof; The verification module is used to provide independent verification capabilities for any third party. The independent verification capabilities include extracting the property stamp object from the protected data, recalculating the hash value of the data content and comparing it with the hash value of the record, and verifying the signature validity of the property stamp object using the producer's identity identifier.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images