Access identity verification method, device, electronic device and storage medium

Abstract

The present disclosure proposes a method, device, electronic device and storage medium for verifying access identity, including: receiving authorization information sent by a data owner, the authorization information at least including the permission storage path of the data access object in a pre-built permission storage data structure; obtaining the first address of the data access object; generating an identity certificate of the data access object according to the authorization information and the first address; sending the identity certificate to a verification system to verify the access identity of the data access object. In this way, it is possible to verify the identity of the data access object through the permission storage path in the verification system without directly verifying the identity of the data owner, without exposing the address or identification of the data owner, preventing unauthorized third parties from stealing or abusing data resources, and providing security for data security and privacy protection.

Description

Technical Field

[0001] The present disclosure relates to the field of trusted business support technology, and in particular to an access identity verification method, device, electronic device and storage medium. Background Art

[0002] Blockchain systems generally run in a relatively open network environment. Their open and transparent characteristics also bring about a series of user privacy and system security issues.

[0003] At present, the access authentication of blockchain data generally adopts the traditional Discretionary Access Control (DAC) method, that is, to determine who can access it by themselves. In order to further refine the access control strategy, the general solution is to set up an Access Control List (ACL). When the visitor applies for access, the visitee checks the user's address or other identity proof and compares it with the access control list one by one for identity authentication. This verification method makes it easy for the addresses of the visitor and the visitee to be obtained, and there is a risk of attack and data leakage. Summary of the invention

[0004] The present disclosure aims to solve one of the technical problems in the related art at least to some extent.

[0005] To this end, an object of the present disclosure is to propose an access identity verification method applied to data access objects.

[0006] A second objective of the present disclosure is to provide an access identity verification method, which is applied to a verification system.

[0007] The third objective of the present disclosure is to provide a device for verifying access identity.

[0008] A fourth objective of the present disclosure is to provide a device for verifying access identity.

[0009] A fifth objective of the present disclosure is to provide an electronic device.

[0010] A sixth object of the present disclosure is to provide a non-transitory computer-readable storage medium.

[0011] A seventh objective of the present disclosure is to provide a computer program product.

[0012] To achieve the above-mentioned purpose, the first aspect of the present disclosure proposes a method for verifying an access identity, which is applied to a data access object, including: receiving authorization information sent by a data-owning object, the authorization information at least including a permission storage path of the data access object in a pre-built permission storage data structure; obtaining a first address of the data access object; generating an identity certificate of the data access object based on the authorization information and the first address; and sending the identity certificate to a verification system to verify the access identity of the data access object.

[0013] According to an embodiment of the present disclosure, the verifying the access identity of the data access object includes: verifying the access identity of the data access object based on the permission storage path.

[0014] According to one embodiment of the present disclosure, generating the identity certificate of the data access object based on the authorization information and the first address includes: obtaining the second address of the proxy object; and generating the identity certificate of the data access object based on the second address, the authorization information, and the first address.

[0015] According to one embodiment of the present disclosure, the method further includes: obtaining the historical transaction times between the proxy object and the data owner object; and generating an identity certificate of the data access object based on the historical transaction times, the second address, the authorization information, and the first address.

[0016] According to one embodiment of the present disclosure, sending the identity certificate to the verification system includes: sending the identity certificate to the verification system through a proxy object.

[0017] According to one embodiment of the present disclosure, generating the identity certificate of the data access object based on the authorization information and the first address includes: obtaining a certificate generation key and a data integrity identifier based on the authorization information; calculating the data integrity identifier, the certificate generation key, the first address and the authority storage path based on a proof generation function to generate the identity certificate.

[0018] According to one embodiment of the present disclosure, the method further includes: receiving verification information fed back by the verification system based on the identity certificate; in response to the data access object passing the identity authentication, accessing the data owner object based on the identity certificate.

[0019] According to an embodiment of the present disclosure, accessing the data-owning object based on the identity certificate includes: sending the identity certificate to a proxy object, and accessing the data-owning object based on the identity certificate through the proxy object.

[0020] According to one embodiment of the present disclosure, after the identity certificate is sent to the verification system for identity verification, the number of historical transactions increases by 1.

[0021] According to one embodiment of the present disclosure, a permission storage data structure of the data owner object is generated, including: obtaining the account addresses of all objects that have permission to access the data of the data owner object through the data owner object; for any account address, calculating the account address based on a hash algorithm through the data owner object to obtain a target hash value; using the target hash value as a leaf object, and generating the permission storage data structure based on all leaf objects through the data owner object.

[0022] According to one embodiment of the present disclosure, the method also includes: after generating the permission storage data structure, sending the certificate generation key, proof generation function and permission storage path corresponding to each leaf object to the object corresponding to each leaf object that has the permission to access the data of the data owner object through the data owner object.

[0023] To achieve the above-mentioned purpose, the second aspect of the implementation of the present disclosure proposes a method for verifying access identity, which is applied to a verification system, including: obtaining an identity certificate sent by a data access object; calling a certificate verification key and an identity certificate verification algorithm in the verification system to verify the validity of the permission storage path in the identity certificate; in response to passing the validity verification, sending verification pass information to the data access object.

[0024] According to one embodiment of the present disclosure, generating the certificate verification key and the certificate generation key includes: the data owner object obtains a preset key generation algorithm; the data owner object generates the certificate verification key and the certificate generation key based on the key generation algorithm.

[0025] To achieve the above-mentioned purpose, the third aspect embodiment of the present disclosure proposes an access identity verification device, which is applied to a data access object, including: a receiving module, used to receive authorization information sent by a data owner object, and the authorization information at least includes a permission storage path of the data access object in a pre-built permission storage data structure; an acquisition module, used to obtain a first address of the data access object; a generation module, used to generate an identity certificate of the data access object based on the authorization information and the first address; and a sending module, used to send the identity certificate to a verification system to verify the access identity of the data access object.

[0026] To achieve the above-mentioned purpose, the fourth aspect embodiment of the present disclosure proposes an access identity verification device, which is applied to a verification system, including: a receiving module, used to obtain an identity certificate sent by a data access object; a matching module, used to call the certificate verification key and the identity certificate verification algorithm in the verification system to verify the validity of the authority storage path in the identity certificate; and a verification module, used to send verification pass information to the data access object in response to the validity verification passing.

[0027] To achieve the above-mentioned purpose, the fifth aspect embodiment of the present disclosure proposes an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to implement the access identity verification method as described in the first aspect embodiment of the present disclosure, or to implement the access identity verification method as described in the second aspect embodiment.

[0028] To achieve the above-mentioned purpose, the sixth aspect embodiment of the present disclosure proposes a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to implement the access identity verification method as described in the first aspect embodiment of the present disclosure, or to implement the access identity verification method as described in the second aspect embodiment.

[0029] To achieve the above-mentioned purpose, the seventh aspect embodiment of the present disclosure proposes a computer program product, including a computer program, which, when executed by a processor, is used to implement the access identity verification method as described in the first aspect embodiment of the present disclosure, or to implement the access identity verification method as described in the second aspect embodiment.

[0030] In this way, there is no need to authenticate the data owner directly, but to verify it in the verification system through the permission storage path. There is no need to expose the address or identifier of the data owner, preventing unauthorized third parties from stealing or abusing data resources, and providing security for data security and privacy protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a schematic diagram of a method for verifying an access identity according to an embodiment of the present disclosure, which is applied to a data access object;

[0032] Figure 2 It is a schematic diagram of an embodiment of the present disclosure for performing identity authentication and data interaction through a proxy object;

[0033] Figure 3 is a schematic diagram of another access identity verification method according to an embodiment of the present disclosure;

[0034] Figure 4is a schematic diagram of another access identity verification method according to an embodiment of the present disclosure;

[0035] Figure 5 is a schematic diagram of another access identity verification method according to an embodiment of the present disclosure;

[0036] Figure 6 It is a schematic diagram of a method for verifying an access identity according to an embodiment of the present disclosure, which is applied to a verification system;

[0037] Figure 7 It is a schematic diagram of an access identity verification device according to an embodiment of the present disclosure, which is applied to a data access object;

[0038] Figure 8 It is a schematic diagram of an access identity verification device according to an embodiment of the present disclosure, which is applied to a verification system;

[0039] Fig. 9 is a schematic diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0040] Embodiments of the present disclosure are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present disclosure, and should not be construed as limiting the present disclosure.

[0041] The acquisition, storage, use, and processing of data in the technical solution disclosed in this disclosure are in compliance with the relevant provisions of relevant laws and regulations.

[0042] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be considered as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0043] Figure 1 is a schematic diagram of an access identity verification method according to an embodiment of the present disclosure, which is applied to data access objects, such as Figure 1 As shown, the access identity verification method includes the following steps:

[0044] S101, receiving authorization information sent by a data owner, where the authorization information at least includes a permission storage path of the data access object in a pre-built permission storage data structure.

[0045] The access identity verification method of the embodiment of the present application can be applied to the scenario of blockchain identity authentication. The execution subject of the access identity verification of the embodiment of the present application is the data access object. It should be noted that the data access object is the applicant of the data, the data ownership object is the owner of the data, and the data access object and the data ownership object can be multiple, and no limitation is made here. For example, the data access object and the data ownership object can be a computer, a terminal, a cloud server, etc.

[0046] It should be noted that the permission storage data structure in the embodiment of the present disclosure is a data structure for efficiently verifying the integrity and consistency of large data. Through this verification structure, the integrity and consistency of the data can be efficiently verified, even when the data is very large.

[0047] In the embodiment of the present disclosure, the authorization information may include multiple information in addition to the permission storage path, which is not limited here. For example, the authorization information may include the identifier of the data owner, hardware information, etc.

[0048] In the embodiment of the present disclosure, the permission storage data structure is established for each data-owning object based on the data access object with access rights. The permission storage data structure stores all accounts with access rights to the data-owning object, thereby providing a data basis for subsequent identity verification.

[0049] The permission storage path can be used to verify whether a data access object belongs to a certain permission storage data structure.

[0050] In another possible implementation, the permission storage path may also verify whether the data access object has been modified.

[0051] In another possible implementation, after or before obtaining the authorization information, one or more data in the authorization information may be encrypted, or data security may be improved through privacy input.

[0052] S102, obtaining a first address of a data access object.

[0053] In the embodiment of the present disclosure, there may be multiple methods for obtaining the first address of the data access object, which are not limited here.

[0054] In one possible implementation, the first address may also be obtained through a corresponding application of the blockchain, for example, the first address may be obtained through a blockchain browser.

[0055] In another possible implementation method, the first address can also be obtained through a blockchain interface.

[0056] It should be noted that, in order to further protect the privacy of data, the first address of the data access object is encrypted, and the outside world cannot identify the specific access address.

[0057] S103: Generate an identity certificate of the data access object according to the authorization information and the first address.

[0058] It should be noted that the identity certificate is a verification identifier of the data access object. In the embodiment of the present disclosure, there are many methods for generating the identity certificate of the data access object according to the authorization information and the first address, which are not limited here.

[0059] In a possible implementation, the authorization information and the first address may be processed by an identity certificate algorithm to generate an identity certificate. It should be noted that the identity certificate algorithm is designed in advance and may be changed according to actual design requirements, and is not limited here.

[0060] In another possible implementation, the authorization information and the first address may also be input into the identity certificate generation model to generate the identity certificate. It should be noted that the identity certificate generation model is pre-trained and can be stored in the storage space of the electronic device to facilitate retrieval and use when needed.

[0061] S104, sending the identity certificate to the verification system to verify the access identity of the data access object.

[0062] It should be noted that the verification system can be an on-chain verification system that stores the verification contract, and the verification system stores all the permission storage data of the data owner. Verification can be achieved by comparing the identity certificate sent by the data access object with all the permission storage data.

[0063] In the disclosed embodiment, the authorization information sent by the data owner is first received, and the authorization information at least includes the permission storage path of the data access object in the pre-built permission storage data structure, and then the first address of the data access object is obtained, and then the identity certificate of the data access object is generated according to the authorization information and the first address, and finally the identity certificate is sent to the verification system to verify the access identity of the data access object. In this way, it is possible to verify the identity of the data access object through the permission storage path in the verification system without directly authenticating the data owner, without exposing the address or identification of the data owner, preventing unauthorized third parties from stealing or abusing data resources, and providing security for data security and privacy protection.

[0064] In the disclosed embodiment, the access identity of the data access object can be verified based on the permission storage path. In this way, the identity authentication is performed through the permission storage path without exposing the first address of the data access object, which can further improve the security of the identity authentication.

[0065] In one possible implementation, after verification, in order to further ensure the confidentiality of data transmission, the identity certificate can be sent to the proxy object, and then the proxy object can access the target smart contract on the blockchain based on the identity certificate. Figure 2 As shown, Figure 2 This is a schematic diagram of an embodiment of the present disclosure, in which identity authentication and data interaction are performed through a proxy object. The proxy object can be used to perform identity authentication and data interaction, thereby further ensuring the security of the data access object.

[0066] In the above embodiment, the identity certificate of the data access object is generated according to the authorization information and the first address, and the identity certificate of the data access object can also be generated by Figure 3 To explain further, Figure 3 is a schematic diagram of another access identity verification method according to an embodiment of the present disclosure, the method comprising:

[0067] S301, obtaining a second address of a proxy object.

[0068] In the embodiment of the present disclosure, there are many methods for obtaining the second address of the proxy object, which are not limited here.

[0069] In one possible implementation, the second address can also be obtained through a corresponding application of the blockchain, for example, the second address can be obtained through a blockchain browser.

[0070] In another possible implementation method, the second address can also be obtained through a blockchain interface.

[0071] S302: Generate an identity certificate of the data access object based on the second address, the authorization information, and the first address.

[0072] In the disclosed embodiment, the second address of the proxy object is first obtained, and then the identity certificate of the data access object is generated based on the second address, authorization information, and the first address. Thus, identity authentication is performed through the second address of the proxy object without exposing the first address of the data owner object, which can further improve the security of identity authentication.

[0073] In one possible implementation, the historical transaction times between the proxy object and the data owner object may also be obtained, and then an identity certificate of the data access object may be generated based on the historical transaction times, the second address, the authorization information, and the first address.

[0074] It should be noted that the number of historical transactions in the embodiment of the present disclosure is the total number of historical transactions between the proxy object and the data owner object.

[0075] In the disclosed embodiment, after the identity certificate is sent to the verification system for identity verification, the number of historical transactions increases by 1.

[0076] In the above embodiment, the identity certificate of the data access object is generated according to the authorization information and the first address, and the identity certificate of the data access object can also be generated by Figure 4 To explain further, Figure 4 is a schematic diagram of another access identity verification method according to an embodiment of the present disclosure, the method comprising:

[0077] S401, obtaining a certificate generation key and a data integrity identifier according to authorization information.

[0078] It should be noted that the certificate generation key in the embodiment of the present disclosure corresponds to the data owner object one-to-one, and different data owners correspond to different certificate generation keys. Therefore, when a data access object that does not have access rights performs identity authentication, it cannot be verified through the certificate generation key of the data owner object.

[0079] The certificate generation key is sent in advance by the data owner to the data access object, and the specific sending method and sending time node are not limited here. In a possible implementation method, it can be sent when it is determined that the corresponding data access object has access rights.

[0080] It should be noted that the data integrity identifier is an identifier for determining whether the authorization information has been replaced or tampered with.

[0081] S402, calculating the data integrity identifier, the certificate generation key, the first address and the authority storage path based on the proof generation function to generate an identity certificate.

[0082] It should be noted that, in order to improve the confidentiality of verification, the proxy object in the embodiment of the present disclosure is a proxy that performs verification, and its main purpose is to provide a substitute or placeholder for the data access object in order to control access to this object.

[0083] In one embodiment of the present disclosure, the data integrity identifier, the certificate generation key, the first address and the authority storage path may be calculated based on a proof generation function to generate an identity certificate. The proof generation function may be as follows:

[0084] π=Prove(pk, C, (accountRoot, Path), (authAddress)), where pk is the certificate generation key, C is the proof generation function, accountRoot is the data integrity identifier of the permission storage data structure, Path is the permission storage path, authAddress is the first address, and π is the identity certificate.

[0085] It should be noted that the proof generation function defines the type and format of evidence that the prover needs to provide, and how the verifier checks the evidence. It is usually a combination of a set of Boolean operation gates (AND, OR, NOT, etc.) and comparators (such as equal, greater than, less than, etc.) to check whether the information provided by the prover meets the expected rules. The proof generation function in the embodiment of the present disclosure can be changed according to actual design needs, and no limitation is made here.

[0086] In the above embodiment, in response to receiving the verification pass information fed back by the data owner based on the identity certificate, the target smart contract is accessed on the blockchain based on the identity certificate.

[0087] In the disclosed embodiment, after the identity certificate is sent to the verification system for identity verification, the number of historical transactions increases by 1. In this way, by generating the identity certificate through such dynamic data, the identity certificate can be prevented from being reused, which can further improve the security of verification.

[0088] In the above embodiment, the authority storage data structure of the generated data owner object can also be Figure 5 To explain further, Figure 5 is a schematic diagram of another access identity verification method according to an embodiment of the present disclosure, the method comprising:

[0089] S501, obtaining the account addresses of all objects having the authority to access the data of the data-owning object through the data-owning object.

[0090] S502: For any account address, the account address is calculated based on a hash algorithm by the data owner object to obtain a target hash value.

[0091] It should be noted that the hash algorithm in the embodiment of the present disclosure may be multiple, and no limitation is made here. For example, the hash algorithm in the embodiment of the present disclosure may be SM3 algorithm, SHA256 algorithm, etc.

[0092] S503, taking the target hash value as a leaf object, and generating a permission storage data structure based on all leaf objects through the data owner object.

[0093] In the disclosed embodiment, the account addresses of all objects with data access rights to the data-owning object are first obtained through the data-owning object, and then for any account address, the account address is calculated based on the hash algorithm through the data-owning object to calculate and obtain the target hash value, and finally the target hash value is used as a leaf object, and the data-owning object is used to generate a permission storage data structure based on all leaf objects. Thus, by generating a permission storage data structure from the account address of the object with access rights to the data-owning object, a physical basis is provided for subsequent identity authentication.

[0094] It should be noted that after generating the permission storage data structure, the certificate generation key, proof generation function and permission storage path corresponding to each leaf object are sent to the object corresponding to each leaf object with the permission to access the data of the data owner object through the data owner object.

[0095] Figure 6 is a schematic diagram of an access identity verification method according to an embodiment of the present disclosure, which is applied to a verification system, such as Figure 6 As shown, the access identity verification method includes the following steps:

[0096] S601, obtaining the identity certificate sent by the data access object.

[0097] It should be noted that the method for generating the identity certificate can refer to the contents in the above embodiment and will not be repeated here.

[0098] S602, calling the certificate verification key and identity certificate verification algorithm in the verification system to verify the validity of the authority storage path in the identity certificate.

[0099] In the disclosed embodiment, the identity certificate can be first obtained to generate a private key, and then the identity certificate can be decrypted based on the verification function and the private key generated by the identity certificate. The permission storage path in the decrypted identity certificate is stored. If the permission storage path is verified, it can be considered that the data access object has the permission to access the data owner object.

[0100] It should be noted that the identity certificate verification algorithm is designed in advance and is an algorithm used to verify the identity certificate.

[0101] In a possible implementation, if the private key generated by the identity certificate cannot be used to decrypt the identity certificate, it means that the data access object that sends the verification request does not have the access right to access the data owner object.

[0102] In one embodiment of the present disclosure, the verification function may be expressed as follows:

[0103] Q = Verify (π, vk)

[0104] Among them, π is the identity certificate, vk is the private key generated by the identity certificate, Q is the decrypted data, Q at least includes the permission storage path, and Verify() is the identity certificate verification algorithm.

[0105] S603: In response to the validity verification being passed, sending verification pass information to the data access object.

[0106] In the disclosed embodiment, the identity certificate sent by the data access object is first obtained, and then the certificate verification key and the identity certificate verification algorithm in the verification system are called to verify the validity of the identity certificate. Finally, in response to the validity verification passing, a verification pass message is sent to the data access object. Thus, by using the identity certificate scheme to perform body authorization and identity authentication, the application contract completes the trusted identity authentication without exposing the specific user authorization account information.

[0107] In an embodiment of the present disclosure, to generate an identity certificate verification key and a certificate generation key, the data owner object may first obtain a preset key generation algorithm, and then the data owner object generates the identity certificate verification key and the certificate generation key based on the key generation algorithm.

[0108] In the embodiment of the present disclosure, the formula for generating the identity certificate verification key and the certificate generation key may be as follows:

[0109] KeyGen(C) -> (pk, vk)

[0110] Among them, KeyGen (C) is the key generation algorithm, pk is the certificate generation key, and vk is the identity certificate verification key.

[0111] Corresponding to the access identity verification methods provided in the above-mentioned embodiments, an embodiment of the present disclosure further provides an access identity verification device, which is applied to data access objects. Since the access identity verification device provided in the embodiment of the present disclosure corresponds to the access identity verification methods provided in the above-mentioned embodiments, the implementation methods of the above-mentioned access identity verification methods are also applicable to the access identity verification device provided in the embodiment of the present disclosure, and will not be described in detail in the following embodiments.

[0112] Figure 7 is a schematic diagram of an access identity verification device according to an embodiment of the present disclosure, which is applied to data access objects, such as Figure 7 As shown, the access identity verification device 700 includes: a receiving module 710 , an acquiring module 720 , a generating module 730 and a sending module 740 .

[0113] The receiving module 710 is used to receive the authorization information sent by the data owner, and the authorization information at least includes the permission storage path of the data access object in the pre-built permission storage data structure.

[0114] The acquisition module 720 is used to acquire the first address of the data access object.

[0115] The generating module 730 is used to generate an identity certificate of the data access object according to the authorization information and the first address.

[0116] The sending module 740 is used to send the identity certificate to the verification system to verify the access identity of the data access object.

[0117] In one embodiment of the present disclosure, the sending module 740 is further used to: verify the access identity of the data access object based on the permission storage path.

[0118] In one embodiment of the present disclosure, the generation module 730 is further used to: obtain the second address of the proxy object; and generate an identity certificate of the data access object based on the second address, the authorization information, and the first address.

[0119] In one embodiment of the present disclosure, the generation module 730 is further used to: obtain the historical transaction times between the proxy object and the data owner object; and generate an identity certificate of the data access object based on the historical transaction times, the second address, the authorization information, and the first address.

[0120] In one embodiment of the present disclosure, the sending module 740 is further used to: send the identity certificate to the verification system through the proxy object.

[0121] In one embodiment of the present disclosure, the generation module 730 is further used to: obtain a certificate generation key and a data integrity identifier according to the authorization information; calculate the data integrity identifier, the certificate generation key, the first address and the authority storage path based on the proof generation function to generate an identity certificate.

[0122] In one embodiment of the present disclosure, the device is further used to: receive verification information fed back by the verification system based on the identity certificate; in response to the data access object passing the identity authentication, access the data ownership object based on the identity certificate.

[0123] In one embodiment of the present disclosure, the apparatus is further configured to: send the identity certificate to the proxy object, and access the data-owning object based on the identity certificate through the proxy object.

[0124] In one embodiment of the present disclosure, after the identity certificate is sent to the verification system for identity verification, the number of historical transactions increases by 1.

[0125] In one embodiment of the present disclosure, a permission storage data structure for a data owner object is generated, including: obtaining the account addresses of all objects that have permission to access the data of the data owner object through the data owner object; for any account address, calculating the account address based on a hash algorithm through the data owner object to calculate a target hash value; using the target hash value as a leaf object, and generating a permission storage data structure based on all leaf objects through the data owner object.

[0126] In one embodiment of the present disclosure, the sending module 740 is also used to: after generating the permission storage data structure, send the certificate generation key, identity certificate generation circuit algorithm and permission storage path corresponding to each leaf object to the object corresponding to each leaf object that has the permission to access the data of the data owner object through the data owner object.

[0127] In this way, it is possible to authenticate the data owner directly without having to authenticate the data owner directly. Instead, the data owner can be authenticated in the verification system through the permission storage path without exposing the address or identifier of the data owner, thereby preventing unauthorized third parties from stealing or abusing data resources, and providing security for data security and privacy protection.

[0128] Corresponding to the access identity verification methods provided in the above-mentioned embodiments, an embodiment of the present disclosure further provides an access identity verification device, which is applied to the verification system. Since the access identity verification device provided in the embodiment of the present disclosure corresponds to the access identity verification methods provided in the above-mentioned embodiments, the implementation methods of the above-mentioned access identity verification methods are also applicable to the access identity verification device provided in the embodiment of the present disclosure, and will not be described in detail in the following embodiments.

[0129] Figure 8 is a schematic diagram of an access identity verification device according to an embodiment of the present disclosure, which is applied to a verification system, such as Figure 8 As shown, the access identity verification device 800 includes: a receiving module 810 , a matching module 820 and a verification module 830 .

[0130] The receiving module 810 is used to obtain the identity certificate sent by the data access object.

[0131] The matching module 820 is used to call the certificate verification key and identity certificate verification algorithm in the verification system to verify the validity of the authority storage path in the identity certificate.

[0132] The verification module 830 is used to send verification pass information to the data access object in response to the validity verification passing.

[0133] In one embodiment of the present disclosure, generating an identity certificate to generate a private key and a certificate to generate a key includes: the data owner object obtains a preset key generation algorithm; the data owner object generates a certificate verification key and a certificate generation key based on the key generation algorithm.

[0134] Therefore, by using the identity certificate scheme to perform body authentication, the application contract can complete the trusted identity authentication without exposing the specific user authorization account information.

[0135] In order to implement the above embodiment, the present disclosure further provides an electronic device 900, Fig. 9 is a schematic diagram of an electronic device according to an embodiment of the present disclosure, such as Fig. 9 As shown, the electronic device 900 includes: a processor 901 and a memory 902 that is communicatively connected to the processor, the memory 902 stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor 901 to implement the present disclosure. Figure 1-Figure 5 A method for authenticating an access identity according to an embodiment of the present invention.

[0136] In order to implement the above embodiments, the present disclosure also provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to implement the above embodiments. Figure 1-Figure 5 A method for authenticating an access identity according to an embodiment of the present invention.

[0137] In order to implement the above embodiments, the present disclosure also provides a computer program product, including a computer program. When the computer program is executed by a processor, the computer program implements the above embodiments. Figure 1-Figure 4 A method for authenticating an access identity according to an embodiment of the present invention.

[0138] It should be noted that personal information from users should be collected for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. In addition, such collection / sharing should be carried out after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign the agreement / authorization including authorization of relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others who have access to personal information data comply with its privacy policy and procedures.

[0139] The present application is expected to provide an implementation scheme for users to selectively block the use or access of personal information data. That is, the present disclosure is expected to provide hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, the risk can be minimized by limiting data collection and deleting the data. In addition, when applicable, such personal information is de-identified to protect the privacy of the user.

[0140] In the description of the aforementioned embodiments, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they contradict each other.

[0141] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0142] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0143] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that contains, stores, communicates, propagates or transmits a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0144] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0145] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0146] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0147] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for verifying access identity, applied to a data access object, characterized in that: include: Receiving authorization information sent by a data owner, the authorization information at least including a permission storage path of the data access object in a pre-built permission storage data structure; Obtaining a first address of the data access object; Generate an identity certificate of the data access object according to the authorization information and the first address; Sending the identity certificate to a verification system to verify the access identity of the data access object based on the authority storage path; The step of generating the identity certificate of the data access object according to the authorization information and the first address includes: Get the second address of the proxy object; Generate an identity certificate of the data access object based on the second address, the authorization information, and the first address; or, Get the historical transaction count between the proxy object and the data owner object; Generate an identity certificate of the data access object based on the historical transaction number, the second address, the authorization information, and the first address; The step of generating the identity certificate of the data access object according to the authorization information and the first address includes: Obtaining a certificate generation key and a data integrity identifier according to the authorization information; Calculate the data integrity identifier, the certificate generation key, the first address and the authority storage path based on a proof generation function to generate the identity certificate; The method further comprises: Receiving verification information fed back by the verification system based on the identity certificate; In response to the data access object passing the identity authentication, the data owning object is accessed based on the identity certificate.

2. The method according to claim 1, characterized in that The sending the identity certificate to the verification system comprises: The identity certificate is sent to the verification system through a proxy object.

3. The method according to claim 1, characterized in that The accessing the data-owning object based on the identity certificate comprises: The identity certificate is sent to the proxy object, and the data owning object is accessed through the proxy object based on the identity certificate.

4. The method according to claim 1, characterized in that: After the identity certificate is sent to the verification system for identity verification, the number of historical transactions increases by 1.

5. The method according to claim 1, characterized in that: Generate a permission storage data structure for the data owner object, including: Obtaining the account addresses of all objects having the authority to access the data of the data-owning object through the data-owning object; For any account address, the data owner object calculates the account address based on a hash algorithm to obtain a target hash value; The target hash value is used as a leaf object, and the permission storage data structure is generated based on all leaf objects through the data owner object.

6. The method according to claim 5, characterized in that The method further comprises: After the permission storage data structure is generated, the certificate generation key, proof generation function and permission storage path corresponding to each leaf object are sent to the object corresponding to each leaf object that has the permission to access the data of the data owner object through the data owner object.

7. An access identity verification device, applied to a data access object, characterized in that: Also used for: A receiving module, used to receive authorization information sent by a data owner, wherein the authorization information at least includes a permission storage path of the data access object in a pre-built permission storage data structure; An acquisition module, used for acquiring a first address of the data access object; A generating module, used for generating an identity certificate of the data access object according to the authorization information and the first address; A sending module, used for sending the identity certificate to a verification system, so as to verify the access identity of the data access object based on the authority storage path; Wherein, the generating module is also used for: Get the second address of the proxy object; Generate an identity certificate of the data access object based on the second address, the authorization information, and the first address; or, Get the historical transaction count between the proxy object and the data owner object; Generate an identity certificate of the data access object based on the historical transaction number, the second address, the authorization information, and the first address; The generating module is further used for: Obtaining a certificate generation key and a data integrity identifier according to the authorization information; Calculate the data integrity identifier, the certificate generation key, the first address and the authority storage path based on a proof generation function to generate the identity certificate; The device is also used for: Receiving verification information fed back by the verification system based on the identity certificate; In response to the data access object passing the identity authentication, the data owning object is accessed based on the identity certificate.

8. An electronic device, characterized in that: Including memory and processor; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to implement the access identity verification method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the access identity verification method according to any one of claims 1 to 6 when executed by a processor.

Images