Distributed digital identity verification method and device and electronic equipment

Abstract

The invention discloses a distributed digital identity verification method and device and electronic equipment, and relates to the technical field of blockchains, and the verification method comprises the steps: controlling a registration module of a preset proxy server side to receive a proxy request, determining a preset tag based on an encrypted digital signature sent by each preset certificate issuing server side, and carrying out the verification of the preset certificate issuing server side based on the preset tag; and generating a digital identity certificate, and controlling a verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each preset certificate issuing server when it is detected that the digital identity certificate is used on the client. According to the invention, the technical problem of low efficiency of verifying a plurality of digital identities at the same time in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a distributed digital identity verification method and device, and an electronic device. Background Art

[0002] Distributed digital identity is a new identity authentication system built on blockchain technology. It uses distributed ledger technologies such as blockchain to give each user a unique and unalterable identifier, allowing users to independently control and manage their own identity information, and achieve autonomous verification, secure storage and privacy protection of identity data.

[0003] The current distributed digital identity system, based on the specifications set by the W3C (World Wide Web Consortium), is mainly operated collaboratively by the issuer, holder and verifier to complete the digital identity credential issuance, registration and verification process, thereby realizing the distributed management of identity information and enhancing the security and privacy protection of identity authentication.

[0004] However, when encountering complex scenarios of multi-level authorization or one-to-many authorization, the current distributed digital identity system needs to verify the signatures of multiple issuers one by one for each verification. This linear verification method slows down the overall process and reduces system performance. This problem becomes particularly prominent when a large number of issuers are involved, which has an adverse impact on user experience and system throughput.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present invention provide a distributed digital identity verification method and device, and an electronic device, so as to at least solve the technical problem of low efficiency in verifying multiple digital identities simultaneously in the related art.

[0007] According to one aspect of an embodiment of the present invention, a method for verifying a distributed digital identity is provided, comprising: controlling a registration module of a preset proxy server to receive a proxy request, wherein the proxy request comes from at least one preset certificate issuing server, and the proxy request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset certificate issuing server; determining a preset tag based on the encrypted digital signature sent by each of the preset certificate issuing servers; generating a digital identity certificate based on the preset tag; and, upon detecting that the digital identity certificate is used on a client, controlling a verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each of the preset certificate issuing servers.

[0008] Furthermore, before controlling the registration module of the preset proxy server to receive the proxy request, it includes: controlling each of the preset certificate issuance servers to receive the application issuance request sent by the client, wherein the application issuance request carries at least application data, and the application data includes at least: the certificate type data of the client; based on the application data, using a preset private key to encrypt the certificate data of the preset certificate issuance server indicated by the certificate type data to obtain the encrypted digital signature.

[0009] Furthermore, the step of determining the preset label based on the encrypted digital signature sent by each of the preset certification server ends includes: controlling the signature module of the preset proxy server end to receive the encrypted digital signature sent by the registration module; adding the encrypted digital signature of each of the preset certification server ends to the digital signature set; and determining the preset label based on the digital signature set.

[0010] Furthermore, based on the digital signature set, the step of determining the preset label includes: characterizing each of the encrypted digital signatures in the digital signature set as a leaf node, and calculating the hash value of each leaf node; constructing Merkle tree data based on the hash value of each leaf node; and determining the preset label based on the Merkle tree data, wherein the preset label includes: all hash values ​​on the path from the leaf node to the root node.

[0011] Furthermore, based on the hash value of each leaf node, the step of constructing the Merkle tree data includes: merging every two leaf nodes to obtain multiple merged leaf nodes, and calculating the merged hash value of the merged leaf nodes; merging every two merged leaf nodes until one merged leaf node remains, and representing the remaining merged leaf node as the root node; calculating the root node hash value of the root node; constructing the Merkle tree data based on the hash value of each leaf node, the merged hash value of the merged leaf node after the merger, and the root node hash value of the root node.

[0012] Furthermore, the step of controlling the verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each of the preset issuing servers includes: decrypting each of the encrypted digital signatures in the digital signature set based on the preset public key on each of the preset issuing servers to obtain the decrypted certificate data; for each of the decrypted certificate data, determining whether the certificate data is the same as the public certificate data on the preset issuing server corresponding to the certificate data; and verifying the digital identity certificate based on the digital signature set when all of the certificate data are the same as the public certificate data on the preset issuing server corresponding to the certificate data.

[0013] Furthermore, the step of verifying the digital identity certificate based on the digital signature set includes: recalculating the hash value of the root node based on the digital signature set to obtain a verification hash value of the root node; determining whether the verification hash value of the root node is the same as the root node hash value of the root node, and if the verification hash value is the same as the root node hash value, determining that the digital identity certificate has been verified.

[0014] According to another aspect of an embodiment of the present invention, a distributed digital identity verification device is also provided, including: a control unit, used to control a registration module of a preset proxy server to receive a proxy request, wherein the proxy request comes from at least one preset certificate issuing server, and the proxy request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset certificate issuing server; a determination unit, used to determine a preset tag based on the encrypted digital signature sent by each of the preset certificate issuing servers; a generation unit, used to generate a digital identity certificate based on the preset tag; and a verification unit, used to control the verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each of the preset certificate issuing servers when it is detected that the digital identity certificate is used on the client.

[0015] Furthermore, the verification device includes: a first control module, used to control each of the preset certificate issuing servers to receive the application issuance request sent by the client before controlling the registration module of the preset proxy server to receive the proxy request, wherein the application issuance request carries at least application data, and the application data includes at least: certificate type data of the client; a first encryption module, used to encrypt the certificate data of the preset certificate issuing server indicated by the certificate type data based on the application data using a preset private key to obtain the encrypted digital signature.

[0016] Furthermore, the determination unit includes: a second control module, used to control the signature module of the preset proxy server to receive the encrypted digital signature sent by the registration module; a first processing module, used to add the encrypted digital signature of each of the preset issuing server to the digital signature set; and a first determination module, used to determine the preset label based on the digital signature set.

[0017] Furthermore, the first determination module includes: a first processing submodule, used to represent each of the encrypted digital signatures in the digital signature set as a leaf node, and calculate the hash value of each leaf node; a first construction submodule, used to construct Merkle tree data based on the hash value of each leaf node; a first determination submodule, used to determine the preset label based on the Merkle tree data, wherein the preset label includes: all hash values ​​on the path from the leaf node to the root node.

[0018] Furthermore, the first construction submodule includes: a second processing submodule, used to merge every two of the leaf nodes to obtain multiple merged leaf nodes, and calculate the merged hash value of the merged leaf nodes; a third processing submodule, used to merge every two of the merged leaf nodes until one merged leaf node remains, and the remaining merged leaf node is represented as the root node; a first calculation submodule, used to calculate the root node hash value of the root node; and a second construction submodule, used to construct the Merkle tree data based on the hash value of each of the leaf nodes, the merged hash value of the merged leaf nodes after merger, and the root node hash value of the root node.

[0019] Furthermore, the verification unit includes: a first decryption module, used to decrypt each of the encrypted digital signatures in the digital signature set based on a preset public key on each of the preset issuing server ends to obtain the decrypted certificate data; a first judgment module, used to judge, for each decrypted certificate data, whether the certificate data is the same as the public certificate data on the preset issuing server end corresponding to the certificate data; and a first verification module, used to verify the digital identity certificate based on the digital signature set when all the certificate data are the same as the public certificate data on the preset issuing server end corresponding to the certificate data.

[0020] Furthermore, the first verification module includes: a second calculation submodule, used to recalculate the hash value of the root node based on the digital signature set to obtain the verification hash value of the root node; a fourth processing submodule, used to determine whether the verification hash value of the root node is the same as the root node hash value of the root node, and when the verification hash value is the same as the root node hash value, determine that the digital identity certificate verification is passed.

[0021] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the distributed digital identity verification method described in any one of the above is implemented.

[0022] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned distributed digital identity verification methods.

[0023] In the present invention, a registration module of a preset proxy server is controlled to receive a proxy request, a preset tag is determined based on the encrypted digital signature sent by each preset certificate issuing server, and a digital identity certificate is generated based on the preset tag. When it is detected that the digital identity certificate is used on the client, a verification module of the preset verification server is controlled to verify the digital identity certificate based on the public certificate data on each preset certificate issuing server, thereby solving the technical problem of low efficiency in verifying multiple digital identities at the same time in the related art.

[0024] In the present invention, the registration module of the preset proxy server can be controlled to receive the proxy request, and the preset label can be determined according to the encrypted digital signature sent by each preset issuing server. Then, a digital identity certificate can be generated according to the preset label, and then the generated digital identity certificate can be uploaded to the verification platform system. The client can obtain the digital identity certificate through the verification platform system. When it is detected that the digital identity certificate is used on the client, the verification module of the preset verification server can be controlled to verify the digital identity certificate based on the public certificate data on each preset issuing server. It is possible to verify multiple digital identity certificates at one time, thereby achieving the technical effect of accurately and efficiently verifying multiple digital identity certificates and improving system performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0026] Figure 1 is a flow chart of an optional distributed digital identity verification method according to an embodiment of the present invention;

[0027] Figure 2 is a schematic diagram of an optional Merkle tree-based distributed digital identity authorization system structure according to an embodiment of the present invention;

[0028] Figure 3 is a schematic diagram of an optional distributed digital identity verification device according to an embodiment of the present invention;

[0029] Figure 4 The present invention is a hardware structure block diagram of an electronic device (or mobile device) for a distributed digital identity verification method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) collected and involved in the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for users to choose to authorize or refuse. For example, an interface is set between the system and the relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0033] In the present invention, by adding a proxy server and aggregating the digital signatures of multiple issuers at the proxy server, authorization management is made clearer and easier to handle. The Merkle tree technology can reduce the exposure of identity information during frequent signature verification processes, while keeping the complexity of the verification process at a low level. Even when the number of issuers increases dramatically, the verification process can still be carried out quickly, thereby shortening the user's waiting time, increasing the verification speed, and further improving the scalability of the system.

[0034] The present invention is described in detail below in conjunction with various embodiments.

[0035] Embodiment 1

[0036] According to an embodiment of the present invention, an embodiment of a method for verifying a distributed digital identity is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in an order different from that shown here.

[0037] Figure 1 is a flow chart of an optional distributed digital identity verification method according to an embodiment of the present invention, such as Figure 1 As shown, the method comprises the following steps:

[0038] Step S101, controlling the registration module of the preset proxy server to receive a proxy request, wherein the proxy request comes from at least one preset certification server, the proxy request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset certification server.

[0039] Optionally, the verification platform system can be used to transmit and process data from the client and each server. The preset issuing server (i.e., the entity responsible for issuing digital certificates (Verifiable Credentials, VC)) can verify the identity on the verification platform system (i.e., verify whether the preset issuing server has the issuing authority), and the preset proxy server (i.e., the entity that accepts proxy authorization from one or more issuers) can also verify the identity on the verification platform system (i.e., verify whether the preset proxy server can issue digital certificates on behalf of the server).

[0040] In this embodiment, the preset certificate issuing server can authorize the preset proxy server to issue digital certificates on its behalf, and the proxy registration module of the preset proxy server can receive proxy requests from any number of preset certificate issuing servers. The proxy request carries at least the encrypted digital signature of each preset certificate issuing server, and the encrypted digital signature can be made public through the registration module of the preset proxy server.

[0041] Step S102, determining a preset label based on the encrypted digital signature sent by each preset certification server.

[0042] Optionally, a preset label (ie, a hash tree structure, such as a Merkle tree) may be determined based on the encrypted digital signature sent by each preset certification server.

[0043] In this embodiment, a hash algorithm may be used to calculate each encrypted digital signature to generate a Merkle tree label (ie, a preset label).

[0044] Step S103: Generate a digital identity certificate based on the preset tag.

[0045] Optionally, when the preset issuing server issues a digital certificate, a Merkle tree tag (i.e., a preset tag) is generated through a hash algorithm based on the digital signatures of one or more issuers. The determined preset tag can be attached to the digital certificate to generate a digital identity certificate, and the digital identity certificate can be uploaded to the verification platform system. The client can obtain the digital identity certificate in the verification platform system.

[0046] Step S104, when it is detected that the digital identity certificate is used on the client, the verification module of the preset verification server is controlled to verify the digital identity certificate based on the public certificate data on each preset issuing server.

[0047] Optionally, users can register their identities on the verification platform system through a client (such as a computer or mobile phone) (i.e., they can be used to distinguish different users), and the preset verification server (i.e., an entity that accepts and verifies digital credentials, such as a business organization, school, etc.) can also verify the identities on the verification platform system (i.e., verify whether the preset verification server has verification authority).

[0048] In this embodiment, after the client obtains the digital identity certificate, when it detects that the digital identity certificate is used on the client, it controls the verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each preset issuing server (i.e., the content data on the certificate applied for by the client).

[0049] In this embodiment, when the user performs operations on the client (such as employment authentication, loan authentication, etc.), the verification module of the preset verification server can verify the identity and qualifications of the user. By verifying the Merkle tree label on the digital identity certificate and the digital signature of the issuer, the signature verification of multiple issuers' authorization can be completed at one time.

[0050] In summary, by controlling the registration module of the preset proxy server to receive the proxy request, the preset tag can be determined according to the encrypted digital signature sent by each preset issuing server, and then a digital identity certificate is generated according to the preset tag, and the digital certificate is uploaded to the verification platform system. After that, the client can obtain the digital identity certificate in the verification platform system. When it is detected that the digital identity certificate is used on the client, the verification module of the preset verification server is controlled to verify the digital identity certificate according to the public certificate data on each preset issuing server, thereby solving the technical problem of low efficiency in verifying multiple digital identities at the same time in the related technology.

[0051] In order to accurately determine the encrypted digital signature, in the distributed digital identity verification method provided in Example 1 of the present application, each preset issuing server is controlled to receive an application issuance request sent by a client, wherein the application issuance request carries at least application data, and the application data includes at least: the certificate type data of the client; based on the application data, the certificate data of the preset issuing server indicated by the certificate type data is encrypted using a preset private key to obtain an encrypted digital signature.

[0052] Optionally, when a user needs to apply for a digital certificate from multiple preset certificate issuing servers, the client can initiate an application request to the multiple preset certificate issuing servers. Each preset certificate issuing server receives the application request sent by the client. The application request carries at least the client's user information data and certificate type data (used to indicate the preset certificate issuing server).

[0053] In this embodiment, the preset private key may be used to encrypt the certificate data of the preset issuing server indicated by the certificate type data (including the user information data of the client and the certificate content) to obtain an encrypted digital signature.

[0054] In order to accurately determine the preset label, in the distributed digital identity verification method provided in Example 1 of the present application, the signature module of the preset proxy server is controlled to receive the encrypted digital signature sent by the registration module; the encrypted digital signature of each preset issuing server is added to the digital signature set; and the preset label is determined based on the digital signature set.

[0055] Optionally, after generating the encrypted digital signature, the registration module of the preset proxy server can send the encrypted digital signature to the signature module of the preset proxy server, control the signature module of the preset proxy server to receive the sent encrypted digital signature, and add the encrypted digital signature of each preset issuing server to the digital signature set.

[0056] In this embodiment, in the signature module of the preset proxy server, the hash value of each digital signature in the digital signature set can be calculated according to the digital signature set, and the preset label can be determined according to each hash value.

[0057] In order to improve the accuracy of determining the preset label, it is necessary to first construct Merkle tree data. In the distributed digital identity verification method provided in Example 1 of the present application, each encrypted digital signature in the digital signature set is represented as a leaf node, and the hash value of each leaf node is calculated; based on the hash value of each leaf node, Merkle tree data is constructed; based on the Merkle tree data, the preset label is determined, wherein the preset label includes: all hash values ​​on the path from the leaf node to the root node.

[0058] Optionally, the Merkle tree data of the encrypted digital signature may be calculated and used as the encrypted digital signature aggregation (ie, the preset tag) of the preset issuing server.

[0059] In this embodiment, each encrypted digital signature in the digital signature set can be represented as a leaf node, and the hash value of each leaf node can be calculated. Based on the hash value of each leaf node, Merkle tree data can be constructed, and based on the Merkle tree data, a preset label (including all hash values ​​on the path from the leaf node to the root node) can be determined.

[0060] In order to deterministically construct Merkle tree data, in the distributed digital identity verification method provided in Example 1 of the present application, every two leaf nodes are merged to obtain multiple merged leaf nodes, and the merged hash value of the merged leaf nodes is calculated; every two merged leaf nodes are merged until one merged leaf node remains, and the remaining merged leaf nodes are represented as root nodes; the root node hash value of the root node is calculated; and based on the hash value of each leaf node, the merged hash value of the merged leaf node after the merge, and the root node hash value of the root node, Merkle tree data is constructed.

[0061] Optionally, every two leaf nodes are merged to obtain multiple merged leaf nodes. If the number of leaf nodes is an odd number, the last leaf node can be paired with itself and the merged hash value of the merged leaf node can be calculated.

[0062] In this embodiment, every two merged leaf nodes are merged until one merged leaf node remains, and the merged leaf node is represented as a root node, and the root node hash value of the root node can be calculated. Merkle tree data can be constructed based on the hash value of each leaf node, the merged hash value of the merged leaf node after the merger, and the root node hash value of the root node.

[0063] In order to verify the digital identity certificate, in the distributed digital identity verification method provided in Example 1 of the present application, each encrypted digital signature in the digital signature set is decrypted based on the preset public key on each preset issuing server to obtain the decrypted certificate data; for each decrypted certificate data, it is determined whether the certificate data is the same as the public certificate data on the preset issuing server corresponding to the certificate data; when all certificate data are the same as the public certificate data on the preset issuing server corresponding to the certificate data, the digital identity certificate is verified based on the digital signature set.

[0064] Optionally, each encrypted digital signature in the digital signature set can be verified by the public key disclosed by the issuer (i.e., the preset issuing server), proving that the encrypted digital signature can only be issued by the issuer. Each encrypted digital signature in the digital signature set can be decrypted according to the preset public key on each preset issuing server to obtain the decrypted certificate data. For each decrypted certificate data, it is determined whether the certificate data is the same as the public certificate data on the preset issuing server corresponding to the certificate data. If they are the same, the consistency of the digital signature is proved.

[0065] In this embodiment, when all certificate data are identical to the public certificate data on the preset issuing server corresponding to the certificate data, the digital identity certificate can be verified according to the digital signature set.

[0066] In order to improve the accuracy of verifying the digital identity certificate, in the distributed digital identity verification method provided in Example 1 of the present application, based on the digital signature set, the hash value of the root node is recalculated to obtain the verification hash value of the root node; it is determined whether the verification hash value of the root node is the same as the root node hash value of the root node; if the verification hash value is the same as the root node hash value, it is determined that the digital identity certificate verification has passed.

[0067] Optionally, the Merkle tree root node can be generated according to the encrypted digital signatures (i.e., the digital signature set) of all participating preset issuing servers in accordance with the same process as generating the preset label (i.e., recalculating the hash value of the root node) to obtain the verification hash value of the root node.

[0068] In this embodiment, it is possible to determine whether the verification hash value of the root node is the same as the root node hash value of the root node, and if the verification hash value is the same as the root node hash value, determine that the verification of the digital identity certificate is passed. In this way, the verification of multiple encrypted digital signatures can be completed at one time.

[0069] Figure 2 is a schematic diagram of an optional Merkle tree-based distributed digital identity authorization system structure according to an embodiment of the present invention, such as Figure 2 As shown, the distributed digital identity authorization system based on the Merkle tree may include different issuers (i.e., preset issuing servers, such as issuer 1, ..., issuer n), agents (i.e., preset agent servers), holders (i.e., the client where the user is located), verifiers (i.e., preset verification servers), and verification platforms. The holder needs to register his identity on the verification platform, and the issuer, agent, and verifier need to verify their identities on the verification platform to indicate that they have corresponding authority. The holder can initiate a certificate application request to the issuer on the verification platform to obtain a digital certificate, thereby proving the user's identity and qualifications in the digital world. The issuer initiates an agent request to the agent (i.e., the agent authorized by the issuer) based on the certificate application request. After generating a digital identity certificate, the agent can issue a verifiable credential (i.e., a digital identity certificate) on the verification platform so that the holder can obtain the verifiable credential. When it is detected that the holder needs to use a verifiable credential, the holder can submit the verifiable credential on the verification platform, and the verifier verifies the verifiable credential based on the preset tag and digital signature set.

[0070] In an embodiment of the present invention, through the verification platform system, the client can send certificate application requests to multiple preset certificate issuing servers. For each preset certificate issuing server, an encrypted digital signature can be generated according to the certificate application request, and a proxy request can be initiated to the preset proxy server. Then, the registration module of the preset proxy server receives the proxy request of each preset certificate issuing server, and can determine the preset tag according to the encrypted digital signature carried by the proxy request. According to the preset tag, a digital identity certificate can be generated, and then the generated digital identity certificate can be uploaded to the verification platform system. The client can obtain the digital identity certificate through the verification platform system. When it is detected that the digital identity certificate is used on the client, the verification module of the preset verification server can be controlled to verify the digital identity certificate based on the public certificate data on each preset certificate issuing server. It can realize verification of multiple digital identity certificates at one time, which improves the verification speed, thereby achieving the technical effect of accurately and efficiently verifying multiple digital identity certificates and improving system performance.

[0071] The following is a detailed description in conjunction with another embodiment.

[0072] Embodiment 2

[0073] A distributed digital identity verification device provided in this embodiment includes multiple implementation units, each implementation unit corresponds to each implementation step in the above-mentioned embodiment 1.

[0074] Figure 3 is a schematic diagram of an optional distributed digital identity verification device according to an embodiment of the present invention, such as Figure 3 As shown, the distributed digital identity verification device may include: a control unit 30, a determination unit 31, a generation unit 32, and a verification unit 33.

[0075] The control unit 30 is used to control the registration module of the preset proxy server to receive a proxy request, wherein the proxy request comes from at least one preset certificate issuing server, and the proxy request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset certificate issuing server;

[0076] A determination unit 31, configured to determine a preset tag based on the encrypted digital signature sent by each preset issuing server;

[0077] A generating unit 32, configured to generate a digital identity certificate based on a preset tag;

[0078] The verification unit 33 is used to control the verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each preset issuing server when it is detected that the digital identity certificate is used on the client.

[0079] The above-mentioned distributed digital identity verification device can control the registration module of the preset proxy server to receive the proxy request through the control unit 30, determine the preset tag based on the encrypted digital signature sent by each preset issuing server through the determination unit 31, generate the digital identity certificate based on the preset tag through the generation unit 32, and control the verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each preset issuing server through the verification unit 33 when the digital identity certificate is detected to be used on the client. In an embodiment of the present invention, the registration module of the preset proxy server can be controlled to receive the proxy request, and the preset tag can be determined based on the encrypted digital signature sent by each preset issuing server, and the digital identity certificate can be generated based on the preset tag, and when the digital identity certificate is detected to be used on the client, the verification module of the preset verification server is controlled to verify the digital identity certificate based on the public certificate data on each preset issuing server.

[0080] Optionally, the verification device includes: a first control module, used to control each preset certificate issuing server to receive an application issuance request sent by a client before controlling the registration module of the preset proxy server to receive a proxy request, wherein the application issuance request carries at least application data, and the application data includes at least: certificate type data of the client; a first encryption module, used to encrypt the certificate data of the preset certificate issuing server indicated by the certificate type data based on the application data using a preset private key to obtain an encrypted digital signature.

[0081] Optionally, the determination unit includes: a second control module, used to control the signature module of the preset proxy server to receive the encrypted digital signature sent by the registration module; a first processing module, used to add the encrypted digital signature of each preset issuing server to the digital signature set; and a first determination module, used to determine the preset label based on the digital signature set.

[0082] Optionally, the first determination module includes: a first processing sub-module, used to represent each encrypted digital signature in the digital signature set as a leaf node, and calculate the hash value of each leaf node; a first construction sub-module, used to construct Merkle tree data based on the hash value of each leaf node; a first determination sub-module, used to determine a preset label based on the Merkle tree data, wherein the preset label includes: all hash values ​​on the path from the leaf node to the root node.

[0083] Optionally, the first construction submodule includes: a second processing submodule, used to merge every two leaf nodes to obtain multiple merged leaf nodes, and calculate the merged hash value of the merged leaf nodes; a third processing submodule, used to merge every two merged leaf nodes until one merged leaf node remains, and represent the remaining merged leaf nodes as root nodes; a first calculation submodule, used to calculate the root node hash value of the root node; and a second construction submodule, used to construct Merkle tree data based on the hash value of each leaf node, the merged hash value of the merged leaf node after the merger, and the root node hash value of the root node.

[0084] Optionally, the verification unit includes: a first decryption module, used to decrypt each encrypted digital signature in the digital signature set based on a preset public key on each preset issuing server to obtain decrypted certificate data; a first judgment module, used to judge, for each decrypted certificate data, whether the certificate data is the same as the public certificate data on the preset issuing server corresponding to the certificate data; and a first verification module, used to verify the digital identity certificate based on the digital signature set when all certificate data are the same as the public certificate data on the preset issuing server corresponding to the certificate data.

[0085] Optionally, the first verification module includes: a second calculation sub-module, used to recalculate the hash value of the root node based on the digital signature set to obtain the verification hash value of the root node; a fourth processing sub-module, used to determine whether the verification hash value of the root node is the same as the root node hash value of the root node, and when the verification hash value is the same as the root node hash value, determine that the digital identity certificate verification is passed.

[0086] The above-mentioned distributed digital identity verification device may also include a processor and a memory. The above-mentioned control unit 30, determination unit 31, generation unit 32, verification unit 33, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0087] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set to verify the digital identity certificate by adjusting kernel parameters.

[0088] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0089] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including a non-volatile computer-readable storage medium, the non-volatile computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, any of the above-mentioned distributed digital identity verification methods is implemented.

[0090] When the computer program product is executed on a data processing device, it is suitable for executing an initialization program having the following method steps: controlling a registration module of a preset proxy server to receive a proxy request, determining a preset tag based on an encrypted digital signature sent by each preset certification server, generating a digital identity certificate based on the preset tag, and, when detecting that a digital identity certificate is used on a client, controlling a verification module of a preset verification server to verify the digital identity certificate based on public certificate data on each preset certification server.

[0091] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement the above-mentioned distributed digital identity verification method.

[0092] Figure 4 1 is a hardware structure block diagram of an electronic device (or mobile device) for a distributed digital identity verification method according to an embodiment of the present invention. Figure 4 As shown, the electronic device may include one or more processors (e.g., Figure 4 The processor 402a, processor 402b, ..., processor 402n, etc., which may include but are not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 404 for storing data. In addition, it may also include: a display, an input / output interface (I / 0 interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / 0 interface), a network interface, a keyboard, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 4 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 4 More or fewer components as shown, or with Figure 4 Different configurations shown.

[0093] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0094] The embodiments or examples of the present disclosure are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection of the present disclosure. In the absence of contradiction, each step in a certain embodiment or example can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0095] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0096] In the several embodiments provided by the present invention, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0097] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0098] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0099] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0100] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A distributed digital identity verification method, characterized in that: include: Controlling a registration module of a preset proxy server to receive a proxy request, wherein the proxy request comes from at least one preset certificate issuing server, and the proxy request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset certificate issuing server; Determining a preset label based on the encrypted digital signature sent by each preset certification service end; Based on the preset tag, generate a digital identity certificate; In the case where it is detected that the digital identity certificate is used on the client, the verification module of the preset verification server is controlled to verify the digital identity certificate based on the public certificate data on each of the preset certificate issuing servers.

2. The distributed digital identity verification method according to claim 1, characterized in that: Before the registration module of the preset proxy server receives the proxy request, it includes: Control each of the preset certificate issuance service ends to receive a certificate issuance request sent by the client, wherein the certificate issuance request carries at least application data, and the application data includes at least: certificate type data of the client; Based on the application data, the certificate data of the preset issuing service end indicated by the certificate type data is encrypted using a preset private key to obtain the encrypted digital signature.

3. The distributed digital identity verification method according to claim 2, characterized in that: The step of determining a preset label based on the encrypted digital signature sent by each preset certification service end comprises: Controlling the signature module of the preset proxy server to receive the encrypted digital signature sent by the registration module; Add the encrypted digital signature of each of the preset issuing service ends to the digital signature set; Based on the digital signature set, the preset label is determined.

4. The distributed digital identity verification method according to claim 3, characterized in that: The step of determining the preset tag based on the digital signature set includes: Characterizing each of the encrypted digital signatures in the digital signature set as a leaf node, and calculating a hash value of each of the leaf nodes; Constructing Merkle tree data based on the hash value of each leaf node; Based on the Merkle tree data, the preset label is determined, wherein the preset label includes: all hash values ​​on the path from the leaf node to the root node.

5. The distributed digital identity verification method according to claim 4, characterized in that: The step of constructing Merkle tree data based on the hash value of each leaf node comprises: Merge every two leaf nodes to obtain multiple merged leaf nodes, and calculate the merged hash value of the merged leaf nodes; Merge every two of the merged leaf nodes until one merged leaf node remains, and characterize the remaining merged leaf node as the root node; Calculating a root node hash value of the root node; The Merkle tree data is constructed based on the hash value of each of the leaf nodes, the merged hash value of the merged leaf nodes after merging, and the root node hash value of the root node.

6. The distributed digital identity verification method according to claim 5, characterized in that: The step of controlling the verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each of the preset certificate issuing servers comprises: Decrypting each of the encrypted digital signatures in the digital signature set based on a preset public key on each of the preset certificate issuing servers to obtain the decrypted certificate data; For each decrypted certificate data, determining whether the certificate data is identical to the public certificate data on the preset issuing server corresponding to the certificate data; In the case that all the certificate data are identical to the public certificate data on the preset certificate issuing server corresponding to the certificate data, the digital identity certificate is verified based on the digital signature set.

7. The distributed digital identity verification method according to claim 6, characterized in that: The step of verifying the digital identity certificate based on the digital signature set includes: Recalculate the hash value of the root node based on the digital signature set to obtain a verification hash value of the root node; Determine whether the verification hash value of the root node is the same as the root node hash value of the root node, and if the verification hash value is the same as the root node hash value, determine that the digital identity certificate is verified successfully.

8. A distributed digital identity verification device, characterized in that: include: A control unit, configured to control a registration module of a preset proxy server to receive a proxy request, wherein the proxy request comes from at least one preset certificate issuing server, the proxy request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset certificate issuing server; A determination unit, configured to determine a preset label based on the encrypted digital signature sent by each of the preset certification service ends; A generating unit, configured to generate a digital identity certificate based on the preset tag; The verification unit is used to control the verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each preset issuing server when detecting that the digital identity certificate is used on the client.

9. A computer program product, characterized in that It comprises a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the distributed digital identity verification method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the distributed digital identity verification method described in any one of claims 1 to 7.

Images