Credible user identity system construction method and business system

Abstract

The invention provides a trusted user identity system construction method and business system, and the method comprises the steps: constructing a block chain network of trusted identity, deploying an intelligent contract of identity management on the block chain network, and defining an on-chain two-dimensional relation table of an identity management application based on an on-chain two-dimensional relation table of the block chain network; and constructing a cross-organization available user system on the block chain network. According to the method, when the two-dimensional relation table on the chain is used for performing management such as addition, modification, query and deletion on the institution certificate, the personal digital identity and the personal credible identity certificate on the chain, quick retrieval positioning and processing can be performed based on the characteristics of the two-dimensional relation table, so that the technical implementation complexity is remarkably reduced, and meanwhile, the processing efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a method for building a trusted user identity system and a business system. Background Art

[0002] When the blockchain network interacts with data and business across organizations, the confirmation of the user's identity attributes (identity attributes are certain attributes of a natural person, such as whether it is a natural person corresponding to a certain ID number, whether it is an employee of a certain position in a certain company, and whether it has a degree certificate from a certain school) is a key basic issue. There are two main types of current technical solutions: one is to build a unified user management platform, such as a unified identity authentication platform for government applications, user identity authentication platforms provided to third-party applications such as WeChat, etc. The second is to use a personal UKey issued by a CA organization. The general process is that the actual business certifier of the identity attribute issues an offline certificate (such as an identity certificate with an official seal + application form) and submits it to the CA organization for issuance.

[0003] However, the prior art still has the following shortcomings: 1. There are two shortcomings of the unified user management platform. First, the identity attributes that a single platform can provide are limited, and it is difficult to meet the different user identity attribute confirmation requirements of various businesses. Second, the credibility of identity information depends on the credibility of the provider of the unified identity authentication platform. Therefore, it is generally used in situations where the credibility of identity attributes is not required. 2. There are two shortcomings in the way CA agencies issue personal UKeys: First, the identity attributes that a single UKey can provide are limited and difficult to expand after issuance, so it is difficult to meet the needs of different business scenarios, resulting in a single user holding multiple UKeys in multiple business scenarios; Second, the management process of the identity itself is essentially an offline process, and the application, replacement, renewal, and cancellation processes are time-consuming and require additional fees. Summary of the invention

[0004] In order to solve the problems existing in the prior art, the purpose of the present invention is to provide a method for building a trusted user identity system and a business system, which can improve the credibility of the blockchain network.

[0005] To achieve the above object, the present invention adopts the following technical solutions:

[0006] A method for building a trusted user identity system, comprising the steps of:

[0007] Build a blockchain network with trusted identity, where a smart contract for identity management is deployed on the blockchain network, and based on the two-dimensional relationship table on the blockchain network, define the on-chain two-dimensional relationship table of the identity management application;

[0008] Build a cross-organizational available user system on the blockchain network, including:

[0009] Verification of the validity of the participating institution certificates;

[0010] Call the smart contract to write the institution certificate into the blockchain network;

[0011] Generate personal digital identities for individual users and call smart contracts to write them into the blockchain network;

[0012] Generate identity credentials based on personal digital identity for individual users on demand, construct parameters and call smart contracts to write them into the blockchain network.

[0013] Obtain the trusted identity information of any individual user from the blockchain network on demand to support business needs.

[0014] As a further improvement of the present invention, the step of building a trusted identity blockchain network includes:

[0015] Participants deploy blockchain nodes, and several blockchain nodes are interconnected to form a blockchain network;

[0016] The data on the blockchain network chain is stored in a two-dimensional relational table on the chain;

[0017] Deploy smart contracts for identity management in the blockchain network to form a trusted identity blockchain network.

[0018] As a further improvement of the present invention, when a new participant joins, the following steps are also included:

[0019] Deploy a new blockchain node and connect it to the existing blockchain network. The new blockchain node will automatically synchronize smart contracts from the existing blockchain network.

[0020] As a further improvement of the present invention, the on-chain two-dimensional relationship table includes: an organization digital certificate table, a personal digital identity table, and a personal digital identity attribute certificate table.

[0021] As a further improvement of the present invention, the step of verifying the validity of the participant institution certificate includes:

[0022] When the institution certificate is in the form of a certificate file, the system server parses the certificate;

[0023] When the institution certificate is in the form of Ukey, the identity management application web page reads the public key certificate content from Ukey and uploads it to the system server for parsing.

[0024] As a further improvement of the present invention, the step of calling a smart contract to write the institution certificate into the blockchain network includes:

[0025] Verify the public key of the institution's certificate and check whether the digital signature written into the blockchain network request is correct;

[0026] Determine whether the organization certificate table on the blockchain network chain has a record of the public key corresponding to the request, and reject it if so;

[0027] Parse the content of the public key authority certificate to obtain the organization name, organization public key, public and private key pair following the algorithm, and write them into the corresponding fields of the organization certificate table through consensus along with the digital certificate content and creation time.

[0028] As a further improvement of the present invention, the step of generating a personal digital identity for a personal user and calling a smart contract to write it into a blockchain network includes:

[0029] The identity management application generates a unique public-private key pair, encapsulates the private key into a personal digital identity table, and guides the user to enter a password. The personal digital identity table is symmetrically encrypted based on the password and saved by the user;

[0030] The identity management application uploads the public key information to the server, and the server calls the smart contract of the blockchain network to write the public key information into the blockchain network. The smart contract writes the public key information into the personal digital identity table.

[0031] As a further improvement of the present invention, when the smart contract writes the public key information into the personal digital identity table, it also includes the step of public key verification:

[0032] If the public key already exists, it is rejected;

[0033] If the public key format is illegal, it will be rejected.

[0034] As a further improvement of the present invention, the steps of generating an identity credential based on a personal digital identity for an individual user on demand, constructing parameters and calling a smart contract to write the identity credential into a blockchain network include:

[0035] The smart contract verifies whether the attribute issuer public key in the input parameter matches the digital signature. If not, it is rejected.

[0036] The smart contract verifies whether the attribute issuer public key in the input parameter has a corresponding record in the on-chain organization digital certificate table and the status is valid. If the conditions are not met, it is rejected;

[0037] The smart contract verifies whether the personal identity public key in the input parameter exists in the on-chain personal digital identity table and the status is valid. If the conditions are not met, it will be rejected;

[0038] The smart contract verifies whether the time parameters are legal. If not, it will be rejected.

[0039] The smart contract parses each field of the input parameter, appends the block height, completes the consensus through the consensus algorithm, and writes it into the personal digital identity attribute certificate table on the chain.

[0040] In addition, the present invention also provides: a blockchain network and an identity association application, wherein the blockchain network is built using the above-mentioned trusted user identity system construction method, and the blockchain network interacts with the identity management application for data.

[0041] The beneficial effects of the present invention are: when using the on-chain two-dimensional relationship table to add, modify, query, delete, and other management of institutional certificates, personal digital identities, and personal trusted identity credentials on the chain, rapid retrieval, positioning, and processing can be performed based on the characteristics of the two-dimensional relationship table, which significantly reduces the complexity of technical implementation and improves processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The present invention is further described in detail below based on the accompanying drawings and embodiments.

[0043] Figure 1 This is an architecture diagram of the business system described in Example 2;

[0044] Figure 2 This is an architecture diagram of the blockchain node in Example 2;

[0045] Figure 3 This is an architecture diagram of the business layer in Example 2. DETAILED DESCRIPTION

[0046] In order to make the technical problems solved by the present invention, the technical solutions adopted and the technical effects achieved clearer, the technical solutions of the embodiments of the present invention are further described in detail below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0047] Example 1

[0048] This embodiment provides a method for building a trusted user identity system, including the following steps:

[0049] S1. Build a blockchain network with trusted identities, where a smart contract for identity management is deployed on the blockchain network, and based on the two-dimensional relationship table on the blockchain network, an on-chain two-dimensional relationship table of the identity management application is defined.

[0050] Specifically, each participant provides a server to arrange the underlying blockchain platform according to its own characteristics, forming a blockchain node managed by the participant, or can choose any underlying blockchain platform that supports two-dimensional relationship tables on the chain, such as Fisco-bcos. Several blockchain nodes are interconnected to form a blockchain network;

[0051] The blockchain network obtained through the above steps stores the data on the blockchain network chain in a two-dimensional relationship table on the chain. The two-dimensional relationship table on the chain includes: organization digital certificate table, personal digital identity table, and personal digital identity attribute certificate table. Deploy the smart contract of identity management in the blockchain network to form a trusted identity blockchain network.

[0052] The attributes of the organization digital certificate table mainly include the organization name, organization public key, the algorithm followed by the public and private key pairs (national secret algorithm SM2 / international algorithm RSA, etc.), digital certificate content, creation time, current status, modification time, creation block height, and latest modification block height.

[0053] The attributes of the personal digital identity table mainly include the creator's public key (the public key from the organization's digital certificate table), personal identity public key, the algorithm followed by the public and private key pair (national secret algorithm SM2 / international algorithm RSA, etc.), creation time, cancellation time, creation block height, and cancellation block height.

[0054] Personal digital identity attribute certificate table: The attributes mainly include personal identity public key, certificate issuer public key, certificate signature algorithm, personal identity attribute mapping, whether personal identity attributes are encrypted, encryption algorithm, creation time, validity expiration time, update time, current status, creation block height, and latest modification block height.

[0055] The method of this embodiment does not require all participants to deploy the underlying blockchain platform to form their own blockchain nodes. Existing nodes in the blockchain network can also be used to complete the interaction with the trusted identity blockchain network. Typical interactions include writing data to the trusted identity blockchain network and reading data from the trusted identity blockchain network.

[0056] If a new party joins, the following steps are also included:

[0057] Deploy new block nodes and connect them to the existing blockchain network. The new blockchain nodes automatically synchronize smart contracts from the blockchain network without the need for repeated deployment.

[0058] S2. Build a cross-organizational available user system on the blockchain network, including:

[0059] S21. Validity verification of the participating institution certificates:

[0060] First, any participant applies for an institutional certificate from the CA, which can be in the form of a UKey or a certificate file, and can use a national or international encryption certificate; the CA is not required to enter the trusted network but its authority can be used.

[0061] The administrator of the participating party submits the public key certificate of his or her own organization certificate to the identity management application through the human-computer interaction interface of the identity management application. After the identity management application verifies the validity of the certificate, it stores a copy in its own database.

[0062] When the institution certificate is in the form of a certificate file, the uploaded certificate complies with the X.509 specification public key certificate, and the system server parses the certificate;

[0063] If the institutional certificate is in the form of Ukey, the identity management application web page reads the public key certificate content from Ukey and uploads it to the system server for parsing. This part of the function is completed by integrating the corresponding Ukey SDK into the identity management application web page.

[0064] S22. The identity management application uses the institution certificate in step S21 and calls the smart contract to write the institution certificate into the blockchain network:

[0065] Verify that the digital signature of the request is correct using the public key of the institution certificate in the input parameter to ensure that only the institution itself can upload its own institution digital certificate.

[0066] Determine whether the organization certificate table on the blockchain network chain has a record of the public key corresponding to the request, and reject it if so;

[0067] Parse the content of the public key authority certificate to obtain the organization name, organization public key, public-private key pair following the algorithm, and write them into the corresponding fields of the organization certificate table through consensus along with the digital certificate content and creation time, where the creation time is carried by the input parameters.

[0068] S23. Generate a personal digital identity for the individual user and call the smart contract to write it into the blockchain network. In the specific implementation process, any employee of the participating party logs in to any identity management application that can access the trusted identity blockchain network and submits a request to generate a personal digital certificate through its personal digital identity management module:

[0069] The front end of the identity management application (which can be a web page or client) generates a unique public-private key pair. The public-private key can be generated based on a national secret algorithm or an international secret algorithm. The system encapsulates the private key into a personal digital certificate, guides the user to enter a password, and symmetrically encrypts the personal digital certificate based on the password for the user to save. In this process, the system does not need to obtain the private key generated by the user, and it is only kept by the user to ensure compliance with the requirements of the digital signature law;

[0070] The public key information of the identity management application is uploaded to the server. The server calls the smart contract of the blockchain to upload the public key information to the chain, and the smart contract writes the public key information into the personal digital identity table. At this time, the public key needs to be verified. If the public key already exists, it will be rejected; if the public key format is illegal, it will be rejected.

[0071] Specifically, the legitimacy of the public key format is determined based on the public-private key generation algorithm. In step S23, the front end of the identity management application generates a personal public-private key pair, takes the public key as the identity ID, and shares it across organizations through the blockchain.

[0072] S24. Generate identity credentials based on personal digital identity for individual users as needed, construct parameters and call smart contracts to write to the blockchain network:

[0073] Any employee of the participating party initiates the trusted identity credential application process through the personal trusted identity attribute management module of the identity management application. After completing the approval process in a certain way, the administrator of the participating party issues a trusted identity certificate to the employee through the application system. The identity certificate is used to prove that the user has a certain identity attribute in the trusted sharing network. For example, the employee certificate generally includes the following information: user name, department, position, user's public key, validity period of the certificate, and the digital signature obtained by the digital signature operation using the participant's institution certificate for the certificate. The issued trusted identity certificate is written to the blockchain. The data contained in various identity certificates can be expanded according to the specific identity certificate type.

[0074] After the identity management application completes the business logic, it constructs relevant parameters based on whether the attributes need to be encrypted, and then calls the blockchain smart contract to put it on the chain (the user's identity attribute proof is directly generated by the actual identity attribute generating organization and published to the trusted sharing network. This logic is similar to offline letters of introduction, academic qualifications, etc., which is rare). The contract writes the data into the personal digital identity attribute certificate table on the chain, including the following steps:

[0075] The smart contract verifies whether the attribute issuer public key in the input parameter matches the digital signature. If not, it is rejected.

[0076] Verify whether the attribute issuer public key in the input parameter has a corresponding record in the on-chain organization digital certificate table and the status is valid. If the conditions are not met, reject it;

[0077] Verify whether the personal identity public key in the input parameter has a corresponding record in the personal digital identity table on the chain and the status is valid. If the conditions are not met, reject it;

[0078] Check whether the time parameters are legal. If not, reject the request.

[0079] Parse each field of the input parameter, append the block height, complete the consensus through the consensus algorithm, and write it into the personal digital identity attribute certificate table on the chain.

[0080] Next, step S24 is explained in conjunction with the specific implementation process:

[0081] The cross-organizational business request data flows from the business system of any participant (hereinafter referred to as system A) to the business system of any other participant (hereinafter referred to as system B), which includes the user's digital identity public key associated with the business request data and the digital signature of the request data using the corresponding digital identity private key (if the encrypted attribute identity certificate on the chain is required, the decryption key will be attached);

[0082] System B parses the personal digital identity public key from the business data and verifies the matching of the digital signature and the public key. If they do not match, the digital signature of the business request is judged to be forged and the corresponding business processing is performed. Otherwise, the subsequent identity authentication process continues.

[0083] Based on the personal digital identity public key, system B calls the smart contract to quickly query the corresponding personal digital identity from the personal digital identity two-dimensional table on the chain using a SQL-like method. If no corresponding record is found, the digital identity is determined to be an illegal digital identity and corresponding business processing is performed, otherwise the subsequent identity authentication process continues.

[0084] Based on the personal digital identity public key, system B calls the smart contract to quickly query all valid personal identity attribute certificates associated with the digital identity public key from the personal digital trusted identity attribute certificate table on the chain using a SQL-like method. For each certificate, it verifies whether its issuer public key exists in the organization certificate table, and whether the digital signature in the trusted identity attribute certificate matches the issuer public key. If there is no associated issuer public key or the digital signature verification does not match, the digital identity is determined to be an illegal digital identity and the corresponding business processing is carried out. Otherwise, the subsequent identity authentication process continues;

[0085] Optionally, system B decrypts the encrypted data of the personal identity attribute credential using the decryption key in the business data request;

[0086] System B presents the personal identity attribute data contained in the personal identity attribute certificate that has been verified as above to the user who is performing business processing, and the user performs subsequent business processing based on the trusted identity attribute according to business rules.

[0087] After any participant uses the above method to complete the processing flow of the on-chain digital identity / identity attribute certificate of its own organization and its employees / members, global trusted user information is formed in the trusted blockchain network. All users have a unique identity ID (i.e., public key) and one or more identity attribute certificates on the chain. Any participant can obtain the identity information of any user from the trusted blockchain network according to business needs (such as file utilization approval), and can also use digital signature technology based on the user public key published in the trusted blockchain network to confirm whether a request is initiated by a certain user. If the identity attribute certificate written to the blockchain network involves sensitive information, the attribute information in the identity attribute certificate is encrypted, and the encryption key is passed to the identity attribute verification party for decryption through subsequent business processing.

[0088] The logic of user information changes in the trusted user system (such as cancellation of personal digital identity, cancellation and renewal of identity attribute certificates, etc.) is similar to the above steps with the addition of new participants. In particular, the cancellation of identity attribute certificates does not necessarily need to be initiated by the user himself, but can be directly initiated by the organization that issued the certificate.

[0089] In summary, this embodiment has the following beneficial effects:

[0090] 1. Identity attributes can be expanded according to business needs: After an individual user has a cross-organizational personal digital identity, different organizations can issue trusted identity attributes to him / her according to business needs; for example, when electronic archives are used across organizations, the archive provider requires that the user is both an employee of a company and a member of a professional association. In this case, the company and the association can issue corresponding trusted identity attribute certificates to the user based on actual conditions.

[0091] 2. Aggregate the trusted identity attributes of multiple parties: The credibility of the trusted identity attribute credentials comes from the social relationships in the real world. For example, a company can prove that someone is its employee, and a school can prove that someone is its graduate. The identities of the company and the school are certified by an authoritative CA organization, thus forming a trust chain that conforms to real social relationships.

[0092] 3. Efficiency: The proof of personal identity attributes no longer requires offline interaction with CA organizations, which greatly improves the efficiency of identity attribute proof, change, and cancellation.

[0093] 4. When using the on-chain two-dimensional relationship table to add, modify, query, delete, and manage institutional certificates, personal digital identities, and personal trusted identity credentials on the chain, rapid retrieval, positioning, and processing can be performed based on the characteristics of the two-dimensional relationship table, which significantly reduces the complexity of technical implementation and improves processing efficiency.

[0094] Example 2

[0095] This embodiment discloses a business system for trusted user identities, such as Figure 1-Figure 3 As shown, it includes: a blockchain network and an identity association application. The blockchain network is built using the trusted user identity system construction method of Example 1, and the blockchain network interacts with the identity management application for data.

[0096] Specifically, the software architecture of the business system includes blockchain networks and identity management applications. The trusted identity blockchain network is an infrastructure maintained by multiple parties, while the identity management application is independently deployed and used by different business participants. The identity management application can interact with the actual business systems of each participant as an independent service to provide them with cross-organizational trusted identity management services, or it can be added as a module to an actual business system.

[0097] Furthermore, the business system of trusted user identity is built on blockchain, which can be understood as a trusted database maintained by multiple parties, as a public storage that cannot be tampered with (and therefore trusted) for cross-organizational sharing of user-related data. The trusted sharing network consists of multiple blockchain nodes (such as Figure 1 The trusted shared network in the blockchain consists of 4 blockchain nodes). Logically, a single blockchain node can be divided into two parts: business-related smart contracts and the underlying blockchain platform.

[0098] The identity management application implements trusted user management within the scope of each participant. It can interact with the actual business system of each participant as an independent service to provide cross-organizational trusted identity management services, or it can be added to an actual business system as a module. The module architecture of the identity management application is as follows. In particular, the client does not need to rely on the server to implement the logic of generating the public and private key pairs of the user's digital identity.

[0099] In summary, the present invention has the following beneficial effects:

[0100] Identity attributes can be expanded according to business needs: after an individual user has a cross-organizational personal digital identity, different organizations can issue trusted identity attributes to him / her according to business needs; for example, when electronic archives are used across organizations, the archive provider requires that the user be both an employee of a certain company and a member of a certain professional association. In this case, the company and the association can issue corresponding trusted identity attribute certificates to the user based on actual conditions.

[0101] Aggregate the trusted identity attributes of multiple parties: The credibility of the trusted identity attribute credentials comes from the social relationships in the real world. For example, a company can prove that someone is its employee, and a school can prove that someone is its graduate. The identities of the company and the school are certified by an authoritative CA organization, thus forming a trust chain that conforms to real social relationships.

[0102] Efficiency: Proof of personal identity attributes no longer requires offline interaction with CA organizations, which greatly improves the efficiency of identity attribute proof, change, and cancellation.

[0103] In addition, it should be understood that although this specification is described according to implementation methods, not every implementation method contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment may also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

[0104] The technical principle of the present invention is described above in conjunction with specific embodiments. These descriptions are only for explaining the principle of the present invention and cannot be interpreted as limiting the scope of protection of the present invention in any way. Based on the explanations herein, those skilled in the art can associate other specific implementations of the present invention without paying creative labor, and these methods will fall within the scope of protection of the present invention.

Claims

1. A method for constructing a trusted user identity system, characterized in that: Includes steps: Build a blockchain network with trusted identity, where a smart contract for identity management is deployed on the blockchain network, and based on the two-dimensional relationship table on the blockchain network, define the on-chain two-dimensional relationship table of the identity management application; Build a cross-organizational available user system on the blockchain network, including: Verification of the validity of the participating institution certificates; Call the smart contract to write the institution certificate into the blockchain network; Generate personal digital identities for individual users and call smart contracts to write them into the blockchain network; Generate identity credentials based on personal digital identity for individual users on demand, construct parameters and call smart contracts to write them into the blockchain network. Obtain the trusted identity information of any individual user from the blockchain network on demand to support business needs.

2. The method for constructing a trusted user identity system according to claim 1, characterized in that: The steps of building a trusted identity blockchain network include: Participants deploy blockchain nodes, and several blockchain nodes are interconnected to form a blockchain network; The data on the blockchain network chain is stored in a two-dimensional relational table on the chain; Deploy smart contracts for identity management in the blockchain network to form a trusted identity blockchain network.

3. The trusted identity blockchain network according to claim 2, characterized in that: If a new party joins, the following steps are also included: Deploy a new blockchain node and connect it to the existing blockchain network. The new blockchain node will automatically synchronize smart contracts from the existing blockchain network.

4. The trusted identity blockchain network according to claim 1, characterized in that: The two-dimensional relationship table on the chain includes: an organization digital certificate table, a personal digital identity table, and a personal digital identity attribute certificate table.

5. The trusted identity blockchain network according to claim 4, characterized in that: The steps of verifying the validity of the participant institution certificate include: When the institution certificate is in the form of a certificate file, the system server parses the certificate; When the institution certificate is in the form of Ukey, the identity management application web page reads the public key certificate content from Ukey and uploads it to the system server for parsing.

6. The trusted identity blockchain network according to claim 4, characterized in that: The step of calling the smart contract to write the institution certificate into the blockchain network includes: Verify the public key of the institution's certificate and check whether the digital signature written into the blockchain network request is correct; Determine whether the organization certificate table on the blockchain network chain has a record of the public key corresponding to the request, and reject it if so; Parse the content of the public key authority certificate to obtain the organization name, organization public key, public and private key pair following the algorithm, and write them into the corresponding fields of the organization certificate table through consensus along with the digital certificate content and creation time.

7. The method for constructing a trusted user identity system according to claim 1, characterized in that: The steps of generating a personal digital identity for an individual user and calling a smart contract to write it into the blockchain network include: The identity management application generates a unique public-private key pair, encapsulates the private key into a personal digital identity table, and guides the user to enter a password. The personal digital identity table is symmetrically encrypted based on the password and saved by the user; The identity management application uploads the public key information to the server, and the server calls the smart contract of the blockchain network to write the public key information into the blockchain network. The smart contract writes the public key information into the personal digital identity table.

8. The method for constructing a trusted user identity system according to claim 7, characterized in that: When the smart contract writes the public key information into the personal digital identity table, it also includes the public key verification step: If the public key already exists, it is rejected; If the public key format is illegal, it will be rejected.

9. The method for constructing a trusted user identity system according to claim 1, characterized in that: The steps of generating identity credentials based on personal digital identity for individual users on demand, constructing parameters and calling smart contracts to write into the blockchain network include: The smart contract verifies whether the attribute issuer public key in the input parameter matches the digital signature. If not, it is rejected. The smart contract verifies whether the attribute issuer public key in the input parameter has a corresponding record in the on-chain organization digital certificate table and the status is valid. If the conditions are not met, it is rejected; The smart contract verifies whether the personal identity public key in the input parameter exists in the on-chain personal digital identity table and the status is valid. If the conditions are not met, it will be rejected; The smart contract verifies whether the time parameters are legal. If not, it will be rejected. The smart contract parses each field of the input parameter, appends the block height, completes the consensus through the consensus algorithm, and writes it into the personal digital identity attribute certificate table on the chain.

10. A business system for trusted user identity, characterized in that: include: A blockchain network and an identity-associated application, wherein the blockchain network is constructed using the trusted user identity system construction method as described in any one of claims 1 to 9, and the blockchain network interacts with the identity management application for data.

Images