User authentication data management method and device

Abstract

The present disclosure provides a method for managing user identity authentication data, a method for authorized query, a management device, an authentication device, a terminal, a non-transitory computer-readable storage medium, and a computer program product. At the management device, a query request from a query requester for the original identity data of a user to be queried is verified, and the query request at least includes a key for encrypting the original identity data to be queried; in response to the query request passing the verification, authorization information for the query request is sent to the query requester; based on the mapping information associated with the original identity data stored by multiple authentication devices, at least one authentication device for storing the original identity data to be queried among multiple authentication devices is determined; and in response to receiving signature information about the original identity data to be queried from the user to be queried, signature information and a key are sent to at least one authentication device, and the signature information is generated by the terminal device of the user to be queried based on the authorization information received from the query requester.

Description

Technical Field

[0001] The present disclosure relates to a method and device for managing user identity authentication data, and more specifically, to a method for managing user identity authentication data based on a blockchain platform, a method for authorized query, a management device, an authentication device, a user terminal device, a non-transitory computer-readable storage medium, and a computer program product. Background Art

[0002] Individuals or companies need to perform identity authentication in many scenarios. In traditional user identity data authentication and management solutions, individuals or companies need to submit original identity data (such as scanned copies of ID cards, scanned copies of company business licenses, etc.) to different certification agencies for identity authentication. For example, when an enterprise applies to become a seller on Internet platform A, a designated KYC (Know Your Customer) certification agency is required to review and authenticate the original identity materials or data submitted by the enterprise (such as scanned copies of the company's business license, identity documents of the primary contact person and beneficiary, account opening license or public bank statements, etc.). The time for this review and authentication is, for example, several days or longer. When the enterprise applies to become a seller on Internet platform B or applies for other qualifications, other KYC certification agencies are required to review and authenticate the original identity data submitted by the enterprise again.

[0003] In traditional user identity data authentication and management solutions, since the original identity authentication data, authentication process and authentication results of different authentication agencies are relatively independent, and there is a lack of effective, reliable and authorized data interaction methods, different authentication agencies have to repeatedly review and authenticate the same original identity data of the same user, resulting in a large waste of social resources, which is not conducive to improving the efficiency of identity authentication, as well as the efficient management and trusted sharing of identity authentication data.

[0004] Therefore, it is necessary to build a user authentication data management solution to achieve trusted sharing of user authentication data authenticated by a certification body. Summary of the invention

[0005] The present disclosure provides a method and device for managing user identity authentication data, which can effectively realize the trusted sharing of user identity authentication data authenticated by a certification body.

[0006] According to the first aspect of the present disclosure, a method for managing user identity authentication data is provided. The method comprises: at a management device, verifying a query request from a query requester for original identity data of a user to be queried, the query request at least comprising a key for encrypting the original identity data to be queried; in response to the query request passing the verification, sending authorization information for the query request to the query requester; based on mapping information associated with the original identity data stored by multiple authentication devices, determining at least one authentication device for storing the original identity data to be queried among multiple authentication devices; and in response to receiving signature information about the original identity data to be queried from the user to be queried, sending signature information and a key to at least one authentication device, the signature information being generated by a terminal device of the user to be queried based on the authorization information received from the query requester.

[0007] According to the second aspect of the present invention, a method for managing user identity authentication data is also provided. The method comprises: at the authentication device, sending mapping information to the user identity authentication data management device, the mapping information indicating the association with the original identity data stored by the authentication device; obtaining signature information and a key related to the authorization of the original identity data to be queried of the user to be queried from the management device; in response to confirming that the signature information has passed the verification, encrypting the original identity data to be queried and the hash value of the original identity data to be queried based on the key, wherein the hash value of the original identity data to be queried is obtained from the blockchain platform; sending the encrypted original identity data to be queried and the hash value of the original identity data to be queried to the management device or the query requester, wherein the hash value of the original identity data to be queried is used to verify the original identity data to be queried.

[0008] According to a third aspect of the present invention, a method for authorized query of user identity authentication data is also provided. The method comprises: obtaining authorization information about the original identity data to be queried from the query requester at the terminal device of the user to be queried; sending feedback data to the management device, the feedback data being generated based on the authorization information; obtaining an authorization confirmation request from the management device, the authorization confirmation request being generated by the management device in response to the feedback data matching the authorization information; and sending signature information about the original identity data to be queried to the management device in response to confirming that the authorization confirmation request is approved.

[0009] According to a fourth aspect of the present invention, there is also provided a user authentication data management device, which includes: a memory configured to store one or more programs; and a processing unit coupled to the memory and configured to execute the one or more programs so that the management device performs the method of the first aspect of the present disclosure.

[0010] According to a fifth aspect of the present invention, there is also provided a user identity authentication data authentication device, which includes: a memory configured to store one or more programs; and a processing unit coupled to the memory and configured to execute the one or more programs so that the authentication device performs the method of the second aspect of the present disclosure.

[0011] According to a sixth aspect of the present invention, a user terminal device is also provided. The device includes: a memory configured to store one or more programs; and a processing unit coupled to the memory and configured to execute the one or more programs to enable the user terminal device to perform the method of the third aspect of the present disclosure.

[0012] According to a seventh aspect of the present disclosure, a non-transitory computer-readable storage medium is provided, wherein machine-executable instructions are stored on the non-transitory computer-readable storage medium, and when the machine-executable instructions are executed, the machine executes the method of any one of the first, second and third aspects of the present disclosure.

[0013] According to an eighth aspect of the present disclosure, a computer program product is provided, which is tangibly stored on a non-transitory computer-readable medium and includes machine executable instructions, which, when executed, cause a machine to perform the method of any one of the first, second and third aspects of the present disclosure.

[0014] This Summary is provided to introduce a selection of concepts in a simplified form that are further described in the Detailed Description below. This Summary is not intended to identify key features or essential features of the disclosure, nor is it intended to limit the scope of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The above and other objects, features and advantages of the present disclosure will become more apparent through a more detailed description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, wherein like reference numerals generally represent like components throughout the exemplary embodiments of the present disclosure.

[0016] Figure 1 An architectural diagram of a management system 100 for user identity authentication data according to an embodiment of the present disclosure is shown;

[0017] Figure 2 A flowchart of a method 200 for managing user identity authentication data according to an embodiment of the present disclosure is shown;

[0018] Figure 3 A flowchart of a method 300 for managing user identity authentication data according to an embodiment of the present disclosure is shown;

[0019] Figure 4 A flowchart of a method 400 for querying user identity authentication data according to an embodiment of the present disclosure is shown;

[0020] Figure 5 A data flow diagram of a method 500 for managing user identity authentication data according to an embodiment of the present disclosure is shown; and

[0021] Figure 6 A block diagram of an electronic device 600 suitable for implementing the embodiments of the present disclosure is schematically shown.

[0022] In the various drawings, the same or corresponding reference numerals represent the same or corresponding parts. DETAILED DESCRIPTION

[0023] The preferred embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the preferred embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0024] As used herein, the term "including" and its variations mean open inclusion, i.e., "including but not limited to". Unless otherwise stated, the term "or" means "and / or". The term "based on" means "based at least in part on". The terms "an example embodiment" and "an embodiment" mean "at least one example embodiment". The term "another embodiment" means "at least one additional embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0025] As described above, in traditional user identity authentication and data management solutions, due to the lack of security measures for data interaction and the lack of user trust for querying original identity data, the original identity authentication data, authentication process and authentication results of different authentication agencies are relatively independent, and reliable data interaction cannot be achieved. As a result, the same original identity data of the same user is repeatedly authenticated by different authentication agencies, and the reliable authentication results authenticated by the authentication agencies cannot be effectively utilized, which in turn causes a large amount of social resources to be wasted, which is not conducive to improving the efficiency of identity authentication and the effective management and sharing of identity authentication data.

[0026] In order to at least partially solve one or more of the above problems and other potential problems, an example embodiment of the present disclosure proposes a user identity authentication data management scheme. In this scheme, at the management device, a query request for the original identity data of the user to be queried from the query requester is verified, and the query request at least includes a key for encrypting the original identity data to be queried; in response to the query request passing the verification, authorization information for the query request is sent to the query requester; based on the mapping information associated with the original identity data stored by multiple authentication devices, at least one authentication device for storing the original identity data to be queried among the multiple authentication devices is determined; and in response to receiving signature information about the original identity data to be queried from the user to be queried, signature information and a key are sent to at least one authentication device, and the signature information is generated by the terminal device of the user to be queried based on the authorization information received from the query requester.

[0027] In the above scheme, by verifying the query request, and in response to the query request passing the verification, sending the authorization information for the query request to the query requester, it can be effectively guaranteed that the data query content involved in the query request is confirmed or supervised by the management device, and the interaction between the query requester and the user to be queried regarding the authorization information is also confirmed and supervised by the management device. By determining at least one authentication device by the mapping information associated with the original identity data stored by multiple authentication devices, and sending the signature information and the key to it, the original identity data stored by multiple authentication devices can be effectively queried. By sending the signature information and the key (for example, the public key from the query requester) to at least one authentication device in response to receiving the signature information about the original identity data from the user to be queried, it can be effectively guaranteed that the authenticated original identity data is encrypted when the user to be queried is authorized, so that the authenticated original identity data is only open to the specific query requester who obtains the verification information. Therefore, the management scheme of user identity authentication data proposed in the example embodiment of the present disclosure can effectively realize the trusted sharing of authenticated user identity authentication data.

[0028] Figure 1 FIG. 1 shows an architecture diagram of a management system 100 for user identity authentication data according to an embodiment of the present disclosure. Figure 1 As shown, the system 100 includes a management device 110, a blockchain platform 112, multiple authentication devices 120, 122, and multiple user terminals (e.g., a mobile phone 130, a computer 132). The management device 110, the blockchain platform 112, the authentication devices 120, 122, and the user terminals 130, 132 interact with each other via a network 140.

[0029] The user terminals 130 and 132 are, for example, but not limited to, mobile phones and personal computers. The user can send the original identity data and authentication request to the authentication device 120 and / or 122 via the user terminal, and when the user is the query requester, send a query request for the original identity data of the user to be queried to the management device 110, or when the user is the user to be queried, send signature information for the original identity data to be queried to the management device 110. Figure 1 As shown, the user 134 sends the first original identity data 160 and the first authentication request to the authentication device 120 for identity data authentication via the user terminal 130; and sends the second original identity data 162 and the second authentication request to the authentication device 122 for identity data authentication. The authentication device 120 for identity data authentication, for example, belongs to a bank authentication agency, and the first original identity data 160 is, for example, an image and / or document of a scanned copy of a company's business license. The authentication device 122 for identity data authentication, for example, belongs to an authentication agency of an Internet operating platform, and the second original identity data 162 is, for example, an image and / or document of a copy of an identity card, a certificate of education, a scanned copy of a company's business license, etc.

[0030] In some embodiments, a wallet application may be run on the user terminal 130. The user 134 may register on the authentication device 120 and / or 122 through the wallet application so as to obtain an associated account ID that uniquely identifies the user at the corresponding authentication device. The associated account ID is, for example, but not limited to, a combination of the user's identifier (e.g., email or mobile phone number) obtained through a connector (such as ".", "-", etc.) and the associated account identifier of the authentication device that stores the original identity data of the user. For example, assuming that the user 134 registers on the authentication device 120 with his mobile phone number 18912345678, and the associated account identifier of the authentication device 120 is IDA, the associated account ID obtained by the user 134 on the authentication device 120 through the wallet application may be expressed as "IDA.18912345678". It can be seen that the associated account ID of the user not only indicates the user identifier, but also indicates the associated account identifier of the authentication device 120 associated with the user, that is, the associated account ID of the authentication device 120.

[0031] In some embodiments, the user terminal 130 may also obtain authorization information (the authorization information is configured in the form of a QR code, for example) sent by the query requester to the user terminal 130 via the wallet application, so as to obtain the temporary session credentials included in the authorization information.

[0032] In some embodiments, the user terminal 130 may also use the key to sign and authorize the authorization confirmation request (eg, a temporary session credential, an authorization code in the form of a random number) from the management device 110 via the wallet application.

[0033] In some embodiments, when user 136 is the query requester, at the terminal device 132, the original identity data to be queried and the hash value of the original identity data to be queried encrypted by an encryption key (such as an asymmetric encryption public key) sent by the authentication devices 120 and 122 can be obtained, and the obtained information can be decrypted using a decryption key (such as an asymmetric encryption private key), and the authenticity of the original identity data to be queried can be verified based on the hash value of the original identity data to be queried.

[0034] Regarding the authentication devices 120 and 122, they are used to authenticate, store and manage one or more original identity data of the user (for example, the first original identity data 160 and the second original identity data 162). The authentication device 120 or 122, for example, belongs to a KYC enterprise. The authentication devices 120 and 122 can establish contact with the management device 110 through initialization to achieve the management of the user's KYC information. For example, the authentication devices 120 and 122 can apply to the management device 110 for an identifier (such as a user name) and a password for accessing the management device 110, and an associated account for identity data management at the management device 110. The authentication devices 120 and 122 can also periodically synchronize at least one of the mapping information, the domain name and the query rule to the management device 110; wherein the mapping information is, for example, a 256-bit data dictionary rule, which is used to describe the meaning of each identification bit of the authentication result of the original identity data stored by the authentication devices 120 and 122, the query rule is used to indicate the queryable range of the original data, and the domain name is used to indicate the corresponding authentication device at the management device 110. The authentication device 120, 122 may also generate authentication result data when the original identity data passes the verification, and transmit the authentication result data to the blockchain platform 112 based on the smart contract deployed by the private key of the authentication device. The authentication device 120, 122 is also configured to provide the original identity data to be queried (for example, the first original identity data 160 or the second original identity data 162 as described above, or the third original identity data different from the first original identity data 160 and the second original identity data 162) encrypted by the key (for example, the public key) and the hash value 166 of the original identity data to be queried stored by the blockchain platform 112 to the query requester (for example, the user 136) via the management device 110 after obtaining the signature information signed by the private key of the user to be queried, and in response to confirming that the signature information passes the verification. In some embodiments, the authentication device 120, 122 may also include a module for managing user-associated accounts, an encryption module for user encryption of original identity data, an encryption module for encrypting the original identity data to be queried and the hash value of the original identity data to be queried, etc.

[0035] Regarding the management device 110, it is used to manage user identity authentication data. The management device 110 is interconnected with multiple distributed authentication devices 120 and 122 via a network 140 to store mapping information, domain names and query rules of each of the multiple distributed authentication devices 120 and 122. In some embodiments, after obtaining the query request submitted by the query requester (e.g., user 136) via the computer 132, the management device 110 verifies the query request, and in response to confirming that the query request has passed the verification, sends authorization information including temporary session credentials to the query requester, and in response to receiving the signature information about the original identity data from the user to be queried 134, sends the signature information and a key (e.g., a public key) to at least one authentication device 120 and / or 122 that stores the original identity data of the user to be queried, so as to obtain the hash value 166 of the original identity data to be queried and the original identity data to be queried stored by the blockchain platform 112, and forward it to the query requester 136. In some embodiments, the hash value 166 of the original user data to be queried and the original identity data to be queried stored by the blockchain platform 112 can also be directly sent to the query requester by the authentication device 120, 122. In some embodiments, the management device 110 is a dedicated processing device independent of the blockchain platform 112 and the authentication device 120, 122, such as a centralized server. In some embodiments, the management device 110 is integrated in the blockchain platform 112 or the authentication device 120 or 122 for user identity authentication.

[0036] Regarding the blockchain platform 112, it is used to store the identity authentication result data. In terms of architecture, the blockchain platform 112 includes, for example, a basic service layer, a smart contract layer, and a blockchain bottom layer (not shown in the figure). The blockchain platform 112, for example, interacts with the management device 110 and the authentication devices 120 and 122 via the network 140 and the application program interface (not shown). In some embodiments, the blockchain platform 112 can be based on a private chain, a public chain, or a consortium chain. In some embodiments, the blockchain platform 112 is interconnected with a hardware-based private key signature device (not shown), and the private key signature device is, for example, a USB key. The authentication devices 120 and 122 can, for example, use the private key signature device to sign the identity authentication result data using the private key corresponding to the smart contract. The blockchain platform 112 then verifies the private key signature, and only when the verification is passed, the identity authentication result data is stored on the blockchain platform 112. In the above scheme, since the writing and modification of the data on the blockchain platform 112 are all required to be signed by the private key of the private key signature device, it can further ensure that the stored user identity authentication result data is safe and cannot be tampered with.

[0037] Figure 2FIG. 2 is a flowchart of a method 200 for managing user identity authentication data according to an embodiment of the present disclosure. Figure 2 In the example, each action is Figure 1 The method 200 may be executed by the processor of the management device 110. The method 200 may also include additional actions not shown and / or may omit the actions shown, and the scope of the present disclosure is not limited in this respect.

[0038] At box 202, at the management device, a query request for the original identity data of the user to be queried from the query requester is verified, and the query request at least includes a key for encrypting the original identity data to be queried. For example, the query requester (e.g., user 136) sends a query request to the management device 110, and the query request, for example, indicates to query the original identity data to be queried (e.g., a scanned copy of an ID card, a scanned copy of a certificate of education) of the user to be queried (e.g., user 134). In some embodiments, the query request also indicates: the query requester, the user to be queried, and the original data to be queried. At this time, the query request indicates which item or items of original identity data of which user the query requester requests to query. In some embodiments, the query request may indicate: the query requester and the user to be queried, without specifically indicating the original data to be queried. At this time, the query request indicates which user the query requester requests to query all queryable original identity data of. In some embodiments, the encryption key mentioned above is, for example, a key in the case of symmetric encryption or a public key in the case of asymmetric encryption, and the original identity data includes, for example, at least one of the following: image data, text data.

[0039] At box 204, in response to the query request passing the verification, authorization information for the query request is sent to the query requester. In some embodiments, sending the authorization information includes: determining whether the query request is verified based on whether the query requester is legitimate and whether at least one authentication device 120 or 122 for storing the original identity data to be queried exists; and in response to determining that the query request is verified, sending the authorization information to the query requester, wherein the authorization information includes a temporary session credential. In some embodiments, confirming whether the query requester is legitimate includes, for example, confirming whether the query requester and the user to be queried have been registered; and confirming whether the identifier of the original identity data to be queried belongs to a predetermined set. The predetermined set is, for example, a set predefined based on the query rules of the authentication device to indicate which original identity data is available for query. In the above scheme, by verifying the query request, and in response to the query request passing the verification, sending the authorization information for the query request to the query requester, it can effectively ensure that the data query content involved in the query request is confirmed or supervised by the management device or organization.

[0040] At block 206, at least one authentication device for storing the original identity data to be queried among the multiple authentication devices is determined based on the mapping information associated with the original identity data stored by the multiple authentication devices. In some embodiments, determining the at least one authentication device includes: determining at least one authentication device storing the original identity data to be queried based on a query request and the mapping information, wherein the query request includes an associated account identifier of the user to be queried, and the mapping information is associated with an identification bit of an authentication result of the original identity data stored by the corresponding authentication device.

[0041] Regarding the user's associated account identifier, in some embodiments, it includes: a combination of a user identifier and an associated account identifier of an authentication device associated with the user. For example, the user's associated account identifier (i.e., associated account ID) includes: a "user identifier" connected by a connector (such as ".", "-", etc.) and an "associated account identifier of an authentication device that stores the original identity data of the user." Therefore, based on the associated account identifier of the user to be queried in the query request, the associated account identifier of the authentication device that stores the original identity data of the user to be queried can be obtained, and based on the associated account identifier and mapping information of the authentication device, the specific authentication device that stores the original identity data to be queried can be further determined. In some embodiments, the associated accounts registered by the same user in multiple authentication devices can also be bound based on the "user identifier" in the user's associated account. By adopting the above means, even if the query request involves multiple original identity data to be queried stored in multiple distributed authentication agencies, the management device can effectively determine the corresponding authentication device or agency.

[0042] At box 208, in response to receiving signature information about the original identity data to be queried from the user to be queried, the signature information and the key are sent to at least one authentication device, wherein the signature information is generated by the terminal device of the user to be queried based on the authorization information received from the query requester. In some embodiments, the signature information at least indicates the query requester, the user to be queried, and the original identity data to be queried. For example, at the management device 110, when the signature information containing the private key signature of the user to be queried (e.g., user 134 via the user terminal 130) is received (e.g., a temporary session credential signed by the private key or an authorization code in the form of a random number), the signature information and the public key are sent to at least one authentication device 120, 122 that stores the original identity data to be queried, so that the at least one authentication device 120, 122 opens the original identity data to be queried to the query requester.

[0043] In some embodiments, after sending the authorization information to the query requester, method 200 also includes: obtaining feedback data from the user to be queried, the feedback data is generated by the user to be queried based on the authorization information received from the query requester; and in response to confirming that the feedback data matches the authorization information, sending an authorization confirmation request to the user to be queried, the authorization confirmation request is used to request the user to be queried to confirm the authorization using signature information.

[0044] In some embodiments, the query requester packages the temporary session credentials included in the authorization information obtained from the management device 110 into a URL and displays it as a QR code. The QR code is then sent to the user to be queried. The user to be queried obtains the temporary session credentials therein based on the authorization information in the form of the QR code, and then returns the temporary session credentials to the management device 110. The management device 110 verifies whether the temporary session credentials contained in the returned data match the temporary session credentials contained in the authorization information sent by the management device to the query requester. In response to confirming that the temporary session credentials match, an authorization confirmation request is sent to the user to be queried. The authorization confirmation request at least indicates: the original identity data to be queried, the authentication device 120 and / or 122 storing the original identity data to be queried, so that the user to be queried confirms whether to agree to the signature authorization of the original identity data to be queried. In some embodiments, for example, it is shown to the user to be queried: which company wants to query which original identity data of the user to be queried stored in which KYC company. In the above scheme, by verifying whether the temporary session credentials contained in the returned data match the temporary session credentials contained in the authorization information, and in response to the temporary session credentials matching, the user to be queried is requested to use the signature information to confirm the authorization, which can effectively ensure that the authorization information sent by the query requester to the user to be queried is consistent with the authorization information sent by the management device to the query requester and has not been tampered with.

[0045] In some embodiments, the method 200 further includes: obtaining the original identity data to be queried and the hash value of the original identity data to be queried from at least one authentication device storing the original identity data to be queried, the original identity data to be queried and the hash value of the original identity data to be queried being encrypted via a key, wherein the hash value of the original identity data to be queried is obtained from the blockchain platform 112; and sending the encrypted original identity data to be queried and the hash value of the original identity data to be queried to the query requester, wherein the hash value of the original identity data to be queried is used to verify the original identity data to be queried. In the above scheme, by sending the hash value of the original identity data to be queried obtained from the blockchain platform to the query requester, the query requester can verify the authenticity of the obtained original identity data to be queried based on the hash value of the obtained original identity data to be queried.

[0046] Figure 3FIG. 3 is a flowchart of a method 300 for managing user identity authentication data according to an embodiment of the present disclosure. Figure 3 In the example, each action is Figure 1 The method 300 may also include additional actions not shown and / or may omit actions shown, and the scope of the present disclosure is not limited in this respect.

[0047] At block 302, at the authentication device, mapping information is sent to the user identity authentication data management device, and the mapping information is associated with the original identity data stored by the authentication device. In some embodiments, the authentication device is at least one authentication device that stores the original identity data to be queried, determined by the management device based on the query request of the query requester and the mapping information, wherein the query request includes the associated account identifier of the user to be queried, and the mapping information is associated with the identification bit of the authentication result of the original identity data stored by the corresponding authentication device.

[0048] In some embodiments, the authentication device 120 applies to the management device for an associated account when initializing; uses the private key of the authentication device to deploy a smart contract for transmitting the identity authentication result data to the blockchain platform 112; and synchronizes mapping information, domain names, and query rules to the management device 110, where the domain name is associated with the associated account ID of the authentication device 120. In some embodiments, the authentication device 120 may apply to the management device 110 for an identifier (such as a user name) and password of the authentication device, and obtain an associated account (such as VeVID) for user identity authentication data management at the management device 110. The domain name mentioned above is used to indicate the authentication device 120 at the management device 110, and is associated with the associated account applied for by the authentication device 120, so the domain name may also be referred to as the associated account domain name of the authentication device.

[0049] In some embodiments, when the authentication device 120 authenticates the user's original identity data, the authentication device 120 generates identity authentication result data in response to confirming that the user's original identity data has passed the verification, and the identity authentication result data includes: the user's associated account ID, the authentication result, and the hash value of the original identity data, wherein the user's associated account ID is associated with the corresponding authentication device 120; and based on the smart contract deployed by the private key, the above-mentioned identity authentication result data is transmitted to the blockchain platform.

[0050] Regarding the authentication result, in some embodiments, it includes at least one of the following: the user's associated account identifier, the associated account identifier of the associated user associated with the user, the user's associated account status, and the user's identity type, the identity type is selected from at least one of the following: individual, organization, device, and smart contract. In the above scheme, based on the analysis of the user's identity type, a suitable authentication strategy can be selected. For example, if the identity type indicates that the user is an individual, it includes authentication of materials such as identity documents, academic degree certificates, etc. If the identity type indicates that the user is an organization, it includes authentication of materials such as legal representatives and business licenses.

[0051] In some embodiments, the authentication result includes a multi-bit binary flag bit, and each flag bit in the multi-bit binary flag bit is used to indicate whether the corresponding item in the original identity data containing multiple items has passed the verification. For example, when a certain bit of the binary flag bit is data "1", it indicates that the corresponding item in the original identity data has passed the verification; when it is data "0", it indicates that the corresponding item in the original identity data has not passed the verification. In the above scheme, based on the analysis of the multi-bit binary flag bits of the authentication result, the authentication profile of the original identity data of the user associated with the multi-bit binary flag bits can be quickly obtained. Through the query based on the flag bit, the information of multiple users whose corresponding items of the original identity data have the same characteristics can be efficiently obtained.

[0052] In some embodiments, the hash value of the original identity data is generated by performing a hash calculation on a corresponding item in the original identity data corresponding to a flag bit indicating that the verification is passed.

[0053] At box 304, signature information and keys related to the authorization of the original identity data to be queried of the user to be queried are obtained from the management device. In some embodiments, the authentication device 120 obtains signature information and a public key signed by the private key of the user to be queried from the user identity data management device. The public key is used to encrypt the original identity data to be queried. In some embodiments, the key is, for example, included in the query request sent by the query requester to encrypt the original identity data to be queried. The encryption key is, for example, a key in the case of symmetric encryption or a public key in the case of asymmetric encryption.

[0054] At box 306, in response to confirming that the signature information has been verified, the original identity data to be queried and the hash value of the original identity data to be queried are encrypted based on the key, wherein the hash value of the original identity data to be queried is obtained from the blockchain platform. In some embodiments, confirming that the signature information has passed the verification includes: confirming whether the query request is signed with the indicated private key at the relevant address in the application for user identity authentication data management. In some embodiments, in response to confirming that the signature information has not passed the verification, an error message about the original identity data to be queried is sent. In some embodiments, the authentication device 120 obtains the original identity data to be queried and the hash value of the original identity data to be queried based on the signature information, wherein the signature information at least indicates the query requester, the user to be queried, and the original identity data to be queried, wherein the original identity data to be queried is stored at the authentication device 120, and the hash value of the original identity data to be queried is stored in the blockchain platform 112. For example, the authentication device 120 obtains the locally stored original identity data of the query and the hash value of the original identity data to be queried stored by the blockchain platform 112 based on the associated account ID of the user to be queried included in the signature information and the authentication result indication bit corresponding to the corresponding item of the original data to be queried.

[0055] At block 308, the encrypted original identity data to be queried and the hash value of the original identity data to be queried are sent to the management device or the query requester, wherein the hash value of the original identity data to be queried is used to verify the original identity data to be queried. In some embodiments, the hash value of the original identity data to be queried obtained from the blockchain platform 112 can be used by the query requester to verify the authenticity of the obtained original identity data to be queried.

[0056] Figure 4 A flowchart of a method 400 for requesting authorization query of user identity authentication data according to an embodiment of the present disclosure is shown.

[0057] exist Figure 4 In the example, each action is Figure 1 The method 400 is executed by a processor of the user terminal device 130. The method 400 may also include additional actions not shown and / or may omit the actions shown, and the scope of the present disclosure is not limited in this respect.

[0058] At block 402, authorization information about the original identity data to be queried is obtained from the query requester at the terminal device of the user to be queried.

[0059] At block 404 , feedback data is sent to a management device, the feedback data being generated based on the authorization information.

[0060] At block 406, an authorization confirmation request is received from the management device, the authorization confirmation request being generated by the management device in response to confirming that the returned data matches the authorization information. In some embodiments, the authorization confirmation request at least indicates the query requester, the original identity data to be queried, and the authentication device storing the original identity data to be queried. In some embodiments, confirming that the returned data matches the authorization information includes confirming that both the authorization information and the returned data include temporary session credentials sent by the management device to the query requester.

[0061] At block 408 , in response to confirming authorization for the authorization confirmation request, signature information about the original identity data to be queried is sent to the management device. In some embodiments, the signature information includes, for example, a temporary session credential or a random number signed by a key, the random number coming from the management device 110 .

[0062] Figure 5 FIG. 5 shows an interactive diagram of a method 500 for managing user identity authentication data according to some embodiments of the present disclosure. Figure 5 In the method 500, each action is implemented by, for example, the query requester terminal device 502, the management device 504, the user terminal device to be queried 506, the authentication device 508, and the blockchain platform 510. In some embodiments, the method 500 involves initializing the authentication device, authenticating the user identity data and storing the identity authentication result data, initializing the query requester, querying the user original identity data, etc. It should be understood that the method 500 may also include additional actions not shown and / or may omit the actions shown, and the scope of the present disclosure is not limited in this respect.

[0063] The following examples are used to authenticate the various actions of device initialization.

[0064] At the authentication device 508, at 520, an identifier (such as a user name) and a password of the authentication device 508 are applied to the management device 504, and an associated account for user identity authentication data management at the management device 504 is obtained. In some embodiments, the associated account is, for example, identified as an identifier (such as VeVID) specific to the management device 504 of the KYC enterprise to which the authentication device 508 belongs. At 522, a smart contract for user identity authentication is deployed to the blockchain platform 510 using the private key of the authentication device 508. At 524, the associated account domain name, mapping information, and query rules are synchronized to the management device 504, wherein the mapping information is used to indicate the meaning of each identification bit of the authentication result, the query rule indicates the queryable range of the original identity data, and the associated account domain name is used to indicate the authentication device 508 at the management device 504, and is associated with the associated account applied for by the authentication device 508. In some embodiments, the mapping information is, for example, a 256-bit data dictionary rule, and the associated account domain name is, for example, the VeVID domain name of the KYC enterprise. In some embodiments, the associated account domain name, mapping information and query rules of the management device 504 can be queried based on the identifier (user name) applied for by the authentication device 508. By adopting the above means, each authentication device used to store user KYC information can establish a connection with the management device through initialization, and each authentication device deploys a smart contract for uploading user KYC information to the chain.

[0065] The following examples are used to authenticate user identity data and store the authentication result data.

[0066] At the user terminal device, for example, at the user terminal device to be queried 506, at 526, the user's original identity data and the authentication request are sent to one or more authentication devices 508. In some embodiments, the user may also provide the user's original identity data and the authentication request to the authentication device 508 or the KYC enterprise to which the authentication device 508 belongs in other ways.

[0067] At the authentication device 508, at 528, the original identity data is authenticated. At 530, in response to the original identity data being authenticated, the user's identity authentication result data is generated and stored. In some embodiments, the identity authentication result data includes at least: the user's associated account, the authentication result with multiple identification bits (e.g., 256 bits), and the hash value of the original identity data. In some embodiments, the user's associated account is associated with the associated account of the authentication device 508. The hash value of the above-mentioned original identity data is generated by performing a hash calculation on the original identity data item corresponding to the identification bit with information about the authentication result. In some embodiments, the authentication device 508 stores the user's original identity data. At 532, the identity authentication result data is uploaded to the blockchain platform 510 based on the deployed smart contract. By adopting the above means, each authentication device can authenticate and store the user's KYC information, and the generated user-associated account, authentication result, and hash value of the original identity data are chained so as to be used to verify the authenticity of the shared original identity data.

[0068] The following examples are used to query the various actions initiated by the requester.

[0069] At the query requester terminal device 502, at 534, the query requester identifier (such as user name) and password are applied to the management device 504. In addition, the query requester terminal device 502 can also apply to the management device 504 for an associated account for identity authentication data management. By adopting the above means, the query requester establishes a connection with the management device through initialization.

[0070] The following examples are used to query various actions of the user's original identity data.

[0071] At the query requester terminal device 502, at 536, a query request is sent to the management device 504, and the query request at least indicates: the query requester, the user to be queried, and the original identity data to be queried. In some embodiments, the query request also indicates an encryption key (e.g., a key in the case of symmetric encryption or a public key in the case of asymmetric encryption) used to encrypt the query result.

[0072] At the management device 504, at 538, it is verified whether the query requester is legal and whether the data storage party related to the original identity data to be queried exists. If it is legal and exists, the query request is verified. In some embodiments, the above verification includes: based on the identifier (user name) of the query requester, confirming whether the query requester is legal; and based on the associated account and mapping information of the user to be queried, confirming whether the data storage party to be queried exists. In some embodiments, the above verification also includes: confirming whether the data to be queried belongs to the queryable range based on the query rules of the authentication device. At 540, in response to the query request passing the verification, a temporary session credential (Token) is generated. At 542, the temporary session credential is sent to the query requester terminal device 502. At 544, based on the query request and the mapping information, at least one authentication device storing the original identity data of the user to be queried is determined. In some embodiments, when the authentication device determined by the management device 504 to store the original identity data of the user to be queried is multiple, multiple temporary session credentials are sent to the query requester terminal device 502. For example, each temporary session credential corresponds to a query service information pointing to an authentication device.

[0073] After obtaining the temporary session credential at the query requester terminal device 502, at 546, authorization information including the temporary session credential is sent to the to-be-queried user terminal device 506. In some embodiments, the temporary session credential is packaged into a website and displayed as a QR code.

[0074] At the terminal device 506 of the user to be queried, at 548, a temporary session credential is obtained based on the authorization information. In some embodiments, the user to be queried uses a wallet app to scan the authorization information of the QR code to obtain the temporary session credential. At 550, the return data is sent to the management device 504, and the return data includes the obtained temporary session credential.

[0075] At the management device 504, at 552, the temporary session credential is verified. In some embodiments, the verification at 552 includes: verifying whether the temporary session credential included in the returned data matches the temporary session credential included in the authorization information. At 554, in response to confirming that the temporary session credential has passed the verification, an authorization confirmation request corresponding to the temporary session credential is sent to the user terminal device 506 to be queried, and the authorization confirmation request at least indicates: the query requester, the original identity data to be queried, and the corresponding authentication agency or device. For example, the query service information corresponding to the temporary session credential is displayed to the user to be queried, that is, it is displayed: which query requester wants to query which associated account and which items of original identity data on which authentication device.

[0076] At the user terminal device 506 to be queried, at 556, it is confirmed whether the authorization confirmation request is authorized. At 558, in response to confirming that the authorization confirmation request is authorized, signature information based on the private key signature is generated. In some embodiments, the authorization confirmation request can be privately signed with a wallet bound to the associated account of the user to be queried to generate a signature hash value, that is, to generate signature information. At 560, the signature information is sent to the management device.

[0077] At the management device 504, after acquiring the signature information, in response to receiving the signature information from the user to be queried, the signature information is sent to the confirmed at least one authentication device 508 storing the original identity data to be queried at 562. In some embodiments, in addition to sending the signature information to the confirmed at least one authentication device 508, a public key used to encrypt the query result is also sent.

[0078] At the authentication device 508, after obtaining the signature information and the public key, at 564, it is confirmed whether the signature information has passed the verification. In some embodiments, it can be confirmed whether the signature information has passed the verification by confirming whether the query request has been signed with a private key at the address corresponding to the associated account. On the one hand, in response to confirming at 564 that the signature information has passed the verification, at 566, the hash value of the locally stored original data to be queried and the original identity data stored by the blockchain platform 510 is encrypted based on the key (e.g., the obtained public key). On the other hand, in response to confirming at 564 that the signature information has not passed the verification, at 568, an error code is generated. At 570, the "original identity data to be queried and the hash value of the original identity data to be queried" or an error code encrypted by the key (e.g., the obtained public key) is sent to the management device 504. In some embodiments, the authentication device 508 obtains the original identity data to be queried and the hash value of the original identity data to be queried based on the associated account identifier of the user to be queried indicated in the mapping information and the signature information.

[0079] At the management device 504 , at 572 , the original identity data to be queried and the hash value of the original identity data encrypted by the key (eg, the public key) or an error code are forwarded to the query requesting terminal device 502 .

[0080] At the query requester terminal device 502, after obtaining the original identity data to be queried and the hash value of the original identity data to be queried encrypted by a key (e.g., a public key), at 574, the key for decryption is used to decrypt to obtain the original identity data to be queried and the hash value of the original identity data to be queried. At 576, based on the hash value of the obtained original identity data to be queried, the authenticity of the obtained original identity data to be queried is verified. In some embodiments, the authenticity of the obtained original identity data to be queried is verified based on comparing whether the hash value of the obtained original identity data is consistent with the hash value of the original identity data stored on the blockchain platform 510 of the associated account.

[0081] By adopting the above method 500, the consensus and non-tamperability of the queried original identity data and / or identity authentication result data can be effectively guaranteed; it can be effectively guaranteed that the authenticated original identity data is encrypted with the authorization of the user to be queried, so that the authenticated original identity data is only open to the specific query requester who obtains the signature information and the key; thereby effectively realizing the trusted sharing of the authenticated user identity authentication data.

[0082] Figure 6 The block diagram of an electronic device 600 suitable for implementing the embodiments of the present disclosure is schematically shown. The device 600 can be used to implement Figure 1 and Figure 5 One or more hosts (such as Figure 1 The management device 110, the authentication devices 120 and 122 shown in FIG. Figure 5 600). As shown in the figure, the device 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 602 or computer program instructions loaded from a storage unit 608 to a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 can also be stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0083] A number of components in the device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0084] The processing unit 601 performs the various methods and processes described above, such as performing methods 200, 300, 400, and 500. For example, in some embodiments, methods 200, 300, 400, and 500 may be implemented as a computer software program, which is stored in a machine-readable medium, such as a storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the CPU 601, one or more operations of the methods 200, 300, 500, and 6000 described above may be performed. Alternatively, in other embodiments, the CPU 601 may be configured to perform one or more actions of the methods 200, 300, 400, and 500 by any other appropriate means (e.g., by means of firmware).

[0085] The present disclosure may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present disclosure.

[0086] Computer readable storage medium can be a tangible device that can hold and store instructions used by an instruction execution device. Computer readable storage medium can be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (non-exhaustive list) of computer readable storage medium include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, for example, a punch card or a convex structure in a groove on which instructions are stored, and any suitable combination thereof. The computer readable storage medium used here is not interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (for example, a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0087] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0088] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0089] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0090] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0091] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0092] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0093] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

[0094] The above are only optional embodiments of the present disclosure and are not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for managing user identity authentication data, comprising: At the management device, verifying a query request from a query requester for the original identity data of a user to be queried, wherein the query request at least includes a key used to encrypt the original identity data to be queried; The query request at least indicates the query requesting party, the user to be queried, and the original identity data to be queried; In response to the query request passing the verification, sending authorization information for the query request to the query requester; Determine, based on mapping information associated with original identity data stored in a plurality of authentication devices, at least one authentication device among the plurality of authentication devices for storing the original identity data to be queried; as well as In response to receiving signature information about the original identity data to be queried from the user to be queried, the signature information and the key are sent to the at least one authentication device, wherein the signature information is generated by the terminal device of the user to be queried based on the authorization information received from the query requester.

2. The method according to claim 1, wherein sending the authorization information comprises: Determining whether the query request is verified based on confirming whether the query requester is legitimate and whether the at least one authentication device for storing the original identity data to be queried exists; as well as In response to determining that the query request is authenticated, the authorization information is sent to the query requester, wherein the authorization information includes a temporary session credential.

3. The method of claim 1 , wherein determining the at least one authentication device comprises: Based on the query request and the mapping information, determine at least one authentication device that stores the original identity data to be queried, wherein the query request also includes the associated account identifier of the user to be queried, and the mapping information is associated with the identification bit of the authentication result of the original identity data stored in the corresponding authentication device.

4. The method according to claim 1, further comprising: Acquire feedback data from the user to be queried, where the feedback data is generated by the user to be queried based on the authorization information received from the query requester; as well as In response to confirming that the returned data matches the authorization information, an authorization confirmation request is sent to the user to be queried, wherein the authorization confirmation request is used to request the user to be queried to confirm authorization using the signature information. 5 . The method according to claim 1 , wherein the signature information at least indicates the query requester, the user to be queried, and the original identity data to be queried.

6. The method according to claim 1, further comprising: Obtaining the original identity data to be queried and the hash value of the original identity data to be queried from the at least one authentication device storing the original identity data to be queried, wherein the original identity data to be queried and the hash value of the original identity data to be queried are encrypted via the key, wherein the hash value of the original identity data to be queried is obtained from the blockchain platform, and the key is the public key of the query requester; as well as The encrypted original identity data to be queried and the hash value of the original identity data to be queried are sent to the query requester, wherein the hash value of the original identity data to be queried is used to verify the original identity data to be queried.

7. A method for managing user identity authentication data, comprising: At the authentication device, sending mapping information to a user identity authentication data management device, the mapping information being associated with the original identity data stored by the authentication device; Acquire signature information and a key related to authorization of the original identity data to be queried of the user to be queried from the management device; In response to confirming that the signature information has passed the verification, encrypting the original identity data to be queried and the hash value of the original identity data to be queried based on the key, wherein the hash value of the original identity data to be queried is obtained from the blockchain platform; as well as Sending the encrypted original identity data to be queried and the hash value of the original identity data to be queried to the management device or the query requester, wherein the hash value of the original identity data to be queried is used to verify the original identity data to be queried; The authentication device is at least one authentication device that stores the original identity data to be queried and is determined by the management device based on the query request of the query requester and the mapping information; The query request at least indicates the query requesting party, the user to be queried, and the original identity data to be queried.

8. The method according to claim 7, further comprising: Apply to the management device for an associated account number of the authentication device; Deploy a smart contract for transmitting identity authentication result data to the blockchain platform using the private key of the authentication device; as well as The mapping information and the domain name are synchronized to the management device, wherein the domain name is associated with the associated account of the authentication device.

9. The method according to claim 7, further comprising: In response to confirming that the original identity data of the user has passed the verification, generating identity authentication result data, the identity authentication result data including: the user's associated account identifier, the authentication result, and the hash value of the original identity data, the user's associated account identifier being associated with the authentication device; and Based on the smart contract deployed by the private key, the identity authentication result data is transmitted to the blockchain platform.

10. The method according to claim 9, wherein the authentication result includes at least one of the following: an associated account identifier of the user, an associated account identifier of an associated user associated with the user, an associated account status of the user, and an identity type of the user, wherein the identity type is selected from at least one of the following: individual, organization, device, and smart contract.

11. The method according to claim 9, wherein the authentication result comprises a plurality of binary flag bits, each flag bit in the plurality of binary flag bits being used to indicate whether a corresponding item in the original identity data comprising a plurality of items has passed verification; and The original identity data includes at least one of the following: image data and text data. 12 . The method according to claim 11 , wherein the hash value of the original identity data is generated by performing a hash calculation on a corresponding item in the original identity data corresponding to a flag bit indicating that the verification is passed.

13. The method according to claim 7, further comprising: Based on the signature information, the original identity data to be queried and the hash value of the original identity data to be queried are obtained, wherein the signature information at least indicates the query requester, the user to be queried and the original identity data to be queried.

14. The method according to claim 7, further comprising: In response to confirming that the signature information fails to pass the verification, error information about the original identity data to be queried is sent.

15. The method according to claim 7, wherein the query request indicates the query requester and the user to be queried, including: The query request includes the associated account identifier of the user to be queried, and the mapping information is associated with the identification bit of the authentication result of the original identity data stored in the corresponding authentication device.

16. A method for querying user identity authentication data authorization, comprising: At the terminal device of the user to be queried, obtaining authorization information about the original identity data to be queried from the query requester; The authorization information includes a temporary session credential sent by the management device to the query requester; the temporary session credential is generated based on the query request through verification; the query request comes from the query requester and is verified by the management device; The query request at least indicates the query requesting party, the user to be queried, and the original identity data to be queried; Sending feedback data to a management device, wherein the feedback data is generated based on the authorization information; receiving an authorization confirmation request from the management device, the authorization confirmation request being generated by the management device in response to confirming that the returned data matches the authorization information; as well as In response to confirming that the authorization confirmation request is authorized, signature information about the original identity data to be queried is sent to the management device, so that the management device sends the signature information to the confirmed at least one authentication device storing the original identity data to be queried.

17. The method according to claim 16, wherein the authorization confirmation request at least indicates the query requester, the original identity data to be queried, and the authentication device storing the original identity data to be queried.

18. The method according to claim 16, wherein confirming that the returned data matches the authorization information comprises: Confirm that the authorization information and the returned data both include the temporary session credentials sent by the management device to the query requester.

19. A user authentication data management device, the device comprising: a memory configured to store one or more programs; A processing unit is coupled to the memory and configured to execute the one or more programs to enable the management device to perform the method according to any one of claims 1 to 6.

20. A device for authenticating user identity authentication data, the device comprising: a memory configured to store one or more programs; A processing unit is coupled to the memory and configured to execute the one or more programs to enable the authentication device to perform the method according to any one of claims 7 to 15.

21. A user terminal device, comprising: a memory configured to store one or more programs; A processing unit is coupled to the memory and configured to execute the one or more programs to enable the user terminal device to perform the method according to any one of claims 16 to 18.

22. A non-transitory computer-readable storage medium having machine-executable instructions stored thereon, which when executed cause a machine to perform the steps of the method according to any one of claims 1-18.

23. A computer program product tangibly stored on a non-transitory computer-readable storage medium and comprising machine-executable instructions which, when executed, cause a machine to perform the steps of the method according to any one of claims 1-18.

Images