A blockchain-based alliance trust distributed identity authentication method and system

Abstract

The present invention relates to a blockchain-based alliance trusted distributed identity authentication method and system, the system comprising an alliance distributed identity ledger, an alliance distributed identity service node and a distributed identity client. The alliance digital identity ledger is used to store the alliance distributed digital identity information of distributed heterogeneous network entities within the alliance; the alliance distributed identity service node receives the distributed identity client identity authentication and identity management request, and uses the alliance distributed identity ledger to write, query and mark the alliance distributed digital identity; the distributed identity client provides local alliance distributed digital identity management for the distributed heterogeneous network entity, and stores the entity's alliance distributed digital identity through the client's built-in identity wallet. The system realizes the registration, verification, update and cancellation of the alliance distributed identity identifier through the alliance distributed identity identifier management model.

Description

Technical Field

[0001] The present invention belongs to the field of identity authentication security in the field of information security, and specifically relates to a blockchain-based alliance trusted distributed identity authentication method and system. Background Art

[0002] In recent years, with the rapid development of technologies such as the Internet of Things, Internet+, 5G, and big data, the information interaction between distributed heterogeneous network entities such as personnel and equipment in alliance organizations has been increasingly enhanced, and the demand for multi-party collaboration and data fusion between distributed business application information systems has increased. Identity authentication, as the first barrier to protect the security of distributed application information systems, has become increasingly important in achieving mutual trust between network entities through reliable identification of identity information of distributed network entities. However, due to the lack of identity information intercommunication among distributed business application systems in alliance organizations, not only do cross-system distributed network entities need to frequently register their identities in each system, but there are also problems such as low efficiency of multi-party collaboration, increased "data islands", and identity fraud. It is difficult to meet the cross-domain identity authentication needs of multi-party collaboration and identity data fusion of various business systems. It is urgent to establish a unified, secure, and cross-domain identity authentication solution for distributed heterogeneous network entities that adapts to the development of new businesses. In response to the above cross-domain authentication needs, the traditional "centralized, user-centric" authentication scheme has the following disadvantages: (1) In the centralized authentication scheme, the user's identity data management is centralized and not controlled by the user. The user's privacy data is scattered on the Internet and difficult to protect. If the central authentication server is successfully attacked, the entire authentication system will collapse; (2) In the user-centric authentication scheme, the user has full control over the identity data, but due to the lack of trust in the authentication process between the two parties, the user cannot effectively identify the fraudulent identity of the identity provider, and it is difficult to prevent "phishing" attacks. Therefore, taking advantage of the decentralized and tamper-proof characteristics of blockchain, a decentralized identity authentication scheme based on blockchain is proposed.

[0003] Existing identity authentication schemes based on blockchain technology cannot achieve autonomous control of user identity information and easily scalable cross-domain unified alliance trusted distributed identity authentication for distributed heterogeneous network entities such as personnel, equipment, enterprises, and organizations in alliance organizations. The patent "Identity Authentication System Based on Blockchain Technology and Its Implementation Method" (CN202010372661.2) proposes a blockchain-based identity authentication system architecture, and the implementation of processes such as real-name registration, identity authentication, and cascade authentication. However, the identity authentication in different application scenarios uses the same digital identity, which cannot meet the application requirements of digital identities in different scenarios. At the same time, identity information is easily aggregated, resulting in the leakage of identity information; the patent only implements the digital identity registration and authentication process, lacks the management of the entire life cycle of digital identities for distributed heterogeneous network entities within the alliance, and distributed heterogeneous network entities cannot flexibly and autonomously control identity information to prevent the leakage of identity privacy.

[0004] The patent "An identity authentication method for alliance chain" (CN202010046737.2) provides a solution for users to jointly participate in key generation and realize identity authentication without mutual trust, but users cannot independently control the generation, registration, update, and revocation of identity; the same private key is used to represent identity in different application scenarios, and identity information is also easily aggregated, causing the user's entire identity information to be leaked, exposing them to security risks.

[0005] The present invention proposes a blockchain-based alliance trust distributed identity authentication method and system, designs an alliance distributed digital identity by an alliance distributed identity identifier for distributed heterogeneous network entities such as personnel, equipment, enterprises, and organizations within the alliance, and registers, verifies, updates, and cancels the alliance distributed identity identifier through the alliance distributed identity identifier management model. The alliance distributed identity authentication operation mechanism model provides secure cross-domain alliance trust distributed identity authentication for distributed heterogeneous network entities within the alliance. The system includes an alliance distributed identity ledger, an alliance distributed identity service node, and a distributed identity client. Among them, the alliance digital identity ledger is used to store alliance digital identity information, and the alliance digital identity of distributed heterogeneous network entities within the alliance is securely stored and shared through a consensus mechanism and a privacy protection mechanism; the alliance distributed identity service node is a bridge connecting the alliance distributed identity ledger and the distributed identity client, receives identity authentication and identity management requests from the distributed identity client, and writes, queries, and marks the alliance distributed digital identity with the help of the alliance distributed identity ledger; the distributed identity client provides local alliance distributed digital identity management for distributed heterogeneous network entities, and stores the entity's alliance distributed digital identity through the identity wallet built into the client. Distributed heterogeneous network entities can use this system to autonomously control the distributed digital identities within the alliance, and achieve unified and secure cross-domain identity authentication in different application scenarios within the alliance. Summary of the invention

[0006] The technology of the present invention solves the problem: In view of the need for identity authentication and intercommunication between distributed application systems of distributed heterogeneous network entities in alliance organizations, and the traditional identity authentication schemes have more or less security risks, the present invention proposes a blockchain-based alliance trust distributed identity authentication method and system, which designs an alliance distributed digital identity by an alliance distributed identity identifier for distributed heterogeneous network entities such as personnel, equipment, enterprises, and organizations within the alliance, adopts an alliance digital identity ledger to save the alliance distributed digital identity information of distributed heterogeneous network entities within the alliance, and ensures the safe storage and safe sharing of the alliance distributed digital identity of distributed heterogeneous network entities within the alliance through a consensus mechanism and a privacy protection mechanism; and registers, verifies, updates, and cancels the alliance distributed identity identifier through a full life cycle management model, and the alliance distributed identity authentication operation mechanism model provides secure cross-domain alliance trust distributed identity authentication for distributed heterogeneous network entities within the alliance. Distributed heterogeneous network entities within the alliance realize unified and secure cross-domain identity authentication in different application scenarios within the alliance through one or more alliance distributed identity identifiers and related alliance digital identity credentials that are autonomously controlled by the system, effectively preventing identity information from being aggregated and privacy from being leaked.

[0007] The technical solution of the present invention is a blockchain-based alliance trust distributed identity authentication system, which mainly includes an alliance distributed identity ledger, an alliance distributed identity service node, and a distributed identity client. The alliance distributed identity ledger is used to store the alliance distributed digital identity information of distributed network entities such as personnel, equipment, enterprises, and organizations within the alliance, and ensures the safe storage and safe sharing of the alliance distributed digital identities of distributed heterogeneous network entities within the alliance through a consensus mechanism and a privacy protection mechanism, and provides alliance distributed digital identity information support for the upper-level alliance distributed identity service node. The alliance distributed identity service node is a bridge connecting the alliance distributed identity ledger and the distributed identity client, receiving the distributed identity client identity management or authentication request of the distributed network entity, and using the alliance distributed identity ledger to write, query, and mark the alliance distributed digital identity; the distributed identity client provides local alliance distributed digital identity management for the distributed heterogeneous network entity, and stores the entity's alliance distributed digital identity through the identity wallet built into the client. The system realizes the registration, verification, update, and cancellation of the alliance distributed identity identifier through the alliance distributed identity identifier management model, and the alliance distributed identity authentication operation mechanism model provides cross-domain alliance trust distributed identity authentication for distributed heterogeneous network entities within the alliance. Distributed heterogeneous network entities can autonomously control the distributed digital identity of the alliance through this system, proactively prevent identity privacy leakage, and realize unified and secure cross-domain identity authentication in different application scenarios within the alliance. The alliance distributed identity identifier is designed for distributed heterogeneous network entities such as personnel, equipment, enterprises, and organizations within the alliance, and has the advantages of global uniqueness within the alliance, easy scalability, and high credibility.

[0008] The blockchain-based alliance trusted distributed identity authentication system comprises an alliance distributed identity ledger, an alliance distributed identity service node, and a distributed identity client;

[0009] Alliance distributed identity ledger, used to store the alliance distributed digital identity information of distributed network entities within the alliance, and to ensure the secure storage and sharing of the alliance distributed digital identities of distributed heterogeneous network entities within the alliance through consensus mechanism and privacy protection mechanism, and to provide alliance distributed digital identity information support for upper-layer alliance distributed identity service nodes. The distributed network entities within the alliance include personnel, equipment, enterprises, and organizations;

[0010] Alliance distributed identity service node, used to connect the alliance distributed identity ledger and distributed identity client, receive distributed identity client identity management or authentication requests from distributed network entities, and write, query, and mark alliance distributed digital identities with the help of the alliance distributed identity ledger;

[0011] The distributed identity client provides local alliance distributed digital identity management for distributed heterogeneous network entities, and stores the entity's alliance distributed digital identity through the client's built-in identity wallet.

[0012] Furthermore, the system realizes the full life cycle management of registration, verification, update and cancellation of alliance distributed identity identifiers through the alliance distributed identity identifier management model. The alliance distributed identity authentication operation mechanism model provides cross-domain alliance trust distributed identity authentication for distributed heterogeneous network entities within the alliance; distributed heterogeneous network entities autonomously control the alliance distributed digital identities within the alliance through the system, actively prevent identity privacy leakage, and realize unified and secure cross-domain identity authentication in different application scenarios within the alliance.

[0013] Furthermore, the generation process of the distributed network entity alliance distributed identity identifier includes:

[0014] The distributed network entity first selects the type of the alliance identity according to its own type through the distributed identity client; then generates a fixed header ConsortiumID, a random string RandomString, and an associated public and private key pair (pk, sk) based on the selected alliance identity type, where pk represents the public key and sk represents the private key, and then combines them to obtain the alliance distributed identity identifier { <consortiumid:type:randomstring>,pk}; finally, the generated alliance distributed identity identifier is stored in the built-in identity wallet.

[0015] Furthermore, the registration process of the distributed network entity alliance distributed identity identifier includes:

[0016] The distributed network entity first retrieves the alliance distributed identity identifier from its own identity wallet through the distributed identity client, performs a hash operation on the retrieved alliance distributed identity identifier, generates an alliance distributed identity identifier information summary, and attaches a timestamp; then uses its own private key to sign the alliance distributed identity identifier information summary and the attached timestamp to generate signature information related to the alliance distributed identity identifier; then sends the generated signature information related to the alliance distributed identity identifier and the alliance distributed identity identifier retrieved from the wallet as registration request parameters to the alliance distributed identity service node; after receiving the registration request, the alliance distributed identity service node verifies the signature information in the received registration request by extracting the public key in the alliance distributed identity identifier in the registration request; if the verification is successful, the alliance distributed identity service node stores the received alliance distributed identity identifier in the alliance distributed identity ledger through a consensus mechanism; otherwise, the registration fails.

[0017] Furthermore, the verification process of the distributed network entity alliance distributed identity identifier includes:

[0018] The distributed network entity first performs a hash operation on its own alliance distributed identity identifier through a distributed identity client to generate an alliance distributed identity identifier information summary H and attach a timestamp; then uses its own private key to sign the alliance distributed identity identifier information summary H and the attached timestamp to generate signature information related to the alliance distributed identity identifier; then sends the alliance distributed identity identifier-related signature and the alliance distributed identity identifier verification request to the alliance distributed identity service node; after receiving the verification request, the alliance distributed identity service node first queries the alliance distributed identity identifier information of the distributed network entity that sent the verification request on the alliance distributed identity ledger, and extracts the public key pk in the alliance distributed identity identifier; then uses the extracted public key pk to verify the signature information related to the alliance distributed identity identifier in the received request, and the alliance distributed identity service node stores the verification result in the alliance distributed identity ledger through a consensus mechanism for query by other distributed network entities, and returns the verification result to the distributed network entity that sent the verification request.

[0019] Furthermore, the update process of the distributed network entity alliance distributed identity identifier includes:

[0020] The distributed network entity first generates a new alliance distributed identity identifier through the distributed identity client, then performs a hash operation on the new alliance distributed identity identifier to generate a new alliance distributed identity identifier information summary and append a timestamp, then uses the corresponding private key of the old alliance distributed identity identifier to sign the new alliance distributed identity identifier information summary and the appended timestamp to obtain the signature information S, and then sends the update request carrying the old alliance distributed identity identifier, the new alliance distributed identity identifier and the signature information S to the alliance distributed identity service node; upon receiving the update request, the alliance distributed identity service node first queries the old alliance distributed identity identifier information on the alliance distributed identity ledger, and extracts the corresponding public key pk in the old alliance distributed identity identifier on the alliance distributed identity ledger; then uses the extracted public key pk to verify the received signature information S, if the verification is successful, the alliance distributed identity service node stores the new alliance distributed identity identifier in the alliance distributed identity ledger through the consensus mechanism, marks the old alliance distributed identity identifier as unavailable, and notifies the distributed network entity that sent the update request to store the new alliance distributed identity identifier in the identity wallet of its own distributed identity client and delete the old alliance distributed identity identifier; otherwise, the update fails.

[0021] Furthermore, the revocation process of the distributed network entity alliance distributed identity identifier includes:

[0022] The distributed network entity first takes out the alliance distributed identity identifier to be revoked from its own identity wallet through the distributed identity client, performs a hash operation on the alliance distributed identity identifier to be revoked, generates an information summary of the alliance distributed identity identifier to be revoked, and attaches a timestamp; then uses its own private key to sign the information summary of the alliance distributed identity identifier to be revoked and the attached timestamp to generate signature information related to the alliance distributed identity identifier to be revoked; then sends a revocation request carrying the signature information related to the alliance distributed identity identifier to be revoked and the revoked alliance distributed identity identifier to the alliance distributed identity server. service node; upon receiving the revocation request, the alliance distributed identity service node first queries the alliance distributed identity identifier to be revoked on the alliance distributed identity ledger, and extracts the public key of the alliance distributed identity identifier to be revoked on the alliance distributed identity ledger; then uses the extracted public key to verify the signature information related to the alliance distributed identity identifier to be revoked. If the verification passes, the information of the alliance distributed identity identifier to be revoked on the alliance distributed identity ledger is marked as revoked; at the same time, the distributed network entity that sent the revocation request is notified to delete the alliance distributed identity identifier to be revoked in the identity wallet of its own distributed identity client.

[0023] According to another aspect of the present invention, a blockchain-based alliance trust distributed identity authentication method is proposed, wherein a distributed heterogeneous network entity generates an alliance distributed identity identifier through a distributed identity client, and requests the alliance distributed identity identifier registration, verification, update, and cancellation services from the alliance distributed identity service node, and autonomously controls the full life cycle management of the alliance distributed identity identifier; specifically, the following steps are included:

[0024] (1.1) Generation of distributed identity identifiers for distributed network entity alliances;

[0025] (1.2) Registration of distributed identity identifiers of distributed network entity alliances;

[0026] (1.3) Verification of distributed identity identifiers of distributed network entity alliances;

[0027] (1.4) Update of distributed identity identifiers of distributed network entity alliances;

[0028] (1.5) Revocation of a distributed identity identifier of a distributed network entity alliance.

[0029] Furthermore, the generation of the distributed network entity alliance distributed identity identifier (1.1) specifically includes:

[0030] The distributed network entity first selects the type of the alliance identity according to its own type through the distributed identity client; then generates a fixed header ConsortiumID, a random string RandomString, and an associated public and private key pair (pk, sk) based on the selected alliance identity type, where pk represents the public key and sk represents the private key, and then combines them to obtain the alliance distributed identity identifier { <consortiumid:type:randomstring>,pk}; finally, the generated alliance distributed identity identifier is stored in the built-in identity wallet.

[0031] Furthermore, the registration of the distributed identity identifier of the distributed network entity alliance (1.2) specifically includes:

[0032] (1.2.1) The distributed network entity first retrieves the alliance distributed identity identifier from its own identity wallet through the distributed identity client, performs a hash operation on the retrieved alliance distributed identity identifier, generates an alliance distributed identity identifier information digest, and appends a timestamp; then uses its own private key to sign the alliance distributed identity identifier information digest and the appended timestamp to generate signature information related to the alliance distributed identity identifier; then sends the generated signature information related to the alliance distributed identity identifier and the alliance distributed identity identifier retrieved from the wallet as registration request parameters to the alliance distributed identity service node;

[0033] (1.2.2) After receiving the registration request, the alliance distributed identity service node verifies the signature information in the registration request by extracting the public key in the alliance distributed identity identifier in the registration request; if the verification is successful, the alliance distributed identity service node stores the received alliance distributed identity identifier in the alliance distributed identity ledger through the consensus mechanism; otherwise, the registration fails.

[0034] Furthermore, the verification of the distributed identity identifier of the distributed network entity alliance (1.3) specifically includes:

[0035] (1.3.1) The distributed network entity first performs a hash operation on its own alliance distributed identity identifier through the distributed identity client to generate the alliance distributed identity identifier information digest H and append a timestamp; then uses its own private key to sign the alliance distributed identity identifier information digest H and the appended timestamp to generate signature information related to the alliance distributed identity identifier; then sends the generated alliance distributed identity identifier-related signature and the alliance distributed identity identifier verification request to the alliance distributed identity service node;

[0036] (1.3.2) After receiving the verification request, the alliance distributed identity service node first queries the alliance distributed identity identifier information of the distributed network entity that sent the verification request on the alliance distributed identity ledger, and extracts the public key pk in the alliance distributed identity identifier; then uses the extracted public key pk to verify the signature information related to the alliance distributed identity identifier in the received request, and the alliance distributed identity service node stores the verification result in the alliance distributed identity ledger through the consensus mechanism for query by other distributed network entities, and returns the verification result to the distributed network entity that sent the verification request.

[0037] Furthermore, the (1.4) updating of the distributed network entity alliance distributed identity identifier specifically includes:

[0038] (1.4.1) The distributed network entity first generates a new alliance distributed identity identifier through the distributed identity client, then performs a hash operation on the new alliance distributed identity identifier to generate a new alliance distributed identity identifier information digest and append a timestamp, then uses the private key corresponding to the old alliance distributed identity identifier to sign the new alliance distributed identity identifier information digest and the appended timestamp to obtain the signature information S, and then sends an update request carrying the old alliance distributed identity identifier, the new alliance distributed identity identifier and the signature information S to the alliance distributed identity service node.

[0039] (1.4.2) Upon receiving the update request, the alliance distributed identity service node first queries the old alliance distributed identity identifier information on the alliance distributed identity ledger, and extracts the corresponding public key pk in the old alliance distributed identity identifier on the alliance distributed identity ledger; then uses the extracted public key pk to verify the received signature information S. If the verification is successful, the alliance distributed identity service node stores the new alliance distributed identity identifier in the alliance distributed identity ledger through the consensus mechanism, marks the old alliance distributed identity identifier as unavailable, and notifies the distributed network entity that sent the update request to store the new alliance distributed identity identifier in the identity wallet of its own distributed identity client and delete the old alliance distributed identity identifier; otherwise, the update fails.

[0040] Furthermore, the revocation of the distributed network entity alliance distributed identity identifier (1.5) specifically includes:

[0041] (1.5.1) The distributed network entity first retrieves the alliance distributed identity identifier to be revoked from its own identity wallet through the distributed identity client, performs a hash operation on the alliance distributed identity identifier to be revoked, generates an information digest of the alliance distributed identity identifier to be revoked, and attaches a timestamp; then uses its own private key to sign the information digest of the alliance distributed identity identifier to be revoked and the attached timestamp to generate signature information related to the alliance distributed identity identifier to be revoked; then sends a revocation request carrying the signature information related to the alliance distributed identity identifier to be revoked and the revoked alliance distributed identity identifier to the alliance distributed identity service node.

[0042] (1.5.2) Upon receiving the revocation request, the alliance distributed identity service node first queries the alliance distributed identity identifier to be revoked on the alliance distributed identity ledger, and extracts the public key of the alliance distributed identity identifier to be revoked on the alliance distributed identity ledger; then uses the extracted public key to verify the signature information related to the alliance distributed identity identifier to be revoked. If the verification is successful, the alliance distributed identity identifier information to be revoked on the alliance distributed identity ledger is marked as revoked. At the same time, the distributed network entity that sent the revocation request is notified to delete the alliance distributed identity identifier to be revoked in the identity wallet of its own distributed identity client.

[0043] Compared with the prior art, the present invention has the advantages that:

[0044] (1) Traditional identity authentication technologies mostly use centralized identity authentication schemes. Using centralized authentication schemes on distributed infrastructures has certain security risks and is susceptible to DDOS attacks, single point failure attacks, etc. In the present invention, multiple alliance organizations provide one or more independent peer nodes to build a trusted distributed identity authentication alliance network, whose nodes are dispersed and decentralized, and can effectively defend against DDoS attacks. Moreover, when an attacker attacks a single node, even if the node fails, it will not affect the entire alliance distributed authentication service.

[0045] (2) In traditional centralized identity authentication schemes, user identity information is scattered across heterogeneous distributed systems, and users cannot control related private data, which will cause personal identity privacy leakage; while in user-centric identity authentication schemes, users fully control their identity information, but the authentication process between the two parties lacks trust, and users cannot effectively identify the fraudulent identity of the identity provider, making it difficult to prevent "phishing" attacks. The present invention ensures the security, reliability, and sharing of identity data in the alliance network environment through the blockchain consensus mechanism and identity privacy protection mechanism. Users can independently control their own identity information and only disclose identity data to specific organizations or individuals within the alliance to prevent identity privacy leakage.

[0046] (3) Traditional identities are based on centralized identities and have increased portability. Different from this, the portability of identity information in the present invention lies in the fact that users can migrate the corresponding alliance distributed digital identity according to their own needs. That is, based on decentralized identity migration, a distributed network entity can obtain multiple alliance distributed identity identifiers and related alliance digital identity certificates in different identity authentication scenarios, and complete the migration of the distributed network entity user identity. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A schematic diagram of the overall structure of the present invention;

[0048] Figure 2 Schematic diagram of the alliance distributed identity identifier management model of the present invention;

[0049] Figure 3 Schematic diagram of the alliance distributed identity authentication operation mechanism model of the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, advantages and technical solutions of the present invention more clearly understood, the following specific measures are taken in conjunction with the attached Figure 1-3 , the present invention is described in further detail.

[0051] A blockchain-based alliance-trusted distributed identity authentication system, such as Figure 1 As shown in the figure, it is mainly composed of a federation distributed identity ledger, a federation distributed identity service node, and a distributed identity client. The federation distributed identity ledger is used to store the alliance digital identity information of distributed network entities such as personnel, equipment, enterprises, and organizations within the alliance, and ensures the secure storage and sharing of the alliance digital identity of distributed heterogeneous network entities within the alliance through consensus mechanisms and privacy protection mechanisms, providing alliance digital identity information support for upper-level alliance distributed identity service nodes. The alliance distributed identity service node is a bridge connecting the alliance distributed identity ledger and the distributed identity client, receiving the distributed identity client identity management or authentication request of the distributed network entity, and using the alliance distributed identity ledger to write, query, and mark the alliance distributed digital identity; the distributed identity client provides local alliance distributed digital identity management for distributed heterogeneous network entities, and stores the entity's alliance distributed digital identity through the identity wallet built into the client. The system realizes the registration, verification, update, and cancellation of the alliance distributed identity identifier through the alliance distributed identity identifier management model. The alliance digital identity certificate management model realizes the issuance, verification, update, and revocation of the alliance digital identity certificate. The alliance distributed identity authentication operation mechanism model provides cross-domain alliance trust distributed identity authentication for distributed heterogeneous network entities within the alliance. Distributed heterogeneous network entities can autonomously control the alliance distributed digital identity within the alliance through this system, actively prevent identity privacy leakage, and realize unified and secure cross-domain identity authentication in different application scenarios within the alliance.

[0052] 1. Working Mechanism of the Alliance Distributed Identity Identifier Management Model

[0053] like Figure 2 As shown in the figure, the alliance distributed identity identifier is designed for distributed heterogeneous network entities such as personnel, equipment, enterprises, and organizations within the alliance. It has the advantages of global uniqueness within the alliance, easy scalability, and high credibility. The alliance distributed identity identifier management model realizes the full life cycle management of the alliance distributed identity identifier registration, verification, update, and cancellation. Distributed heterogeneous network entities generate alliance distributed identity identifiers through distributed identity clients, and request alliance distributed identity identifier registration, verification, update, and cancellation services from alliance distributed identity service nodes, autonomously control the full life cycle management of alliance distributed identity identifiers, and actively prevent identity privacy leakage.

[0054] (1.1) Generation of distributed network entity alliance distributed identity identifier. The distributed network entity first selects the type of alliance identity according to its own type through the distributed identity client; then generates a fixed header ConsortiumID, a random string RandomString, and an associated public-private key pair (pk, sk) based on the selected alliance identity type, where pk represents the public key and sk represents the private key, and then combines them to obtain the alliance distributed identity identifier { <consortiumid:type:randomstring>,pk}; finally, the generated alliance distributed identity identifier is stored in the built-in identity wallet.

[0055] (1.2) Registration of distributed identity identifiers of the distributed network entity alliance.

[0056] (1.2.1) The distributed network entity first retrieves the alliance distributed identity identifier from its own identity wallet through the distributed identity client, performs a hash operation on the retrieved alliance distributed identity identifier, generates an alliance distributed identity identifier information summary, and attaches a timestamp; then uses its own private key to sign the alliance distributed identity identifier information summary and the attached timestamp to generate signature information related to the alliance distributed identity identifier; then sends the generated signature information related to the alliance distributed identity identifier and the alliance distributed identity identifier retrieved from the wallet as registration request parameters to the alliance distributed identity service node.

[0057] (1.2.2) After receiving the registration request, the alliance distributed identity service node verifies the signature information in the registration request by extracting the public key in the alliance distributed identity identifier in the registration request; if the verification is successful, the alliance distributed identity service node stores the received alliance distributed identity identifier in the alliance distributed identity ledger through the consensus mechanism; otherwise, the registration fails.

[0058] (1.3) Verification of distributed identity identifiers of distributed network entity alliances.

[0059] (1.3.1) The distributed network entity first performs a hash operation on its own alliance distributed identity identifier through the distributed identity client to generate the alliance distributed identity identifier information digest H and attach a timestamp; then uses its own private key to sign the alliance distributed identity identifier information digest H and the attached timestamp to generate signature information related to the alliance distributed identity identifier; then sends the generated alliance distributed identity identifier-related signature and the alliance distributed identity identifier verification request to the alliance distributed identity service node.

[0060] (1.3.2) After receiving the verification request, the alliance distributed identity service node first queries the alliance distributed identity identifier information of the distributed network entity that sent the verification request on the alliance distributed identity ledger, and extracts the public key pk in the alliance distributed identity identifier; then uses the extracted public key pk to verify the signature information related to the alliance distributed identity identifier in the received request, and the alliance distributed identity service node stores the verification result in the alliance distributed identity ledger through the consensus mechanism for query by other distributed network entities, and returns the verification result to the distributed network entity that sent the verification request.

[0061] (1.4) Update of distributed identity identifiers of distributed network entity alliances.

[0062] (1.4.1) The distributed network entity first generates a new alliance distributed identity identifier through the distributed identity client, then performs a hash operation on the new alliance distributed identity identifier to generate a new alliance distributed identity identifier information digest and append a timestamp, then uses the private key corresponding to the old alliance distributed identity identifier to sign the new alliance distributed identity identifier information digest and the appended timestamp to obtain the signature information S, and then sends an update request carrying the old alliance distributed identity identifier, the new alliance distributed identity identifier and the signature information S to the alliance distributed identity service node.

[0063] (1.4.2) Upon receiving the update request, the alliance distributed identity service node first queries the old alliance distributed identity identifier information on the alliance distributed identity ledger, and extracts the corresponding public key pk in the old alliance distributed identity identifier on the alliance distributed identity ledger; then uses the extracted public key pk to verify the received signature information S. If the verification is successful, the alliance distributed identity service node stores the new alliance distributed identity identifier in the alliance distributed identity ledger through the consensus mechanism, marks the old alliance distributed identity identifier as unavailable, and notifies the distributed network entity that sent the update request to store the new alliance distributed identity identifier in the identity wallet of its own distributed identity client and delete the old alliance distributed identity identifier; otherwise, the update fails.

[0064] (1.5) Revocation of a distributed identity identifier of a distributed network entity alliance.

[0065] (1.5.1) The distributed network entity first retrieves the alliance distributed identity identifier to be revoked from its own identity wallet through the distributed identity client, performs a hash operation on the alliance distributed identity identifier to be revoked, generates an information digest of the alliance distributed identity identifier to be revoked, and attaches a timestamp; then uses its own private key to sign the information digest of the alliance distributed identity identifier to be revoked and the attached timestamp to generate signature information related to the alliance distributed identity identifier to be revoked; then sends a revocation request carrying the signature information related to the alliance distributed identity identifier to be revoked and the revoked alliance distributed identity identifier to the alliance distributed identity service node.

[0066] (1.5.2) Upon receiving the revocation request, the alliance distributed identity service node first queries the alliance distributed identity identifier to be revoked on the alliance distributed identity ledger, and extracts the public key of the alliance distributed identity identifier to be revoked on the alliance distributed identity ledger; then uses the extracted public key to verify the signature information related to the alliance distributed identity identifier to be revoked. If the verification is successful, the alliance distributed identity identifier information to be revoked on the alliance distributed identity ledger is marked as revoked. At the same time, the distributed network entity that sent the revocation request is notified to delete the alliance distributed identity identifier to be revoked in the identity wallet of its own distributed identity client.

[0067] 2. Alliance Digital Identity Credentials

[0068] The alliance digital identity credential is a set of distributed network entity identity attributes associated with the alliance distributed identity identifier, which enables the distributed network entity to adapt to distributed cross-domain identity authentication in different application scenarios within the alliance. According to the definition of the alliance digital identity credential, the alliance digital identity credential is generated by assigning attributes. The data structure of the alliance digital identity credential definition consists of three parts: metadata Credential Metadata, attribute set Claims, and credential issuer signature information Proofs, such as: {Credential Metadata:{credentialName,issuanceDate,expireDate,Issuer}, Claims:{claim1,...,claimN}, Proofs:{signatureValue,signatureAlgorithm,createdTime}}, where the metadata includes the credential name credentialName, the issuance date issuanceDate and the validity period expireDate, the credential issuer Issuer and other information; the credential issuer signature information includes signature information signatureValue, signature algorithm signatureAlgorithm, signature creation time createdTime, etc.

[0069] 3. Alliance Distributed Identity Authentication Operation Mechanism Model

[0070] The alliance distributed identity authentication operation mechanism model includes four-level operation mechanisms: distributed digital identity generation, alliance digital identity credential generation, alliance digital identity block generation, and alliance digital identity authentication. It provides a unified and secure cross-domain identity authentication for distributed heterogeneous network entities within the alliance in different application scenarios within the alliance, such as Figure 3 As shown:

[0071] (3.1) Generation of distributed digital identity: A distributed network entity first generates its own consortium distributed identity identifier through a distributed identity client. The consortium distributed identity identifier mainly includes: a fixed header ConsortiumID, a random string RandomString, and an associated public-private key pair (pk, sk), where pk represents the public key and sk represents the private key; a hash operation is performed on the consortium distributed identity identifier to generate a consortium distributed identity identifier information digest and attach a timestamp; then the consortium distributed identity identifier information digest and the attached timestamp are signed using its own private key to generate a consortium distributed identity identifier-related signature, and then the generated consortium distributed identity identifier-related signature and the consortium distributed identity identifier are sent to the consortium distributed identity service node.

[0072] (3.2) Alliance digital identity credential generation: The distributed network entity, as the credential issuer, performs a hash operation on the alliance digital identity credential definition through the distributed identity client to generate an alliance digital identity credential definition information summary and attach a timestamp; then uses its own private key in the (a) distributed digital identity identification generation process to sign the alliance digital identity credential definition information summary and the attached timestamp to generate a signature related to the alliance digital identity credential definition; then sends the generated alliance digital identity credential definition-related signature and the alliance digital identity credential definition to the alliance distributed identity service node. The credential issuer will issue an alliance digital identity credential to the distributed network entity based on the digital identity credential definition.

[0073] (3.3) Generation of Alliance Digital Identity Block: After receiving the alliance distributed identity identifier-related signatures and alliance digital identity credential definition-related signatures from each distributed network entity, the alliance distributed identity service node verifies the received signatures. If the verification passes, a new block is generated based on the received alliance distributed identity identifier and alliance digital identity credential definition and broadcasted to the entire network. The received alliance distributed identity identifier and alliance digital identity credential definition are stored in the alliance distributed identity ledger through a consensus mechanism.

[0074] (3.4) Alliance digital identity authentication: A distributed network entity, as a holder of an alliance digital identity certificate, applies to access an application system. The alliance digital identity certificate verifier of the system first verifies the alliance digital identity identifier of the distributed network entity applying for access, then queries and obtains the digital identity certificate definition of the distributed network entity applying for access on the alliance distributed identity ledger, and verifies the alliance digital identity certificate information presented by the distributed network entity applying for access, thereby completing the verification of the user's identity and obtaining access to the application system.

[0075] Although the above describes the illustrative specific embodiments of the present invention to facilitate those skilled in the art to understand the present invention, and it should be clear that the present invention is not limited to the scope of the specific embodiments, for those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations using the concept of the present invention are protected.< / consortiumid:type:randomstring> < / consortiumid:type:randomstring> < / consortiumid:type:randomstring>

Claims

1. A blockchain-based alliance trust distributed identity authentication system, comprising an alliance distributed identity ledger, an alliance distributed identity service node, and a distributed identity client; characterized in that: Alliance distributed identity ledger, used to store the alliance distributed digital identity information of distributed network entities within the alliance, and to ensure the secure storage and sharing of the alliance distributed digital identity of distributed network entities within the alliance through consensus mechanism and privacy protection mechanism, and to provide alliance distributed digital identity information support for upper-layer alliance distributed identity service nodes. The distributed network entities within the alliance include personnel, equipment, enterprises, and organizations; Alliance distributed identity service node, used to connect the alliance distributed identity ledger and distributed identity client, receive distributed identity client identity management or authentication requests from distributed network entities, and write, query, and mark alliance distributed digital identities with the help of the alliance distributed identity ledger; A distributed identity client provides local federation distributed digital identity management for distributed network entities and stores the federation distributed digital identities of distributed network entities through the identity wallet built into the distributed identity client; The generation process of the distributed identity identifier of the distributed network entity alliance includes: The distributed network entity first selects the type of the alliance identity according to its own type through the distributed identity client; then generates a fixed header ConsortiumID, a random string RandomString, and an associated public and private key pair (pk, sk) based on the selected alliance identity type, where pk represents the public key and sk represents the private key, and then combines them to obtain the alliance distributed identity identifier { <consortiumid:type:randomstring> ,pk}; finally, the generated alliance distributed identity identifier is stored in the built-in identity wallet;< / consortiumid:type:randomstring> The registration process of the distributed network entity alliance distributed identity identifier includes: The distributed network entity first retrieves the alliance distributed identity identifier from its own identity wallet through the distributed identity client, performs a hash operation on the retrieved alliance distributed identity identifier, generates an alliance distributed identity identifier information summary, and attaches a timestamp; then uses its own private key to sign the alliance distributed identity identifier information summary and the attached timestamp to generate signature information related to the alliance distributed identity identifier; then sends the generated signature information related to the alliance distributed identity identifier and the alliance distributed identity identifier retrieved from the wallet as registration request parameters to the alliance distributed identity service node; after receiving the registration request, the alliance distributed identity service node verifies the signature information in the received registration request by extracting the public key in the alliance distributed identity identifier in the registration request; if the verification is successful, the alliance distributed identity service node stores the received alliance distributed identity identifier in the alliance distributed identity ledger through the consensus mechanism; otherwise, the registration fails; The verification process of the distributed identity identifier of the distributed network entity alliance includes: The distributed network entity first performs a hash operation on its own alliance distributed identity identifier through the distributed identity client to generate the alliance distributed identity identifier information summary H and attach a timestamp; then uses its own private key to sign the alliance distributed identity identifier information summary H and the attached timestamp to generate signature information related to the alliance distributed identity identifier; then sends the alliance distributed identity identifier-related signature and the alliance distributed identity identifier verification request to the alliance distributed identity service node; after receiving the verification request, the alliance distributed identity service node first queries the alliance distributed identity identifier information of the distributed network entity that sent the verification request on the alliance distributed identity ledger, and extracts the public key pk in the alliance distributed identity identifier; then uses the extracted public key pk to verify the signature information related to the alliance distributed identity identifier in the received request, and the alliance distributed identity service node stores the verification result in the alliance distributed identity ledger through the consensus mechanism for query by other distributed network entities, and returns the verification result to the distributed network entity that sent the verification request; The update process of the distributed identity identifier of the distributed network entity alliance includes: The distributed network entity first generates a new alliance distributed identity identifier through the distributed identity client, then performs a hash operation on the new alliance distributed identity identifier to generate a new alliance distributed identity identifier information summary and append a timestamp, then uses the corresponding private key of the old alliance distributed identity identifier to sign the new alliance distributed identity identifier information summary and the appended timestamp to obtain the signature information S, and then sends the update request carrying the old alliance distributed identity identifier, the new alliance distributed identity identifier and the signature information S to the alliance distributed identity service node; after receiving the update request, the alliance distributed identity service node first queries the old alliance distributed identity identifier information on the alliance distributed identity ledger, and extracts the corresponding public key pk in the old alliance distributed identity identifier on the alliance distributed identity ledger; then uses the extracted public key pk to verify the received signature information S, if the verification is successful, the alliance distributed identity service node stores the new alliance distributed identity identifier in the alliance distributed identity ledger through the consensus mechanism, marks the old alliance distributed identity identifier as unavailable, and notifies the distributed network entity that sent the update request to store the new alliance distributed identity identifier in the identity wallet of its own distributed identity client and delete the old alliance distributed identity identifier; otherwise, the update fails; The revocation process of the distributed identity identifier of the distributed network entity alliance includes: The distributed network entity first takes out the alliance distributed identity identifier to be revoked from its own identity wallet through the distributed identity client, performs a hash operation on the alliance distributed identity identifier to be revoked, generates an information summary of the alliance distributed identity identifier to be revoked, and attaches a timestamp; then uses its own private key to sign the information summary of the alliance distributed identity identifier to be revoked and the attached timestamp to generate signature information related to the alliance distributed identity identifier to be revoked; then sends a revocation request carrying the signature information related to the alliance distributed identity identifier to be revoked and the alliance distributed identity identifier to be revoked to the alliance distributed identity. Service node; upon receiving the revocation request, the alliance distributed identity service node first queries the alliance distributed identity identifier to be revoked on the alliance distributed identity ledger, and extracts the public key of the alliance distributed identity identifier to be revoked on the alliance distributed identity ledger; then uses the extracted public key to verify the signature information related to the alliance distributed identity identifier to be revoked. If the verification is successful, the information of the alliance distributed identity identifier to be revoked on the alliance distributed identity ledger is marked as revoked; at the same time, the distributed network entity that sent the revocation request is notified to delete the alliance distributed identity identifier to be revoked in the identity wallet of its own distributed identity client.

2. According to claim 1, a blockchain-based alliance trust distributed identity authentication system is characterized by: The system uses the alliance distributed identity identifier management model to achieve the full life cycle management of the alliance distributed identity identifier, including registration, verification, update, and cancellation. The alliance distributed identity authentication operation mechanism model provides cross-domain alliance trust distributed identity authentication for distributed network entities within the alliance. Distributed network entities use the system to autonomously control the alliance distributed digital identities within the alliance, proactively prevent identity privacy leakage, and achieve unified and secure cross-domain identity authentication in different application scenarios within the alliance.

3. A blockchain-based alliance trust distributed identity authentication method, characterized in that: The distributed network entity generates a federation distributed identity identifier through a distributed identity client, and requests the federation distributed identity identifier registration, verification, update, and cancellation services from the federation distributed identity service node, and autonomously controls the full life cycle management of the federation distributed identity identifier; specifically, the steps include: (1.1) Generation of distributed identity identifiers for distributed network entity alliances; (1.2) Registration of distributed identity identifiers of distributed network entity alliances; (1.3) Verification of distributed identity identifiers of distributed network entity alliances; (1.4) Update of distributed identity identifiers of distributed network entity alliances; (1.5) Revocation of distributed identity identifiers of distributed network entity alliances; The (1.1) generation of a distributed identity identifier of a distributed network entity alliance specifically includes: The distributed network entity first selects the type of the alliance identity according to its own type through the distributed identity client; then generates a fixed header ConsortiumID, a random string RandomString, and an associated public and private key pair (pk, sk) based on the selected alliance identity type, where pk represents the public key and sk represents the private key, and then combines them to obtain the alliance distributed identity identifier { <consortiumid:type:randomstring> ,pk}; finally, the generated alliance distributed identity identifier is stored in the built-in identity wallet;< / consortiumid:type:randomstring> The (1.2) registration of the distributed network entity alliance distributed identity identifier specifically includes: (1.2.1) The distributed network entity first retrieves the alliance distributed identity identifier from its own identity wallet through the distributed identity client, performs a hash operation on the retrieved alliance distributed identity identifier, generates an alliance distributed identity identifier information digest, and appends a timestamp; then uses its own private key to sign the alliance distributed identity identifier information digest and the appended timestamp to generate signature information related to the alliance distributed identity identifier; then sends the generated alliance distributed identity identifier related signature information and the alliance distributed identity identifier retrieved from the wallet as registration request parameters to the alliance distributed identity service node; (1.2.2) After receiving the registration request, the federation distributed identity service node verifies the signature information in the registration request by extracting the public key in the federation distributed identity identifier in the registration request; if the verification is successful, the federation distributed identity service node stores the received federation distributed identity identifier in the federation distributed identity ledger through the consensus mechanism; otherwise, the registration fails; The verification of the distributed identity identifier of the distributed network entity alliance (1.3) specifically includes: (1.3.1) The distributed network entity first performs a hash operation on its own alliance distributed identity identifier through the distributed identity client to generate the alliance distributed identity identifier information digest H and append a timestamp; then uses its own private key to sign the alliance distributed identity identifier information digest H and the appended timestamp to generate signature information related to the alliance distributed identity identifier; then sends the generated alliance distributed identity identifier-related signature and the alliance distributed identity identifier verification request to the alliance distributed identity service node; (1.3.2) After receiving the verification request, the federation distributed identity service node first queries the federation distributed identity identifier information of the distributed network entity that sent the verification request on the federation distributed identity ledger, and extracts the public key pk in the federation distributed identity identifier; then uses the extracted public key pk to verify the signature information related to the federation distributed identity identifier in the received request, and the federation distributed identity service node stores the verification result in the federation distributed identity ledger through the consensus mechanism for query by other distributed network entities, and returns the verification result to the distributed network entity that sent the verification request; The (1.4) updating of the distributed network entity alliance distributed identity identifier specifically includes: (1.4.1) The distributed network entity first generates a new alliance distributed identity identifier through the distributed identity client, then performs a hash operation on the new alliance distributed identity identifier to generate a new alliance distributed identity identifier information digest and append a timestamp, then uses the private key corresponding to the old alliance distributed identity identifier to sign the new alliance distributed identity identifier information digest and the appended timestamp to obtain the signature information S, and then sends an update request carrying the old alliance distributed identity identifier, the new alliance distributed identity identifier and the signature information S to the alliance distributed identity service node; (1.4.2) Upon receiving the update request, the alliance distributed identity service node first queries the old alliance distributed identity identifier information on the alliance distributed identity ledger, and extracts the corresponding public key pk in the old alliance distributed identity identifier on the alliance distributed identity ledger; then uses the extracted public key pk to verify the received signature information S. If the verification is successful, the alliance distributed identity service node stores the new alliance distributed identity identifier in the alliance distributed identity ledger through the consensus mechanism, marks the old alliance distributed identity identifier as unavailable, and notifies the distributed network entity that sent the update request to store the new alliance distributed identity identifier in the identity wallet of its own distributed identity client and delete the old alliance distributed identity identifier; otherwise, the update fails; The above (1.5) revocation of the distributed network entity alliance distributed identity identifier specifically includes: (1.5.1) The distributed network entity first retrieves the alliance distributed identity identifier to be revoked from its own identity wallet through the distributed identity client, performs a hash operation on the alliance distributed identity identifier to be revoked, generates an information digest of the alliance distributed identity identifier to be revoked, and adds a timestamp; then uses its own private key to sign the information digest of the alliance distributed identity identifier to be revoked and the attached timestamp to generate signature information related to the alliance distributed identity identifier to be revoked; then sends a revocation request carrying the signature information related to the alliance distributed identity identifier to be revoked and the alliance distributed identity identifier to be revoked to the alliance distributed identity service node; (1.5.2) Upon receiving the revocation request, the federated distributed identity service node first queries the federated distributed identity identifier to be revoked on the federated distributed identity ledger, and extracts the public key of the federated distributed identity identifier to be revoked on the federated distributed identity ledger; then, the extracted public key is used to verify the signature information related to the federated distributed identity identifier to be revoked. If the verification is successful, the information of the federated distributed identity identifier to be revoked on the federated distributed identity ledger is marked as revoked; at the same time, the distributed network entity that sent the revocation request is notified to delete the federated distributed identity identifier to be revoked in the identity wallet of its own distributed identity client.

Images