Application access method and system based on blockchain, storage medium, and electronic device

Abstract

The embodiment of the present invention is about a blockchain-based application access method and system, storage medium, and electronic device, and relates to the field of computer technology. The method includes: obtaining a target certificate required by an access application party, and determining whether the target certificate exists in the current certificate of the user party; if the target certificate exists in the current certificate, generating certificate authorization information according to the target certificate; uploading the certificate authorization information to the state library of the blockchain, so that when the application party polls the state library to find that the user party's certificate authorization information exists, after confirming that the target certificates included in the certificate authorization information are all valid, the user party's access behavior is authorized. The embodiment of the present invention improves the security of user information.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular, to a blockchain-based application access method, a blockchain-based application access device, a computer-readable storage medium, and an electronic device. Background Art

[0002] In the application model where the client and server are separated, the server where the application is located needs to authenticate the client and confirm the identity of the user.

[0003] In a common scenario, such as a login interface, the user needs to enter his or her identity information in the interface. Only after the server confirms that the information is correct can it allow the client to perform subsequent operations with this identity.

[0004] However, the above solution has the following defects: since the user needs to enter his / her own identity information, the user's sensitive information is overly exposed, which leads to low security of the user's information.

[0005] Therefore, a new blockchain-based application access method needs to be provided.

[0006] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present invention, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the invention

[0007] The purpose of the present invention is to provide a blockchain-based application access method, a blockchain-based application access device, a computer-readable storage medium and an electronic device, thereby at least to a certain extent overcoming the problem of low security of user information caused by the limitations and defects of related technologies.

[0008] According to one aspect of the present disclosure, a blockchain-based application access method is provided, comprising:

[0009] Obtain the target certificate required by the access application, and determine whether the target certificate exists in the current certificate of the user;

[0010] If the target certificate exists in the current certificate, generating certificate authorization information according to the target certificate;

[0011] The certificate authorization information is uploaded to the status library of the blockchain, so that when the application party polls the status library to find that the user party's certificate authorization information exists, it authorizes the user party's access behavior after confirming that the target certificates included in the certificate authorization information are valid.

[0012] In an exemplary embodiment of the present disclosure, before generating authorization certificate information according to the target certificate, the blockchain-based application access method further includes:

[0013] If the target certificate does not exist in the current certificate type, generating a certificate application request according to the certificate type to which the target certificate belongs and the decentralized identifier of the user;

[0014] The certificate application request is sent to the issuing party, and the issuing party responds to the certificate application request and receives a target certificate generated according to the certificate type to which the target certificate belongs and the decentralized identifier of the user.

[0015] In an exemplary embodiment of the present disclosure, generating a certificate application request according to the certificate type to which the target certificate belongs and the decentralized identifier of the user party includes:

[0016] Generate a password pair including a user public key and a user private key;

[0017] The certificate application request is generated according to the user public key in the password pair, the certificate type to which the target certificate belongs, and the decentralized identifier of the user.

[0018] In an exemplary embodiment of the present disclosure, the blockchain-based application access method further includes:

[0019] Establishing a mapping relationship between the user private key in the password pair and the target certificate;

[0020] The mapping relationship, the user private key and the target certificate are stored.

[0021] In an exemplary embodiment of the present disclosure, uploading the certificate authorization information to the status library includes:

[0022] Creating target account information in the blockchain, and binding the target account information and the current account information of the user;

[0023] Based on the binding relationship, the certificate authorization information is shared in the status library.

[0024] In an exemplary embodiment of the present disclosure, the blockchain-based application access method further includes:

[0025] A certificate list is generated according to the current certificate, and based on the binding relationship, the current certificate list is stored in the state library.

[0026] According to one aspect of the present disclosure, there is provided a blockchain-based application access device, comprising:

[0027] The target certificate acquisition module is used to obtain the target certificate required by the access application party and determine whether the target certificate exists in the current certificate of the user party;

[0028] An authorization information generating module, configured to generate certificate authorization information according to the target certificate if the target certificate exists in the current certificate;

[0029] The application access module is used to upload the certificate authorization information to the status library of the blockchain, so that when the application party polls the status library to find that the certificate authorization information of the user party exists, after confirming that the target certificates included in the certificate authorization information are valid, the application party is authorized to access.

[0030] According to one aspect of the present disclosure, there is provided a blockchain-based application access system, comprising:

[0031] The terminal device of the user is used to implement any of the above-mentioned blockchain-based application access methods;

[0032] A blockchain, connected to the terminal device network of the user, for managing the certificate authorization information uploaded by the user;

[0033] The server where the application party is located is connected to the blockchain network, and is used to generate a certificate verification request based on the target certificate included in the certificate authorization information and send it to the issuer after polling the blockchain for the existence of certificate authorization information, and when confirming that the verification result sent by the issuer is that all the target certificates are valid, authorize the access behavior of the user party corresponding to the target certificate.

[0034] According to one aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the blockchain-based application access method described above is implemented.

[0035] According to one aspect of the present disclosure, there is provided an electronic device, including:

[0036] Processor; and

[0037] A memory, configured to store executable instructions of the processor;

[0038] The processor is configured to execute any one of the above-mentioned blockchain-based application access methods by executing the executable instructions.

[0039] An application access method based on blockchain provided by an embodiment of the present invention, on the one hand, obtains the target certificate required by the access application party, and determines whether the target certificate exists in the current certificate of the user party; and when it is determined that the target certificate exists in the current certificate, generates certificate authorization information according to the target certificate; finally, uploads the certificate authorization information to the state library of the blockchain, so that when the application party polls the state library to find that the certificate authorization information of the user party exists, when it is confirmed that the target certificates included in the certificate authorization information are all valid, the user party's access behavior is authorized, which solves the problem of excessive exposure of the user party's sensitive information due to the user party's need to enter his own identity information in the prior art, thereby resulting in low security of the user party's information, and improves the security of the user party's information; on the other hand, because the application party authorizes the user party's access behavior only when it is confirmed that the target certificates included in the certificate authorization information are all valid, the secondary verification of the user party's current certificate is realized; on the other hand, by generating certificate authorization information according to the target certificate when it is determined that the target certificate exists in the current certificate, the problem of low access efficiency caused by the need to enter identity information is avoided.

[0040] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present invention, and together with the specification are used to explain the principles of the present invention. Obviously, the accompanying drawings described below are only some embodiments of the present invention, and for those of ordinary skill in the art, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0042] Figure 1 A flowchart of a blockchain-based application access method according to an exemplary embodiment of the present invention is schematically shown.

[0043] Figure 2 A block diagram of a blockchain-based application access system according to an exemplary embodiment of the present invention is schematically shown.

[0044] Figure 3 A block diagram based on blockchain according to an exemplary embodiment of the present invention is schematically shown.

[0045] Figure 4 A flowchart of another blockchain-based application access method according to an exemplary embodiment of the present invention is schematically shown.

[0046] Figure 5 A flowchart of another blockchain-based application access method according to an exemplary embodiment of the present invention is schematically shown.

[0047] Figure 6 A flowchart of another blockchain-based application access method according to an exemplary embodiment of the present invention is schematically shown.

[0048] Figure 7 A block diagram of a blockchain-based application access device according to an exemplary embodiment of the present invention is schematically shown.

[0049] Figure 8 A block diagram schematically illustrates another blockchain-based application access device according to an exemplary embodiment of the present invention.

[0050] Fig. 9 An electronic device for implementing the above-mentioned blockchain-based application access method according to an exemplary embodiment of the present invention is schematically shown. DETAILED DESCRIPTION

[0051] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present invention will be more comprehensive and complete, and the concept of the example embodiments will be fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present invention. However, those skilled in the art will appreciate that the technical solutions of the present invention may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present invention.

[0052] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0053] In recent years, the Internet has been widely used and is closely related to everyone's daily life. While it brings convenience to people, it also causes excessive exposure of users' sensitive information.

[0054] To solve the above problems, W3C (World Wide Web Consortium) proposed the concept of DID (Decentralized Identifier), which is a distributed identity specification. The distributed identity specification can convert users' sensitive information into anonymous verifiable statements. The statement mainly provides assertions and is endorsed by the issuer. Users cannot see the user's sensitive information, but use the assertions to determine user permissions.

[0055] However, W3C's DID is still at the specification stage, and there is no mature overall solution that can be combined with business, that is, it has not been applied to specific application scenarios, which has led to many details not being answered. For example, in the overall system framework, how does the issuer verify the user's sensitive information; how do the user and user parties effectively manage; how to quickly connect with more business parties, etc.

[0056] Based on this, this exemplary embodiment first provides a blockchain-based application access method, which can be run on a terminal device; of course, those skilled in the art can also run the method of the present invention on other platforms as required, and this exemplary embodiment does not specifically limit this. Figure 1 As shown, the blockchain-based application access method may include the following steps:

[0057] Step S110. Obtain the target certificate required by the access application, and determine whether the target certificate exists in the current certificate of the user;

[0058] Step S120. If the target certificate exists in the current certificate, generate certificate authorization information according to the target certificate;

[0059] Step S130. Upload the certificate authorization information to the status library of the blockchain, so that when the application party polls the status library to find that the user party's certificate authorization information exists, it authorizes the user party's access behavior after confirming that the target certificates included in the certificate authorization information are valid.

[0060] In the above-mentioned blockchain-based application access method, on the one hand, by obtaining the target certificate required by the access application party and judging whether the target certificate exists in the current certificate of the user party; and when it is determined that the target certificate exists in the current certificate, the certificate authorization information is generated according to the target certificate; finally, the certificate authorization information is uploaded to the state library of the blockchain, so that when the application party polls the state library to find that the certificate authorization information of the user party exists, when it is confirmed that the target certificates included in the certificate authorization information are all valid, the user party's access behavior is authorized, which solves the problem in the prior art that the user party needs to enter his own identity information, resulting in excessive exposure of the user party's sensitive information, thereby resulting in low security of the user party's information, and improves the security of the user party's information; on the other hand, because the application party only authorizes the user party's access behavior when it is confirmed that the target certificates included in the certificate authorization information are all valid, the secondary verification of the user party's current certificate is realized; on the other hand, by generating certificate authorization information according to the target certificate when it is determined that the target certificate exists in the current certificate, the problem of low access efficiency caused by the need to enter identity information is avoided.

[0061] Hereinafter, the steps involved in the blockchain-based application access method according to an exemplary embodiment of the present invention will be explained and illustrated in detail with reference to the accompanying drawings.

[0062] First, the purpose of the invention of the exemplary embodiment of the present invention is explained and illustrated. Specifically, the present invention is inspired by the theoretical basis of W3CDID, combines blockchain technology to achieve effective management of multiple parties, and completes the security supervision and tracking audit of the behavior of multiple parties through smart contracts, so that the user party can successfully access the application party; at the same time, it can also quickly connect with different business parties and different blockchain platforms.

[0063] Among them, the decentralized identifier is a new type of verifiable and "self-sovereign" digital identity identifier. As a decentralized authentication data structure, it can define people, objects and institutions. The method specification of the decentralized identifier was created by the World Wide Web Consortium (W3C). The emergence of blockchain technology provides an opportunity to implement decentralized identity management. In the decentralized identifier, all identity information is shared by trust nodes in the form of a distributed ledger. Each decentralized identifier is encrypted and protected by the private key of the identity owner. It is recognized that it can redefine the important security layer missing in the Internet protocol, namely the identity layer. The traditional identity authentication management system is centralized, while the decentralized identifier is completely independent of the centralized management center, third-party authentication service and certificate authority (issuer).

[0064] Decentralized identifiers DIDs are completely controlled by the DIDs subject and do not rely on any central registry, identity provider or certificate authority. The system design of decentralized identifiers should eliminate the reliance on centralized registration authorities and centralized certificate authorities for key management - the hierarchical PKI (public key infrastructure) standard model. Since DIDs reside on a distributed ledger, each entity can act as its own authority trust root, which is an architecture called DPKI (decentralized PKI).

[0065] DIDs are URLs (Uniform Resource Identifiers) that associate DIDs subjects with trusted interaction endpoints. DIDs resolve to DIDs documents, which are simple documents that describe how to use that specific DIDs. Each DIDs document contains at least three components: cryptographic materials, authentication suites, and service endpoints. Cryptographic materials combined with authentication suites provide a set of mechanisms for authenticating as DIDs subjects (e.g., public keys, anonymous biometric protocols, etc.), and service endpoints support trusted interactions with DIDs subjects. Entities are identified by decentralized identifiers (DIDs) and can be authenticated by proofs (e.g., digital signatures, privacy-preserving biometric protocols, etc.). DIDs point to DIDs documents. Following the principles of privacy by design, each entity can have as many DIDs as needed to respect the entity's desired identity and achieve separation of personas and backgrounds.

[0066] Next, the application access system based on blockchain according to an exemplary embodiment of the present invention is explained and described. Figure 2 As shown, the blockchain-based application access system may include a terminal device 210 where the user is located, a blockchain 220, and a server 230 where the application is located, and the terminal device where the user is located and the server where the application is located are respectively connected to the blockchain network. Further, the blockchain-based application access system may also include a server 240 where the issuing party is located, which is respectively connected to the terminal device 210 where the user is located, the blockchain 220, and the server 230 where the application is located. Specifically:

[0067] First, the user can generate certificate authorization information based on the target certificate required by the application party, and upload the certificate authorization information to the blockchain's state library. For example, the user can scan the QR code provided by the application party, which includes the decentralized identifier of the application party, wherein the specific scanning process can be scanned by a terminal device, for example, by scanning through a WeChat applet, etc.; then, the user can query the target certificate (list) required to access the application party based on the decentralized identifier; when the user party obtains the target certificate, it determines whether the target certificate is included in the currently owned certificate. If so, the certificate authorization information is generated and uploaded to the blockchain's state library; if not, a target certificate application request is generated based on the required target certificate and the user's decentralized identifier, and the target certificate application request is sent to the issuing party.

[0068] Secondly, refer to Figure 3 As shown, the blockchain may include a management module 301, which can be used to manage the certificate authorization information sent by the user in the status library.

[0069] Then, the application side can be used to generate a certificate verification request according to the target certificate included in the certificate authorization information and send it to the issuing side after polling the management module to find that there is certificate authorization information, and when confirming that the verification result sent by the issuing side is that the target certificate is fully valid, authorize the access behavior of the user side corresponding to the target certificate;

[0070] Finally, the issuing party, connected to the application party, the blockchain and the user party network, can be used to verify the target certificate included in the certificate verification request sent by the application party, obtain the verification result, and send the verification result to the application party. Of course, the issuing party can also be used to generate the target certificate after receiving the target certificate application request and determining that the application request meets the requirements; at the same time, the issuing party can also be used to: revoke the target certificate when it is detected that the target certificate expires and / or is updated.

[0071] The following, combined Figure 3 Further explanation and description of blockchain. Figure 3 As shown, the blockchain may also include an identity module 302 and a certificate module 303. Among them:

[0072] First, the management module is used to manage the application party, the certificate issuer, and maintain the certificate.

[0073] The application side includes the identity of the application side, the trusted issuer, and the required target certificate (i.e., verifiable statement assertion). There can be multiple application sides, which can also include newly connected application sides and application side information update, deletion and other operations.

[0074] The issuer includes the identity of the issuer and the certificate types supported by the issuer. There can be multiple issuers, which can also include newly connected issuers, inter-system service docking, and update and delete operations of issuer information.

[0075] Certificates include certificate description, validity period, currently supported issuers, etc. There are a large number of different certificates.

[0076] Secondly, the identity module is used to manage the identity of the entire system and cross-chain identity. The identity module can first manage the blockchain identity of the application party, the issuer, and the ordinary user (user party), and the retrieval of secret key pairs. However, it will not save or leak any user sensitive information, such as real-name information, user private keys, etc.

[0077] Since many business systems have independent account systems, such as the account system of the issuer's own verification service system and the account system of the application system. Since the issuer's account system is used as a query condition for checking the certificate content, it will be managed by a third-party identity security module. The account system of the application system provides users with anonymous security and distributed identities with various certificates. The application party can access this system at any time, associate its own account system, and configure its own business permissions.

[0078] Finally, the certificate module is used for certificate storage, application, authorization, and revocation. The certificate module first saves a large number of different types of certificates issued by different issuers to different users. The structure of each certificate covers the x509 certificate specification and the DIDs certificate specification, meets the multi-party security specification standards, and provides more redundant fields for front-end display.

[0079] The certificate module is also responsible for the application action initiated by ordinary users to the certificate issuer, which is a work order-like action. It has multiple states: application creation, processing, application failure, and success.

[0080] The certificate module is also responsible for the authorization actions initiated by ordinary users to the application party. This is also a work order action with multiple states: authorization creation, processing, authorization failure and success.

[0081] The certificate module is also responsible for revoking the certificate itself. When the certificate is authorized or verified by the application, it will be found that the certificate has expired or the verification service of the issuer returns invalid, which will trigger the certificate revocation action. The certificate module also includes a query index module. For user application, authorization, certificate revocation and other records, the business system front end will have query needs, so this module is to serve the purpose of quickly querying these records.

[0082] In the following, we will combine the above Figure 2Steps S110 to S130 are explained and described.

[0083] In step S110, a target certificate required for accessing the application is obtained, and it is determined whether the target certificate exists in the current certificate of the user.

[0084] In this example embodiment, first, the terminal device where the user is located scans the QR code displayed by the application party (specifically, the QR code can be scanned through the WeChat applet included in the terminal device, of course, it can also be scanned in other ways, and this example does not impose special restrictions on this) to obtain the decentralized identifier of the application party; then, the user party obtains the target certificate required to access the application party from the management module of the blockchain according to the decentralized identifier (which can exist in the form of a list); further, after obtaining the target certificate, it is determined whether the target certificate is fully present in the user's current certificate (which can also exist in the form of a list).

[0085] It should be noted that, based on the above-mentioned records, the target certificate required by the application party and the current certificate owned by the user party can be stored in the management module of the blockchain, and can exist in the form of a list. Therefore, the target certificate can be obtained directly from the management module of the blockchain, and the current certificate can also be obtained from the management module of the blockchain. After both are obtained, they can be compared. Based on this method, by using blockchain technology to manage the distributed identities of the application party and the user party, the anonymity, irreversibility and high robustness of the blockchain can be utilized, the management efficiency of the certificate and the credibility of the certificate can be improved, the barriers between multiple parties can be broken, the system efficiency of the application party and the user party can be improved, and the access efficiency can be improved; at the same time, it can also facilitate security monitoring and post-event tracking and auditing, further improving the security of the application party and the user party themselves.

[0086] In step S120, if the target certificate exists in the current certificate, certificate authorization information is generated according to the target certificate.

[0087] Specifically, here we take the application party as an App as an example to explain and illustrate the specific generation process of certificate authorization information. Specifically, assuming that the target certificates required by the App are all present in the current certificate, the user can select the target certificate by checking it and check the option to agree to the authorization. When the terminal device receives the user's selection information, it can generate certificate authorization information based on the target certificate checked by the user.

[0088] In addition, if the target certificate does not exist in the current certificate, refer to Figure 4 As shown, the blockchain-based application access method may further include step S410 and step S420. Among them:

[0089] In step S410, if the target certificate does not exist in the current certificate, a certificate application request is generated according to the certificate type to which the target certificate belongs and the decentralized identifier of the user.

[0090] In this example embodiment, when the target certificate does not exist or does not completely exist in the current certificate, a certificate application request can be generated based on the certificate type to which the target certificate that does not exist in the current certificate belongs and the decentralized identifier of the user. Specifically, it can include: first, generating a password pair including a user public key and a user private key; second, generating the certificate application request based on the user public key in the password pair, the certificate type to which the target certificate belongs, and the decentralized identifier of the user. For example, when it is necessary to apply for a target certificate, the terminal device generates a password pair including a user public key and a user private key, and then generates a certificate application request based on the user apartment in the password pair, the certificate type to which the target certificate belongs, and the decentralized identifier of the user.

[0091] It should be noted that users can generate password pairs through the RSA algorithm. Among them, the RSA algorithm is a non-paired encryption algorithm. When generating asymmetric encryption keys, two keys are generated for each group, and due to mathematical properties, it is difficult to deduce the other key by knowing only one of the keys. Therefore, data encrypted with one key can only be decrypted by the other key. When using, one of the generated keys is made public (called the user's public key), and the other is kept properly (called the user's private key). Anyone can use the public key to encrypt data and send it to the owner of the private key. Since only the owner of the private key can decrypt the data, it can also prevent others from falsely claiming to be the owner of the private key and obtaining plaintext information. Similarly, data encrypted with the private key can be decrypted by anyone using the corresponding public key. This operation can be used to ensure that the person sending the information must be the owner of the private key. When using, the private key owner usually performs a digest algorithm (hash) on the plaintext information to be sent, and encrypts the digest result with the private key. This operation is called signing. The recipient uses the same algorithm to calculate the summary information of the plaintext, and compares it with the signature after decryption using the public key to determine whether the original sender is the owner of the corresponding private key.

[0092] In step S420, the certificate application request is sent to the issuer, and the issuer responds to the certificate application request and receives a target certificate generated according to the certificate type to which the target certificate belongs and the decentralized identifier of the user.

[0093] In this example embodiment, after obtaining the above-mentioned certificate application request, the certificate application request can be sent to the issuer. After receiving the certificate application request, the issuer responds to the certificate application request and verifies the decentralized identifier; if the verification is successful, the target certificate is issued and sent to the user based on the certificate type to which the target certificate belongs and the user's public key; if the verification fails, a message indicating that the certificate issuance failed is sent to the user.

[0094] Furthermore, after the user receives the target certificate, the blockchain-based application access method also includes: first, establishing a mapping relationship between the user private key in the password pair and the target certificate; second, storing the mapping relationship, the user private key and the target certificate. Through this method, the target certificate can be renewed, the verification information of the target certificate can be modified, or the function of the certificate can be changed. The specific reasons are as follows: when renewing the target certificate, modifying the verification information of the target certificate, or changing the function of the certificate, the issuer needs to verify the legitimacy of the user's target certificate. The specific verification process is: verify whether the target certificate is issued by the issuer, and whether the user's corresponding client has a user private key; if the user private key exists, the issuer can re-issue the target certificate according to the new user public key provided by the user.

[0095] In step S130, the certificate authorization information is uploaded to the status library of the blockchain, so that when the application party polls the status library to find that the certificate authorization information of the user party exists, it authorizes the user party's access behavior after confirming that the target certificates included in the certificate authorization information are valid.

[0096] In this example embodiment, first, the certificate authorization information is uploaded to the state library of the blockchain, which may specifically include: first, creating the target account information in the blockchain, and binding the target account information and the current account information of the user; second, based on the binding relationship, sharing the certificate authorization information to the state library. Specifically, the target account information can be created in the blockchain according to the decentralized identifier of the user, and then the target account information and the current account information of the user (such as WeChat account information) can be bound. After the authorization information is generated, the certificate authorization information can be shared to the state library of the blockchain based on the binding relationship. Through this method, the sharing efficiency of the certificate authorization information can be improved, thereby improving the access efficiency.

[0097] Secondly, after sharing to the status library, the application can poll the certificate authorization information from the status library in a polling manner, and after polling the certificate authorization information, it can confirm whether the target certificates are all valid (or legal). If all are valid, access is authorized; if not, access is denied.

[0098] Furthermore, in order to facilitate the determination of whether all target certificates exist in the current certificate, the method further includes: generating a certificate list according to the current certificate and storing the current certificate list in the status library based on the binding relationship. Furthermore, when it is necessary to determine whether all target certificates exist in the current certificate, a match can be made based on the certificate list and the certificate list generated by the target certificate, and then based on the matching result, it can be determined whether they exist completely in the current certificate. This method can improve the determination efficiency and thus improve the access efficiency.

[0099] The exemplary embodiment of the present invention also provides another blockchain-based application access method, which can be run on the server where the application party is located. Figure 5 As shown, the blockchain-based application access method may include steps S510 to S530. Among them:

[0100] In step S510, when it is polled that there is certificate authorization information generated by the user according to the target certificate when determining that the target certificate exists in the current certificate in the blockchain, a certificate verification request is generated according to the target certificate included in the certificate authorization information.

[0101] In step S520, the certificate verification request is sent to the issuing party, and the verification result sent by the issuing party after verifying the target certificate is received.

[0102] In step S530, if the verification result is that all the target certificates are valid, the access behavior of the user party corresponding to the target certificate is authorized.

[0103] Figure 5 In the schematically illustrated blockchain-based application access method, a secondary verification of the user's current certificate is implemented, further improving the security of the system where the application is located.

[0104] The following will be combined Figure 6 The application access method based on blockchain in the exemplary embodiment of the present invention is further explained and illustrated. Figure 6 As shown, the blockchain-based application access method may include the following steps:

[0105] Step S610: The user scans the QR code displayed by the application to obtain the decentralized identifier of the application;

[0106] Step S620: the user obtains the target certificate required to access the application according to the decentralized identifier of the application, and determines whether the target certificate is completely present in the current certificate; if yes, jump to step S630; if no, jump to step S660;

[0107] Step S630: The user generates certificate authorization information according to the target certificate, and shares the certificate authorization information to the status library of the blockchain;

[0108] In step S640, the application polls the user's certificate authorization information from the status library and determines whether the target certificate included in the certificate authorization information is valid; if yes, jump to step S650, if not, jump to step S670.

[0109] Step S650: the application authorizes the user to log in and access.

[0110] In step S660, the user generates a certificate application request according to the certificate type of the target certificate to apply for the target certificate from the issuer until all applications for the target certificate are successful.

[0111] Step S670: The application denies the user's login and access.

[0112] In the blockchain-based application access method provided in the exemplary embodiment of the present invention, a W3C DID-based implementation solution is implemented, including system architecture solutions for multiple roles and certificates, docking management of certificate issuance services, docking suggestions for application parties, etc. At the same time, by using blockchain technology, multiple roles and actions on distributed identities completed by each role through smart contracts are managed. In this way, the excellent characteristics of blockchain are utilized, such as anonymity, irreversibility, high robustness, breaking through barriers between multiple parties, improving collaborative efficiency, security monitoring and post-event tracking audit, etc.

[0113] The exemplary embodiment of the present invention also provides an application access device based on blockchain. Figure 7 As shown, the blockchain-based application access device may include a target certificate acquisition module 710, an authorization information generation module 720, and an application access module 730. Among them:

[0114] The target certificate acquisition module 710 may be used to acquire the target certificate required by the access application and determine whether the target certificate exists in the current certificate of the user;

[0115] The authorization information generating module 720 may be used to generate certificate authorization information according to the target certificate if the target certificate exists in the current certificate;

[0116] The application access module 730 can be used to upload the certificate authorization information to the status library of the blockchain, so that when the application party polls the status library to find that the certificate authorization information of the user party exists, it authorizes the access behavior of the user party after confirming that the target certificates included in the certificate authorization information are valid.

[0117] In an exemplary embodiment of the present disclosure, the blockchain-based application access device further includes:

[0118] A certificate application request generation module, which can be used to generate a certificate application request according to the certificate type to which the target certificate belongs and the decentralized identifier of the user party if the target certificate does not exist in the current certificate type;

[0119] The target certificate receiving module can be used to send the certificate application request to the issuer, and receive the target certificate generated by the issuer in response to the certificate application request according to the certificate type to which the target certificate belongs and the decentralized identifier of the user.

[0120] In an exemplary embodiment of the present disclosure, generating a certificate application request according to the certificate type to which the target certificate belongs and the decentralized identifier of the user party includes:

[0121] Generate a password pair including a user public key and a user private key;

[0122] The certificate application request is generated according to the user public key in the password pair, the certificate type to which the target certificate belongs, and the decentralized identifier of the user.

[0123] In an exemplary embodiment of the present disclosure, the blockchain-based application access device further includes:

[0124] A mapping relationship establishing module, which can be used to establish a mapping relationship between the user private key in the password pair and the target certificate;

[0125] The storage module can be used to store the mapping relationship, the user private key and the target certificate.

[0126] In an exemplary embodiment of the present disclosure, uploading the certificate authorization information to the status library includes: creating target account information in the blockchain, and binding the target account information and the current account information of the user; based on the binding relationship, sharing the certificate authorization information to the status library.

[0127] In an exemplary embodiment of the present disclosure, the blockchain-based application access device further includes:

[0128] The certificate list generating module may be configured to generate a certificate list according to the current certificate, and store the current certificate list in the status library based on the binding relationship.

[0129] The exemplary embodiment of the present invention also provides another application access device based on blockchain. Figure 8 As shown, the blockchain-based application access device may further include a certificate verification request generation module 810, a verification result receiving module 820, and an authorization module 830. Among them:

[0130] The certificate verification request generation module 810 may be used to generate a certificate verification request according to the target certificate included in the certificate authorization information when polling the blockchain to find that there is certificate authorization information generated by the user according to the target certificate when determining that the target certificate exists in the current certificate;

[0131] The verification result receiving module 820 may be used to send the certificate verification request to the issuing party and receive the verification result sent by the issuing party after verifying the target certificate;

[0132] The authorization module 830 may be configured to authorize access behavior of the user party corresponding to the target certificate if the verification result shows that all the target certificates are valid.

[0133] The specific details of each module in the above-mentioned blockchain-based application access device have been described in detail in the corresponding blockchain-based application access method, so they will not be repeated here.

[0134] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0135] In addition, although the steps of the method of the present invention are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0136] In an exemplary embodiment of the present invention, an electronic device capable of implementing the above method is also provided. It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation combining hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0137] Refer to the following Fig. 9 An electronic device 900 according to this embodiment of the present invention will be described. Fig. 9 The electronic device 900 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0138] like Fig. 9 As shown, the electronic device 900 is in the form of a general computing device. The components of the electronic device 900 may include, but are not limited to: the at least one processing unit 910, the at least one storage unit 920, a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910), and a display unit 940.

[0139] The storage unit stores program codes, which can be executed by the processing unit 910, so that the processing unit 910 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 910 can perform the following steps: Figure 1 Step S110 shown in: obtaining the target certificate required for accessing the application party, and determining whether the target certificate exists in the current certificate of the user party; step S120: if the target certificate exists in the current certificate, generating certificate authorization information according to the target certificate; step S130: uploading the certificate authorization information to the status library of the blockchain, so that when the application party polls the status library to find that the certificate authorization information of the user party exists, after confirming that the target certificates included in the certificate authorization information are all valid, the user party's access behavior is authorized.

[0140] The processing unit 910 may also perform the following steps: Figure 5 Step S510 described in: when polling the blockchain to find that there is certificate authorization information generated by the user based on the target certificate when determining that the target certificate exists in the current certificate, generate a certificate verification request based on the target certificate included in the certificate authorization information; Step S520: send the certificate verification request to the issuer, and accept the verification result sent by the issuer after verifying the target certificate; Step S530: if the verification result is that all the target certificates are valid, authorize the access behavior of the user corresponding to the target certificate.

[0141] The storage unit 920 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 9201 and / or a cache storage unit 9202 , and may further include a read-only storage unit (ROM) 9203 .

[0142] The storage unit 920 may also include a program / utility 9204 having a set (at least one) of program modules 9205, such program modules 9205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0143] Bus 930 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0144] The electronic device 900 may also communicate with one or more external devices 1000 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 900, and / or communicate with any device that enables the electronic device 900 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 950. Furthermore, the electronic device 900 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 960. As shown, the network adapter 960 communicates with other modules of the electronic device 900 via a bus 930. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0145] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present invention.

[0146] In an exemplary embodiment of the present invention, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of this specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to perform the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of this specification.

[0147] The program product for implementing the above method according to an embodiment of the present invention may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0148] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0149] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0150] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0151] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0152] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0153] Other embodiments of the invention will readily occur to those skilled in the art after considering the specification and practicing the invention invented herein. This application is intended to cover any variations, uses or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art that are not invented by the present invention. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the claims.

Claims

1. A blockchain-based application access method, characterized in that: include: Obtain the target certificate required by the access application, and determine whether the target certificate exists in the current certificate of the user; If the target certificate exists in the current certificate, generating certificate authorization information according to the target certificate; If the target certificate does not exist in the current certificate, generating a certificate application request according to the certificate type to which the target certificate belongs and the decentralized identifier of the user; Sending the certificate application request to the issuer, receiving the target certificate generated by the issuer in response to the certificate application request according to the certificate type to which the target certificate belongs and the decentralized identifier of the user, and generating certificate authorization information according to the target certificate; The certificate authorization information is uploaded to the status library of the blockchain, so that when the application party polls the status library to find that the user party's certificate authorization information exists, it authorizes the user party's access behavior after confirming that the target certificates included in the certificate authorization information are valid.

2. The blockchain-based application access method according to claim 1, characterized in that: Generate a certificate application request according to the certificate type of the target certificate and the decentralized identifier of the user, including: Generate a password pair including a user public key and a user private key; The certificate application request is generated according to the user public key in the password pair, the certificate type to which the target certificate belongs, and the decentralized identifier of the user.

3. The blockchain-based application access method according to claim 2, characterized in that: The blockchain-based application access method further includes: Establishing a mapping relationship between the user private key in the password pair and the target certificate; The mapping relationship, the user private key and the target certificate are stored.

4. The blockchain-based application access method according to claim 1, characterized in that: Uploading the certificate authorization information to the state library of the blockchain includes: Creating target account information in the blockchain, and binding the target account information and the current account information of the user; Based on the binding relationship, the certificate authorization information is shared in the status library.

5. The blockchain-based application access method according to claim 4, characterized in that: The blockchain-based application access method further includes: A certificate list is generated according to the current certificate, and based on the binding relationship, the current certificate list is stored in the state library.

6. A blockchain-based application access device, characterized in that: include: The target certificate acquisition module is used to obtain the target certificate required by the access application party and determine whether the target certificate exists in the current certificate of the user party; An authorization information generating module, configured to generate certificate authorization information according to the target certificate if the target certificate exists in the current certificate; A certificate application request generation module, which can be used to generate a certificate application request according to the certificate type to which the target certificate belongs and the decentralized identifier of the user party if the target certificate does not exist in the current certificate type; The target certificate receiving module can be used to send the certificate application request to the issuer, receive the target certificate generated by the issuer in response to the certificate application request according to the certificate type to which the target certificate belongs and the decentralized identifier of the user, and generate certificate authorization information according to the target certificate; The application access module is used to upload the certificate authorization information to the status library of the blockchain, so that when the application party polls the status library to find that the certificate authorization information of the user party exists, after confirming that the target certificates included in the certificate authorization information are valid, the application party is authorized to access.

7. A blockchain-based application access system, characterized in that: include: The terminal device where the user is located is used to implement the blockchain-based application access method according to any one of claims 1 to 5; A blockchain, connected to the terminal device network of the user, for managing the certificate authorization information uploaded by the user; The server where the application party is located is connected to the blockchain network, and is used to generate a certificate verification request based on the target certificate included in the certificate authorization information and send it to the issuer after polling the blockchain for the existence of certificate authorization information, and when confirming that the verification result sent by the issuer is that all the target certificates are valid, authorize the access behavior of the user party corresponding to the target certificate.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the blockchain-based application access method according to any one of claims 1 to 5 is implemented.

9. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; Wherein, the processor is configured to execute the blockchain-based application access method described in any one of claims 1-5 by executing the executable instructions.

Images