Identity Management System

Abstract

The present invention provides an identity management system, which relates to the field of information security technology and solves the problem of how to effectively manage identity information. The system includes a service provider, an identity issuing agency and a network operator, all of which maintain an editable blockchain storing identity information of a preset object; the network operator processes the transaction data of the target object in the editable blockchain maintained by it according to the identity identifier and transaction processing type of the target object included in the transaction processing instruction; and sends the transaction processing instruction to the identity issuing agency and the service provider; the identity issuing agency and the service provider process the transaction data of the target object in the editable blockchain maintained by them according to the transaction processing instruction, so that the processed transaction data in the editable blockchain maintained by them are consistent, and the effective management of identity information is achieved under the premise of ensuring the security of identity information.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an identity management system. Background Art

[0002] In traditional identity information management scenarios, user identity information is usually stored in a centralized third-party trusted data center, and the third-party trusted data center manages the identity information, such as changing or deleting the identity information. Among them, identity information is a basic social attribute of a person, and most social business operations require identity information authorization to confirm the validity and legality of the business, such as banking business, social security business, and urban service business.

[0003] However, when a third-party trusted data center is attacked at a single point, the identity information stored in the third-party trusted data center will be leaked, which is not conducive to the management of identity information. Therefore, how to effectively manage identity information while ensuring the security of identity information is an urgent problem to be solved by those skilled in the art. Summary of the invention

[0004] The present invention provides an identity management system, which realizes effective management of identity information while ensuring the security of identity information.

[0005] The present invention provides an identity management system, which includes a service provider that provides services for users, an identity issuing agency that provides identity authentication for preset objects, and a network operator that provides network services for the preset objects. The service provider, the identity issuing agency, and the network operator all maintain an editable blockchain that stores transaction ledgers corresponding to identity information of preset objects, and the preset objects include the users and the service provider.

[0006] Among them, the network operator is used to receive a transaction processing instruction, which includes an identity identifier and a transaction processing type of a target object to be processed; and according to the identity identifier and the transaction processing type of the target object, perform corresponding processing on the identity transaction data of the target object in the editable blockchain maintained by the network operator; and send the transaction processing instruction to the identity issuing agency and the service provider; the target object belongs to the preset object.

[0007] The identity issuing agency is used to process the identity transaction data of the target object in the editable blockchain maintained by the identity issuing agency accordingly according to the identity identifier of the target object and the transaction processing type.

[0008] The service provider is used to perform corresponding processing on the identity transaction data of the target object in the editable blockchain maintained by the service provider according to the identity identifier of the target object and the transaction processing type.

[0009] According to an identity management system provided by the present invention, the identity issuing agency, the service provider and the network operator all maintain a hash value index table between the hash value corresponding to the identity identifier of the preset object and the hash value corresponding to the block storing the identity transaction data of the preset object in the editable blockchain.

[0010] Among them, the network operator is also used to determine the target block from the editable blockchain according to the hash value corresponding to the identity identifier of the target object and the hash value index table maintained by the network operator, and perform corresponding processing on the identity transaction data of the target object in the target block.

[0011] The identity issuing agency is further used to determine the target block from the editable blockchain according to the hash value corresponding to the identity identifier of the target object and the hash value index table maintained by the identity issuing agency, and to perform corresponding processing on the identity transaction data of the target object in the target block.

[0012] The service provider is further used to determine the target block from the editable blockchain according to the hash value corresponding to the identity identifier of the target object and the hash value index table maintained by the network operator, and to perform corresponding processing on the identity transaction data of the target object in the target block.

[0013] According to an identity management system provided by the present invention, the network operator is further used to generate the target block storing identity transaction data corresponding to the identity information based on the identity information of the target object and the reception time of the identity information, and trigger the identity issuing agency and the service provider to reach a consensus and upload the target block to the chain; and based on the hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block, update the hash value index table maintained by the network operator.

[0014] The identity issuing agency is used to reach a consensus on and upload the target block to the chain, and update the hash value index table maintained by the identity issuing agency based on the hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block.

[0015] The service provider is used to reach consensus and upload the target block to the chain, and update the hash value index table maintained by the service provider based on the hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block.

[0016] According to an identity management system provided by the present invention, the network operator determines a hash value corresponding to the identity identifier of the target object and a hash value corresponding to the target block based on a first hash algorithm.

[0017] The identity issuing agency determines the hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block based on a second hash algorithm.

[0018] The service provider determines the hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block based on a third hash algorithm.

[0019] The first hash algorithm, the second hash algorithm and the third hash algorithm are different. For example, when there are multiple consensus units within the service provider, the hash algorithms used by each consensus unit are as different as possible.

[0020] According to an identity management system provided by the present invention, the multiple entities with a trust relationship corresponding to the network operator serve as nodes, constituting the consensus unit of the network operator; the multiple entities with a trust relationship corresponding to the identity issuing agency serve as nodes, constituting the consensus unit of the identity issuing agency; and the multiple entities with a trust relationship corresponding to the service provider serve as nodes, constituting the consensus unit of the service provider.

[0021] Each node in the consensus unit stores several different blocks in the editable blockchain, and the union of the blocks stored by all nodes in the consensus unit is the editable blockchain.

[0022] According to an identity management system provided by the present invention, the identity issuing agency is also used to monitor the behavior data of the preset objects, and when it is determined based on the behavior data that a first object among the preset objects has malicious behavior, send an identity revocation request to the network operator, and the identity revocation request includes the identity identifier of the first object.

[0023] The network operator is further configured to stop providing network services to the first object according to the identity identifier.

[0024] According to an identity management system provided by the present invention, the network operator is further used to delete the identity transaction data of the first object in the editable blockchain maintained by the network operator, and send a transaction deletion instruction to the identity issuing agency and the service provider, wherein the transaction deletion instruction includes the identity identifier of the first object.

[0025] The identity issuing agency is used to delete the identity transaction data of the first object in the editable blockchain maintained by the identity issuing agency according to the identity identifier of the first object.

[0026] The service provider is used to delete the identity transaction data of the first object in the editable blockchain maintained by the service provider according to the identity identifier of the first object.

[0027] According to an identity management system provided by the present invention, the service provider is further used to receive a service request sent by the user, wherein the service request includes the identity identifier of the user and the requested service content; and according to the identity identifier of the user, search for the identity transaction data of the user from the editable blockchain maintained by the service provider, and verify the identity of the user according to the identity transaction data of the user.

[0028] The service provider is further configured to provide the user with corresponding services according to the requested service content when the user's identity authentication is passed.

[0029] According to an identity management system provided by the present invention, the network operator is further used to receive a query request sent by the user, wherein the query request includes an identity identifier of the service provider; and based on the identity identifier of the service provider, search for identity transaction data of the service provider from the editable blockchain maintained by the network operator, and feed back a query response to the user.

[0030] The query response includes the identity transaction data of the service provider, and the query response is used by the user to send the service request to the service provider when the user determines that the identity authentication of the service provider is passed according to the identity transaction data of the service provider.

[0031] According to an identity management system provided by the present invention, the identity issuing agency is further used to receive a network access request sent by the preset object, the network access request includes the identity identifier and public key of the preset object, and based on the identity identifier of the preset object, when it is determined that the credibility of the preset object is greater than a preset threshold, endorse the network access request sent by the preset object, and send the endorsed network access request to the preset object.

[0032] The network operator is further used to receive an endorsed network access request sent by the preset object, wherein the endorsed network access request includes the identity identifier and the public key of the preset object, and perform a network access operation for the preset object according to the endorsed network access request to provide network services for the preset object.

[0033] The identity management system provided by the present invention includes a service provider, an identity issuing agency and a network operator, all of which maintain an editable blockchain storing identity information of a preset object; the network operator performs corresponding processing on the transaction data of the target object in the editable blockchain it maintains according to the identity identifier and transaction processing type of the target object included in the transaction processing instruction; and sends the transaction processing instruction to the identity issuing agency and the service provider; the identity issuing agency and the service provider perform corresponding processing on the transaction data of the target object in the editable blockchain they respectively maintain according to the transaction processing instruction, so that the processed transaction data in the editable blockchains they respectively maintain are consistent, and effective management of identity information is achieved under the premise of ensuring the security of identity information. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0035] Figure 1 A schematic diagram of the architecture of an identity management system provided by an embodiment of the present invention;

[0036] Figure 2 A schematic diagram of a network operator maintaining a hash index table provided by an embodiment of the present invention;

[0037] Figure 3 A schematic diagram of an identity issuing agency maintaining a hash index table provided in an embodiment of the present invention;

[0038] Figure 4 A schematic diagram of a service provider maintaining a hash index table provided in an embodiment of the present invention;

[0039] Figure 5 A schematic diagram of an identity management system provided in accordance with an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] In the embodiments of the present invention, "at least one" means one or more, and "more" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In the text description of the present invention, the character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0042] The technical solution provided by the embodiment of the present invention can be applied to the identity information management scenario. In the traditional identity information management scenario, the user's identity information is usually stored in a third-party trusted data center in a centralized form, and the identity information is managed by the third-party trusted data center. However, when the third-party trusted data center is attacked by a single point, the identity information stored in the third-party trusted data center will be leaked, which is not conducive to the management of the identity information. Therefore, how to manage the identity information while ensuring the security of the identity information is a problem that needs to be solved urgently by those skilled in the art.

[0043] In order to improve the security of identity information, blockchain is usually used as the storage medium for identity information. The nodes in the blockchain can maintain complete identity information by themselves and check it at any time to meet the needs of users to access network services, thus forming a new identity management system. Although the security of identity information can be effectively guaranteed by blockchain technology, due to the characteristics of blockchain itself such as being tamper-proof and leaving traces throughout the process, the blockchain cannot change or delete the identity information in the block. When a user or service provider has malicious behavior or needs to exit the network, it is difficult to change or delete their identity information from the existing blockchain. Therefore, how to effectively manage identity information, such as changing or deleting it, while ensuring the security of identity information is a problem that needs to be solved urgently by those skilled in the art.

[0044] In order to achieve effective management of identity information while ensuring the security of identity information, an embodiment of the present invention provides an identity management system. The identity management system provided by the present invention will be described in detail below through specific embodiments. It can be understood that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0045] Figure 1 For an example of the structure diagram of the identity management system provided in the embodiment of the present invention, please refer to Figure 1As shown, the identity management system may include a service provider that provides services to users, an identity issuing agency that provides identity authentication for preset objects, and a network operator that provides network services to preset objects. The service provider, the identity issuing agency, and the network operator all maintain an editable blockchain that stores transaction ledgers corresponding to the identity information of the preset objects. The preset objects include users and service providers.

[0046] Among them, the network operator is used to receive transaction processing instructions, which include the identity identification and transaction processing type of the target object to be processed; and according to the identity identification and transaction processing type of the target object, the identity transaction data of the target object in the editable blockchain maintained by the network operator is processed accordingly; and the transaction processing instructions are sent to the identity issuing agency and the service provider, and the target object belongs to the preset object.

[0047] The identity issuing agency is used to process the identity transaction data of the target object in the editable blockchain maintained by the identity issuing agency according to the identity identification and transaction processing type of the target object.

[0048] The service provider is used to process the identity transaction data of the target object in the editable blockchain maintained by the service provider according to the identity identification and transaction processing type of the target object.

[0049] For example, the transaction processing instruction may be a modification operation instruction or a deletion operation instruction, and may be specifically set according to actual needs.

[0050] It is understandable that, usually, the identity transaction data stored in the editable blockchain includes the identity transaction data of the user and the identity transaction data of the service provider. For example, the identity transaction data of the user usually includes the user's identity identifier and the corresponding public key, and the identity transaction data of the service provider usually includes the service provider's identity identifier and the corresponding public key. In this way, the identity information of the user and the service provider is stored in the editable blockchain in the form of identity transaction data, which can not only ensure the security of the identity information of the user and the service provider, but also effectively meet the change and deletion operations performed on the identity information. Among them, the identity transaction data in the editable blockchain maintained by the service provider, the identity issuing agency and the network operator are the same.

[0051] The editable blockchain maintained by the service provider, identity issuing agency and network operator usually needs to endorse the network access request sent by the user and service provider before storing the identity transaction data of the user and the identity transaction data of the service provider, and feedback the endorsed network access request to the user and service provider; correspondingly, the user and service provider send the endorsed network access request to the network operator, and the network operator combines the endorsed network access request into the form of identity transaction data, waiting to be packaged to generate blocks, and sends the generated blocks to the service provider and the identity issuing agency for consensus and chaining. After the service provider and the identity issuing agency reach consensus and chaining, the service provider, the identity issuing agency and the network operator will maintain the editable blockchain storing the identity transaction data of the user and the identity transaction data of the service provider. The specific process can be seen as follows:

[0052] For example, the user and the service provider can each generate their own identity and corresponding public-private key pair, and carry their own identity and corresponding public key in their own network access request, send it to the identity issuing agency, and wait for the network access request feedback sent by the identity issuing agency.

[0053] For example, the user may include an identity management module, a blockchain light node module, and a service request module. Among them, the identity management module is mainly used to generate the user's identity and the corresponding public key-private key pair, and carry the user's identity and the corresponding public key in the network access request and send it to the identity issuing agency.

[0054] For example, the format of the network access request sent by the user can be in, represents the network access request sent by the i-th user, U i represents the i-th user, represents the identity of the i-th user, Represents the public key of the i-th user.

[0055] The blockchain light node module is mainly used to initiate a service provider identity query request to and only to the network operator before obtaining service content from the service provider after obtaining legal network access permission, and receive the corresponding query results to verify the identity of the service provider. This part will be described later. It can be understood that the blockchain light node module deployed on the user side is characterized in that each individual light node does not need to store all transaction ledgers, but only needs to store block header information. The blockchain light node module does not participate in the consensus and chain of blocks, and only needs to have corresponding query and verification functions.

[0056] The service request module is mainly used to request relevant service content from the service provider and receive services provided by the service provider after the user obtains legal network access permission. This part will be described later.

[0057] For example, the service provider may include an identity management module, a service provider blockchain consensus unit node module, and a service module. Among them, the identity management module is mainly used to generate the identity of the service provider and the corresponding public key-private key pair, and carry its identity and the corresponding public key in the network access request, send it to the identity issuing agency, and wait for the network access request feedback sent by the identity issuing agency.

[0058] For example, the format of the network access request sent by the identity issuing agency can be in, represents the network access request sent by the i-th identity issuing agency, represents the identity of the i-th identity issuing agency, Represents the public key of the i-th identity issuing authority.

[0059] The service provider blockchain consensus unit node module is mainly used to receive transaction processing instructions sent by the network operator, and according to the identity identification and transaction processing type of the target object included in the transaction processing instruction, the identity transaction data of the target object in the editable blockchain maintained by the issuing institution is processed accordingly; and after obtaining a legal network access license, before providing service content to the user, the user identity is queried through the identity transaction data in the editable blockchain, and the query result is output to verify the user identity according to the query result; In addition, the service provider blockchain consensus unit node module is also used to participate in the consensus and chain of new blocks, which will be described later. It can be understood that the blockchain consensus unit node module deployed on the service provider side is characterized by a number of entity institutions with mutual trust between service providers, such as subsidiaries of the same management agency, commercial financial service institutions, multimedia alliances and other institutions that can conduct commercial cooperation, which can jointly form a consensus unit and jointly maintain at least one transaction ledger. Among them, each individual node only needs to maintain a part of the transaction ledger. The service provider node needs to have the function of participating in block consensus, executing blocks and transaction data queries.

[0060] The service module is mainly used to provide relevant service content to users after the user identity verification is passed. This part will be described later.

[0061] Correspondingly, after the identity issuing agency receives the network access request sent by the user and the service provider, if the network access request is a network access request sent by the user, the credibility of the user can be queried according to the identity identifier of the user included in the network access request, and if it is determined that the credibility of the user is greater than the preset threshold, the network access request sent by the user is endorsed, and the endorsed network access request is fed back to the user. If the network access request is a network access request sent by the service provider, the credibility of the service provider can be queried according to the identity identifier of the service provider included in the network access request, and if it is determined that the credibility of the service provider is greater than the preset threshold, the network access request sent by the service provider is endorsed, and the endorsed network access request is fed back to the service provider. The value of the preset threshold can be set according to actual needs, and the embodiment of the present invention does not specifically limit the specific value of the preset threshold.

[0062] By way of example, the identity issuing agency may include a network access request receiving module, an identity reputation management module, an identity issuing module, a feedback module, and an identity issuing agency blockchain consensus unit node.

[0063] Among them, the network access request receiving module is mainly used to receive network access requests sent by users and service providers.

[0064] The identity reputation management module is mainly used to record and monitor the reputation of all individual users or service providers in the real world. The reputation determines whether the identity issuing agency can issue an identity to the user or service provider.

[0065] The identity issuing module is mainly used for the network access request receiving module to retrieve the relevant records of the user in the identity reputation management module according to the user's identity included in the network access request after receiving the network access request, and determine the user's reputation according to the relevant records, and endorse the network access request sent by the user and attach the private key signature of the identity issuing agency when it is determined that the user's reputation is greater than a preset threshold. When the network access request is sent by a service provider, the relevant records of the service provider in the identity reputation management module are retrieved according to the service provider's identity included in the network access request, and determine the service provider's reputation according to the relevant records, and endorse the network access request sent by the service provider when it is determined that the service provider's reputation is greater than a preset threshold.

[0066] The feedback module is mainly used to send the endorsed network access request to the user when the network access request is sent by the user, and to send the endorsed network access request to the service provider when the network access request is sent by the service provider.

[0067] For example, when the network access request is sent by a user, the format of the endorsed network access request fed back by the identity issuing agency may be:

[0068]

[0069] in, Reply_Message indicates the endorsed access request from the identity issuing agency to the i-th user. SK II Sign the private key of Identity Issuer II.

[0070] For example, when the network access request is sent by a service provider, the format of the endorsed network access request fed back by the identity issuing agency may be:

[0071]

[0072] in, Reply_Message indicates the endorsed access request fed back by the identity issuing agency to the i-th service provider. Reply_Message indicates the specific information fed back by the identity issuing agency to the i-th service provider. II Sign the private key of Identity Issuer II.

[0073] The identity issuing agency blockchain consensus unit node module is mainly used to receive transaction processing instructions sent by network operators, and according to the identity identification and transaction processing type of the target object included in the transaction processing instructions, the identity transaction data of the target object in the editable blockchain maintained by the issuing agency is processed accordingly; and, when a user or service provider commits malicious acts in the real world, an identity revocation request is initiated to the network operator; in addition, the identity issuing agency blockchain consensus unit node module is also used to participate in the consensus and chain of new blocks, which will be described later. It can be understood that the blockchain consensus unit node module deployed by the identity issuing agency is characterized by several entity institutions with mutual trust between identity issuing agencies, such as university alliances, social security agencies, national financial institutions and other official institutions with certain authority, which can jointly form a consensus unit and jointly maintain at least one transaction ledger, in which each individual node only needs to maintain a part of the transaction ledger. The identity issuing agency node needs to have the functions of participating in block consensus, executing block and transaction data queries, and initiating transaction change requests.

[0074] Correspondingly, after receiving the endorsed network access request fed back by the identity issuing agency, the user sends the endorsed network access request to the network operator. The endorsed network access request includes the user's identity and public key.

[0075] Correspondingly, the network operator receives the endorsed network access requests sent by the user and the service provider respectively, and executes the network access operations of the user and the service provider according to the endorsed network access requests, so as to provide network services to the user and the service provider; correspondingly, the service provider can start to provide corresponding services to the user normally; and combine the endorsed network access requests sent by the user and the service provider into a transaction form, waiting to be packaged to generate blocks; and then send the generated blocks to the service provider and the identity issuing agency for consensus and chain-up. After the service provider and the identity issuing agency reach consensus and chain-up, the service provider, the identity issuing agency and the network operator will all maintain an editable blockchain that stores the identity information of the user and the service provider.

[0076] For example, a network operator may include a transaction generation module, a network operator blockchain consensus unit node module, and a network operation module. Among them, the transaction generation module is mainly used to receive network access requests endorsed by the identity issuing agency, and combine the network access requests into a transaction form, waiting to be packaged to generate a block.

[0077] The network operator blockchain consensus unit node module is mainly used to package the received network access request, generate a new block, and send the generated block to the service provider and the identity issuing agency for consensus and chaining; the network operator blockchain consensus unit node module is also used to receive transaction processing instructions, and according to the identity identification and transaction processing type of the target object to be processed included in the transaction processing instruction, the identity transaction data of the target object in the editable blockchain maintained by the network operator is processed accordingly; in addition, the network operator blockchain consensus unit node module is also used to send an identity revocation instruction to the service provider and the identity issuing agency when a user or service provider commits malicious behavior in the real world, which will be described later. It can be understood that the blockchain consensus unit node module deployed by the network operator is characterized by a number of entities with mutual trust within the network operator, such as data centers belonging to different network operators, which can jointly form a consensus unit and jointly maintain at least one transaction ledger, in which each individual node only needs to maintain a part of the transaction ledger. The network operator node needs to have the functions of packaging transactions and generating blocks, participating in block consensus, executing block and transaction data queries, initiating transaction change requests, and executing transaction changes.

[0078] For example, in the case where the network access request is a network access request sent by a user, the user's identity identifier, public key and the timestamp when the network access request is received in the network access request are combined into a transaction form and temporarily stored in the local database. The transaction can be Among them, TxU iIt represents the transaction data after the network access request of the i-th user is combined, and timestamp represents the timestamp.

[0079] For example, in the case where the network access request is sent by a service provider, the service provider's identity identifier, public key and timestamp of receiving the network access request in the network access request are combined into a transaction form and temporarily stored in a local database. The transaction can be Among them, TxSP i Represents the transaction data of the network access request combination of the i-th service provider.

[0080] For example, when the combined transaction data meets the preset conditions, such as the number of transaction data is greater than the number threshold, or the time interval is greater than the time threshold, the currently combined transaction data is packaged and a new block is generated. The specific content of the new block is

[0081] Among them, Block represents the new block generated by packaging, BlockHash represents the hash value of the current block, PreviousHash represents the hash value of the previous block, {Txs} represents the combined transaction data, and SK NO It is the private key of the network operator.

[0082] After packaging and generating a new block, the consensus of the new block can be carried out. When reaching consensus on a new block, considering the low mobility characteristics of the communication environment of the consensus unit node, the Byzantine consensus algorithm (Practical Byzantine Fault Tolerance, PBFT) consensus mechanism can be used to complete the consensus of the new block.

[0083] The network operation module is mainly used to provide relevant mobile networks for users, identity issuers and service providers.

[0084] Through the above operations, the service provider, the identity issuing agency and the network operator will all maintain an editable blockchain that stores the user's identity transaction data and the service provider's identity transaction data. In this way, by storing the user's identity transaction data and the service provider's identity transaction data in the editable blockchain, when the user's identity information and / or the service provider's identity information is subsequently changed or deleted, the network operator blockchain consensus unit node module in the network operator can receive the transaction processing instruction, and according to the identity identifier and transaction processing type of the target object to be processed included in the transaction processing instruction, perform corresponding processing on the identity transaction data of the target object in the editable blockchain maintained by the network operator; and send the transaction processing instruction to the identity issuing agency and the service provider, so that the identity issuing agency and the service provider perform corresponding processing on the identity transaction data of the target object in the editable blockchain maintained by each of them according to the transaction processing instruction.

[0085] Correspondingly, after the identity issuing agency receives the transaction processing instruction sent by the network operator, the identity issuing agency blockchain consensus unit node module in the identity issuing agency performs corresponding processing on the identity transaction data of the target object in the editable blockchain maintained by the identity issuing agency according to the identity identification and transaction processing type of the target object.

[0086] Correspondingly, after receiving the transaction processing instruction sent by the network operator, the service provider blockchain consensus unit node module in the service provider processes the identity transaction data of the target object in the editable blockchain maintained by the service provider according to the identity identification and transaction processing type of the target object. In this way, storing the identity transaction data in the editable blockchain can effectively ensure the security of identity information; and when receiving the transaction processing instruction, the service provider, the identity issuing agency and the network operator will process the identity transaction data of the target object in the editable blockchain maintained by each according to the transaction processing instruction, so that the processed identity transaction data in the editable blockchain maintained by each maintains consistency, and realize the effective management of identity information under the premise of ensuring the security of identity information.

[0087] It can be seen that the identity management system provided by the embodiment of the present invention includes a service provider, an identity issuing agency and a network operator. The service provider, the identity issuing agency and the network operator all maintain an editable blockchain that stores a transaction ledger corresponding to the identity information of a preset object, and the preset object includes a user and a service provider; the network operator receives a transaction processing instruction, and according to the identity identifier and the transaction processing type of the target object included in the transaction processing instruction, performs corresponding processing on the identity transaction data of the target object in the editable blockchain maintained by the network operator; and sends the transaction processing instruction to the identity issuing agency and the service provider; the identity issuing agency performs corresponding processing on the identity transaction data of the target object in the editable blockchain maintained by the identity issuing agency according to the identity identifier and the transaction processing type of the target object; the service provider performs corresponding processing on the identity transaction data of the target object in the editable blockchain maintained by the service provider according to the identity identifier and the transaction processing type of the target object, so that the processed identity transaction data in the editable blockchain maintained by each is consistent, and effective management of identity information is achieved under the premise of ensuring the security of identity information.

[0088] For example, considering the characteristics of traditional blockchain itself, the complete ledger storing the identity data of all users and service providers needs to be stored on each blockchain node, which will cause a large storage pressure on a single node. Therefore, in an embodiment of the present invention, multiple entities with a trust relationship corresponding to the network operator serve as nodes to constitute the consensus unit of the network operator; multiple entities with a trust relationship corresponding to the identity issuing agency serve as nodes to constitute the consensus unit of the identity issuing agency; and multiple entities with a trust relationship corresponding to the service provider serve as nodes to constitute the consensus unit of the service provider.

[0089] Among them, each node in the consensus unit stores several different blocks in the editable blockchain, and the union of the blocks stored by all nodes in the consensus unit is the editable blockchain, which can effectively reduce the storage pressure of a single node.

[0090] Based on the above Figure 1 In the embodiment shown, for network operators, identity issuing institutions, and service providers, when processing the identity transaction data of the target object in the editable blockchain maintained by them respectively according to the identity identifier and transaction processing type of the target object, they all need to first find and confirm the block used to store the identity transaction data of the target object from the editable blockchain maintained by them respectively according to the identity identifier of the target object. For example, in the embodiment of the present invention, the block used to store the identity transaction data of the target object can be recorded as the target block, and after determining the target block, the identity transaction data of the target object in the target block is processed accordingly according to the transaction processing type.

[0091] For example, for network operators, identity issuing agencies and service providers, when searching for a block for storing the identity transaction data of a target object from an editable blockchain maintained by each of them according to the identity identifier of the target object, it is considered that the identity transaction data in the editable block itself needs to face a large number of repeated query operations. If the query operation is performed directly based on the identity transaction data, it will bring huge computing overhead. Therefore, in order to reduce the computing overhead caused by the query operation, in an embodiment of the present invention, a hash value index table is set, and the hash value index table is an index table for describing the mapping relationship between the hash value corresponding to the identity identifier of a preset object and the hash value corresponding to the block storing the identity transaction data of the preset object in the editable blockchain. When performing a query operation, the target block for storing the identity transaction data of the target object can be found through the hash value corresponding to the identity identifier of the target object and the hash value index table maintained by each of them, thereby effectively reducing the computing overhead caused by the query operation.

[0092] For example, the network operator is also used to determine the target block from the editable blockchain based on the hash value corresponding to the identity identifier of the target object and the hash value index table maintained by the network operator, where the target block is the block storing the identity transaction data of the target object; and perform corresponding processing on the identity transaction data of the target object in the target block.

[0093] The identity issuing agency is further used to determine the target block from the editable blockchain according to the hash value corresponding to the identity identifier of the target object and the hash value index table maintained by the identity issuing agency, where the target block is the block storing the identity transaction data of the target object; and perform corresponding processing on the identity transaction data of the target object in the target block.

[0094] The service provider is further used to determine the target block from the editable blockchain according to the hash value corresponding to the identity identifier of the target object and the hash value index table maintained by the network operator, where the target block is the block storing the identity transaction data of the target object; and perform corresponding processing on the identity transaction data of the target object in the target block.

[0095] For example, in order to further ensure the security of identity information, the network operator, the identity issuing agency, and the service provider each maintain a different hash value index table.

[0096] It can be seen that in the embodiment of the present invention, by setting a hash value index table, when receiving a transaction processing instruction, the network operator, the identity issuing agency and the service provider can determine the target block for storing the identity transaction data of the target object from the editable blockchain according to the hash value corresponding to the identity identifier of the target object included in the transaction processing instruction and the hash value index table maintained by each of them, and perform corresponding processing on the identity transaction data of the target object in the target block, which can not only accurately find the target block, but also effectively reduce the computing overhead caused by the query operation.

[0097] For network operators, identity issuers and service providers, they need to first generate a target block for storing the target object's identity transaction data, and based on the hash value corresponding to the target object's identity identifier and the hash value corresponding to the target block, update their respective hash value index tables so that their respective hash value index tables include the mapping relationship between the hash value corresponding to the target object's identity identifier and the hash value corresponding to the target block. In this way, in subsequent query operations, they can determine the target block for storing the target object's identity transaction data from the editable blockchain based on the hash value corresponding to the target object's identity identifier and the hash value index tables they maintain.

[0098] For example, the network operator is also used to generate a target block for storing identity transaction data corresponding to the identity information based on the identity information of the target object and the time when the identity information was received, and trigger the identity issuing agency and the service provider to reach consensus and upload the target block to the chain; and based on the hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block, update the hash value index table maintained by the network operator.

[0099] The identity issuing agency is used to reach consensus and upload the target block to the chain, and update the hash value index table maintained by the identity issuing agency based on the hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block.

[0100] The service provider is used to reach consensus and upload the target block to the chain, and based on the hash value corresponding to the identity of the target object and the hash value corresponding to the target block, update the hash value index table maintained by the service provider.

[0101] It can be understood that, for network operators, identity issuing agencies and service providers, although the editable blockchains they maintain are the same, in order to further improve the security of identity information, for example, in an embodiment of the present invention, the hash value index tables maintained by network operators, identity issuing agencies and service providers are different. The network operator determines the hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block based on the first hash algorithm, thereby constructing the hash value index table maintained by the network operator based on the calculated hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block; the identity issuing agency determines the hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block based on the calculated hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block, thereby constructing the hash value index table maintained by the identity issuing agency; the service provider determines the hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block based on the third hash algorithm, thereby constructing the hash value index table maintained by the service provider based on the calculated hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block; wherein the first hash algorithm, the second hash algorithm and the third hash algorithm are different. For example, when there are multiple consensus units within a service provider, the hash algorithms used by each consensus unit should be as different as possible.

[0102] For example, see Figure 2 As shown, Figure 2 A schematic diagram of a network operator maintaining a hash index table provided in an embodiment of the present invention, the network operator generates a block storing identity transaction data based on the identity information of the object and the time of receiving the identity information, and triggers the identity issuing agency and the service provider to reach a consensus and upload the target block to the chain. After the consensus and upload of each new block are completed, the consensus unit node in the blockchain consensus unit node module will decode the identity of the user or service provider contained in the transaction data in the new block, and calculate the hash value corresponding to the identity and the hash value corresponding to the new block based on the first hash algorithm, and build a hash value index table based on the calculated hash value corresponding to the identity of the target object and the hash value corresponding to the target block, and maintain the hash value index table. It can be understood that when the hash value corresponding to the identity and the hash value corresponding to the new block are calculated based on the first hash algorithm, the same hash operation is used in the same consensus unit.

[0103] For example, see Figure 3 As shown, Figure 3A schematic diagram of an identity issuing agency maintaining a hash index table provided in an embodiment of the present invention, after receiving a new block sent by a network operator, the identity issuing agency participates in the consensus and chaining of the new block, and after each new block consensus and chaining is completed, the consensus unit node in its blockchain consensus unit node module will decode the identity of the user or service provider contained in the transaction data in the new block, and calculate the hash value corresponding to the identity and the hash value corresponding to the new block based on the second hash algorithm, and based on the calculated hash value corresponding to the identity of the target object and the hash value corresponding to the target block, construct a hash value index table, and maintain the hash value index table. It can be understood that when calculating the hash value corresponding to the identity and the hash value corresponding to the new block based on the second hash algorithm, the same hash operation is used in the same consensus unit.

[0104] For example, see Figure 4 As shown, Figure 4 A schematic diagram of a service provider maintaining a hash index table provided in an embodiment of the present invention, after receiving a new block sent by a network operator, the service provider participates in the consensus and chaining of the new block, and after each new block consensus and chaining is completed, the consensus unit node in its blockchain consensus unit node module will decode the identity of the user or service provider contained in the transaction data in the new block, and calculate the hash value corresponding to the identity and the hash value corresponding to the new block based on a third hash algorithm, and based on the calculated hash value corresponding to the identity of the target object and the hash value corresponding to the target block, construct a hash value index table, and maintain the hash value index table. It can be understood that when calculating the hash value corresponding to the identity and the hash value corresponding to the new block based on the third hash algorithm, the same hash operation is used in the same consensus unit.

[0105] Based on the above Figure 1 In the embodiment shown, the identity issuing agency can also monitor the behavior data of the preset object, and determine whether the preset object has malicious behavior based on the monitored behavior data. For example, assuming that the first object among the preset objects is determined to have malicious behavior based on the behavior data, an identity revocation request is sent to the network operator, and the identity revocation request can include the identity identifier of the first object. Correspondingly, the network operator is also used to stop providing network services to the first object based on the identity identifier, so as to avoid providing network services to objects with malicious behavior, thereby effectively saving network service resources.

[0106] For example, the first object with malicious behavior may be a user or a service provider, and may be specifically set according to actual needs. Here, the embodiment of the present invention does not make any specific limitation.

[0107] For example, after the network operator stops providing network services to the first object based on the identity identifier, the network operator can also delete the identity transaction data of the first object in the editable blockchain maintained by it based on the identity identifier of the first object, and send a transaction deletion instruction to the identity issuing agency and the service provider, wherein the transaction deletion instruction includes the identity identifier of the first object.

[0108] Correspondingly, the identity issuing agency is used to delete the identity transaction data of the first object in the editable blockchain maintained by the identity issuing agency according to the identity identifier of the first object.

[0109] Correspondingly, the service provider is used to delete the identity transaction data of the first object in the editable blockchain maintained by the service provider according to the identity identifier of the first object, so as to release the storage resources occupied by the identity transaction data of the first object, thereby improving the utilization rate of the storage resources.

[0110] Based on the above Figure 1 In the illustrated embodiment, after receiving the endorsed network access request sent by the user and the service provider, the network operator will provide the user and the service provider with a corresponding mobile network, so that the user can request service content from the service provider through the mobile network provided by the network operator; correspondingly, the service provider can also provide the user with corresponding services through the mobile network provided by the network operator, and the process may include:

[0111] For example, before a user requests service content from a service provider, the user usually needs to verify the identity of the service provider. When verifying the identity of the service provider, a query request can be sent to the network operator, and the query request includes the identity of the service provider; correspondingly, the network operator receives the query request sent by the user, and searches for the identity transaction data of the service provider from the editable blockchain maintained by the network operator based on the identity of the service provider, and feeds back the query response to the user. The query response includes the identity transaction data of the service provider; after the user obtains the identity transaction data of the service provider, the user verifies the identity of the service provider based on the identity transaction data, and sends a service request to the service provider if the identity authentication is passed; the service request includes the user's identity and the requested service content.

[0112] Correspondingly, the service provider receives the service request sent by the user and usually needs to verify the user's identity before providing the corresponding service content to the user. When verifying the user's identity, the user's identity transaction data can be found from the editable blockchain maintained by the service provider based on the user's identity identifier, and the user's identity can be verified based on the user's identity transaction data. If the identity verification is passed, the corresponding service is provided to the user according to the requested service content.

[0113] It can be seen that when a user requests service content from a service provider, he first requests the service provider's identity transaction data through the network operator, and determines based on the service provider's identity transaction data that the service provider's identity authentication is passed, and then sends a service request to the service provider; correspondingly, the service provider searches for the user's identity transaction data from the editable blockchain maintained by the service provider based on the user's identity identification, and determines based on the user's identity transaction data that the user's identity authentication is passed, and then provides the user with corresponding services according to the requested service content. In this way, through two-way verification, it can effectively prevent users from requesting services from illegal service providers, and effectively prevent service providers from providing service content to illegal users, thereby improving the reliability of service content.

[0114] To facilitate understanding of the identity management system provided by the embodiment of the present invention, for example, see Figure 5 As shown, Figure 5 A schematic diagram of an identity management system provided by an embodiment of the invention, Figure 5 The method includes the generation and consensus of new blocks in the editable blockchain, the identity transaction data in the block is integrated into a hash index table, the query of the hash index table and the related processing of transaction changes. The generation and consensus of new blocks, the identity transaction data in the block is integrated into a hash index table, the query of the hash index table and the related processing of transaction changes can be referred to the above description, which will not be repeated here. By storing identity transaction data in the editable blockchain, the processed transaction data in the editable blockchain maintained by the service provider, the identity issuing agency and the network operator can be kept consistent, and the effective management of identity information is achieved under the premise of ensuring the security of identity information; in addition, by setting a hash value index table, the hash value index table is an index table for describing the mapping relationship between the hash value corresponding to the identity identifier of the preset object and the hash value corresponding to the block storing the identity transaction data of the preset object in the editable blockchain, so that when performing a query operation, the target block for storing the identity transaction data of the target object can be found through the hash value corresponding to the identity identifier of the target object and the hash value index table maintained by each, thereby effectively reducing the computational overhead caused by the query operation.

[0115] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0116] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An identity management system, characterized in that: The identity management system includes a service provider that provides services to users, an identity issuing agency that provides identity authentication for preset objects, and a network operator that provides network services to the preset objects. The service provider, the identity issuing agency, and the network operator all maintain an editable blockchain that stores transaction ledgers corresponding to identity information of preset objects, and the preset objects include the users and the service provider; The network operator is configured to receive a transaction processing instruction, wherein the transaction processing instruction includes an identity identifier and a transaction processing type of a target object to be processed; and according to the identity identifier and the transaction processing type of the target object, perform corresponding processing on the identity transaction data of the target object in the editable blockchain maintained by the network operator; and send the transaction processing instruction to the identity issuing institution and the service provider; the target object belongs to the preset object; The identity issuing agency is used to process the identity transaction data of the target object in the editable blockchain maintained by the identity issuing agency accordingly according to the identity identifier of the target object and the transaction processing type; The service provider is used to perform corresponding processing on the identity transaction data of the target object in the editable blockchain maintained by the service provider according to the identity identifier of the target object and the transaction processing type.

2. The identity management system according to claim 1, characterized in that: The identity issuing agency, the service provider, and the network operator all maintain a hash value index table between the hash value corresponding to the identity identifier of the preset object and the hash value corresponding to the block storing the identity transaction data of the preset object in the editable blockchain; The network operator is further configured to determine a target block from the editable blockchain according to a hash value corresponding to the identity identifier of the target object and a hash value index table maintained by the network operator, and to perform corresponding processing on the identity transaction data of the target object in the target block; The identity issuing agency is further used to determine the target block from the editable blockchain according to the hash value corresponding to the identity identifier of the target object and the hash value index table maintained by the identity issuing agency, and perform corresponding processing on the identity transaction data of the target object in the target block; The service provider is further used to determine the target block from the editable blockchain according to the hash value corresponding to the identity identifier of the target object and the hash value index table maintained by the network operator, and to perform corresponding processing on the identity transaction data of the target object in the target block.

3. The identity management system according to claim 2, characterized in that: The network operator is further configured to generate the target block storing the identity transaction data corresponding to the identity information based on the identity information of the target object and the time when the identity information is received, and trigger the identity issuing agency and the service provider to reach a consensus and upload the target block to the chain; and update the hash value index table maintained by the network operator based on the hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block; The identity issuing agency is used to reach a consensus on the target block and upload it to the chain, and update the hash value index table maintained by the identity issuing agency based on the hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block; The service provider is used to reach consensus and upload the target block to the chain, and update the hash value index table maintained by the service provider based on the hash value corresponding to the identity identifier of the target object and the hash value corresponding to the target block.

4. The identity management system according to claim 3, characterized in that: The network operator determines, based on a first hash algorithm, a hash value corresponding to the identity identifier of the target object and a hash value corresponding to the target block; The identity issuing agency determines, based on a second hash algorithm, a hash value corresponding to the identity identifier of the target object and a hash value corresponding to the target block; The service provider determines, based on a third hash algorithm, a hash value corresponding to the identity identifier of the target object and a hash value corresponding to the target block; The first Hash algorithm, the second Hash algorithm and the third Hash algorithm are different.

5. The identity management system according to any one of claims 1 to 4, characterized in that: The multiple entities with trust relationships corresponding to the network operator serve as nodes, constituting the consensus unit of the network operator; the multiple entities with trust relationships corresponding to the identity issuing agency serve as nodes, constituting the consensus unit of the identity issuing agency; the multiple entities with trust relationships corresponding to the service provider serve as nodes, constituting the consensus unit of the service provider; Each node in the consensus unit stores several different blocks in the editable blockchain, and the union of the blocks stored by all nodes in the consensus unit is the editable blockchain.

6. The identity management system according to any one of claims 1 to 4, characterized in that: The identity issuing agency is further used to monitor the behavior data of the preset objects, and when it is determined based on the behavior data that a first object among the preset objects has malicious behavior, send an identity revocation request to the network operator, wherein the identity revocation request includes an identity identifier of the first object; The network operator is further configured to stop providing network services to the first object according to the identity identifier.

7. The identity management system according to claim 6, characterized in that: The network operator is further configured to delete the identity transaction data of the first object in the editable blockchain maintained by the network operator, and send a transaction deletion instruction to the identity issuing agency and the service provider, wherein the transaction deletion instruction includes the identity identifier of the first object; The identity issuing agency is configured to delete the identity transaction data of the first object in the editable blockchain maintained by the identity issuing agency according to the identity identifier of the first object; The service provider is used to delete the identity transaction data of the first object in the editable blockchain maintained by the service provider according to the identity identifier of the first object.

8. The identity management system according to any one of claims 1 to 4, characterized in that: The service provider is further configured to receive a service request sent by the user, wherein the service request includes the identity identifier of the user and the requested service content; and according to the identity identifier of the user, search for the identity transaction data of the user from the editable blockchain maintained by the service provider, and verify the identity of the user according to the identity transaction data of the user; The service provider is further configured to provide the user with corresponding services according to the requested service content when the user's identity authentication is passed.

9. The identity management system according to claim 8, characterized in that: The network operator is further configured to receive a query request sent by the user, wherein the query request includes the identity identifier of the service provider; and according to the identity identifier of the service provider, search for the identity transaction data of the service provider from the editable blockchain maintained by the network operator, and feed back a query response to the user; The query response includes the identity transaction data of the service provider, and the query response is used by the user to send the service request to the service provider when the user determines that the identity authentication of the service provider is passed according to the identity transaction data of the service provider.

10. The identity management system according to any one of claims 1 to 4, characterized in that: The identity issuing agency is further used to receive a network access request sent by the preset object, the network access request including the identity identifier and public key of the preset object, and endorse the network access request sent by the preset object based on the identity identifier of the preset object and when it is determined that the reputation of the preset object is greater than a preset threshold, and send the endorsed network access request to the preset object; The network operator is further used to receive an endorsed network access request sent by the preset object, wherein the endorsed network access request includes the identity identifier and the public key of the preset object, and perform a network access operation for the preset object according to the endorsed network access request to provide network services for the preset object.

Images