Authorization method, device, equipment and system based on verifiable declaration

Abstract

The embodiments of the present specification provide an authorization method, apparatus, device and system based on a verifiable declaration, the method comprising: a server obtains business type information of a verifiable declaration to be issued by a first user to a second user, and obtains a corresponding declaration authorization template based on the business type information; sends the declaration authorization template to the client of the first user, and receives authorization-related information provided by the first user based on the declaration authorization template and returned by the client of the first user; confirms whether to issue a verifiable declaration to the second user based on the authorization-related information, and if so, generates a verifiable declaration based on the authorization-related information and sends it to the client of the second user.

Description

[0001] This application is a divisional application of the invention patent application with the application date of October 11, 2019, application number 201910964126.3, and invention name “Authorization method, device, equipment and system based on verifiable declaration”. Technical Field

[0002] This document relates to the field of data processing technology, and in particular to an authorization method, device, equipment and system based on verifiable declaration. Background Art

[0003] In life and work, people often entrust other users (hereinafter referred to as agent users) to handle the business they need to handle on their behalf. The current business entrustment process usually involves users and agent users negotiating offline on the details of the agency handling business, drafting a paper entrustment agreement and signing an agreement, so that the agreement can be used as proof that the agent has the authority to handle a certain business of the user. Therefore, when the agent handles the business on behalf of the user, the agent needs to carry the signed paper agreement with him. This offline method of granting the agent the authority to handle business is not only inefficient, but it is also inevitable that the agent will forget to bring the signed paper agreement, which will affect the handling of the business. Summary of the invention

[0004] One or more embodiments of the present specification provide an authorization method based on a verifiable statement, which is applied to a server. The authorization method includes obtaining business type information of a verifiable statement to be issued by a first user to a second user, and obtaining a corresponding statement authorization template based on the business type information. The statement authorization template is sent to the client of the first user, and the authorization related information provided by the first user based on the statement authorization template and returned by the client of the first user is received. Whether to issue a verifiable statement to the second user is confirmed based on the authorization related information. If so, a verifiable statement is generated based on the authorization related information and sent to the client of the second user.

[0005] One or more embodiments of the present specification provide an authorization method based on a verifiable statement, which is applied to the client of a first user. The authorization method includes sending a request for issuing a verifiable statement to a server in response to an issuance operation of a verifiable statement of the first user. The issuance request is used to request the issuance of a verifiable statement granting business processing authority to a second user, so that the second user can process the designated business of the first user. The issuance request includes business type information of the designated business, so that the server can obtain the corresponding declaration authorization template according to the business type information. The declaration authorization template returned by the server is displayed, and the authorization-related information provided by the first user based on the declaration authorization template is obtained. The authorization-related information is sent to the server, so that the server generates a verifiable statement based on the authorization-related information and sends it to the client of the second user.

[0006] One or more embodiments of the present specification provide an authorization device based on a verifiable declaration, which is applied to a server. The authorization device includes an acquisition module, which acquires the business type information of the verifiable declaration to be issued by the first user to the second user, and acquires the corresponding declaration authorization template based on the business type information. The authorization device also includes a sending module, which sends the declaration authorization template to the client of the first user. The authorization device also includes a receiving module, which receives the authorization-related information provided by the first user based on the declaration authorization template and returned by the client of the first user. The authorization device also includes a determination module, which confirms whether to issue a verifiable declaration to the second user based on the authorization-related information. The authorization device also includes a generation module, and if the determination result of the determination module is yes, a verifiable declaration is generated based on the authorization-related information and sent to the client of the second user.

[0007] One or more embodiments of the present specification provide an authorization device based on a verifiable declaration, which is applied to a client of a first user. The authorization device includes a first sending module, which sends a request for issuing a verifiable declaration to a server in response to an issuance operation of a verifiable declaration by the first user. The issuance request is used to request a verifiable declaration to be issued to a second user to grant business processing authority, so that the second user can process the designated business of the first user. The issuance request includes business type information of the designated business, so that the server can obtain the corresponding declaration authorization template according to the business type information. The authorization device also includes a display acquisition module, which displays the declaration authorization template returned by the server and obtains the authorization-related information provided by the first user based on the declaration authorization template. The authorization device also includes a second sending module, which sends the authorization-related information to the server, so that the server can generate a verifiable declaration based on the authorization-related information and send it to the client of the second user.

[0008] One or more embodiments of the present specification provide an authorization system based on a verifiable statement, the system comprising a client of a first user, a server, and a client of a second user. The client of the first user, in response to the verifiable statement issuance operation of the first user, sends a request for issuing a verifiable statement to the server; wherein the issuance request is used to request the issuance of a verifiable statement granting business processing authority to the second user, so that the second user can process the designated business of the first user; the issuance request includes the business type information of the designated business; and, displays the declaration authorization template returned by the server, obtains the authorization related information provided by the first user based on the declaration authorization template, and sends the authorization related information to the server. The server obtains the business type information from the issuance request, obtains the corresponding declaration authorization template according to the business type information, and sends the declaration authorization template to the client of the first user; and, receives the authorization related information sent by the client of the first user, generates a verifiable statement according to the authorization related information, and sends the verifiable statement to the client of the second user. The client of the second user receives the verifiable statement sent by the server.

[0009] One or more embodiments of the present specification provide an authorization device based on a verifiable statement, including a processor. The authorization device also includes a memory arranged to store computer-executable instructions. When the computer-executable instructions are executed, the processor obtains the business type information of the verifiable statement to be issued by the first user to the second user, and obtains the corresponding statement authorization template based on the business type information. The statement authorization template is sent to the client of the first user, and the authorization related information provided by the first user based on the statement authorization template and returned by the client of the first user is received. Confirm whether to issue a verifiable statement to the second user based on the authorization related information, and if so, generate a verifiable statement based on the authorization related information and send it to the client of the second user.

[0010] One or more embodiments of the present specification provide an authorization device based on a verifiable statement, including a processor. The authorization device also includes a memory arranged to store computer executable instructions. When the computer executable instructions are executed, the processor sends a request for issuing a verifiable statement to a server in response to the issuance operation of the verifiable statement of the first user. The issuance request is used to request the issuance of a verifiable statement granting business processing authority to a second user, so that the second user can process the designated business of the first user. The issuance request includes the business type information of the designated business, so that the server obtains the corresponding declaration authorization template according to the business type information. The declaration authorization template returned by the server is displayed, and the authorization related information provided by the first user based on the declaration authorization template is obtained. The authorization related information is sent to the server, so that the server generates a verifiable statement based on the authorization related information and sends it to the client of the second user.

[0011] One or more embodiments of the present specification provide a storage medium for storing computer-executable instructions. When the computer-executable instructions are executed, the business type information of the verifiable statement to be issued by the first user to the second user is obtained, and the corresponding statement authorization template is obtained according to the business type information. The statement authorization template is sent to the client of the first user, and the authorization-related information provided by the first user based on the statement authorization template and returned by the client of the first user is received. According to the authorization-related information, it is confirmed whether to issue a verifiable statement to the second user. If so, a verifiable statement is generated according to the authorization-related information and sent to the client of the second user.

[0012] One or more embodiments of the present specification provide a storage medium for storing computer-executable instructions. When the computer-executable instructions are executed, in response to the issuance operation of a verifiable statement of a first user, a request for issuance of a verifiable statement is sent to a server. The issuance request is used to request the issuance of a verifiable statement granting business processing authority to a second user, so that the second user can process the designated business of the first user. The issuance request includes business type information of the designated business, so that the server obtains the corresponding declaration authorization template according to the business type information. The declaration authorization template returned by the server is displayed, and the authorization-related information provided by the first user based on the declaration authorization template is obtained. The authorization-related information is sent to the server, so that the server generates a verifiable statement based on the authorization-related information and sends it to the client of the second user. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate one or more embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0014] Figure 1 A first scenario diagram of an authorization method based on a verifiable statement provided for one or more embodiments of this specification;

[0015] Figure 2 A second scenario diagram of an authorization method based on a verifiable statement provided for one or more embodiments of this specification;

[0016] Figure 3 A first flow chart of an authorization method based on a verifiable statement provided for one or more embodiments of this specification;

[0017] Figure 4 A schematic diagram of a process for generating a verifiable statement for one or more embodiments of this specification;

[0018] Figure 5 A second flow chart of an authorization method based on a verifiable statement provided for one or more embodiments of this specification;

[0019] Figure 6 A schematic diagram of a process for generating issuance record information provided in one or more embodiments of this specification;

[0020] Figure 7 A third flow chart of an authorization method based on a verifiable statement provided for one or more embodiments of this specification;

[0021] Figure 8 A schematic diagram of a process for obtaining authorization-related information provided in one or more embodiments of this specification;

[0022] Fig. 9 A fourth flow chart of an authorization method based on a verifiable statement provided for one or more embodiments of this specification;

[0023] Fig.10 A schematic diagram of an inquiry interface provided for one or more embodiments of the present specification;

[0024] Fig.11 A schematic diagram of an identity authentication interface provided for one or more embodiments of this specification;

[0025] Fig.12A fifth flow chart of an authorization method based on a verifiable statement provided for one or more embodiments of this specification;

[0026] Fig.13 A schematic diagram of a first process for verifying a verifiable claim provided for one or more embodiments of this specification;

[0027] Fig.14 A second flow diagram of verifying a verifiable claim provided for one or more embodiments of this specification;

[0028] Fig.15 A schematic diagram of a first module composition of an authorization device based on a verifiable statement provided for one or more embodiments of this specification;

[0029] Fig.16 A schematic diagram of a second module composition of an authorization device based on a verifiable statement provided in one or more embodiments of this specification;

[0030] Fig.17 A schematic diagram of the composition of an authorization system based on verifiable claims provided for one or more embodiments of this specification;

[0031] Fig.18 A schematic diagram of the structure of an authorization device based on a verifiable statement is provided for one or more embodiments of this specification. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the following will be combined with the drawings in one or more embodiments of this specification to clearly and completely describe the technical solutions in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this document.

[0033] Figure 1 A schematic diagram of an application scenario of an authorization method based on a verifiable statement provided in one or more embodiments of this specification, such as Figure 1 As shown, the scenario includes: a client of the first user, a client of the second user and a server; wherein the client of the first user and the client of the second user can be a mobile phone, a tablet computer, a desktop computer, a portable notebook computer, etc.; the server can be an independent server or a server cluster composed of multiple servers; the client of the first user and the client of the second user are respectively communicated with the server through a wireless network.

[0034] Specifically, the first user operates his client to specify the business type of the verifiable statement to be issued, and the client sends a request for issuing the verifiable statement to the server in response to the issuance operation of the verifiable statement of the first user; wherein the issuance request is used to request the issuance of a verifiable statement granting business processing authority to the second user, so that the second user can process the specified business of the first user; further, the issuance request includes business type information of the specified business; the server obtains the business type information from the issuance request, obtains the corresponding statement authorization template based on the business type information, and sends the statement authorization template to the client of the first user; the client of the first user displays the statement authorization template returned by the server, and obtains the authorization-related information provided by the first user based on the statement authorization template, and sends the authorization-related information to the server; the server receives the authorization-related information sent by the client of the first user, and confirms whether to issue a verifiable statement to the second user based on the authorization-related information. If so, a verifiable statement is generated based on the authorization-related information and sent to the client of the second user; the client of the second user receives the verifiable statement sent by the server. Thus, the first user can interact with the server online by operating his client, and the server can generate a verifiable statement based on the authorization-related information sent by the first user's client, so that the second user can act on behalf of the first user to handle the first user's designated business based on the verifiable statement, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of agency authorization; at the same time, since the verifiable statement can be stored in the second user's client in electronic form, the second user does not need to carry the signed paper authorization agreement when acting on behalf of the first user to handle business, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0035] Further, such as Figure 2 As shown, the scenario may also include at least one blockchain node in the blockchain ( Figure 2 Only one is shown in the figure), after generating a verifiable statement, the server generates issuance record information according to the verifiable statement, and sends the issuance record information to the blockchain node, so that the blockchain node saves the issuance record information in the blockchain; thus, when the second user processes the designated business of the first user based on the verifiable statement, the verifiable statement provided by the second user can be verified based on the issuance record information stored in the blockchain, thereby ensuring business security.

[0036] Based on the above application scenario architecture, one or more embodiments of this specification provide an authorization method based on verifiable declaration. Figure 3 A flowchart of an authorization method based on a verifiable statement is provided for one or more embodiments of this specification. Figure 3 The method in can be Figure 1 The server execution in Figure 3 As shown, the method comprises the following steps:

[0037] Step S102, obtaining the service type information of the verifiable declaration to be issued by the first user to the second user, and obtaining the corresponding declaration authorization template according to the service type information;

[0038] Specifically, a request for issuing a verifiable declaration sent by a client of the first user is received, and business type information is obtained from the issuance request; wherein the issuance request is used to request the issuance of a verifiable declaration granting business processing authority to the second user so that the second user can process the designated business of the first user, and the issuance request includes business type information of the designated business.

[0039] Step S104, sending a declaration authorization template to the client of the first user;

[0040] Step S106, receiving authorization related information provided by the first user based on the declared authorization template and returned by the client of the first user;

[0041] Step S108: confirm whether to issue a verifiable statement to the second user according to the authorization-related information; if so, generate a verifiable statement according to the authorization-related information and send it to the client of the second user.

[0042] In one or more embodiments of the present specification, the server can generate a verifiable declaration based on the authorization-related information sent by the client of the first user through online data interaction with the client, so that the second user can act on behalf of the first user to handle the designated business of the first user based on the verifiable declaration, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the client of the second user in electronic form, the second user does not need to carry the signed paper authorization agreement when handling business on behalf of the first user, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0043] In order to enable the server to quickly obtain the corresponding declaration authorization template according to the business type information, in one or more embodiments of this specification, the association record information of the business type information and the declaration authorization template can be preset, and the association record information can be saved in the server. Correspondingly, in step S102, the corresponding declaration authorization template is obtained according to the business type information, including:

[0044] According to the business type information, the associated declaration authorization template is obtained from the association record information between the business type information and the declaration authorization template.

[0045] Considering that the business model of the service provider is not static, in order to avoid the problem that the service end fails to update the stored claim authorization template and causes the issuance of the verifiable claim to fail, in one or more embodiments of the present specification, the claim authorization template can also be uploaded to the blockchain by the service provider through the node device in the blockchain, so that when the business model changes, the service provider can upload the new claim authorization template to the blockchain in a timely manner; correspondingly, in step S102, according to the business type information, the corresponding claim authorization template is obtained, including:

[0046] Step M2, according to the service type information, obtaining the associated template identifier from the association record information between the service type information and the template identifier of the declared authorization template;

[0047] Step M4: According to the obtained template identifier, obtain the corresponding declaration authorization template from the declaration authorization template stored in the blockchain through the second blockchain node.

[0048] Specifically, according to the obtained template identifier, a template acquisition request is sent to the second blockchain node; the second blockchain node searches the blockchain for the corresponding last declaration authorization template saved to the blockchain according to the template identifier in the template acquisition request in the order of the storage time of the declaration authorization template saved to the blockchain, and returns the searched declaration authorization template to the server. Therefore, by obtaining the declaration authorization template from the blockchain, the accuracy and validity of the obtained declaration authorization template can be ensured.

[0049] In order to prevent the authorization-related information sent by the client of the first user from containing bad information, such as information related to pornography, gambling, drugs, etc., in one or more embodiments of the present specification, risk control conditions are pre-set, and based on the risk control conditions and the authorization-related information, it is confirmed whether to issue a verifiable statement to the second user; specifically, in step S108, confirming whether to issue a verifiable statement to the second user according to the authorization-related information includes:

[0050] Step N, determining whether the authorization-related information meets a preset risk control condition, and if the risk control condition is met, confirming that a verifiable statement is issued to the second user.

[0051] Optionally, a large amount of text is collected in advance and sensitive information (such as pornography, gambling, drugs, etc.) is annotated to obtain a training set, the training set is trained based on a neural network to obtain a detection model, and based on the detection model, it is determined whether the authorization-related information meets the preset risk control conditions; that is, determining whether the authorization-related information meets the preset risk control conditions in step N includes: using a pre-trained detection model to detect the authorization-related information, and determining whether the authorization-related information meets the preset risk control conditions according to the detection results;

[0052] Specifically, the authorization-related information is input into a pre-trained detection model to detect the authorization-related information and obtain a detection result; if the detection result indicates that the authorization-related information contains sensitive information, it is determined that the authorization-related information does not meet the preset risk control conditions; if the detection result indicates that the authorization-related information does not contain sensitive information, it is determined that the authorization-related information meets the preset risk control conditions. It should be pointed out that the training process of the detection model can be set according to needs in actual applications, and this specification does not make specific restrictions on this.

[0053] Alternatively, a blacklist of sensitive information is set in advance, the blacklist is saved in the blockchain, and based on the blacklist, it is determined whether the authorization-related information meets the preset risk control conditions; that is, determining whether the authorization-related information meets the preset risk control conditions in step N includes: matching the authorization-related information with the authorization blacklist stored in the blockchain through the first blockchain node, and determining whether the authorization-related information meets the preset risk control conditions based on the matching result.

[0054] Specifically, a risk detection request is sent to the first blockchain node based on the authorization-related information, the first blockchain calls the smart contract, matches the authorization-related information included in the risk detection request with the authorization blacklist stored in the blockchain, and sends the matching result to the server; the server determines the type of the matching result, if the matching result is a successful match, it is determined that the authorization-related information does not meet the preset risk control conditions, if the matching result is a failed match, it is determined that the authorization-related information meets the preset risk control conditions.

[0055] Further, if the authorization-related information does not meet the risk control condition, it is confirmed that the verifiable statement will not be issued to the second user, and the issuance result of the issuance failure is returned to the client of the first user, so that the client of the first user displays the issuance failure information.

[0056] By determining whether authorization-related information meets risk control conditions, it is effectively avoided that adverse effects on people's lives and society are caused by bad information contained in authorization-related information.

[0057] In order to avoid subsequent troubles caused by the first user providing wrong authorization-related information, in one or more embodiments of this specification, generating a verifiable statement according to the authorization-related information in step S108 includes:

[0058] Step T2, asking the first user through the client of the first user whether to grant the service processing authority to the second user;

[0059] Specifically, an inquiry message is generated based on authorization-related information and / or a declared authorization template; wherein the inquiry message includes relevant information of the second user and relevant information of the designated service; the inquiry message is sent to the client of the first user to display an inquiry interface including relevant information of the second user and relevant information of the designated service on the client of the first user, so as to inquire whether the first user grants the second user the right to handle the service.

[0060] It should be pointed out that the inquiry information may also include relevant information of the first user, or may only include relevant information of the designated business, which can be set as needed in actual applications; further, for different businesses, the business processing authority information to be granted may be included in the authorization-related information, or may be fixed information already in the declaration authorization template. Correspondingly, generating inquiry information based on authorization-related information and / or declaration authorization template may include: querying the relevant information of the first user and the relevant information of the second user, such as user name, contact information, etc., on a designated platform or organization based on the digital identity information of the first user and the digital identity information of the second user included in the authorization-related information, and obtaining relevant information of the designated business from the authorization-related information and / or declaration authorization template, and generating inquiry information based on the obtained user information of the first user, the user information of the second user, and the business information of the designated business.

[0061] Taking the example of a bank loan as the business type of the verifiable declaration issued by the first user to the second user, the declaration authorization template may contain fixed relevant information describing the loan business, but the loan amount, loan bank, loan time and other information may be specified by the first user through its client, that is, included in the authorization related information; the server queries the first user's name as Li on the designated platform or institution based on the digital identity information of the first user included in the authorization related information, and queries the second user's name as Wang on the designated platform or institution based on the digital identity information of the second user, and obtains relevant information about the designated business from the authorization related information and the declaration authorization template, including that the designated business is a bank loan, the loan time is August 3, 2019, the loan amount is RMB 1,000,000, and the loan bank is Bank 1. The generated inquiry information is, for example, that Li authorizes Wang to initiate a loan of RMB 1,000,000 from Bank 1 on August 3, 2019.

[0062] The digital identity information of the first user and the digital identity information of the second user are respectively obtained by the first user and the second user from the designated platform in advance. For example, the user operates the client with the digital identity information application function installed in the terminal device to send a digital identity information application request to the designated platform, the designated platform applies for a public-private key pair on behalf of the user, generates digital identity information according to the public key, generates a document (DID doc) corresponding to the digital identity information of the user, sends the generated digital identity information to the corresponding client, and saves the public key, encryption protocol and other related information to the generated document; for another example, the user operates the client with the digital identity information application function installed in the terminal device to send a digital identity information application request to the designated platform, wherein the digital identity application request includes the user's ID number and other information, the designated platform generates the user's digital identity information according to the user's ID number after performing real-person authentication (such as face recognition authentication, fingerprint authentication, etc.) on the user, and generates a document corresponding to the user's digital identity information, sends the generated digital identity information to the corresponding client, and obtains the user's public key corresponding to the digital identity information, and saves the obtained public key and other related information to the generated document. It should be pointed out that the application process for digital identity information is not specifically limited in this specification and can be set as needed in actual applications.

[0063] Step T4: if it is confirmed that the first user has granted the business processing authority to the second user, a verifiable statement is generated based on the authorization-related information.

[0064] Therefore, by sending inquiry information to the client of the first user so that the first user can review the inquiry information, it is effectively avoided that the second user is granted the wrong business processing authority due to incorrect authorization-related information, thereby providing protection for the interests of the first user.

[0065] In order to improve the efficiency of issuing verifiable claims, in one or more embodiments of this specification, after sending the query information to the client of the first user, as long as the confirmation authorization information returned by the client of the first user is received, it is confirmed that the first user has granted the business processing authority to the second user; correspondingly, in step T4, confirming that the first user has granted the business processing authority to the second user includes:

[0066] If the confirmation authorization information returned by the client of the first user is obtained, it is confirmed that the first user has granted the business processing authority to the second user.

[0067] Considering that different services have different degrees of relevance to user interests, for example, financial services have a higher relevance to user interests, such as bank loans, etc.; while the application service for participating in a public welfare activity has a relatively weaker relevance to user interests; based on this, in one or more embodiments of this specification, the security levels of different services can be preset, and when the security level of the specified service corresponding to the verifiable statement requested by the first user meets the preset conditions, the first user is authenticated to ensure security; wherein, the division of security levels and the setting of preset conditions can be set by oneself according to needs in actual applications, and this specification does not make specific restrictions on this; correspondingly, in step T4, confirming that the first user grants the service processing authority to the second user includes:

[0068] If the security level of the designated service meets the preset conditions and the confirmation authorization information returned by the client of the first user is obtained, the identity of the first user is authenticated through the client of the first user; if the identity authentication is successful, it is confirmed that the first user has granted the service processing authority to the second user;

[0069] Alternatively, if the security level of the designated service does not meet the preset condition, and the confirmation authorization information returned by the client of the first user is obtained, it is confirmed that the first user grants the service processing authority to the second user.

[0070] The step of authenticating the first user through a client of the first user includes:

[0071] Step A2, sending an identity authentication request to the client of the first user, so that the client of the first user performs an identity authentication operation on the first user;

[0072] Step A4: authenticating the first user according to the authentication information returned by the client of the first user.

[0073] The identity authentication information may be biometric information, such as any one or more of face, fingerprint, iris, etc., and may also be authentication information in the form of a verification code. If the identity authentication information is biometric information, step A4 may include: matching the identity authentication information with the user's identity information stored in the database of the designated institution, if the match is successful, determining that the identity authentication of the first user is passed, if the match fails, determining that the identity authentication of the first user is failed, and sending the verification result of the failed verification to the client of the first user; wherein the designated institution is a trusted third-party institution with authority and legitimacy, and its database stores the identity information of the user, and the user's identity authentication information is authenticated by accessing the database; the designated institution is, for example, a public security bureau. If the identity authentication information is a verification code, the verification code returned by the client of the first user is matched with the verification code stored by itself, if the match is successful, determining that the identity authentication of the first user is passed, if the match fails, determining that the identity authentication of the first user is failed, and sending the verification result of the failed verification to the client of the first user. By authenticating the first user, it is possible to avoid the occurrence of other users maliciously impersonating the first user, further improving security.

[0074] In order to enable the second user to process the designated service of the first user based on the verifiable statement without providing additional information related to the verifiable statement, such as certification information proving that the verifiable statement is issued by the first user to the second user; in one or more embodiments of the present specification, the digital identity information of the first user, the digital identity information of the second user, etc. are all recorded in the verifiable statement; specifically, Figure 4 As shown, in step S108, a verifiable statement is generated according to the authorization-related information, including:

[0075] Step B2, obtaining the business processing authority information to be granted from the authorization related information and / or the declaration authorization template;

[0076] Specifically, for different businesses, the business processing authority information to be granted may be included in the authorization-related information, or it may be fixed information already in the declared authorization template. In actual applications, the business processing authority information to be granted is obtained from the authorization-related information and / or the declared authorization template according to actual conditions.

[0077] Step B4, generating a statement identifier that can verify the statement;

[0078] Specifically, a declaration mark of a verifiable declaration is generated according to a preset declaration identifier generation mechanism; wherein the preset declaration identifier generation mechanism can be set by oneself as needed in actual applications, such as calculating one or more information included in the creation request, and using the calculation result or part of the information in the calculation result as the declaration identifier; or dynamically generating a declaration identifier according to a preset dynamic generation mechanism, wherein the dynamic generation mechanism can ensure that the declaration identifier generated each time is different.

[0079] Step B6, using the private key of the first user to sign the preset first designated information to obtain signature data;

[0080] Optionally, the server agent maintains the user's private key. Correspondingly, step B6 includes: according to the digital identity information of the first user, obtaining the associated private key in the association record information of the digital identity information and the private key, and using the obtained private key to sign the preset first designated information to obtain signature data;

[0081] Alternatively, the designated hosting platform acts as an agent for the user to maintain the user's private key. Accordingly, step B6 includes: sending a private key acquisition request to the hosting platform according to the digital identity information of the first user, and receiving the private key returned by the hosting platform; using the received private key to sign the preset first designated information to obtain signature data;

[0082] Alternatively, the user maintains his own private key. Correspondingly, step B6 includes: sending a private key acquisition request to the client of the first user according to the digital identity information of the first user, and receiving the private key returned by the client of the first user; using the received private key to sign the preset first designated information to obtain signature data;

[0083] Among them, the first designated information can be the digital identity information of the first user, or part or all of the information in the business processing authority information, or information pre-set by the server, etc. The specific content of the first designated information is not specifically limited in this specification.

[0084] It should be noted that the execution order of step B2, step B4 and step B6 can be interchanged.

[0085] Step B8: Generate a verifiable statement based on the business processing authority information, the statement identifier, the signature data, the digital identity information of the first user and the digital identity information of the second user.

[0086] By generating a declaration identifier and signature data, and generating a verifiable declaration based on the declaration identifier, signature data, the digital identity information of the first user, the digital identity information of the second user and the business processing authority information, not only can the verifiable declaration be distinguished based on the declaration identifier, but also when the second user processes the designated business of the first user based on the verifiable declaration, the authenticity of the verifiable declaration can be verified, such as by indexing the corresponding document (DID doc) based on the digital identity information of the first user in the verifiable declaration, obtaining the public key of the first user from the document, and using the obtained public key to verify the signature data in the verifiable declaration; or, sending a public key acquisition request to a designated platform or organization based on the digital identity information of the first user in the verifiable declaration, receiving the public key returned by the designated platform or organization, and using the received public key to verify the signature data in the verifiable declaration; thereby ensuring that the verifiable declaration is issued by the first user for the second user, and is not forged.

[0087] In order to more comprehensively verify the authenticity and validity of the verifiable statement when the second user processes the designated service of the first user based on the verifiable statement, in one or more embodiments of the present specification, for example Figure 5 As shown, after step S108, the following steps are also included:

[0088] Step S110, generating issuance record information according to the verifiable statement;

[0089] Step S112, sending the issuance record information to the blockchain node so that the blockchain node saves the issuance record information in the blockchain.

[0090] By saving the issuance and processing record information in the blockchain, when the second user processes the designated business of the first user based on the verifiable statement, sufficient verification basis can be provided for the verification of the verifiable statement.

[0091] Because different users have different requirements for the privacy of their personal information, the first user may set the anonymity attribute of the verifiable statement when issuing the verifiable statement to the second user; or the first user may operate the client in advance to set the verifiable statement to have a unified anonymity attribute, such as non-public, when issuing the verifiable statement to any second user; correspondingly, when the anonymity attribute is non-public, such as Figure 6 As shown, step S110 includes:

[0092] Step S110-2, calculating a hash value of the digital identity information of the first user;

[0093] Step S110-4, calculating a hash value of the digital identity information of the second user;

[0094] Step S110-6, calculating a hash value of the second specified information in the verifiable statement;

[0095] Among them, the second designated information can be the digital identity information of the first user, the digital identity information of the second user, the business processing authority information, the declaration identifier and the validity field, or it can be any one or a combination of several of the digital identity information of the first user, the digital identity information of the second user, the business processing authority information, the declaration identifier and the validity field; wherein the validity field represents the state of the verifiable declaration, such as valid state or invalid state.

[0096] It should be noted that the execution order of step S110 - 2 , step S110 - 4 , and step S110 - 6 can be interchanged with each other, and the calculation algorithm of the hash value can be set as needed in practice.

[0097] Step S110 - 8 , the calculated hash values, declaration identifiers, and validity fields are associated and recorded, and the recorded information is used as issuance record information.

[0098] By calculating the hash value of the first user's digital identity information, the second user's digital identity information and the second designated information, and generating the issuance record information based on the hash value, the security of the user's privacy data is effectively ensured; at the same time, by saving the issuance record information in the blockchain, when the second user processes the first user's designated business based on the verifiable statement, the verifiable statement can be more comprehensively verified based on the issuance record information in the blockchain, ensuring the authenticity and validity of the verifiable statement, thereby ensuring business security.

[0099] Further, when the anonymity attribute set by the first user is public, step S110 includes:

[0100] The verifiable statement, the digital identity information of the first user, the digital identity information of the second user, the statement identifier and the validity field are associated and recorded, and the recorded information is used as issuance record information; wherein the validity field represents the status of the verifiable statement.

[0101] Therefore, by saving the plain text of the verifiable declaration in the blockchain, when the second user processes the designated business of the first user based on the verifiable declaration, the authenticity and validity of the verifiable declaration can be more directly verified based on the issuance record information in the blockchain, thereby ensuring business security.

[0102] In order to let the first user know the issuance result, in one or more embodiments of this specification, after step S108, the following steps are further included:

[0103] The issuance result of successful issuance is sent to the client of the first user, so that the client of the first user displays issuance success information.

[0104] In actual applications, the first user may also operate his client to freeze or revoke the verifiable statement that grants the second user the business processing authority. For example, after the second user completes the processing of the first user's designated business, in order to prevent the corresponding verifiable statement from being misused, when the first user determines that he will no longer handle the corresponding designated business within a certain period of time, the corresponding verifiable statement may be frozen to make the verifiable statement invalid, and apply to restore its validity when the verifiable statement needs to be used; for another example, after the verifiable statement is generated, if the first user wants to change the business processing authority information, the corresponding generated verifiable statement may be revoked; based on this, in one or more embodiments of the present specification, the method further includes:

[0105] Step T2, receiving a claim processing request sent by a client of the first user, wherein the claim processing request includes a claim identifier of a verifiable claim to be processed;

[0106] Among them, the claim processing request is used to request freezing, unfreezing, revocation, etc. of a verifiable claim.

[0107] Step T4, generating statement processing record information according to the statement identifier of the verifiable statement to be processed and the validity field representing the state of the verifiable statement;

[0108] Step T6, sending the declaration processing record information to the third blockchain node, so that the third blockchain node saves the declaration processing record information in the blockchain.

[0109] By saving the declaration processing record information in the blockchain, when the second user handles the designated business of the first user based on the verifiable declaration, sufficient verification basis can be provided for the verification of the verifiable declaration, and illegal business operations caused by the misappropriation of the verifiable declaration can be effectively avoided.

[0110] It should be pointed out that the aforementioned first blockchain node, second blockchain node and third blockchain node can be the same blockchain node or different blockchain nodes.

[0111] In one or more embodiments of the present specification, the server can generate a verifiable declaration based on the authorization-related information sent by the client of the first user through online data interaction with the client, so that the second user can act on behalf of the first user to handle the designated business of the first user based on the verifiable declaration, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the client of the second user in electronic form, the second user does not need to carry the signed paper authorization agreement when handling business on behalf of the first user, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0112] Corresponding to the above Figures 3 to 6 The authorization method based on verifiable declaration described above is based on the same technical concept, and one or more embodiments of this specification provide another authorization method based on verifiable declaration; Figure 7 A flowchart of another authorization method based on verifiable declaration provided for one or more embodiments of this specification, Figure 7 The method in can be Figure 1 The first user's client executes, such as Figure 7 As shown, the method comprises the following steps:

[0113] Step S202, in response to the issuance operation of the verifiable statement of the first user, sending a request for issuance of the verifiable statement to the server; wherein the issuance request is used to request the issuance of a verifiable statement granting a business processing authority to the second user, so that the second user can process the designated business of the first user; the issuance request includes business type information of the designated business, so that the server obtains the corresponding statement authorization template according to the business type information;

[0114] Step S204, displaying the declaration authorization template returned by the server, and obtaining authorization related information provided by the first user based on the declaration authorization template;

[0115] Step S206: Send authorization related information to the server, so that the server generates a verifiable statement according to the authorization related information and sends it to the client of the second user.

[0116] In one or more embodiments of the present specification, the client of the first user interacts with the server online so that the server generates a verifiable declaration based on the authorization-related information, so that the second user can act on behalf of the first user to handle the first user's designated business based on the verifiable declaration, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the client of the second user in electronic form, the second user does not need to carry the signed paper authorization agreement when acting on behalf of the first user to handle business, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0117] In order to prevent the first user from providing bad information, such as pornography, gambling, drugs, etc., based on the declaration authorization template, in one or more embodiments of the present specification, the to-be-edited items in the declaration authorization template are displayed in an enumerated manner as candidate information, so that the first user can select the information he needs from the candidate information; specifically, Figure 8 As shown, in step S204, obtaining authorization related information provided by the first user based on the declared authorization template includes:

[0118] Step R2, when a trigger operation of the first user on the item to be edited in the declaration authorization template is detected, corresponding candidate information is determined;

[0119] Specifically, if the item to be edited is relevant information of the first user or the second user, such as digital identity information, home address, etc., the first user can operate his client to pre-edit it, and the client saves the information edited by the first user when it obtains it; and when it detects that the first user triggers an operation on the corresponding item to be edited in the declaration authorization template, the corresponding information is obtained from the saved information as candidate information; if the item to be edited is information related to business, etc., the server will send the corresponding candidate information, the associated information of each item to be edited, and the declaration authorization template to the client of the first user, and correspondingly, when the client detects that the first user triggers an operation on the corresponding item to be edited in the declaration authorization template, the corresponding candidate information is obtained from the associated information sent by the server.

[0120] Step R4, displaying the candidate information, and displaying the target candidate information selected by the first user from the candidate information in the item to be edited;

[0121] Step R6: if a submission operation of the first user is detected, the information displayed in each item to be edited is obtained, and the authorization related information provided by the first user based on the declaration authorization template is obtained.

[0122] Therefore, by displaying candidate information for the first user to select, the editing of the first user is reduced, which can effectively prevent the first user from providing bad information based on the declaration authorization template.

[0123] In order to prevent the first user from providing erroneous authorization related information, in one or more embodiments of this specification, Fig. 9 As shown, after sending authorization related information to the server in step S206, the following steps are also included:

[0124] Step S208, receiving inquiry information sent by the server, wherein the inquiry information includes relevant information of the second user and relevant information of the designated service;

[0125] Step S210, displaying an inquiry interface for inquiring the first user whether to grant the business processing authority to the second user according to the inquiry information;

[0126] Step S212, based on the operation of the first user, feedback information to the server, so that when the server confirms based on the feedback information that the first user grants the business processing authority to the second user, a verifiable statement is generated according to the authorization-related information.

[0127] For example, the first user grants the second user the permission to handle loan business. The query information sent by the server is that Li authorizes Wang to initiate a loan with Bank 1 on August 3, 2019, with a loan amount of 1,000,000 yuan. The corresponding diagram of the query interface is as follows: Fig.10 It should be pointed out that Fig.10 It is only used for illustration and is not limited by the user. The specific style of the inquiry interface can be set as needed in actual application.

[0128] Furthermore, since different services are related to user interests to different degrees, in order to ensure security, the server may, according to the preset security levels of different services, perform identity authentication on the first user when it is determined that the security level of the designated service corresponding to the verifiable statement issued by the first user to the second user satisfies the preset conditions; correspondingly, in step S212, feedback of information to the server based on the operation of the first user includes:

[0129] If a confirmation authorization operation of the first user on the inquiry interface is detected, confirmation authorization information is sent to the server; and if an identity authentication request sent by the server is received, an identity authentication operation on the first user is performed, and the identity authentication information is fed back to the server, so that the server authenticates the first user based on the identity authentication information.

[0130] The identity authentication operation may be to collect the biometric information of the first user, or to obtain a verification code submitted by the first user; correspondingly, the identity authentication information may be biometric information, such as any one or more of face, fingerprint, iris, etc., or verification information in the form of a verification code. Taking the collection of a face image as an example, Fig.11 As shown, if the first user triggers the "Confirm Authorization" control on the query interface, the confirmation authorization information is sent to the server; and when the identity authentication request from the server is received, the face collection interface is displayed to collect the face image of the first user, and the collected face image is sent to the server, so that the server can authenticate the first user based on the face image. In this way, it can avoid the occurrence of other users maliciously impersonating the first user, and improve security.

[0131] In order to let the first user know the authorization result, after sending the authorization related information to the server in step S206, the following steps are further included:

[0132] Receive the issuance result sent by the server, and display the issuance success information or issuance failure information according to the issuance result.

[0133] Furthermore, to ensure safety, before step S202, the following steps may also be included:

[0134] The login information of the first user is obtained. If the login information is verified successfully, step S202 is executed; if the login information is not verified successfully, a login failure message is prompted.

[0135] The login information may be an account name and a login password, or a user's face image, that is, the user's face image is collected, and when the face image is verified, step S202 is executed. This can prevent other users from maliciously acting as the first user to grant the second user business processing authority, thereby improving security.

[0136] Furthermore, the first user may also operate the client to freeze, unfreeze, revoke, etc. the verifiable statement issued by the first user. Correspondingly, the method further includes:

[0137] Step W2, in response to the verifiable claim processing operation of the first user, determining a claim identifier of the verifiable claim to be processed;

[0138] Step W4, according to the claim identifier of the verifiable claim to be processed, sending a claim processing request to the server, so that the server generates claim processing record information according to the claim identifier of the verifiable claim to be processed and the validity field representing the state of the verifiable claim, and saves the claim processing record information to the blockchain through the third blockchain node;

[0139] Therefore, not only can sufficient verification basis be provided for the verification of the verifiable claim when business processing is performed based on the verifiable claim, but also illegal business operations caused by the misappropriation of the verifiable claim can be effectively avoided.

[0140] In one or more embodiments of the present specification, the client of the first user interacts with the server online so that the server generates a verifiable declaration based on the authorization-related information, so that the second user can act on behalf of the first user to handle the first user's designated business based on the verifiable declaration, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the client of the second user in electronic form, the second user does not need to carry the signed paper authorization agreement when acting on behalf of the first user to handle business, which greatly improves convenience.

[0141] Corresponding to the authorization method based on verifiable declaration described above, based on the same technical concept, one or more embodiments of this specification also provide an authorization method based on verifiable declaration, which is applied to a third blockchain node; Fig.12 A flowchart of a verifiable statement-based authorization method applied to a third blockchain node provided for one or more embodiments of this specification, such as Fig.12 As shown, the method comprises the following steps:

[0142] Step S302, receiving issuance record information sent by the server, wherein the issuance record information is information generated by the server after generating a verifiable statement according to the issuance request sent by the first user;

[0143] Step S304, save the issuance record information in the blockchain.

[0144] In one or more embodiments of the present specification, by saving the issuance record information in the blockchain, the authenticity and validity of the issuance record information can be ensured based on the tamper-proof nature of the blockchain. Therefore, when the second user processes the designated business of the first user based on the verifiable statement, the verifiable statement provided by the second user can be verified by the third blockchain node based on the issuance record information stored in the blockchain, thereby ensuring business security.

[0145] In order to facilitate verification of the validity of the verifiable claim, in one or more embodiments of this specification, the method further includes:

[0146] Receive the statement processing record information sent by the server, and save the statement processing record information in the blockchain; wherein the statement processing record information includes the statement identifier of the processed verifiable statement and the validity field representing the status of the verifiable statement, etc.

[0147] Based on the various record information stored in the blockchain, the third blockchain node can perform a comprehensive verification of the verifiable statement to be verified when receiving a statement verification request sent by a third party, wherein the third party can be a business provider, and when the verifiable statement is verified, it processes the designated business of the first user based on the verifiable statement; for example, the second user acts as an agent for the first user to handle a loan business at a bank based on the verifiable statement, wherein the bank is the third party, and when the bank determines that the verifiable statement provided by the second user is true and valid, it processes the loan business of the first user based on the business processing authority information in the verifiable statement. Specifically, the method also includes:

[0148] Step D2, receiving a claim verification request sent by a third party, wherein the claim verification request includes a verifiable claim to be verified;

[0149] Step D4, calling the smart contract deployed in the blockchain, and verifying the verifiable claim to be verified according to the record information about the verifiable claim to be verified stored in the blockchain.

[0150] Therefore, the verifiable claims to be verified are automatically verified based on smart contracts without human intervention, which not only avoids the problem of manual misdetection and improves verification efficiency; but also verifies the verifiable claims based on the record information stored in the blockchain, which can ensure the authenticity and validity of the verifiable claims, thereby ensuring business security.

[0151] Considering that the first user may freeze or revoke the verifiable statement, when verifying the verifiable statement to be verified, it is first necessary to verify whether it is in a valid state; secondly, considering that different services are related to user interests to different degrees, for example, the handling of financial services is more relevant to user interests, such as bank loans, etc.; while the handling of membership joining, participation in certain public welfare activities and other services are relatively less relevant to user interests. Based on this, in one or more embodiments of the present specification, the security levels of different services can be pre-set, wherein the security level division criteria can be set by oneself according to needs in actual applications, for example, the security level of financial services such as bank account opening and loans is high, while the security level of services such as membership joining and participation in public welfare activities is low; or when the first user issues a verifiable statement to the second user, the security mechanism is set by oneself, and the verifiable statement includes the security mechanism information set by the user; correspondingly, when it is determined that the security level of the designated service handled based on the verifiable statement to be verified is low, or it is determined based on the security mechanism information in the verifiable statement that no confirmation by the first user is required, such as Fig.13 As shown, in step D4, the verifiable claim to be verified is verified according to the record information about the verifiable claim to be verified stored in the blockchain, including:

[0152] Step E2, querying target record information about the verifiable claim to be verified from the record information stored in the blockchain according to the claim identifier included in the verifiable claim to be verified;

[0153] Specifically, according to the order of the storage time of each record information saved in the blockchain, according to the declaration identifier in the verifiable statement to be verified, the corresponding last record information is queried in the blockchain. If the validity field in the last record information queried indicates that the verifiable statement is in an invalid state, then the last record information is used as the target record information; if the validity field in the last record information queried indicates that the verifiable statement is in a valid state, and the last record information is not the only record information corresponding to the declaration identifier in the verifiable statement to be verified, then according to the declaration identifier in the verifiable statement to be verified, the corresponding first record information is queried in the blockchain to obtain the issuance record information, and the issuance record information and the last record information are used as the target record information. It should be pointed out that when the last record information is the only record information corresponding to the declaration identifier in the verifiable statement to be verified, the record information is the issuance record information of the verifiable statement to be verified.

[0154] Step E4, if it is determined that the verifiable claim to be verified is in a valid state according to the validity field in the target record information, then determining whether the verifiable claim to be verified is legal according to the target record information;

[0155] Specifically, the validity field is read from the last record information included in the target record information. If the read validity field indicates that the verifiable statement is in an invalid state, a verification failure message is sent to a third party; if the read validity field indicates that the verifiable statement is in a valid state, it is determined whether the verifiable statement to be verified is legal based on the issuance record information in the target record information.

[0156] Step E6: If it is determined that the verifiable claim to be verified is legal, then it is determined that the verifiable claim to be verified has passed the verification.

[0157] Therefore, when the security level of the business handled based on the verifiable declaration is low, or when it is determined according to the security mechanism set by the first user that no confirmation by the first user is required, the verifiable declaration is verified based on the record information stored in the blockchain, ensuring the authenticity and validity of the verifiable declaration, thereby providing protection for business security.

[0158] Further, in order to prevent the verifiable statement from being misused, or when it is determined that the security level of the service handled based on the verifiable statement is high, or when it is determined that the first user's confirmation is required according to the security mechanism set by the first user, such as Fig.14As shown, in step D4, the verifiable claim to be verified is verified according to the issuance record information stored in the blockchain, including:

[0159] Step F2, querying target record information about the verifiable claim to be verified from the record information stored in the blockchain according to the claim identifier in the verifiable claim to be verified;

[0160] The implementation process of this step can be found in the above-mentioned related description, and the repeated parts will not be repeated here.

[0161] Step F4, if it is determined that the verifiable statement to be verified is in a valid state according to the validity field in the target record information, a service confirmation request is sent to the client of the first user according to the digital identity information of the first user in the verifiable statement to be verified, and it is determined whether the confirmation information of the first user is obtained through the client of the first user;

[0162] Specifically, read the validity field in the last record information included in the target record information, and if the read validity field indicates that the verifiable statement is in an invalid state, send a verification failure message to a third party; if the read validity field indicates that the verifiable statement is in a valid state, then according to the digital identity information of the first user in the verifiable statement to be verified, obtain the associated client identifier in the associated record information of the user's digital identity information and the client identifier; send a business confirmation request to the client corresponding to the obtained client identifier; when the client receives the business confirmation request, it displays the information to be confirmed included in the business confirmation request, and when the confirmation operation of the first user is detected, returns the confirmation information to the blockchain node; it should be pointed out that the specific content of the information to be confirmed can be set by itself according to needs in actual applications, and this is not specifically limited in the embodiments of this specification.

[0163] Step F6, determining whether the verifiable claim to be verified is legal according to the target record information;

[0164] Step F8: If the confirmation information of the first user is obtained and it is determined that the verifiable statement to be verified is legal, it is determined that the verifiable statement to be verified has been verified.

[0165] Specifically, if it is determined that the verifiable statement to be verified is in a valid state according to the validity field in the target record information, a service confirmation request is sent to the client of the first user according to the digital identity information of the first user in the verifiable statement to be verified. If confirmation information is received from the client of the first user, it is determined whether the verifiable statement to be verified is legal according to the issuance record information in the target record information. If it is determined to be legal, it is determined that the verifiable statement to be verified has passed the verification.

[0166] Therefore, when the security level of the designated business handled based on the verifiable declaration is higher, or when it is determined according to the security mechanism set by the first user that the first user's confirmation is required, a business confirmation request is sent to the first user's client so that the first user can confirm it, and the verifiable declaration is verified based on the record information stored in the blockchain. This not only avoids the risk of the verifiable declaration being stolen, but also ensures the authenticity and validity of the verifiable declaration, providing protection for business security.

[0167] It should be noted that step E2 and step F2 may also include:

[0168] The valid deadline is read from the verifiable claim to be verified. If the verifiable claim to be verified is determined to be invalid according to the read valid deadline, a verification failure message is sent to a third party. If the verifiable claim to be verified is determined to be valid according to the read valid deadline, the target record information about the verifiable claim to be verified is queried from the record information stored in the blockchain according to the claim identifier.

[0169] Since different users have different requirements for the privacy of personal information, the first user may also set the anonymity attribute of the verifiable statement granting the business processing authority to the second user. When the anonymity attribute is non-public, the issuance record information stored in the blockchain includes the hash value of the user's digital identity information, the hash value of the server's digital identity information, the hash value of the second specified information in the verifiable statement, the statement identifier and the validity field; correspondingly, in step E4 and step F6, determining whether the verifiable statement to be verified is legal based on the target record information includes:

[0170] Step H2, obtaining the public key of the first user according to the digital identity information of the first user in the verifiable statement, and verifying the signature information in the verifiable statement using the public key of the first user;

[0171] Specifically, the digital identity information of the first user in the verifiable declaration is indexed to the corresponding document (DIDdoc), and the public key of the first user is obtained from the document; or, the corresponding public key is obtained from the pre-stored association record information of the digital identity information and the public key of the first user according to the digital identity information of the first user; or, according to the digital identity information of the first user in the verifiable declaration, a public key acquisition request is sent to a designated platform or organization, and the public key sent by the designated platform or organization is received; the acquired public key is used to verify the signature information in the verifiable declaration.

[0172] Step H4, calculating the hash value of the second designated information in the verifiable statement, and obtaining the hash value corresponding to the verifiable statement from the issuance record information included in the target record information, and matching the calculated hash value of the second designated information with the obtained hash value corresponding to the verifiable statement;

[0173] Step H6: If the signature information is verified and the hash value matches successfully, the verifiable statement is determined to be legal.

[0174] Specifically, based on the digital identity information of the first user in the verifiable declaration, the public key of the first user is obtained, and the signature information in the verifiable declaration is verified using the public key of the first user. If the verification passes, the hash value of the second specified information in the verifiable declaration is calculated, and the hash value corresponding to the verifiable declaration is obtained from the issuance record information included in the target record information. The calculated hash value of the second specified information is matched with the hash value corresponding to the obtained verifiable declaration. If the match is successful, the verifiable declaration is determined to be legal.

[0175] Therefore, when the hash value corresponding to the verifiable statement is stored in the blockchain, the hash value of the second specified information in the verifiable statement is calculated and compared with the hash value corresponding to the verifiable statement in the issuance record information, the validity of the verifiable statement is verified, providing a guarantee for business security.

[0176] Furthermore, when the anonymity attribute of the verifiable statement set by the first user is public, the issuance record information stored in the blockchain includes the verifiable statement. Correspondingly, in step E4 and step F6, determining whether the verifiable statement is legal according to the target record information includes:

[0177] Step K2, obtaining the public key of the first user according to the digital identity information of the first user in the verifiable statement, and verifying the signature information in the verifiable statement using the public key of the first user;

[0178] Step K4, matching the verifiable claim to be verified with the verifiable claim in the issuance record information;

[0179] Step K6: If the match is successful and the signature information is verified, the verifiable statement to be verified is determined to be legal.

[0180] Specifically, according to the digital identity information of the first user in the verifiable statement, the public key of the first user is obtained, and the signature information in the verifiable statement is verified using the public key of the first user. If the verification is successful, the verifiable statement is obtained from the issuance record information included in the target record information, and the verifiable statement to be verified is matched with the obtained verifiable statement. If the match is successful, it is determined that the verifiable statement to be verified is legal. Among them, the process of obtaining the public key of the first user can refer to the above-mentioned related description, and the repeated parts will not be repeated here; therefore, when a verifiable statement is stored in the blockchain, by verifying the signature information in the verifiable statement to be verified, and matching the verifiable statement to be verified with the verifiable statement stored in the blockchain, the effective verification of the verifiable statement is achieved, which provides a guarantee for business security.

[0181] In one or more embodiments of the present specification, by saving the issuance record information and other record information of the verifiable declaration on the blockchain, when the second user acts as an agent for the first user to process a designated business based on the verifiable declaration, the verifiable declaration provided by the second user can be verified based on the record information stored in the blockchain. This not only ensures business security, but also eliminates the need for the business provider to visually inspect the paper authorization agreement provided by the second user, thereby improving verification efficiency and accuracy.

[0182] Corresponding to the above Figures 3 to 6 The authorization method based on verifiable declaration is described. Based on the same technical concept, one or more embodiments of this specification also provide an authorization device based on verifiable declaration, which is applied to the server. Fig.15 A schematic diagram of the module composition of an authorization device based on a verifiable statement provided in one or more embodiments of this specification, the device is used to execute Figures 3 to 6 Describes the authorization method based on verifiable claims, such as Fig.15 As shown, the device comprises:

[0183] An acquisition module 401 is configured to acquire business type information of a verifiable declaration to be issued by a first user to a second user, and acquire a corresponding declaration authorization template according to the business type information;

[0184] A sending module 402 is configured to send the declaration authorization template to a client of the first user;

[0185] A receiving module 403 receives authorization related information provided by the first user based on the declared authorization template and returned by the client of the first user;

[0186] A first determination module 404, which determines whether to issue a verifiable statement to the second user according to the authorization related information;

[0187] The first generating module 405 generates a verifiable statement according to the authorization-related information and sends the statement to the client of the second user if the determination result of the first determining module 404 is yes.

[0188] In one or more embodiments of the present specification, by conducting online data interaction with a client, a verifiable declaration can be generated based on the authorization-related information sent by the client of the first user, so that the second user can act on behalf of the first user to handle the designated business of the first user based on the verifiable declaration, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the client of the second user in electronic form, the second user does not need to carry the signed paper authorization agreement when handling business on behalf of the first user, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0189] Optionally, the first determination module 404 determines whether the authorization-related information satisfies a preset risk control condition, and if so, confirms issuing a verifiable statement to the second user.

[0190] Optionally, the first determination module 404 uses a pre-trained detection model to detect the authorization-related information, and determines whether the authorization-related information meets a preset risk control condition according to the detection result; or

[0191] The authorization-related information is matched with the authorization blacklist stored in the blockchain through the first blockchain node, and it is determined whether the authorization-related information meets the preset risk control conditions according to the matching result.

[0192] Optionally, if the authorization-related information does not satisfy the risk control condition, the first determination module 404 confirms that a verifiable statement will not be issued to the second user, and returns a failed issuance result to the first user's client, so that the first user's client displays the failed issuance information.

[0193] Optionally, the acquisition module 401 acquires the associated declaration authorization template from the association record information between the business type information and the declaration authorization template according to the business type information; or,

[0194] According to the business type information, the associated template identifier is obtained in the association record information between the business type information and the template identifier of the declaration authorization template; and according to the obtained template identifier, the corresponding declaration authorization template is obtained from the declaration authorization template stored in the blockchain through the second blockchain node; wherein the declaration authorization template stored in the blockchain is uploaded by the business provider.

[0195] Optionally, the acquisition module 401 receives a request for issuing the verifiable statement sent by a client of the first user; wherein the request for issuing is used to request issuing a verifiable statement for granting business processing authority to the second user, so that the second user can process a designated business of the first user, and the request for issuing includes business type information of the designated business; and

[0196] The service type information is obtained from the issuance request.

[0197] Optionally, the device further includes: a second determining module;

[0198] The second determining module asks the first user through the client of the first user whether to grant the service processing authority to the second user;

[0199] The first generating module 405 generates a verifiable statement according to the authorization-related information if the second determining module confirms that the first user has granted the business processing authority to the second user.

[0200] Optionally, the second determination module generates inquiry information according to the authorization related information and / or the declared authorization template, the inquiry information including relevant information of the second user and relevant information of the designated service; and

[0201] The inquiry information is sent to the client of the first user to display an inquiry interface including relevant information of the second user and relevant information of the designated service on the client of the first user, so as to inquire whether the first user grants the service processing authority to the second user.

[0202] Optionally, the second determination module, if the security level of the designated service meets a preset condition and the confirmation authorization information returned by the client of the first user is obtained, performs identity authentication on the first user through the client of the first user; if the identity authentication is successful, confirms that the first user grants the service processing authority to the second user;

[0203] Alternatively, if the security level of the designated service does not meet the preset condition, and the confirmation authorization information returned by the client of the first user is obtained, it is confirmed that the first user grants the service processing authority to the second user.

[0204] Alternatively, if confirmation authorization information returned by the client of the first user is obtained, it is confirmed that the first user grants the business processing authority to the second user.

[0205] Optionally, the second determining module sends an identity authentication request to a client of the first user, so that the client of the first user collects the identity authentication information of the first user; and

[0206] The first user is authenticated according to the identity authentication information returned by the client of the first user.

[0207] Optionally, the device further comprises: a second generating module;

[0208] The second generating module generates issuance record information according to the verifiable statement; and

[0209] The issuance record information is sent to a third blockchain node so that the third blockchain node saves the issuance record information in the blockchain.

[0210] Optionally, the authorization-related information includes the digital identity information of the first user and the digital identity information of the second user;

[0211] The first generating module 405 acquires the business processing authority information to be granted from the authorization related information and / or the declared authorization template; and

[0212] generating a claim identifier for the verifiable claim;

[0213] Using the private key of the first user to sign the preset first designated information to obtain signature data;

[0214] A verifiable statement is generated according to the business processing authority information, the statement identifier, the signature data, the digital identity information of the first user, and the digital identity information of the second user.

[0215] Optionally, the sending module 402 sends a successful issuance result to the client of the first user after the first generating module 405 sends the verifiable statement to the client of the second user, so that the client of the first user displays successful issuance information.

[0216] The authorization device based on verifiable declaration provided in one or more embodiments of the present specification can generate a verifiable declaration based on the authorization-related information sent by the client of the first user through online data interaction with the client, so that the second user can act on behalf of the first user to handle the designated business of the first user based on the verifiable declaration, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the client of the second user in electronic form, the second user does not need to carry the signed paper authorization agreement when handling business on behalf of the first user, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0217] It should be noted that the embodiment of the authorization device based on a verifiable declaration in this specification and the embodiment of the authorization method based on a verifiable declaration in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the aforementioned corresponding implementation of the authorization method based on a verifiable declaration applied to the server, and the repeated parts will not be repeated.

[0218] Furthermore, corresponding to the above Figures 7 to 9 The authorization method based on verifiable declaration is described. Based on the same technical concept, one or more embodiments of this specification also provide an authorization device based on verifiable declaration, which is applied to the client of the first user. Fig.16 A schematic diagram of the module composition of an authorization device based on a verifiable statement provided in one or more embodiments of this specification, the device is used to execute Figures 7 to 9 Describes the authorization method based on verifiable claims, such as Fig.16 As shown, the device comprises:

[0219] A first sending module 501, in response to the issuance operation of the verifiable statement of the first user, sends a request for issuing the verifiable statement to the server; wherein the issuance request is used to request the issuance of a verifiable statement for granting business processing authority to the second user, so that the second user can process the designated business of the first user; the issuance request includes business type information of the designated business, so that the server obtains the corresponding statement authorization template according to the business type information;

[0220] A display module 502, which displays the declaration authorization template returned by the server;

[0221] An acquisition module 503 is configured to acquire authorization related information provided by the first user based on the declared authorization template;

[0222] The second sending module 504 sends the authorization related information to the server, so that the server generates a verifiable statement according to the authorization related information and sends it to the client of the second user.

[0223] In one or more embodiments of the present specification, online data interaction is performed with a server so that the server generates a verifiable declaration based on authorization-related information, so that the second user can act on behalf of the first user to handle the first user's designated business based on the verifiable declaration, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the second user's client in electronic form, the second user does not need to carry the signed paper authorization agreement when acting on behalf of the first user to handle business, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0224] Optionally, the acquisition module 503 determines corresponding candidate information when detecting a triggering operation of the first user on the item to be edited in the declaration authorization template; and

[0225] Displaying the candidate information, and displaying the target candidate information selected by the first user from the candidate information in the item to be edited;

[0226] If a submission operation of the first user is detected, the information displayed in each of the items to be edited is acquired to obtain the authorization-related information provided by the first user based on the declaration authorization template.

[0227] Optionally, the display module 502 receives inquiry information sent by the server, wherein the inquiry information includes relevant information of the second user and relevant information of the designated service; and

[0228] According to the inquiry information, displaying an inquiry interface for inquiring the first user whether to grant the business processing authority to the second user;

[0229] The second sending module 504 feeds back information to the server based on the operation of the first user, so that when the server confirms that the first user grants the business processing authority to the second user based on the feedback information, a verifiable statement is generated according to the authorization-related information.

[0230] Optionally, if the second sending module 504 detects the first user's confirmation authorization operation on the inquiry interface, it sends confirmation authorization information to the server; and if it receives an identity authentication request sent by the server, it performs an identity authentication operation on the first user and feeds back the identity authentication information to the server, so that the server authenticates the first user based on the identity authentication information.

[0231] Optionally, the display module 502 receives the issuance result sent by the server; and

[0232] The issuance success information or issuance failure information is displayed according to the issuance result.

[0233] The authorization device based on verifiable declaration provided in one or more embodiments of the present specification performs online data interaction with a server so that the server generates a verifiable declaration based on authorization-related information, so that the second user can act as an agent for the first user to handle the first user's designated business based on the verifiable declaration, without the need for the first user to conduct offline negotiations with the second user, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the second user's client in electronic form, the second user does not need to carry the signed paper authorization agreement when acting as an agent for the first user to handle business, which greatly improves convenience.

[0234] It should be noted that the embodiment of the authorization device based on a verifiable declaration in this specification and the embodiment of the authorization method based on a verifiable declaration in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the aforementioned corresponding implementation of the authorization method based on a verifiable declaration applied to the client of the first user, and the repeated parts will not be repeated.

[0235] Further, corresponding to the authorization method based on verifiable declaration described above, based on the same technical concept, one or more embodiments of this specification also provide an authorization system based on verifiable declaration, Fig.17 A schematic diagram of a composition of an authorization system based on verifiable claims provided for one or more embodiments of this specification, such as Fig.17 As shown, the system includes: a first user's client 601, a server 602 and a second user's client 603;

[0236] The client 601 of the first user, in response to the verifiable statement issuance operation of the first user, sends a request for issuing a verifiable statement to the server 602; wherein the issuance request is used to request the issuance of a verifiable statement granting a business processing authority to the second user, so that the second user can process the designated business of the first user; the issuance request includes business type information of the designated business; and, displays the statement authorization template returned by the server 602, obtains the authorization related information provided by the first user based on the statement authorization template, and sends the authorization related information to the server 602;

[0237] The server 602 obtains the service type information from the issuance request, obtains the corresponding declaration authorization template according to the service type information, and sends the declaration authorization template to the client 601 of the first user; and receives the authorization related information sent by the client 601 of the first user, confirms whether to issue a verifiable declaration to the second user according to the authorization related information, and if so, generates a verifiable declaration according to the authorization related information and sends it to the client 603 of the second user;

[0238] The client 603 of the second user receives the verifiable statement sent by the server 602 .

[0239] Optionally, the system further includes: a blockchain 604;

[0240] After generating the verifiable declaration, the server 602 generates issuance record information according to the verifiable declaration, and sends the issuance record information to the third blockchain node in the blockchain 604, so that the third blockchain node saves the authorization record information in the blockchain 604.

[0241] One or more embodiments of the present specification provide an authorization system based on a verifiable declaration. The server can generate a verifiable declaration based on the authorization-related information sent by the client of the first user by performing online data interaction with the client, so that the second user can act on behalf of the first user to handle the designated business of the first user based on the verifiable declaration, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization. At the same time, since the verifiable declaration can be stored in the client of the second user in electronic form, the second user does not need to carry the signed paper authorization agreement when handling business on behalf of the first user, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0242] It should be noted that the embodiments of the authorization system based on verifiable declaration in this specification and the embodiments of the authorization method based on verifiable declaration in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the aforementioned corresponding implementation of the authorization method based on verifiable declaration, and the repeated parts will not be repeated.

[0243] Further, corresponding to the authorization method based on verifiable declaration described above, based on the same technical concept, one or more embodiments of this specification also provide an authorization device based on verifiable declaration, which is used to execute the authorization method based on verifiable declaration. Fig.18 A schematic diagram of the structure of an authorization device based on a verifiable statement is provided for one or more embodiments of this specification.

[0244] like Fig.18 As shown, the authorization device based on the verifiable statement may have relatively large differences due to different configurations or performances, and may include one or more processors 701 and memory 702, and the memory 702 may store one or more storage applications or data. Among them, the memory 702 may be a short-term storage or a persistent storage. The application stored in the memory 702 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the authorization device based on the verifiable statement. Furthermore, the processor 701 may be configured to communicate with the memory 702, and execute a series of computer executable instructions in the memory 702 on the authorization device based on the verifiable statement. The authorization device based on the verifiable statement may also include one or more power supplies 703, one or more wired or wireless network interfaces 704, one or more input and output interfaces 705, one or more keyboards 706, etc.

[0245] In a specific embodiment, the authorization device based on verifiable claims includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions for the authorization device based on verifiable claims, and the one or more programs are configured to be executed by one or more processors, including computer executable instructions for performing the following:

[0246] Obtaining business type information of a verifiable statement to be issued by a first user to a second user, and obtaining a corresponding statement authorization template according to the business type information;

[0247] Sending the declaration authorization template to the client of the first user;

[0248] Receiving authorization related information provided by the first user based on the declaration authorization template and returned by the client of the first user;

[0249] Confirm whether to issue a verifiable statement to the second user according to the authorization-related information; if so, generate a verifiable statement according to the authorization-related information and send it to the client of the second user.

[0250] In one or more embodiments of the present specification, by conducting online data interaction with a client, a verifiable declaration can be generated based on the authorization-related information sent by the client of the first user, so that the second user can act on behalf of the first user to handle the designated business of the first user based on the verifiable declaration, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the client of the second user in electronic form, the second user does not need to carry the signed paper authorization agreement when handling business on behalf of the first user, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0251] Optionally, when the computer executable instructions are executed, the confirming whether to issue a verifiable statement to the second user according to the authorization related information includes:

[0252] Determine whether the authorization-related information meets the preset risk control conditions;

[0253] If the risk control condition is met, confirming that a verifiable statement is issued to the second user.

[0254] Optionally, when the computer executable instruction is executed, determining whether the authorization related information meets a preset risk control condition includes:

[0255] Using a pre-trained detection model to detect the authorization-related information, and determining whether the authorization-related information meets a preset risk control condition based on the detection result; or,

[0256] The authorization-related information is matched with the authorization blacklist stored in the blockchain through the first blockchain node, and it is determined whether the authorization-related information meets the preset risk control conditions according to the matching result.

[0257] Optionally, when the computer executable instructions are executed, the method further comprises:

[0258] If the authorization-related information does not meet the risk control condition, it is confirmed that the verifiable statement will not be issued to the second user, and a failed issuance result is returned to the client of the first user, so that the client of the first user displays the issuance failure information.

[0259] Optionally, when the computer executable instruction is executed, obtaining a corresponding declaration authorization template according to the business type information includes:

[0260] According to the service type information, obtaining the associated declaration authorization template from the association record information between the service type information and the declaration authorization template; or,

[0261] According to the business type information, the associated template identifier is obtained in the association record information between the business type information and the template identifier of the declaration authorization template; and according to the obtained template identifier, the corresponding declaration authorization template is obtained from the declaration authorization template stored in the blockchain through the second blockchain node; wherein the declaration authorization template stored in the blockchain is uploaded by the business provider.

[0262] Optionally, when the computer executable instructions are executed, obtaining the business type information of the verifiable declaration to be issued by the first user to the second user includes:

[0263] receiving a request for issuing the verifiable statement sent by a client of the first user; wherein the request for issuing is used to request issuing a verifiable statement for granting a business processing authority to the second user, so that the second user can process a designated business of the first user, and the request for issuing includes business type information of the designated business;

[0264] The service type information is obtained from the issuance request.

[0265] Optionally, when the computer executable instructions are executed, generating a verifiable statement according to the authorization related information includes:

[0266] Inquiring, through the client of the first user, the first user whether to grant the service processing authority to the second user;

[0267] If it is confirmed that the first user has granted the business processing authority to the second user, a verifiable statement is generated according to the authorization-related information.

[0268] Optionally, when the computer executable instructions are executed, asking the first user through the client of the first user whether to grant the business processing authority to the second user includes:

[0269] Generate inquiry information according to the authorization related information and / or the declared authorization template, the inquiry information including relevant information of the second user and relevant information of the designated service;

[0270] The inquiry information is sent to the client of the first user to display an inquiry interface including relevant information of the second user and relevant information of the designated service on the client of the first user, so as to inquire whether the first user grants the service processing authority to the second user.

[0271] Optionally, when the computer executable instructions are executed, the confirming that the first user grants the business processing authority to the second user includes:

[0272] If the security level of the designated service meets the preset conditions and the confirmation authorization information returned by the client of the first user is obtained, the identity authentication of the first user is performed through the client of the first user; if the identity authentication is successful, it is confirmed that the first user grants the service processing authority to the second user;

[0273] Alternatively, if the security level of the designated service does not meet the preset condition, and the confirmation authorization information returned by the client of the first user is obtained, it is confirmed that the first user grants the service processing authority to the second user.

[0274] Alternatively, if confirmation authorization information returned by the client of the first user is obtained, it is confirmed that the first user grants the business processing authority to the second user.

[0275] Optionally, when the computer executable instructions are executed, authenticating the first user through the client of the first user includes:

[0276] Sending an identity authentication request to a client of the first user, so that the client of the first user collects the identity authentication information of the first user;

[0277] The first user is authenticated according to the identity authentication information returned by the client of the first user.

[0278] Optionally, when the computer executable instructions are executed, after generating a verifiable statement according to the authorization related information, the instructions further include:

[0279] generating issuance record information based on the verifiable statement;

[0280] The issuance record information is sent to a third blockchain node so that the third blockchain node saves the issuance record information in the blockchain.

[0281] Optionally, when the computer executable instructions are executed, the authorization related information includes the digital identity information of the first user and the digital identity information of the second user;

[0282] Generating a verifiable statement according to the authorization-related information includes:

[0283] Acquire the business processing authority information to be granted from the authorization related information and / or the declared authorization template;

[0284] generating a claim identifier for the verifiable claim;

[0285] Using the private key of the first user to sign the preset first designated information to obtain signature data;

[0286] A verifiable statement is generated according to the business processing authority information, the statement identifier, the signature data, the digital identity information of the first user, and the digital identity information of the second user.

[0287] Optionally, when the computer executable instructions are executed, after sending the instructions to the client of the second user, the instructions further include:

[0288] The issuance result of successful issuance is sent to the client of the first user, so that the client of the first user displays issuance success information.

[0289] The authorization device based on verifiable declaration provided by one or more embodiments of the present specification can generate a verifiable declaration based on the authorization-related information sent by the client of the first user through online data interaction with the client, so that the second user can act on behalf of the first user to handle the designated business of the first user based on the verifiable declaration, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the client of the second user in electronic form, the second user does not need to carry the signed paper authorization agreement when handling business on behalf of the first user, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0290] In another specific embodiment, a verifiable statement-based authorization device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions for the verifiable statement-based authorization device, and the one or more programs are configured to be executed by one or more processors, including computer executable instructions for performing the following:

[0291] In response to the issuance operation of the verifiable statement of the first user, sending a request for issuing the verifiable statement to the server; wherein the issuance request is used to request the issuance of a verifiable statement for granting business processing authority to the second user, so that the second user can process the designated business of the first user; the issuance request includes business type information of the designated business, so that the server obtains the corresponding statement authorization template according to the business type information;

[0292] Displaying the declaration authorization template returned by the server, and obtaining authorization-related information provided by the first user based on the declaration authorization template;

[0293] The authorization-related information is sent to the server, so that the server generates a verifiable statement according to the authorization-related information and sends it to the client of the second user.

[0294] In one or more embodiments of the present specification, online data interaction is performed with a server so that the server generates a verifiable declaration based on authorization-related information, so that the second user can act on behalf of the first user to handle the first user's designated business based on the verifiable declaration, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the second user's client in electronic form, the second user does not need to carry the signed paper authorization agreement when acting on behalf of the first user to handle business, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0295] Optionally, when the computer executable instructions are executed, obtaining authorization related information provided by the first user based on the declaration authorization template includes:

[0296] When detecting a triggering operation of the first user on the item to be edited in the declaration authorization template, determining corresponding candidate information;

[0297] Displaying the candidate information, and displaying the target candidate information selected by the first user from the candidate information in the item to be edited;

[0298] If a submission operation of the first user is detected, the information displayed in each of the items to be edited is acquired to obtain the authorization-related information provided by the first user based on the declaration authorization template.

[0299] Optionally, when the computer executable instructions are executed, after sending the authorization related information to the server, the instructions further include:

[0300] Receiving inquiry information sent by the server, wherein the inquiry information includes relevant information of the second user and relevant information of the designated service;

[0301] According to the inquiry information, displaying an inquiry interface for inquiring the first user whether to grant the business processing authority to the second user;

[0302] Feedback information is provided to the server based on the operation of the first user, so that when the server confirms based on the feedback information that the first user has granted the business processing authority to the second user, a verifiable statement is generated according to the authorization-related information.

[0303] Optionally, when the computer executable instruction is executed, the security level of the designated service meets a preset condition, and the feeding back information to the server based on the operation of the first user includes:

[0304] If a confirmation authorization operation of the first user on the inquiry interface is detected, confirmation authorization information is sent to the server; and if an identity authentication request sent by the server is received, an identity authentication operation on the first user is performed, and identity authentication information is fed back to the server, so that the server authenticates the first user based on the identity authentication information.

[0305] Optionally, when the computer executable instructions are executed, after sending the authorization related information to the server, the instructions further include:

[0306] Receiving the issuance result sent by the server;

[0307] The issuance success information or issuance failure information is displayed according to the issuance result.

[0308] The authorization device based on verifiable declaration provided in one or more embodiments of the present specification performs online data interaction with a server so that the server generates a verifiable declaration based on authorization-related information, so that the second user can act on behalf of the first user to handle the designated business of the first user based on the verifiable declaration, without the need for the first user to conduct offline negotiations with the second user, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the second user's client in electronic form, the second user does not need to carry the signed paper authorization agreement when acting on behalf of the first user to handle business, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0309] It should be noted that the embodiment of the authorization device based on a verifiable declaration in this specification and the embodiment of the authorization method based on a verifiable declaration in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the aforementioned corresponding implementation of the authorization method based on a verifiable declaration, and the repeated parts will not be repeated.

[0310] Furthermore, corresponding to the authorization method based on verifiable declaration described above, based on the same technical concept, one or more embodiments of this specification further provide a storage medium for storing computer executable instructions. In a specific embodiment, the storage medium may be a USB flash drive, an optical disk, a hard disk, etc. When the computer executable instructions stored in the storage medium are executed by the processor, the following process can be implemented:

[0311] Obtaining business type information of a verifiable statement to be issued by a first user to a second user, and obtaining a corresponding statement authorization template according to the business type information;

[0312] Sending the declaration authorization template to the client of the first user;

[0313] Receiving authorization related information provided by the first user based on the declaration authorization template and returned by the client of the first user;

[0314] Confirm whether to issue a verifiable statement to the second user according to the authorization-related information; if so, generate a verifiable statement according to the authorization-related information and send it to the client of the second user.

[0315] In one or more embodiments of the present specification, by conducting online data interaction with a client, a verifiable declaration can be generated based on the authorization-related information sent by the client of the first user, so that the second user can act on behalf of the first user to handle the designated business of the first user based on the verifiable declaration, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the client of the second user in electronic form, the second user does not need to carry the signed paper authorization agreement when handling business on behalf of the first user, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0316] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the confirming whether to issue a verifiable statement to the second user according to the authorization-related information includes:

[0317] Determine whether the authorization-related information meets the preset risk control conditions;

[0318] If the risk control condition is met, confirming that a verifiable statement is issued to the second user.

[0319] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, determining whether the authorization-related information meets a preset risk control condition includes:

[0320] Using a pre-trained detection model to detect the authorization-related information, and determining whether the authorization-related information meets a preset risk control condition based on the detection result; or,

[0321] The authorization-related information is matched with the authorization blacklist stored in the blockchain through the first blockchain node, and it is determined whether the authorization-related information meets the preset risk control conditions according to the matching result.

[0322] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the method further includes:

[0323] If the authorization-related information does not meet the risk control condition, it is confirmed that the verifiable statement will not be issued to the second user, and a failed issuance result is returned to the client of the first user, so that the client of the first user displays the issuance failure information.

[0324] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, obtaining a corresponding declaration authorization template according to the business type information includes:

[0325] According to the service type information, obtaining the associated declaration authorization template from the association record information between the service type information and the declaration authorization template; or,

[0326] According to the business type information, the associated template identifier is obtained in the association record information between the business type information and the template identifier of the declaration authorization template; and according to the obtained template identifier, the corresponding declaration authorization template is obtained from the declaration authorization template stored in the blockchain through the second blockchain node; wherein the declaration authorization template stored in the blockchain is uploaded by the business provider.

[0327] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the step of obtaining the business type information of the verifiable declaration to be issued by the first user to the second user includes:

[0328] receiving a request for issuing the verifiable statement sent by a client of the first user; wherein the request for issuing is used to request issuing a verifiable statement for granting a business processing authority to the second user, so that the second user can process a designated business of the first user, and the request for issuing includes business type information of the designated business;

[0329] The service type information is obtained from the issuance request.

[0330] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, generating a verifiable statement according to the authorization-related information includes:

[0331] Inquiring, through the client of the first user, the first user whether to grant the service processing authority to the second user;

[0332] If it is confirmed that the first user has granted the business processing authority to the second user, a verifiable statement is generated according to the authorization-related information.

[0333] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the step of asking the first user through the client of the first user whether to grant the service processing authority to the second user includes:

[0334] Generate inquiry information according to the authorization related information and / or the declared authorization template, the inquiry information including relevant information of the second user and relevant information of the designated service;

[0335] The inquiry information is sent to the client of the first user to display an inquiry interface including relevant information of the second user and relevant information of the designated service on the client of the first user, so as to inquire whether the first user grants the service processing authority to the second user.

[0336] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the confirming that the first user grants the business processing authority to the second user includes:

[0337] If the security level of the designated service meets the preset conditions and the confirmation authorization information returned by the client of the first user is obtained, the identity authentication of the first user is performed through the client of the first user; if the identity authentication is successful, it is confirmed that the first user grants the service processing authority to the second user;

[0338] Alternatively, if the security level of the designated service does not meet the preset condition, and the confirmation authorization information returned by the client of the first user is obtained, it is confirmed that the first user grants the service processing authority to the second user.

[0339] Alternatively, if confirmation authorization information returned by the client of the first user is obtained, it is confirmed that the first user grants the business processing authority to the second user.

[0340] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, authenticating the first user through the client of the first user includes:

[0341] Sending an identity authentication request to a client of the first user, so that the client of the first user collects the identity authentication information of the first user;

[0342] The first user is authenticated according to the identity authentication information returned by the client of the first user.

[0343] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, after generating a verifiable statement according to the authorization-related information, the instructions further include:

[0344] generating issuance record information based on the verifiable statement;

[0345] The issuance record information is sent to a third blockchain node so that the third blockchain node saves the issuance record information in the blockchain.

[0346] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the authorization-related information includes the digital identity information of the first user and the digital identity information of the second user;

[0347] Generating a verifiable statement according to the authorization-related information includes:

[0348] Acquire the business processing authority information to be granted from the authorization related information and / or the declared authorization template;

[0349] generating a claim identifier for the verifiable claim;

[0350] Using the private key of the first user to sign the preset first designated information to obtain signature data;

[0351] A verifiable statement is generated according to the business processing authority information, the statement identifier, the signature data, the digital identity information of the first user, and the digital identity information of the second user.

[0352] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, after sending the instructions to the client of the second user, the instructions further include:

[0353] The issuance result of successful issuance is sent to the client of the first user, so that the client of the first user displays issuance success information.

[0354] When the computer executable instructions stored in the storage medium provided in one or more embodiments of the present specification are executed by the processor, a verifiable declaration can be generated based on the authorization-related information sent by the client of the first user through online data interaction with the client of the first user, so that the second user can act on behalf of the first user to handle the designated business of the first user based on the verifiable declaration, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the client of the second user in electronic form, the second user does not need to carry the signed paper authorization agreement when handling business on behalf of the first user, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0355] In another specific embodiment, the storage medium may be a USB flash drive, an optical disk, a hard disk, etc. When the computer executable instructions stored in the storage medium are executed by the processor, the following process can be implemented:

[0356] In response to the issuance operation of the verifiable statement of the first user, sending a request for issuing the verifiable statement to the server; wherein the issuance request is used to request the issuance of a verifiable statement for granting business processing authority to the second user, so that the second user can process the designated business of the first user; the issuance request includes business type information of the designated business, so that the server obtains the corresponding statement authorization template according to the business type information;

[0357] Displaying the declaration authorization template returned by the server, and obtaining authorization-related information provided by the first user based on the declaration authorization template;

[0358] The authorization-related information is sent to the server, so that the server generates a verifiable statement according to the authorization-related information and sends it to the client of the second user.

[0359] In one or more embodiments of the present specification, online data interaction is performed with a server so that the server generates a verifiable declaration based on authorization-related information, so that the second user can act on behalf of the first user to handle the first user's designated business based on the verifiable declaration, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable declaration can be stored in the second user's client in electronic form, the second user does not need to carry the signed paper authorization agreement when acting on behalf of the first user to handle business, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0360] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, obtaining the authorization related information provided by the first user based on the declaration authorization template includes:

[0361] When detecting a triggering operation of the first user on the item to be edited in the declaration authorization template, determining corresponding candidate information;

[0362] Displaying the candidate information, and displaying the target candidate information selected by the first user from the candidate information in the item to be edited;

[0363] If a submission operation of the first user is detected, the information displayed in each of the items to be edited is acquired to obtain the authorization-related information provided by the first user based on the declaration authorization template.

[0364] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, after sending the authorization related information to the server, the following further comprises:

[0365] Receiving inquiry information sent by the server, wherein the inquiry information includes relevant information of the second user and relevant information of the designated service;

[0366] According to the inquiry information, displaying an inquiry interface for inquiring the first user whether to grant the business processing authority to the second user;

[0367] Feedback information is provided to the server based on the operation of the first user, so that when the server confirms based on the feedback information that the first user has granted the business processing authority to the second user, a verifiable statement is generated according to the authorization-related information.

[0368] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the security level of the designated service meets a preset condition, and the feeding back information to the server based on the operation of the first user includes:

[0369] If a confirmation authorization operation of the first user on the inquiry interface is detected, confirmation authorization information is sent to the server; and if an identity authentication request sent by the server is received, an identity authentication operation on the first user is performed, and identity authentication information is fed back to the server, so that the server authenticates the first user based on the identity authentication information.

[0370] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, after sending the authorization related information to the server, the following further comprises:

[0371] Receiving the issuance result sent by the server;

[0372] The issuance success information or issuance failure information is displayed according to the issuance result.

[0373] When the computer executable instructions stored in the storage medium provided in one or more embodiments of the present specification are executed by the processor, they interact with the server online so that the server generates a verifiable statement based on the authorization-related information, so that the second user can act on behalf of the first user to handle the first user's designated business based on the verifiable statement, without the need for the first user and the second user to conduct offline negotiations, sign paper agreements, etc., thereby improving the efficiency of proxy authorization; at the same time, since the verifiable statement can be stored in the second user's client in electronic form, the second user does not need to carry the signed paper authorization agreement when handling business on behalf of the first user, which not only improves convenience, but also reduces the use of consumables such as paper, which can save energy and reduce costs, and is environmentally friendly and hygienic, which is conducive to improving social benefits.

[0374] It should be noted that the embodiment of the storage medium in this specification and the embodiment of the authorization method based on verifiable declaration in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the aforementioned corresponding implementation of the authorization method based on verifiable declaration, and the repeated parts will not be repeated.

[0375] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0376] In the 1930s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0377] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0378] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0379] For the convenience of description, the above devices are described in terms of functions and are divided into various units. Of course, when implementing the embodiments of this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0380] It should be understood by those skilled in the art that one or more embodiments of this specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0381] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0382] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0383] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0384] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0385] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0386] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0387] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0388] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0389] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0390] The above description is only an embodiment of this document and is not intended to limit this document. For those skilled in the art, this document may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this document should be included in the scope of the claims of this document.

Claims

1. An authorization method based on verifiable claims, applied to the server, include: Obtaining business type information of a verifiable declaration to be issued by a first user to a second user, and obtaining a corresponding declaration authorization template from a blockchain according to the business type information; wherein the declaration authorization template stored in the blockchain is provided by a business provider; Sending the declaration authorization template to the client of the first user; Receiving authorization related information provided by the first user based on the declaration authorization template and returned by the client of the first user; Determine whether the authorization-related information contains preset sensitive information; if not, generate a verifiable statement based on the authorization-related information and send it to the client of the second user, so that the second user can provide the verifiable statement to the service provider when processing the designated service of the first user.

2. The method according to claim 1, wherein determining whether the authorization-related information contains preset sensitive information, include: Using a pre-trained detection model to detect the authorization-related information, and determining whether the authorization-related information contains preset sensitive information based on the detection result; or, The authorization-related information is matched with the authorization blacklist stored in the blockchain through the first blockchain node, and it is determined whether the authorization-related information contains preset sensitive information according to the matching result.

3. The method according to claim 1, further comprising: include: If it is determined that the authorization-related information contains preset sensitive information, it is confirmed that the verifiable statement will not be issued to the second user, and the issuance result of failure is returned to the client of the first user, so that the client of the first user displays the issuance failure information.

4. The method according to claim 1, wherein the corresponding declaration authorization template is obtained from the blockchain according to the business type information, include: According to the service type information, obtaining the associated template identifier in the association record information between the service type information and the template identifier of the declared authorization template; And, according to the obtained template identifier, the corresponding declaration authorization template is obtained from the declaration authorization template stored in the blockchain through the second blockchain node.

5. The method according to claim 1, wherein obtaining the service type information of the verifiable declaration to be issued by the first user to the second user, include: receiving a request for issuing the verifiable statement sent by a client of the first user; wherein the request for issuing is used to request issuing a verifiable statement for granting a business processing authority to the second user, so that the second user can process a designated business of the first user, and the request for issuing includes business type information of the designated business; The service type information is obtained from the issuance request.

6. The method according to claim 5, wherein a verifiable statement is generated based on the authorization-related information and sent to the client of the second user, include: Generate inquiry information according to the authorization related information and / or the declared authorization template, the inquiry information including relevant information of the second user and relevant information of the designated service; Sending the inquiry information to the client of the first user, so as to display an inquiry interface including relevant information of the second user and relevant information of the designated service on the client of the first user, so as to inquire the first user whether to grant the service processing authority to the second user; If it is confirmed that the first user has granted the business processing authority to the second user, a verifiable statement is generated according to the authorization-related information and sent to the client of the second user.

7. The method according to claim 6, wherein the step of confirming that the first user grants the service processing authority to the second user, include: If the security level of the designated service meets the preset conditions and the confirmation authorization information returned by the client of the first user is obtained, the identity authentication of the first user is performed through the client of the first user; If the identity authentication is passed, confirming that the first user has granted the business processing authority to the second user; Alternatively, if the security level of the designated service does not meet the preset condition, and the confirmation authorization information returned by the client of the first user is obtained, then confirming that the first user grants the service processing authority to the second user; Alternatively, if confirmation authorization information returned by the client of the first user is obtained, it is confirmed that the first user grants the business processing authority to the second user.

8. The method according to claim 7, wherein the identity authentication of the first user is performed through a client of the first user, include: Sending an identity authentication request to a client of the first user, so that the client of the first user collects the identity authentication information of the first user; The first user is authenticated according to the identity authentication information returned by the client of the first user.

9. The method according to claim 1, after generating a verifiable statement based on the authorization-related information, further comprising: include: generating issuance record information based on the verifiable statement; The issuance record information is sent to a third blockchain node so that the third blockchain node saves the issuance record information in the blockchain.

10. The method according to claim 1, wherein the authorization-related information includes digital identity information of the first user and digital identity information of the second user; generating a verifiable statement based on the authorization related information, include: Acquire the business processing authority information to be granted from the authorization related information and / or the declared authorization template; generating a claim identifier for the verifiable claim; Using the private key of the first user to sign the preset first designated information to obtain signature data; A verifiable statement is generated according to the business processing authority information, the statement identifier, the signature data, the digital identity information of the first user, and the digital identity information of the second user.

11. The method according to any one of claims 1 to 10, further comprising: include: The issuance result of successful issuance is sent to the client of the first user, so that the client of the first user displays issuance success information.

12. An authorization method based on a verifiable statement, applied to a client of a first user, include: In response to the issuance operation of the verifiable statement of the first user, a request for issuance of the verifiable statement is sent to the server; wherein the issuance request is used to request the issuance of a verifiable statement granting business processing authority to the second user, so that the second user provides the verifiable statement to the business provider of the designated business when processing the designated business of the first user; the issuance request includes the business type information of the designated business, so that the server obtains the corresponding statement authorization template from the blockchain according to the business type information; the statement authorization template stored in the blockchain is provided by the business provider; Displaying the declaration authorization template returned by the server, and obtaining authorization-related information provided by the first user based on the declaration authorization template; The authorization-related information is sent to the server, so that the server generates a verifiable statement according to the authorization-related information and sends it to the client of the second user.

13. The method according to claim 12, wherein obtaining authorization related information provided by the first user based on the declaration authorization template, include: When detecting a triggering operation of the first user on the item to be edited in the declaration authorization template, determining corresponding candidate information; Displaying the candidate information, and displaying the target candidate information selected by the first user from the candidate information in the item to be edited; If a submission operation of the first user is detected, the information displayed in each of the items to be edited is acquired to obtain the authorization-related information provided by the first user based on the declaration authorization template.

14. The method according to claim 12, wherein the security level of the designated service meets a preset condition, and the information is fed back to the server based on the operation of the first user. include: receiving the inquiry information sent by the server, and displaying, according to the inquiry information, an inquiry interface for inquiring the first user whether to grant the business processing authority to the second user; If a confirmation authorization operation of the first user on the inquiry interface is detected, sending confirmation authorization information to the server; And, if an identity authentication request sent by the server is received, an identity authentication operation for the first user is performed, and identity authentication information is fed back to the server, so that the server authenticates the first user based on the identity authentication information.

15. The method according to any one of claims 12 to 14, after sending the authorization related information to the server, further include: Receiving the issuance result sent by the server; The issuance success information or issuance failure information is displayed according to the issuance result.

16. An authorization device based on a verifiable statement, applied to a server, include: An acquisition module, which acquires business type information of a verifiable declaration to be issued by a first user to a second user, and acquires a corresponding declaration authorization template from a blockchain according to the business type information; wherein the declaration authorization template stored in the blockchain is provided by a business provider; A sending module, configured to send the declaration authorization template to a client of the first user; A receiving module, configured to receive authorization related information provided by the first user based on the declared authorization template and returned by a client of the first user; A first determination module, which determines whether the authorization-related information contains preset sensitive information; A generation module generates a verifiable statement based on the authorization-related information and sends it to the client of the second user if the determination result of the first determination module is no, so that the second user can provide the verifiable statement to the service provider when processing the designated service of the first user.

17. The device according to claim 16, The acquisition module acquires, according to the business type information, an associated template identifier in the association record information between the business type information and the template identifier of the declaration authorization template; and, according to the acquired template identifier, acquires a corresponding declaration authorization template from the declaration authorization template stored in the blockchain through the second blockchain node; in, The declaration authorization template stored in the blockchain is uploaded by the service provider.

18. An authorization device based on a verifiable statement, applied to a client of a first user, include: A first sending module, in response to the issuance operation of the verifiable statement of the first user, sends a request for issuing the verifiable statement to the server; wherein the issuance request is used to request the issuance of a verifiable statement for granting business processing authority to the second user, so that the second user provides the verifiable statement to the business provider of the designated business when processing the designated business of the first user; the issuance request includes the business type information of the designated business, so that the server obtains the corresponding statement authorization template from the blockchain according to the business type information; the statement authorization template stored in the blockchain is provided by the business provider; A display module, which displays the declaration authorization template returned by the server; An acquisition module, configured to acquire authorization related information provided by the first user based on the declaration authorization template; The second sending module sends the authorization related information to the server, so that the server generates a verifiable statement according to the authorization related information and sends it to the client of the second user.

19. The device according to claim 18, The acquisition module, when detecting a triggering operation of the first user on the item to be edited in the declaration authorization template, determines the corresponding candidate information ； as well as, Displaying the candidate information, and displaying the target candidate information selected by the first user from the candidate information in the item to be edited; If a submission operation of the first user is detected, the information displayed in each of the items to be edited is acquired to obtain the authorization-related information provided by the first user based on the declaration authorization template.

20. An authorization system based on verifiable claims, include: The client of the first user, the server, and the client of the second user; The client of the first user, in response to the verifiable statement issuance operation of the first user, sends a request for issuing a verifiable statement to the server; wherein the issuance request is used to request the issuance of a verifiable statement granting a business processing authority to the second user, so that the second user provides the verifiable statement to the business provider of the designated business when processing the designated business of the first user; the issuance request includes business type information of the designated business; and, displays the statement authorization template returned by the server, obtains authorization related information provided by the first user based on the statement authorization template, and sends the authorization related information to the server; The server obtains business type information from the issuance request, and obtains a corresponding declaration authorization template from the blockchain according to the business type information, wherein the declaration authorization template stored in the blockchain is provided by the business provider; sends the declaration authorization template to the client of the first user; and receives the authorization-related information sent by the client of the first user, determines whether the authorization-related information contains preset sensitive information, and if not, generates a verifiable declaration according to the authorization-related information and sends it to the client of the second user; The client of the second user receives the verifiable statement sent by the server.

21. An authorization device based on a verifiable claim, include: processor; as well as, a memory arranged to store computer executable instructions which, when executed, cause the processor to: Obtaining business type information of a verifiable declaration to be issued by a first user to a second user, and obtaining a corresponding declaration authorization template from a blockchain according to the business type information; wherein the declaration authorization template stored in the blockchain is provided by a business provider; Sending the declaration authorization template to the client of the first user; Receiving authorization related information provided by the first user based on the declaration authorization template and returned by the client of the first user; Determine whether the authorization-related information contains preset sensitive information; if not, generate a verifiable statement based on the authorization-related information and send it to the client of the second user, so that the second user can provide the verifiable statement to the service provider when processing the designated service of the first user.

22. An authorization device based on a verifiable claim, include: processor; as well as; a memory arranged to store computer executable instructions which, when executed, cause the processor to: In response to the issuance operation of the verifiable statement of the first user, a request for issuance of the verifiable statement is sent to the server; wherein the issuance request is used to request the issuance of a verifiable statement granting business processing authority to the second user, so that the second user provides the verifiable statement to the business provider of the designated business when processing the designated business of the first user; the issuance request includes the business type information of the designated business, so that the server obtains the corresponding statement authorization template from the blockchain according to the business type information; the statement authorization template stored in the blockchain is provided by the business provider; Displaying the declaration authorization template returned by the server, and obtaining authorization-related information provided by the first user based on the declaration authorization template; The authorization-related information is sent to the server, so that the server generates a verifiable statement according to the authorization-related information and sends it to the client of the second user.

23. A storage medium for storing computer executable instructions, wherein the computer executable instructions implement the following process when executed: Obtaining business type information of a verifiable declaration to be issued by the first user to the second user, and obtaining a corresponding declaration authorization template from the blockchain according to the business type information; in, The declaration authorization template stored in the blockchain is provided by a service provider; Sending the declaration authorization template to the client of the first user; Receiving authorization related information provided by the first user based on the declaration authorization template and returned by the client of the first user; Determine whether the authorization-related information contains preset sensitive information; if not, generate a verifiable statement based on the authorization-related information and send it to the client of the second user, so that the second user can provide the verifiable statement to the service provider when processing the designated service of the first user.

24. A storage medium for storing computer executable instructions, wherein the computer executable instructions implement the following process when executed: In response to the issuance operation of the verifiable statement of the first user, sending a request for issuance of the verifiable statement to the server; in, The issuance request is used to request the issuance of a verifiable statement granting business processing authority to the second user, so that the second user provides the verifiable statement to the business provider of the designated business when processing the designated business of the first user; the issuance request includes the business type information of the designated business, so that the server obtains the corresponding statement authorization template from the blockchain according to the business type information; The declaration authorization template stored in the blockchain is provided by a service provider; Displaying the declaration authorization template returned by the server, and obtaining authorization-related information provided by the first user based on the declaration authorization template; The authorization-related information is sent to the server, so that the server generates a verifiable statement according to the authorization-related information and sends it to the client of the second user.

Images