A digital identity application method of root legal identity

Abstract

The application relates to a digital identity application method of a root legal identity, which comprises the following steps: an application party acquires a digital identity file; the digital identity file contains an account identity identifier and a real-name identity identifier, and the account identity identifier is obtained by mapping the real-name identity identifier; the application party sends the digital identity file to a digital identity service party and requests service data; the digital identity service party acquires the account identity identifier by using the digital identity file; the digital identity service party acquires the service data according to the account identity identifier; and the digital identity service party returns the account identity identifier and the service data to the application party.

Description

TECHNICAL FIELD

[0001] The application relates to a digital identity application method of a root legal identity, and belongs to the field of digital identity. BACKGROUND

[0002] Digital identity is divided into real-name identity and account identity. The real-name identity contains social attributes such as the name, ID number and passport number of an entity, is based on legal documents, and can distinguish a certain entity in a legal sense. The account identity only needs to distinguish a user of an application system, for example, an identifier composed of a single word or meaningless string. In most cases, the application system does not need to know the real name and ID number of the user. However, in some application scenarios, the system service needs both the real-name identity and the account identity.

[0003] The existing application system manually binds the real-name identity and the account identity of the user. However, the user can bind the business system identity of the user into the real-name identity of another person, and the system cannot ensure that the real-name identity and the account identity are of the same person.

[0004] Therefore, a method for ensuring the reliability of the correspondence between the real-name identity and the account identity of the user is needed.

[0005] The patent with the publication number CN107729727A discloses a real-name authentication method and device for an account, which includes the following steps: receiving an authentication request for real-name authentication of a target account by a target user; obtaining account historical data corresponding to the target account; judging whether the target user is a binding user of the target account according to the account historical data; and if yes, performing real-name authentication on the target account by using real-name authentication data currently uploaded by the target user. The method judges whether the account is bound according to the account historical data, and ensures the reliability of real-name authentication. SUMMARY

[0006] In order to overcome the problems in the prior art, the application discloses a digital identity application method of a root legal identity. The real-name identity is mapped to the account identity of the application system by using an encryption algorithm instead of being manually bound by the user at a later stage, the binding relationship between the real-name identity and the account identity is established, and it is ensured that the real-name identity and the account identity correspond to the same user.

[0007] In order to achieve the above purpose, the application adopts the following technical scheme:

[0008] Technical scheme one

[0009] A digital identity application method of a root legal identity includes the following steps:

[0010] The application obtains a digital identity file; the digital identity file comprises an account identity and a real-name identity, and the account identity is mapped from the real-name identity;

[0011] The application sends the digital identity file to a digital identity service and requests service data;

[0012] The digital identity service obtains the account identity by using the digital identity file;

[0013] The digital identity service obtains the service data according to the account identity;

[0014] The digital identity service returns the account identity and the service data to the application.

[0015] Further, the digital identity file comprises A segment data, B segment data and S segment data, the A segment data comprises a network identity certificate, the B segment data comprises the account identity, and the S segment data comprises a signature value of a splicing result of the A segment data and the B segment data; the network identity certificate comprises the real-name identity.

[0016] Further, the digital identity service verifies the validity of the digital identity file.

[0017] Further, the obtaining of the account identity by using the digital identity file comprises:

[0018] The digital identity service parses the A segment data in the digital identity file to obtain the network identity certificate;

[0019] The network identity certificate is verified; after the verification of the network identity certificate is passed, the network identity certificate is parsed to obtain the real-name identity;

[0020] The digital identity service maps the real-name identity to the account identity according to a preset mapping algorithm.

[0021] Further, the obtaining of the account identity by using the digital identity file comprises:

[0022] The digital identity service parses the B segment data in the digital identity file to obtain the account identity; the account identity is verified, and the account identity that fails the verification is discarded.

[0023] Further, the method further comprises:

[0024] An authentication factor is obtained; the network identity certificate and the authentication factor are verified for matching; if the network identity certificate and the authentication factor match, the network identity certificate is parsed to obtain the real-name identity.

[0025] Technical solution two:

[0026] A digital identity application method of a root legal identity, applied to a first client / first server, comprising the following steps:

[0027] Obtaining a digital identity file; the digital identity file contains an account identity identifier and a real-name identity identifier, and the account identity identifier is mapped from the real-name identity identifier;

[0028] Sending the digital identity file to a digital identity service party and requesting business data;

[0029] Receiving the account identity identifier and the business data returned by the digital identity service party.

[0030] Further, the digital identity file includes A segment data, B segment data and S segment data, the A segment data includes a network identity certificate, the B segment data includes an account identity identifier, and the S segment data includes a signature value of a splicing result of the A segment data and the B segment data; the network identity certificate contains a real-name identity identifier.

[0031] Further, it further includes: the digital identity service party verifies the validity of the digital identity file.

[0032] Further, the account identity identifier is obtained by using the digital identity file, specifically:

[0033] The digital identity service party parses the A segment data in the digital identity file to obtain a network identity certificate;

[0034] Verifying the network identity certificate; after the network identity certificate verification is passed, the network identity certificate is parsed to obtain a real-name identity identifier;

[0035] The digital identity service party maps the real-name identity identifier to an account identity identifier according to a preset mapping algorithm.

[0036] Further, the account identity identifier is obtained by using the digital identity file, specifically:

[0037] The digital identity service party parses the B segment data in the digital identity file to obtain an account identity identifier; the account identity identifier is verified and the account identity identifier that fails the verification is discarded.

[0038] Technical solution three:

[0039] A digital identity application method of a root legal identity, applied to a second server, comprising the following steps:

[0040] Receiving a digital identity file and requesting business data; the digital identity file contains an account identity identifier and a real-name identity identifier, and the account identity identifier is mapped from the real-name identity identifier;

[0041] Parsing the digital identity file to obtain an account identity identifier;

[0042] According to the account identity identifier, obtain service data;

[0043] Return the account identity identifier and the service data.

[0044] Further, the digital identity file includes A segment data, B segment data and S segment data, the A segment data includes a network identity certificate, the B segment data includes an account identity identifier, and the S segment data includes a signature value of splicing results of the A segment data and the B segment data; the network identity certificate contains a real-name identity identifier.

[0045] Further, it also includes that a digital identity service party verifies the validity of the digital identity file.

[0046] Further, the account identity identifier is obtained by using the digital identity file, and specifically,

[0047] The digital identity service party parses the A segment data in the digital identity file to obtain the network identity certificate;

[0048] The network identity certificate is verified, and after the network identity certificate verification passes, the network identity certificate is parsed to obtain the real-name identity identifier;

[0049] The digital identity service party maps the real-name identity identifier into the account identity identifier according to a preset mapping algorithm.

[0050] Further, the account identity identifier is obtained by using the digital identity file, and specifically,

[0051] The digital identity service party parses the B segment data in the digital identity file to obtain the account identity identifier; the account identity identifier is verified, and the account identity identifier that does not pass the verification is discarded.

[0052] Compared with the prior art, the present application has the following characteristics and beneficial effects:

[0053] 1. The present application uses an encryption algorithm to map the real-name identity identifier into the account identity identifier of the application system, rather than manually binding it by the user later, establishes the binding relationship between the real-name identity identifier and the account identity identifier, and ensures that the real-name identity and the account identity correspond to the same user; at the same time, the binding relationship is stored in the digital identity file rather than being uniformly stored in the system background, thereby avoiding the risk of large-scale leakage and tampering of the binding relationship in the system background.

[0054] 2. The digital identity file of the present application adopts A+B+S data format, wherein the S segment data is the signature value of the A segment data and the B segment data, which ensures the integrity and anti-tampering of the digital identity file content.

[0055] 3. In this invention, the application sends a digital identity file to the digital identity service provider. The digital identity service provider verifies and parses the digital identity file to obtain and return the account identity identifier in the digital identity file. The application then conducts business transactions based on the account identity identifier. During the application process, users do not need to input the account identity identifier and real-name identity identifier, thus avoiding the leakage of sensitive data.

[0056] 4. This invention sets up two authentication modes. The first authentication mode uses real-name identity tokens for identity authentication, which is suitable for strong identity authentication scenarios. The second authentication mode uses account identity tokens for application, which is suitable for weak identity authentication scenarios. Both authentication modes are based on the binding relationship between real-name identity tokens and account identity tokens, and can ensure that the same user is using the digital identity file. Attached Figure Description

[0057] Figure 1 This is a flowchart of the invention;

[0058] Figure 2 This is a schematic diagram of the online identity credential generation process;

[0059] Figure 3 This is a schematic diagram of the digital identity file generation process described in Embodiment 2;

[0060] Figure 4 This is a schematic diagram of the digital identity file generation process described in Embodiment 3;

[0061] Figure 5 This is a schematic diagram of the digital identity file application process described in Example 4;

[0062] Figure 6 This is a schematic diagram of the digital identity file application process described in Example 5. Detailed Implementation

[0063] The present invention will now be described in more detail with reference to the embodiments.

[0064] Example 1

[0065] A digital identity file includes three data segments: A, B, and S. Segment A is encrypted network identity credential, which is a dynamically changing electronic document issued by an identity service provider. The network identity credential contains data such as a real-name identity identifier and a timestamp (preferably, the network identity credential is a QR code). The identity service provider provides authentication services for the network identity credential. Segment B is an account identity identifier. Segment S is encrypted by concatenating segment A and segment B and then encrypting the concatenated data using the SM2 signature algorithm.

[0066] The account identity identifier is obtained by mapping the real-name identity identifier. In this embodiment, the preferred approach is to use different encryption algorithms to map the real-name identity identifier to the account identity identifier of different application systems. For example, the first encryption algorithm is used to map the real-name identity identifier to the account identity identifier of the payment application system; the second encryption algorithm is used to map the real-name identity identifier to the account identity identifier of the social application system.

[0067] The transmission medium for the digital identity document is one of the following: QR code, SIM card, Bluetooth, NFC, sound wave, or flashlight. In this embodiment, a QR code is preferred.

[0068] Example 2

[0069] like Figures 2-3 As shown, a method for generating a digital identity file includes the following steps:

[0070] In this embodiment, the application side includes the application system client / server and the application system verification terminal, and the digital identity service provider includes the digital identity system client and the digital identity system server.

[0071] S1. Application system client / server requests network identity credentials: The application system client / server launches the digital identity system client and requests the network identity credentials from the digital identity system client; the user selects the network identity credentials in the digital identity system client, and the digital identity system client returns the encrypted network identity credentials.

[0072] S2. The application system client / server requests the digital identity file from the digital identity system server, as follows:

[0073] S21. The user selects a verification mode on the application system client / server. The verification mode includes at least the following categories: network identity credential, network identity credential + password, network identity credential + facial image, network identity credential + password + facial image, and network identity credential + password. In this embodiment, the network identity credential + facial image verification mode is adopted.

[0074] The application system client / server collects the corresponding authentication factors (human image).

[0075] The application system client / server calls the digital identity system server through the corresponding interface according to the selected verification mode and sends the authentication factor and encrypted network identity credential.

[0076] S22. The digital identity system server verifies the encrypted network identity credential and authentication factor, as follows:

[0077] The digital identity system server verifies the validity of the encrypted network identity credential and checks whether the network identity credential and authentication factor match: it verifies whether the format of the encrypted network identity credential is correct; if the format is correct, it parses the encrypted network identity credential to obtain the real-name identity identifier; it retrieves the corresponding pre-stored authentication factor based on the real-name identity identifier; it compares the pre-stored authentication factor with the received authentication factor, and if the comparison results are consistent, the verification is considered successful; otherwise, the verification fails.

[0078] S23. After verification, the digital identity system server encrypts the real-name identity identifier to obtain the account identity identifier.

[0079] S24. The digital identity system server uses the encrypted network identity credential as segment A data (or maps the cached network identity credential to a token as segment A data), and the account identity identifier as segment B data. It concatenates segment A data and segment B data and performs signature calculation using SM2 or a composite verification algorithm to obtain segment S data. It then concatenates segment A data, segment B data, and segment S data to obtain a digital identity file and returns it to the application system client / server.

[0080] Example 3

[0081] like Figure 4 As shown, the difference in this embodiment is that the digital identity service provider includes a first digital identity platform and an authoritative second digital identity platform. The real-name identity identifier is stored in the network identity credential after anonymization.

[0082] The application system client / server requests a digital identity file from the first digital identity platform, as follows:

[0083] S21. The user selects the verification mode on the application system client / server.

[0084] The application system client / server collects the corresponding authentication factors.

[0085] The application system client / server calls the first digital identity platform through the corresponding interface according to the selected verification mode, and sends the authentication factor and encrypted network identity credential to the first digital identity platform. The first digital identity platform then requests the second digital identity platform to verify the encrypted network identity credential and authentication factor.

[0086] The second digital identity platform verifies the encrypted network identity credentials and authentication factors as follows:

[0087] The second digital identity platform verifies the validity of the encrypted network identity credential and checks whether the network identity credential and authentication factor match: it verifies whether the format of the encrypted network identity credential is correct; if the format is correct, it parses the encrypted network identity credential to obtain an anonymized real-name identity identifier; it retrieves the corresponding pre-stored authentication factor based on the pre-stored associated data; it compares the pre-stored authentication factor with the received authentication factor, and if the comparison results are consistent, it considers the verification to be successful and returns the verification result and real-name identity identifier to the first digital identity platform; otherwise, the verification fails.

[0088] S23. After verification, the first digital identity platform encrypts the real-name identity identifier to obtain the account identity identifier.

[0089] S24. The first digital identity platform uses the network identity credential as segment A data (or maps the network identity credential to a token after caching as segment A data), and the account identity identifier as segment B data. It concatenates segment A data and segment B data and uses SM2 or composite verification algorithm to perform signature calculation to obtain segment S data. It concatenates segment A data, segment B data and segment S data to obtain digital identity file and returns it to the application system client / server.

[0090] Example 4

[0091] like Figure 5 As shown, a method for applying a digital identity file includes the following steps:

[0092] In this embodiment, the application side includes the application system client / server and the application system verification terminal, and the digital identity service provider includes the digital identity system client and the digital identity system server.

[0093] Application system clients / servers present digital identity documents to request business data;

[0094] The application system verification terminal obtains the digital identity file and authentication factor from the application system client / server. The method of obtaining the digital identity file is as follows: the digital identity file is displayed on the application system client / server in the form of a QR code, and the application system verification terminal reads the QR code.

[0095] The application system's verification terminal calls the digital identity system's server, sending the digital identity file, authentication factor, and requesting business data.

[0096] The digital identity system server verifies the validity of the digital identity file: it uses the SM2 signature algorithm to verify the S segment data in the digital identity file; if the verification passes, it determines the authentication mode (in this embodiment, the digital identity system server determines the authentication mode based on the call interface used by the application system's verification terminal);

[0097] If it is the first authentication mode, the digital identity system server parses the A segment data in the digital identity file to obtain the encrypted network identity credential; the digital identity system server performs identity authentication (i.e., verifies the validity of the encrypted network identity credential and verifies whether the network identity credential and authentication factor match). If the identity authentication is successful, the encrypted network identity credential is parsed to obtain the real-name identity identifier; the digital identity system server performs encrypted calculation on the real-name identity identifier according to the preset encryption algorithm to obtain the account identity identifier.

[0098] If the second authentication mode is used, the digital identity system server parses the B segment data in the digital identity file to obtain the account identity identifier. The digital identity system server verifies the account identity identifier: it decrypts the B segment data in the digital identity file using the SM4 decryption algorithm to obtain the account identity identifier, and queries the database to check the validity status of this account identity identifier; if it is valid, the verification is passed; otherwise, the account identity identifier is discarded.

[0099] The digital identity system server returns the account identity identifier to the application system's verification terminal.

[0100] The application system's verification terminal retrieves relevant business data based on account identity identifiers, such as mobile phone numbers, email addresses, medical insurance card numbers, user file numbers, etc., which can be used as index IDs for retrieving personal data within the government data sharing network.

[0101] The application system's verification terminal returns business data to the application system's client / server, which then displays the business data.

[0102] Example 5

[0103] The difference in this embodiment is that the digital identity service provider includes a first digital identity platform and an authoritative second digital identity platform.

[0104] like Figure 6 As shown, a method for applying a digital identity file includes the following steps:

[0105] Application system clients / servers present digital identity documents to request business data;

[0106] The application system's verification terminal obtains the digital identity file and authentication factor.

[0107] The application system's verification terminal calls the first digital identity platform and sends digital identity files and authentication factors to the first digital identity platform to request business data.

[0108] The first digital identity platform verifies the validity of the digital identity document. If the verification is successful, the first digital identity platform determines the authentication mode.

[0109] If it is the first authentication mode, the first digital identity platform parses the A segment data in the digital identity file to obtain the encrypted network identity credential; the first digital identity platform sends the encrypted network identity credential, authentication factor, and identity authentication request to the second digital identity platform; the second digital identity platform performs identity authentication (i.e., verifies the validity of the encrypted network identity credential and verifies whether the network identity credential and authentication factor match). If the identity authentication is successful, the encrypted network identity credential is parsed to obtain the real-name identity identifier, and the real-name identity identifier is returned to the first digital identity platform; the first digital identity platform performs encrypted calculation on the real-name identity identifier according to the preset encryption algorithm to obtain the account identity identifier.

[0110] If the second authentication mode is used, the first digital identity platform parses the B segment data in the digital identity file to obtain the account identity identifier. The first digital identity platform verifies the account identity identifier and returns the verified account identity identifier to the application system's verification terminal.

[0111] The application system's verification terminal retrieves the corresponding business data based on the account identity identifier and returns it to the application system's client / server, which then displays the business data.

[0112] Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

Claims

1. A method for applying digital identity based on legal identity, characterized in that, Includes the following steps: The application obtains a digital identity file; the digital identity file contains an account identity identifier and a real-name identity identifier, the account identity identifier being mapped from the real-name identity identifier; the digital identity file includes A-segment data, B-segment data and S-segment data, the A-segment data includes a network identity credential, the B-segment data includes an account identity identifier, the S-segment data includes a signature value of the concatenation result of the A-segment data and the B-segment data, and the network identity credential includes a real-name identity identifier; The application sends a digital identity file to the digital identity service provider and requests business data; The digital identity service provider uses the digital identity file to obtain the account identity identifier. Specifically, the digital identity service provider parses the A segment data in the digital identity file to obtain the network identity credential; verifies the network identity credential; after the network identity credential is verified, it is parsed to obtain the real-name identity identifier; the digital identity service provider maps the real-name identity identifier to the account identity identifier according to a preset mapping algorithm. Digital identity service providers obtain business data based on account identity identifiers; The digital identity service provider returns account identity identifiers and business data to the application provider.

2. The digital identity application method based on legally recognized identity as described in claim 1, characterized in that, Also includes: The digital identity service provider verifies the validity of the digital identity document.

3. The digital identity application method based on legally recognized identity as described in claim 1, characterized in that, The method of obtaining account identity identifiers using digital identity files specifically includes: The digital identity service provider parses the B segment data in the digital identity file to obtain the account identity identifier; it verifies the account identity identifier and discards the account identity identifiers that fail verification.

4. The digital identity application method based on legally recognized identity as described in claim 1, characterized in that, Also includes: Obtain authentication factors; Verify whether the online identity credentials and authentication factors match; If a match is found, the network identity credential is parsed to obtain the real-name identity identifier.

Images