Secure circulation method based on DID credential data, DID credential data system and storage medium

Abstract

The present application discloses a secure circulation method based on DID credential data, a DID credential data system and a storage medium. The method comprises: the user node generates user credential request data according to the user credential acquisition request sent by the user node, using the user private key corresponding to the user credential acquisition request and the service public key of the service node; the service node obtains the user information and the credential information of the requested user credential from the user credential request data using the service private key corresponding to the service public key and the user public key corresponding to the user private key; the service node generates credential response data according to the credential request data using the service private key and the user public key, wherein the credential response data contains the storage address of the user credential in the service node. The embodiment of the present application ensures the credibility of the received information and greatly reduces the risk of leakage of user privacy data.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a secure transfer method based on DID credential data, a DID credential data system and a storage medium. Background Art

[0002] With the development of Internet technology, people can increasingly live and work through the Internet, and therefore, various websites built on the Internet have emerged to provide users with various services. Due to the identity anonymity of the Internet, websites often cannot know the true identity of users who visit or log in to their websites, and therefore cannot regulate and manage the users' use of services accordingly. For this reason, the prior art has proposed that users need to pre-register their identity information in the website they visit or log in to, so that the website can provide services to users based on the identity information submitted by the user when the user requests to use the website's services. In this process, users need to provide the original data of their identity information to the website and then save it in the website's server, but such identity information is usually the user's private data. Therefore, when users use the services provided by different websites, they also have to store their private data on each website, which greatly increases the risk of user privacy exposure. In this regard, a solution that can ensure the security of users' private data is needed. Summary of the invention

[0003] The embodiments of the present application provide a secure transfer method based on DID credential data, a DID credential data system, and a storage medium to solve the defect of the prior art that users' privacy data lacks security when using Internet services.

[0004] To achieve the above objectives, the present application provides a method for secure transfer of DID credential data, including:

[0005] The user node generates user credential request data using the user private key corresponding to the user credential acquisition request and the service public key of the service node according to the user credential acquisition request sent by the user node, wherein the user credential acquisition request is used to obtain the user credential issued by the issuing node and stored on the service node, and the user credential is generated by the issuing node according to the authentication information sent by the user from the user node;

[0006] The service node uses a service private key corresponding to the service public key and a user public key corresponding to the user private key to obtain user information and credential information of the requested credential from the user credential request data;

[0007] The service node generates credential response data according to the credential information using the service private key and the user's public key, wherein the credential response data includes a storage address of the credential in the service node.

[0008] The embodiment of the present application also provides a DID credential data system, including: a user node, a user node, a service node and an issuer node, wherein the user node is used to: generate user credential request data according to a user credential acquisition request sent by the user node, using a user private key corresponding to the user credential acquisition request and a service public key of the service node, wherein the user credential acquisition request is used to obtain a user credential issued by the issuer node and stored on the service node, and the user credential is generated by the issuer node according to authentication information sent by the user from the user node;

[0009] The service node is used to: use a service private key corresponding to the service public key and a user public key corresponding to the user private key to obtain user information and credential information of the requested user credential from the user credential request data; and generate credential response data using the service private key and the user's public key according to the credential information, wherein the credential response data contains the storage address of the user credential in the service node.

[0010] The present application also provides an electronic device, including:

[0011] Memory, used to store programs;

[0012] A processor is used to run the program stored in the memory, and when the program is running, the secure circulation method provided in the embodiment of the present application is executed.

[0013] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program executable by a processor is stored, wherein the program, when executed by the processor, implements the secure circulation method provided in the embodiment of the present application.

[0014] The secure circulation method based on DID credential data, DID credential data system and storage medium provided in the embodiments of the present application are that the user node uses the user private key and the service public key to generate the user credential request data according to the user credential acquisition request sent by the user node and sends it to the service node, and the service node uses the service private key and the user public key to obtain the user information and the credential information of the requested user credential from the user credential request data sent by the user node, and searches the service node for the storage address of the user credential on the service node according to the credential information, and includes the storage address in the credential response data generated using the service private key and the user public key to send it to the user node, so that in the process of the user node sending the user credential request data to the service node and the service node sending the storage address of the user credential requested by the user to the user node in the DID system, the user information and the credential information are both included in the data encrypted using the other party's secret key, and direct transmission of user information does not occur during the entire process, and the receiving party can also use the public key of the sending party to verify the received data content to ensure the credibility of the received information, thereby greatly reducing the risk of leakage of user privacy data.

[0015] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0017] Figure 1 is a schematic diagram showing an application scenario of a solution for secure transfer of DID credential data according to an embodiment of the present application;

[0018] Figure 2 A flowchart of an embodiment of the secure circulation method provided by the present application;

[0019] Figure 3 A schematic diagram of the structure of the DID credential data system provided for this application;

[0020] Figure 4 A schematic diagram of the structure of an electronic device embodiment provided in this application. DETAILED DESCRIPTION

[0021] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0022] Embodiment 1

[0023] The solution provided in the embodiments of the present application can be applied to any data system with encryption and decryption functions.

[0024] With the development of Internet technology, people can live and work more and more through the Internet, and therefore, various websites built on the Internet have emerged to provide users with various services. Due to the identity anonymity of the Internet, websites often cannot know the real identity of users who visit or log in to their websites, and therefore cannot regulate and manage the use of services by users accordingly. For this reason, it has been proposed in the prior art that users need to pre-register their identity information in the websites they visit or log in to, so that the websites can provide services to users based on the identity information submitted by users when users request to use the services of the websites. In this process, users need to provide the original data of their identity information to the website and then save it in the server of the website, but such identity information is usually the user's private data. Therefore, when users use the services provided by different websites, they also have to store their private data on various websites, which greatly increases the risk of user privacy exposure.

[0025] In this regard, the DID (decentralized identity) system has been proposed in the prior art. This system is mainly proposed for the above-mentioned existing centralized identity system in which each website manages the identity information of users. Since the identity registration modules of most different websites or platforms are not interoperable, most websites or platforms of different operators currently do not have the authority to access or even manage the identity data of each other's websites, and cannot verify the identity of users who use the identity identifiers issued by each other's websites.

[0026] In the DID system, users can request identity authentication from the issuer that is capable of authenticating the user's real identity, and the issuer can verify the identity information requested by the user based on the user's authentication request and issue credential data to the user after the verification is passed. The credential data can be used as proof data issued by an authority to the user to prove the user's specific identity information. For example, Figure 1 is a schematic diagram showing an application scenario of DID credential data according to an embodiment of the present application. Figure 1In the scenario shown in , a user can use a user node in the DID system to send a credential issuance request to the issuing node according to the user's credential acquisition request or according to his own credential needs. The issuing node can be, for example, a department or unit that is legally or recognized to authenticate one or more identity information of the user, and thus the issuing party can respond to the received authentication request sent by the user through the user node, that is, request to issue an authentication credential, to authenticate the specified identity information contained in the user's request. For example, the website that the user needs to log in needs to know the user's age to confirm whether the user's age has reached the age value for using the services provided by the website.

[0027] Therefore, in traditional Internet systems, users need to register their own information such as date of birth in the personal information interface of the website first, and in order to ensure the accuracy of the date of birth information registered by the user, the website often requires the user to upload legal documents such as identity documents for the website to verify. In order for the website to know their age information, the user needs to send their birthday information and complete certificate information including birthday information to the website. However, usually, such legal certificate information usually contains many kinds of identity information, such as the user's address, photo, etc., and the user uploads such complete certificate information to the website only to prove his age, which is one kind of identity information.

[0028] In this regard, in the DID system, users can request an issuer with legal or recognized certification authority for their age to issue credential data about their current age. The issuer can retrieve the user's identity information stored in its database or only retrieve the user's date of birth information based on the user identifier contained in the user's authentication request, and determine the user's age on that date in combination with the date of receipt of the user's request or the date specified by the user in the request, and thereby issue credential data about the user's age on the specified date to the user. After receiving the credential data, the user can present the credential data to website 1 when visiting website 1 that is the user of the credential data, so that website 1 can confirm the user's age on the current date based on the credential data, and can provide services to the user when the user's age meets the requirements for using the relevant services.

[0029] Therefore, in the DID system, when a user requests various services that require identity authentication from the user, although the website needs to determine whether to provide services to the user based on whether the user's identity information complies with the regulations, the user only needs to request the issuing party to issue the corresponding credential data for the type of identity information required by the website to be visited or the website service to be used, and provide the credential data as identity proof to the corresponding website. The website can determine whether to provide the corresponding service to the user based on the credential data. In this process, the user does not need to provide any specific identity information to the website, but instead provides the proof of identity required by the website, that is, credential data, in which the issuing party can write the user's corresponding identity information verification result or the conclusion data calculated or judged based on the user's corresponding identity information. For example, in the above example where the website needs to verify the user's age, the website does not actually need the current age, but needs to confirm whether the user visiting the website is over 18 years old. Therefore, in the credential data for the website issued by the user requesting the issuing party, the issuing party does not need to write the user's age on the specified date in the credential data, but can only write the user's age value on the specified date and the information of the issuing party in the credential data.

[0030] However, in the existing DID system, although the user avoids the risk of privacy leakage in the prior art that the user needs to provide his original identity information on each website by providing the credential data provided by the issuer when requesting services based on the user's identity information, after the issuer issues the credential data in response to the user's request, the user still needs to transmit his own privacy data in the system during the process of applying for and presenting the credential, so there is still a risk of privacy data leakage.

[0031] In this regard, Figure 1 As shown in , in the DID system scenario according to the embodiment of the present application, the user can log in to the DID system from the user node by using a terminal installed with the client of the DID system according to the embodiment of the present application, and the user and the issuer can also log in to the DID system from their respective nodes similarly through such a terminal. In this case, if the user needs to browse a web page that has special requirements on the user's age or address or request a corresponding service when visiting a website operated by the user, the user sends a request to the user node to provide a user credential for authenticating its identity information by using the user node, and when the user node receives the user credential acquisition request, since the user credential is not stored at the user node in the embodiment of the present application, the user cannot directly send the user credential requested by the user to the user node according to the request sent by the user.

[0032] In an embodiment of the present application, a user may first request a service node storing user credentials through a user node to provide the credential data to the user. For example, the user node may use a predetermined algorithm to calculate the user's user credential acquisition request or the credential content required therein to obtain a first calculation result. For example, in an embodiment of the present application, the user node may use a hash algorithm to calculate the hash value of the user credential acquisition request sent by the user or the credential content requested therein as the first calculation result, and then use the user's private key stored at the user node or uploaded to the user node when the user logs in to the user's node using his own terminal to encrypt the first calculation result to obtain encrypted data. In an embodiment of the present application, a user may use a terminal to generate his own user private key and user public key when registering in the DID system and upload the user public key to the user node, and the user node may send the user's public key to other nodes in the DID system in association with the user's user identification information in the DID system. Of course, in an embodiment of the present application, the user can also use the terminal to generate a user private key and a user public key when registering in the DID system, save them in his own terminal, and then upload the user private key from the terminal to the user node to encrypt the calculated hash value of the credential content when generating encrypted data, for example, according to the user credential acquisition request sent by the user as above.

[0033] After the user node generates encrypted data using the user's user private key for the first calculation result of the credential content requested by the user, the user node can further use the service public key of the service node to perform encryption processing on the encrypted data and the user credential acquisition request sent by the user to generate user credential request data sent to the server. For example, the user node can request the issuer to generate a user credential for the authentication content required by the user through the issuer node in response to the user credential acquisition request sent by the user node, and the user credential can be sent by the issuer node to the service node and stored in the service node. In addition, the user credential can also be a pre-existing user credential that the user node requested the issuer to generate and store in the service node through the issuer node in response to the user credential acquisition request sent by other users for the same authentication content before the request sent by the user. The service public key can be a service public key broadcast by the service node to other nodes in the DID system when the DID system is initialized, or it can be a service public key obtained by requesting the service node when or before the user node performs encryption processing on the signature data generated using its user private key based on the first calculation result.

[0034] like Figure 1As shown in , after generating the user credential request data, the user node can associate the node information of the node with the user credential request data and send it to the service node, or can also generate, for example, a message form based on the node information and the user credential request data to send it to the service node. After receiving the user credential request data sent by the user node, the service node can first use its stored service private key to decrypt the user credential request data to obtain the user credential acquisition request and user information contained in the request. In an embodiment of the present application, the user information can be, for example, the identification information of the user in the DID system, so that the service node can use the user public key of the user stored in the service node according to the user information to calculate the credential content in the user credential request data using the same calculation method used by the user node to calculate the user credential acquisition request in the user credential request sent from the user node. For example, when the user node uses a hash algorithm to calculate the first calculation result, the service node can use the same calculation method as the user node to calculate the user credential acquisition request in the user credential request sent from the user node according to the algorithm information contained in the user credential request data, and compare the calculation result obtained by the calculation with the encrypted data encrypted by the user's own private key contained in the user credential request data sent from the user node. When the two data are consistent, the service node can determine that the user credential information in the received user credential request data is the information of the user credential that the user wants to call, and therefore, the service node can search for the corresponding user credential of the user stored in the service node according to the credential information, and in the case of finding the stored user credential, the service node can send the storage address of the user credential in the service node to the user. For example, the service node can compare the credential identifier of the stored user credential with the credential identifier in the user credential request information one by one according to the credential information, such as the identifier of the user credential or the user identifier and the type of the user credential, and when the comparison result is a match, the storage address of the matched stored user credential can be used as the search result. After obtaining the search result, the service node can first use a predetermined algorithm, such as a hash algorithm, to calculate the storage address of the found user credentials, and encrypt the calculation result using the private key of the service node. Afterwards, the storage address of the user credentials and the encrypted data obtained by encrypting using the private key of the service node using the user's public key can be encrypted according to the user information contained in the user request sent by the user node to obtain credential response data, and the credential response data can be sent to the corresponding user node according to the user information.In addition, in an embodiment of the present application, at the same time or after the service node includes the storage address of the user credentials requested by the user party on the service node in the response data and sends it to the user node of the user party, the service node can also send the sending information of sending the response data to the user node as the response data for the user party to the user node corresponding to the user party, so that the user party can understand from the response data that the service node has sent the user credentials required by the user to the user, and the user party can continue to request its service on the website operated by the user.

[0035] In addition, in an embodiment of the present application, the service node may also send the storage address of the user credential found as the response data for the user to the user node of the user party. For example, the service node may first use a predetermined algorithm, such as a hash algorithm, to calculate the storage address of the user credential found, and encrypt the calculation result using the private key of the service node, and then, according to the user information contained in the user request sent by the user node, use the user's public key to encrypt the storage address of the user credential and the encrypted data obtained by encrypting the private key of the service node, and then use the user's public key to encrypt the encrypted data to obtain the credential response data, or after the calculation result is encrypted using the private key of the service node, use the public key of the user node to encrypt the encrypted data to obtain the credential response data. Afterwards, the credential response data can be sent to the user node, so that after the user receives the credential response data through the user node, the user can use the user's private key to decrypt the credential response data, and after decryption, the corresponding user's public key can be used to encrypt the decrypted credential response data according to the user credential information contained in the response data, and the credential response data can be sent to the corresponding user node according to the user information.

[0036] After the user node receives the credential response data, it can first call the user's private key according to the user information to decrypt the credential response data, and after decryption, it can use the corresponding algorithm to perform calculations on the user credential address contained in the credential response data. In an embodiment of the present application, the corresponding algorithm can be sent to each node as an initialization parameter of the system in advance when the DID system is initialized, so that each node can use the same calculation algorithm, such as a hash algorithm, to perform calculation processing. Or in an embodiment of the present application, each node can also use its own algorithm to calculate the original data to be sent, and use the algorithm information used by this node to perform the calculation, such as the algorithm type and other information as part of the data sent to the target node, so that after receiving the sent data, the target node can obtain the algorithm information from the received data by decrypting it with its own private key, and use the corresponding algorithm to perform corresponding calculations on the original data in the decrypted data, such as the credential request or the user credential address.

[0037] After the user calculates the user credential address using a predetermined algorithm, the user can perform encryption calculation processing on the calculation result according to the sender information contained in the credential response data. For example, when the service node sends the user credential response data to the user node, the user node can use the service public key to encrypt the calculation result according to the service node information contained in the credential response data, and compare the encrypted result with the encrypted data after the service node uses the service party private key to encrypt its calculation result contained in the credential response data to confirm whether the result of the encryption processing performed by the user node is consistent with the encrypted data contained in the credential response data. If consistent, the user can understand that the credential response data received by the user node is indeed sent by the service node and is also credible. After the user confirms that the credential response data it received is credible, the user can further use the user credential address contained in the credential response data to obtain the user credential from the service node according to the service node information contained in the data, and can confirm whether the user can use the corresponding service or access the corresponding data according to the user credential.

[0038] Similar to the above method, when the user node sends the credential response data including the user credential storage address generated at the service node to the corresponding user node, the user node can use its own user private key to decrypt the received credential response data to obtain the result of the encryption processing performed by the service node using its own private key and the user credential storage address, so that the user node can use a predetermined algorithm or use a corresponding algorithm based on the algorithm information contained in the credential response data to calculate the user credential storage address, and use the public key of the service node to encrypt the calculation result, so that the encryption result can be compared with the encryption processing result of the service node contained in the credential response data to confirm that the user credential address contained in the credential response data is credible, and thus the user can use the user credential address through the user node to obtain the user credential from the service node and can confirm whether the user can use the corresponding service or access the corresponding data based on the user credential.

[0039] Therefore, the secure circulation scheme based on DID credential data in the embodiment of the present application is achieved by the user node using the user private key and the service public key to generate the user credential request data according to the user credential acquisition request sent by the user node and send it to the service node, and the service node uses the service private key and the user public key to obtain the user information and the credential information of the requested user credential from the user credential request data sent by the user node, and searches the service node for the storage address of the user credential on the service node according to the credential information, and includes the storage address in the credential response data generated using the service private key and the user public key to send it to the user node, so that in the process of the user node sending the user credential request data to the service node and the service node sending the storage address of the user credential requested by the user to the user node in the DID system, the user information and the credential information are both included in the data encrypted using the other party's secret key, and direct transmission of user information does not occur during the entire process, and the receiving party can also use the public key of the sending party to verify the received data content to ensure the credibility of the received information, thereby greatly reducing the risk of leakage of user privacy data.

[0040] The above embodiments are illustrations of the technical principles and exemplary application frameworks of the embodiments of the present application. The specific technical solutions of the embodiments of the present application are further described in detail below through multiple embodiments.

[0041] Embodiment 2

[0042] Figure 2This is a flowchart of an embodiment of the method for secure transfer of DID credential data provided by this application. The execution subject of this method can be various terminals or server devices with data encryption and decryption capabilities, or it can be a device or chip integrated on these devices. Figure 2 As shown, the secure circulation method includes the following steps:

[0043] S201, the user node generates user credential request data according to the user credential acquisition request sent by the user node, using the user private key corresponding to the user credential acquisition request and the service public key of the service node.

[0044] In step S201, the user node can generate user credential request data according to the user credential acquisition request sent by the user node. Figure 1 When the website operated by the user shown in , the user will receive the user credential acquisition request from the user because the service the user wants to use or the data to be accessed requires the user's identity to be verified, and the user is required to provide the corresponding user credential for the website, i.e., the user to verify. The user credential requested in step S201 may be the user credential for the authentication content required by the user that has been issued by the issuing node and stored on the service node, or may be the user node requesting the issuing node to issue and store on the service node according to the user's requirements when the user uses the service provided by the user this time.

[0045] For example, in step S201, the user node may calculate the user credential acquisition request or the credential content required therein by the user using a predetermined algorithm according to the user's instruction to obtain the first request information. For example, in an embodiment of the present application, the user node may use a hash algorithm to calculate the hash value of the user credential acquisition request sent by the user or the credential content requested therein as the first request information, and then use the user's private key stored at the user node or uploaded to the user node when the user uses his own terminal to log in to the user's node to encrypt the first request information to obtain the first encrypted data.

[0046] In an embodiment of the present application, the predetermined algorithm used by the user node may be an algorithm or algorithm information that is sent to each node as an initialization parameter of the system in advance when the DID system is initialized, so that each node can use the same calculation algorithm, such as a hash algorithm, to perform calculation processing on the information or data sent to the outside. Or in an embodiment of the present application, each node may also use its own algorithm to calculate the original data to be sent, and use the algorithm information used by the node to perform the calculation, such as the algorithm type, as part of the data sent to the target node, so that, for example, after receiving the data sent by the user node, the target node of the service node can obtain the algorithm information from the received data by decrypting it with its own private key, and use the corresponding algorithm to perform corresponding calculations on the original data in the decrypted data, such as the credential request or the user credential address.

[0047] In addition, in an embodiment of the present application, the user public key corresponding to the user private key used by the user node in step S201 can be generated by the user in pairs with the user private key using his own terminal and uploaded to the user node when registering in the DID system, and the user node can send the user's public key to other nodes in the DID system in association with the user's user identification information in the DID system.

[0048] Of course, in an embodiment of the present application, the user can also use the terminal to generate a user private key and a user public key when registering in the DID system, save them in his own terminal, and then upload the user private key from the terminal to the user node to encrypt the calculated hash value of the credential content when generating encrypted data, for example, according to the user credential acquisition request sent by the user as above.

[0049] After the user node generates the first encrypted data using the user's user private key for the first request information of the authentication content requested by the user as above, the user node can further use the service public key of the service node as its destination node to perform a second encryption process on the first encrypted data and the user credential acquisition request sent by the user to generate user credential request data sent to the server. In an embodiment of the present application, the service public key can be a service public key broadcasted by the service node to other nodes in the DID system when the DID system is initialized, or it can also be a service public key obtained by requesting the service node when or before the user node encrypts the signature data generated based on the first request information using its user private key.

[0050] In addition, in step S201, before the user node generates the user credential request data, the user node may also request the issuer of the user credential to generate the user credential through the issuer node for the authentication content required by the user in response to the user credential acquisition request sent by the user node, and the user credential may be sent by the issuer node to the service node and stored in the service node. In addition, the user credential may also be a pre-existing user credential that the user node requested the issuer to generate through the issuer node and stored in the service node in response to the user credential acquisition request sent by other users for the same authentication content before the request sent by the user.

[0051] After the user node performs the second encryption processing on the first encrypted data using the service public key to generate the user credential request data in step S201, the user node may send the user credential request data to the service node. Specifically, after generating the user credential request data, the user node may associate the node information of the node with the user credential request data and send it to the service node, or may generate, for example, a message form based on the node information of the node and the user credential request data to send it to the service node.

[0052] S202, the service node uses the service private key corresponding to the service public key and the user public key corresponding to the user private key to obtain the user information and the credential information of the requested user credential from the user credential request data.

[0053] In step S202, the service node that receives the user credential request data sent by the user node may use its service private key and the user public key of the user to obtain the user information and the credential information of the user credential requested by the user. For example, after receiving the user credential request data sent by the user node, the service node may first use its stored service private key to decrypt the user credential request data to obtain the user credential acquisition request and user information contained in the request. In an embodiment of the present application, the user information may be, for example, identification information of the user in the DID system, so that the service node may use the user public key of the user stored in the service node based on the user information to calculate the credential content in the user credential request data in the same manner as the calculation method used by the user node to calculate the user credential acquisition request in the user credential request data sent from the user node.

[0054] For example, in step S201, the user node may use a hash algorithm to calculate the first request information, then in step S202, the service node may use the same method as the method used by the user node in step S201 to calculate the user credential acquisition request in the user credential request data sent from the user node in step S201, based on the algorithm information contained in the user credential request data or the algorithm information contained in the information sent to the service node together with the user credential request data, and compare the calculation result obtained with the encrypted data encrypted using the user's own private key contained in the user credential request data sent from the user node. When the two data are consistent, the service node can determine that the user credential information in the received user credential request data is the user credential information that the user wants to call. Therefore, the service node can search for the corresponding user credential of the user stored in the service node according to the credential information, and when the stored user credential is found, the service node can send the storage address of the user credential in the service node to the user node or the user node.

[0055] For example, in step S202, the service node may compare the credential identifier of the user credential stored in the service node with the credential identifier in the user credential request data one by one according to the determined credential information, such as the identifier of the user credential or the user identifier and the type of the user credential, and when the comparison result is a match, the storage address of the matched stored user credential may be used as the search result.

[0056] S203, the service node generates credential response data using the service private key and the user public key according to the credential information.

[0057] In step S203, the service node may use the service private key and the user public key to generate credential response data for the storage address of the user credential found in step S202. For example, the service node may use a predetermined algorithm, such as a hash algorithm, to calculate the storage address of the user credential found in step S202, and perform a third encryption process on the calculation result using the private key of the service node, thereby obtaining third encrypted data. Afterwards, the service node may perform a fourth encryption process on the storage address of the user credential and the third encrypted data previously obtained by encrypting the storage address of the user credential using the user public key according to the user information included in the user credential acquisition request sent by the user node in step S201, so as to obtain credential response data, which may include the storage address of the user credential found by the service node in step S202.

[0058] After generating the credential response data, the service node can send the credential response data to the corresponding user node according to the user information included in the user credential acquisition request. At the same time or after the service node includes the storage address of the user credential requested by the user party on the service node in the response data and sends it to the user node of the user party, the service node can also send the sending information of sending the response data to the user node as the response data for the user party to the user node corresponding to the user party, so that the user party can understand from the response data that the service node has sent the user credential requested by the user party to the user party, so that the user party can continue to request the service on the website operated by the user party.

[0059] In addition, in step S203, the service node may also send the storage address of the user credential found as response data for the user to the user node of the user party. For example, the service node may first use a predetermined algorithm, such as a hash algorithm, to calculate the storage address of the user credential found in step S202, and encrypt the calculation result using the private key of the service node, and then, according to the user information contained in the user request sent by the user node, use the user's public key to perform a third encryption on the storage address of the user credential and the encrypted data obtained by encrypting the storage address of the user credential using the private key of the service node, and then use the user's public key to perform a fourth encryption on the encrypted data to obtain the credential response data, or after encrypting the calculation result using the private key of the service node, use the public key of the user node to encrypt the encrypted data to obtain the credential response data. The credential response data generated in this way is sent to the user node, and after receiving the credential response data, the user node can use the user's private key to decrypt the credential response data, and after decryption, it can use the corresponding user public key to encrypt the decrypted credential response data according to the user credential information contained in the response data and send the credential response data to the corresponding user node according to the user information.

[0060] In addition, in step S202, if the calculation result obtained by the service node is inconsistent with the encrypted data encrypted using the user's own private key contained in the user credential request data sent by the user node in step S201, the service node may not be able to determine whether the user credential information in the received user credential request data is the user credential information that the user wants to call. In other words, the service node cannot confirm whether the received user credential request data is issued by the user, that is, it is not credible. Therefore, the service node can send a message of user credential acquisition failure to the user node as credential response data.

[0061] In an embodiment of the present application, after receiving the credential response data from the service node or the user node, the user node can first call the user private key according to the user information to decrypt the credential response data, and after decryption, the corresponding algorithm can be used to perform calculations on the user credential address contained in the credential response data. And the calculation result is encrypted and calculated according to the sender information contained in the credential response data. For example, in step S203, when the service node sends the user credential response data to the user node, the user node can use the service public key to encrypt the calculation result according to the service node information contained in the credential response data, and compare the encrypted result with the encrypted data after the service node contained in the credential response data encrypts its calculation result using the service private key to confirm whether the result of the encryption processing performed by the user node is consistent with the encrypted data contained in the credential response data. If consistent, the user can understand that the credential response data received by the user node is indeed sent by the service node and is also credible. After the user confirms that the received credential response data is credible, the user can further use the user credential address contained in the credential response data to obtain the user credential from the service node based on the service node information contained in the data, and based on the user credential, confirm whether the user can use the corresponding service or access the corresponding data.

[0062] In addition, when the user node sends the credential response data including the user credential storage address generated at the service node to the corresponding user node, the user node can use its own user private key to decrypt the received credential response data to obtain the result of the encryption processing performed by the service node using its own private key and the user credential storage address, so that the user node can use a predetermined algorithm or use a corresponding algorithm based on the algorithm information contained in the credential response data to calculate the user credential storage address, and use the public key of the service node to encrypt the calculation result, so that the encryption result can be compared with the encryption processing result of the service node contained in the credential response data to confirm that the user credential address contained in the credential response data is credible, and thus the user can use the user credential address through the user node to obtain the user credential from the service node and can confirm whether the user can use the corresponding service or access the corresponding data based on the user credential.

[0063] The secure circulation method based on DID credential data provided in the embodiment of the present application is that the user node uses the user private key and the service public key to generate the user credential request data according to the user credential acquisition request sent by the user node and sends it to the service node, and the service node uses the service private key and the user public key to obtain the user information and the credential information of the requested user credential from the user credential request data sent by the user node, and searches the service node for the storage address of the user credential on the service node according to the credential information, and includes the storage address in the credential response data generated using the service private key and the user public key to send it to the user node, so that in the process of the user node sending the user credential request data to the service node and the service node sending the storage address of the user credential requested by the user to the user node in the DID system, the user information and the credential information are both included in the data encrypted using the other party's secret key, and direct transmission of user information does not occur during the entire process, and the receiving party can also use the public key of the sending party to verify the received data content to ensure the credibility of the received information, thereby greatly reducing the risk of leakage of user privacy data.

[0064] Embodiment 3

[0065] Figure 3 This is a schematic diagram of the structure of the DID credential data system provided by this application. The DID credential data system can be used to implement, for example, reference Figure 2 The secure transfer method provided by the embodiment of the present application is described. The DID credential data system may include: a user node 31, a user node 32, a service node 33 and an issuer node 34.

[0066] The user node 31 may be configured to generate user credential request data according to a user credential acquisition request sent by a user node, using a user private key corresponding to the user credential acquisition request and a service public key of the service node 33 .

[0067] When users visit Figure 1 When the user visits the website operated by the user shown in , the user will be requested to obtain the user credentials by the user because the service the user wants to use or the data the user wants to access needs to verify the user's identity. The user is required to provide the corresponding user credentials so that the website, i.e., the user, can verify the user credentials. The user credentials requested by the user can be the user credentials for the authentication content required by the user that have been issued by the issuing node 34 and stored on the service node 33, or can be the user node 31 that requests the issuing node to issue and store on the service node 33 according to the user's requirements when using the service provided by the user this time.

[0068] For example, the user node 31 may calculate the user credential acquisition request or the credential content required therein by the user using a predetermined algorithm according to the user's instruction to obtain the first request information. For example, in an embodiment of the present application, the user node 31 may use a hash algorithm to calculate the hash value of the user credential acquisition request sent by the user or the credential content requested therein as the first request information, and then use the user's private key stored at the user node 31 or uploaded to the user node 31 when the user uses his own terminal to log in to the user's node to encrypt the first request information to obtain the first encrypted data.

[0069] In an embodiment of the present application, the predetermined algorithm used by the user node 31 may be an algorithm or algorithm information that is sent to each node as an initialization parameter of the system in advance when the DID credential data system is initialized, so that each node can use the same calculation algorithm, such as a hash algorithm, to perform calculation processing on the information or data sent to the outside. Or in an embodiment of the present application, each node may also use its own algorithm to calculate the original data to be sent, and use the algorithm information used by the node to perform the calculation, such as the algorithm type, as part of the data sent to the target node, so that, for example, the target node of the service node 33, after receiving the data sent by the user node 31, can obtain the algorithm information from the received data by decrypting it with its own private key, and use the corresponding algorithm to perform corresponding calculations on the original data in the decrypted data, such as the credential request or the user credential address.

[0070] In addition, in an embodiment of the present application, the user public key corresponding to the user private key used by the user node 31 can be generated in pairs by the user using his own terminal and the user private key when registering in the DID credential data system and uploaded to the user node 31, and the user node 31 can send the user's public key to other nodes in the DID credential data system in association with the user's user identification information in the DID credential data system.

[0071] Of course, in an embodiment of the present application, the user can also use the terminal to generate a user private key and a user public key when registering in the DID credential data system, and save them in his own terminal, and then upload the user private key from the terminal to the user node 31 to encrypt the calculated hash value of the credential content when generating encrypted data, for example, according to the user credential acquisition request sent by the user as above.

[0072] After the user node 31 generates the first encrypted data for the first request information of the authentication content requested by the user using the user's user private key as above, the user node 31 can further use the service public key of the service node 33 as its destination node to perform a second encryption process on the first encrypted data and the user credential acquisition request sent by the user to generate user credential request data sent to the server. In an embodiment of the present application, the service public key can be a service public key broadcasted by the service node 33 to other nodes in the DID credential data system when the DID system is initialized, or it can also be a service public key obtained by requesting the service node 33 when or before the user node 31 encrypts the signature data generated using its user private key based on the first request information.

[0073] In addition, before the user node 31 generates the user credential request data, the user node 31 may also request the issuer of the user credential to generate the user credential through the issuer node for the authentication content required by the user in response to the user credential acquisition request sent by the user node 32, and the user credential may be sent by the issuer node to the service node 33 and stored in the service node 33. In addition, the user credential may also be a pre-existing user credential that the user node 31 requests the issuer to generate through the issuer node and store in the service node 33 in response to the user credential acquisition request sent by other users for the same authentication content before the request sent by the user.

[0074] After the user node 31 performs the second encryption processing on the first encrypted data using the service public key to generate the user credential request data, the user node 31 may send the user credential request data to the service node 33. Specifically, after generating the user credential request data, the user node 31 may associate the node information of the node with the user credential request data and send them to the service node 33, or may generate, for example, a message form based on the node information of the node and the user credential request data to send to the service node 33.

[0075] The service node 33 can be used to obtain user information and credential information of the requested user credential from the user credential request data using a service private key corresponding to the service public key and a user public key corresponding to the user private key, and generate credential response data based on the credential information using the service private key and the user public key.

[0076] After receiving the user credential request data sent by the user node 31, the service node 33 can use its service private key and the user public key of the user to obtain the user information and the credential information of the user credential requested by the user. For example, after receiving the user credential request data sent by the user node 31, the service node 33 can first use its stored service private key to decrypt the user credential request data to obtain the user credential acquisition request and user information contained in the request. In an embodiment of the present application, the user information can be, for example, the identification information of the user in the DID credential data system, so that the service node 33 can use the user public key of the user stored in the service node 33 according to the user information to calculate the credential content in the user credential request data in the same way as the calculation method used by the user node 31 to calculate the user credential acquisition request in the user credential request data sent from the user node 31.

[0077] For example, the user node 31 may use a hash algorithm to calculate the first request information, then the service node 33 may use the same calculation method as that used by the user node 31 to calculate the user credential acquisition request in the user credential request data sent by the user node 31, based on, for example, the algorithm information contained in the user credential request data or the algorithm information contained in the information sent to the service node 33 together with the user credential request data, and compare the calculation result with the encrypted data encrypted using the user's own private key contained in the user credential request data sent by the user node 31.

[0078] When the two data are consistent, the service node 33 can determine that the user credential information in the received user credential request data is the information of the user credential that the user wants to call. Therefore, the service node 33 can search for the corresponding user credential of the user stored in the service node 33 according to the credential information, and when the stored user credential is found, the service node 33 can send the storage address of the user credential in the service node 33 to the user node 32 or the user node 31.

[0079] For example, the service node 33 can compare the credential identifier of the user credential stored in the service node 33 with the credential identifier in the user credential request data one by one according to the determined credential information, such as the identifier of the user credential or the user identifier and the type of the user credential, and when the comparison result is a match, the storage address of the matched stored user credential can be used as the search result.

[0080] For example, the service node 33 may use a predetermined algorithm, such as a hash algorithm, to calculate the storage address of the user credential found for the storage address found, and perform a third encryption process on the calculation result using the service private key, thereby obtaining the third encrypted data. Afterwards, the service node 33 may perform a fourth encryption process on the storage address of the user credential and the third encrypted data previously obtained by encrypting the storage address of the user credential using the user public key according to the user information contained in the user credential acquisition request sent by the user node 31, so as to obtain the credential response data, which may include the storage address of the user credential found by the service node 33.

[0081] After generating the credential response data, the service node 33 can send the credential response data to the corresponding user node 32 according to the user information included in the user credential acquisition request. At the same time or after the service node 33 includes the storage address of the user credential requested by the user on the service node 33 in the response data and sends it to the user node 32 of the user, the service node 33 can also send the sending information of sending the response data to the user node 32 as the response data for the user to the user node 31 corresponding to the user, so that the user can understand from the response data that the service node 33 has sent the user credential requested by the user to the user, so that the user can continue to request the service on the website operated by the user.

[0082] In addition, the service node 33 may also send the storage address of the user credential found as the response data for the user to the user node 31 of the user side. For example, the service node 33 may first use a predetermined algorithm, such as a hash algorithm, to calculate the storage address of the user credential found, and encrypt the calculation result using the private key of the service node 33, and then, according to the user information contained in the user request sent by the user node 31, the user's public key may be used to perform a third encryption process on the storage address of the user credential and the encrypted data obtained by encrypting the storage address of the user credential using the service private key, and then the user's public key may be used to perform a fourth encryption on the encrypted data to obtain the credential response data, or the encrypted data may be encrypted using the public key of the user node 31 after the calculation result is encrypted using the private key of the service node 33 to obtain the credential response data. The credential response data generated in this way is sent to the user node 31, and after receiving the credential response data, the user node 31 can use the user's private key to decrypt the credential response data, and after decryption, it can use the corresponding user public key to encrypt the decrypted credential response data according to the user credential information contained in the response data and send the credential response data to the corresponding user node 32 according to the user information.

[0083] In addition, if the calculation result obtained by the service node 33 is inconsistent with the encrypted data encrypted using the user's own private key contained in the user credential request data sent by the user node 31 in step S201, the service node 33 may not be able to determine whether the user credential information in the received user credential request data is the user credential information that the user wants to call. In other words, the service node 33 cannot confirm whether the received user credential request data is issued by the user, that is, it is not credible. Therefore, the service node 33 can send a message of user credential acquisition failure as credential response data to the user node 31.

[0084] In an embodiment of the present application, after receiving the credential response data from the service node 33 or the user node 31, the user node 32 can first call the user private key according to the user information to decrypt the credential response data, and after decryption, the corresponding algorithm can be used to perform calculations on the user credential address contained in the credential response data. And the calculation result is encrypted and calculated according to the sender information contained in the credential response data. For example, when the service node 33 sends the user credential response data to the user node 32, the user node 32 can encrypt the calculation result using the service node 33 public key according to the service node 33 information contained in the credential response data, and compare the encrypted result with the encrypted data after the service node contained in the credential response data encrypts the calculation result using the service party private key to confirm whether the result of the encryption processing performed by the user node 32 is consistent with the encrypted data contained in the credential response data. If consistent, the user can understand that the credential response data received by the user node 32 is indeed sent by the service node 33 and is also credible. After the user confirms that the received credential response data is credible, the user can further use the user credential address contained in the credential response data to obtain the user credential from the service node 33 based on the service node 33 information contained in the data, and can confirm whether the user can use the corresponding service or access the corresponding data based on the user credential.

[0085] In addition, when the user node 31 sends the credential response data including the user credential storage address generated at the service node 33 to the corresponding user node 32, the user node 32 can use its own user private key to decrypt the received credential response data to obtain the result of the encryption processing performed by the service node 33 using its own private key and the user credential storage address, so that the user node 32 can use a predetermined algorithm or use a corresponding algorithm based on the algorithm information contained in the credential response data to calculate the user credential storage address, and use the service public key to encrypt the calculation result, so that the encryption result can be compared with the encryption processing result of the service node 33 contained in the credential response data to confirm that the user credential address contained in the credential response data is credible, and thus the user can use the user credential address through the user node 32 to obtain the user credential from the service node 33 and can confirm whether the user can use the corresponding service or access the corresponding data based on the user credential.

[0086] The DID credential data system provided by the embodiment of the present application uses a user private key and a service public key to generate the user credential request data according to a user credential acquisition request sent by a user node and sends it to a service node, and the service node uses the service private key and the user public key to obtain the user information and the credential information of the requested user credential from the user credential request data sent by the user node, and searches the service node for the storage address of the user credential on the service node according to the credential information, and includes the storage address in the credential response data generated using the service private key and the user public key to send it to the user node, so that in the process of the user node sending the user credential request data to the service node and the service node sending the storage address of the user credential requested by the user to the user node in the DID system, the user information and the credential information are both included in the data encrypted using the other party's secret key, and direct transmission of user information does not occur during the entire process, and the receiving party can also use the public key of the sending party to verify the received data content to ensure the credibility of the received information, thereby greatly reducing the risk of leakage of user privacy data.

[0087] Embodiment 4

[0088] The above describes the internal functions and structure of the DID credential data system, which can be implemented as an electronic device. Figure 4 This is a schematic diagram of the structure of an electronic device embodiment provided by this application. Figure 4 As shown, the electronic device includes a memory 41 and a processor 42 .

[0089] The memory 41 is used to store programs. In addition to the above programs, the memory 41 can also be configured to store various other data to support operations on the electronic device. Examples of such data include instructions for any application or method operating on the electronic device, contact data, phone book data, messages, pictures, videos, etc.

[0090] The memory 41 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0091] The processor 42 is not limited to a processor (CPU), but may also be a processing chip such as a graphics processing unit (GPU), a field programmable gate array (FPGA), an embedded neural network processor (NPU) or an artificial intelligence (AI) chip. The processor 42 is coupled to the memory 41 and executes the program stored in the memory 41 to execute the secure transfer method of the above-mentioned embodiment 2.

[0092] Further, if Figure 4 As shown, the electronic device may also include: a communication component 43, a power component 44, an audio component 45, a display 46 and other components. Figure 4 Only some components are shown schematically, which does not mean that the electronic device only includes Figure 4 Components shown.

[0093] The communication component 43 is configured to facilitate wired or wireless communication between the electronic device and other devices. The electronic device can access a wireless network based on a communication standard, such as WiFi, 3G, 4G or 5G, or a combination thereof. In an exemplary embodiment, the communication component 43 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 43 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0094] The power supply assembly 44 provides power to various components of the electronic device. The power supply assembly 44 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device.

[0095] The audio component 45 is configured to output and / or input audio signals. For example, the audio component 45 includes a microphone (MIC), and when the electronic device is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 41 or sent via the communication component 43. In some embodiments, the audio component 45 also includes a speaker for outputting audio signals.

[0096] The display 46 includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0097] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0098] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A secure transfer method based on DID credential data, comprising: The user node generates user credential request data using the user private key corresponding to the user credential acquisition request and the service public key of the service node according to the user credential acquisition request sent by the user node, wherein the user credential acquisition request is used to obtain the user credential issued by the issuing node and stored on the service node, and the user credential is generated by the issuing node according to the authentication information sent by the user from the user node; The service node uses a service private key corresponding to the service public key and a user public key corresponding to the user private key to obtain user information and credential information of the requested user credential from the user credential request data; The service node generates credential response data using the service private key and the user public key according to the credential request data, wherein the credential response data includes the storage address of the user credential in the service node, The step of generating user credential request data by the user node according to the user credential acquisition request sent by the user node using the user private key corresponding to the user credential acquisition request and the service public key of the service node comprises: The user node obtains first request information of the user credential acquisition request by using a first encryption algorithm according to the user credential acquisition request sent by the user node; The user node performs a first encryption process on the first request information using a user private key corresponding to the user credential acquisition request to obtain first encrypted data; The user node uses the service public key obtained from the service node to perform a second encryption process on the user credential acquisition request and the first encrypted data to obtain second encrypted data as the user credential request data, The process of obtaining the user information and the credential information of the requested credential from the user credential request data by the service node using the service private key corresponding to the service public key and the user public key corresponding to the user private key includes: The service node uses the service private key to decrypt the user credential request data to obtain the user credential acquisition request and the first encrypted data; The service node uses the user public key to decrypt the first encrypted data to obtain first decrypted data; The service node uses the first encryption algorithm to calculate the user credential acquisition request to obtain second request information; The service node compares the first decrypted data with the second request information; When the service node determines that the first decrypted data is consistent with the second request information, the storage address of the user credential on the service node is determined according to the user credential acquisition request.

2. The safe circulation method according to claim 1, wherein: The secure circulation method further comprises: The service node sends the credential response data to the user node; The user node generates credential request response data based on the credential response data using the service public key, the user private key and the user private key of the user requesting the credential, wherein the credential request response data at least includes the storage address of the user credential in the service node.

3. The safe circulation method according to claim 1, wherein: The secure circulation method further comprises: The service node sends the credential response data to the user node; The storage address is obtained from the credential response data by the consumer node using the service public key and the consumer private key.

4. The safe circulation method according to claim 1, wherein: The decryption process of the user credential request data by the service node using the service private key further includes: The service node uses the service private key to decrypt the user credential request data to obtain user information; The user public key is obtained according to the user information.

5. The safe circulation method according to claim 4, wherein: The process of obtaining user information and the requested credential from the user credential request data by the service node using the service private key corresponding to the service public key and the user public key corresponding to the user private key further includes: When the service node determines that the first decrypted data and the second request information are inconsistent, the service node generates credential request response data using the service private key and the user public key according to the comparison processing result of the service node and the user information obtained by the decryption processing; The service node sends the credential request response data to the user node.

6. A DID credential data system, comprising: A user node, a user node, a service node and an issuer node, wherein the user node is used to: generate user credential request data according to a user credential acquisition request sent by the user node, using a user private key corresponding to the user credential acquisition request and a service public key of the service node, wherein the user credential acquisition request is used to acquire a user credential issued by the issuer node and stored on the service node, and the user credential is generated by the issuer node according to authentication information sent by the user from the user node; The service node is used to: use a service private key corresponding to the service public key and a user public key corresponding to the user private key to obtain user information and credential information of the requested user credential from the user credential request data; and generate credential response data using the service private key and the user's public key according to the credential information, wherein the credential response data contains a storage address of the user credential in the service node, Wherein, generating user credential request data using a user private key corresponding to the user credential acquisition request and a service public key of the service node according to the user credential acquisition request sent by the user node comprises: The user node obtains first request information of the user credential acquisition request by using a first encryption algorithm according to the user credential acquisition request sent by the user node; The user node performs a first encryption process on the first request information using a user private key corresponding to the user credential acquisition request to obtain first encrypted data; The user node uses the service public key obtained from the service node to perform a second encryption process on the user credential acquisition request and the first encrypted data to obtain second encrypted data as the user credential request data, The step of obtaining user information and credential information of the requested credential from the user credential request data using a service private key corresponding to the service public key and a user public key corresponding to the user private key includes: The service node uses the service private key to decrypt the user credential request data to obtain the user credential acquisition request and the first encrypted data; The service node uses the user public key to decrypt the first encrypted data to obtain first decrypted data; The service node uses the first encryption algorithm to calculate the user credential acquisition request to obtain second request information; The service node compares the first decrypted data with the second request information; When the service node determines that the first decrypted data is consistent with the second request information, the storage address of the user credential on the service node is determined according to the user credential acquisition request.

7. The DID credential data system according to claim 6, wherein: The service node is further configured to send the credential response data to the user node or the consumer node, and When the service node sends the credential response data to the user node, the user node is further used to: generate credential request response data according to the credential response data using the service public key, the user private key and the user private key of the user requesting the credential, wherein the credential request response data at least includes the storage address of the user credential in the service node; When the service node sends the credential response data to the user node, the user node is further used to: obtain the storage address from the credential response data using the service public key and the user private key.

8. A computer-readable storage medium having stored thereon a computer program executable by a processor, wherein: When the program is executed by a processor, the secure circulation method as described in any one of claims 1 to 5 is implemented.

Images