Identity authentication method and device, computer device and storage medium

Abstract

The application relates to an identity authentication method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: obtaining a to-be-signed message generated by an application platform when a service request requiring identity authentication is received; signing the to-be-signed message by using a local private key to obtain a first signed message; obtaining an encrypted signed message based on an application public key and the first signed message; obtaining a second signed message decrypted by the application platform based on an application private key; determining a decryption result based on a local public key and the second signed message; and determining that the identity authentication result of the service request is passed in the case that the decryption result indicates that the decryption is successful. The method can improve the identity authentication efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchains, and in particular to an identity authentication method and device, a computer device, a storage medium, and a computer program product. BACKGROUND

[0002] A Ukey (USB Key, a hardware storage device with a USB interface) is also called a smart password key. It is a small storage device that is directly connected to a computer through a USB (Universal Serial Bus interface), has a password verification function, and is reliable and high-speed. The Ukey itself is a key storage device, and its hardware design structure and internal control chip only allow the writing of certificates and do not allow the reading of certificates. A large number of Ukey hardware devices are used in the financial industry, such as Ushields, authentication Ukeys, electronic signature Ukeys, and financial tax control disks. These Ukeys are scattered in various departments and are held by different employees, which is relatively troublesome to manage. Each time the Ukey device needs to be carried, which greatly affects the customer experience. The current financial institutions involve a large number of business scenarios and a large amount of information. If the identity authentication of each business transaction relies on the traditional method of Ukey, there is a problem of identity authentication efficiency. SUMMARY

[0003] Therefore, it is necessary to provide an identity authentication method, device, computer device, computer readable storage medium, and computer program product that can improve the identity authentication efficiency in view of the problem of identity authentication efficiency of the traditional identity authentication method relying on Ukey.

[0004] In a first aspect, the present application provides an identity authentication method. The method comprises:

[0005] obtaining a to-be-signed message generated by an application platform when receiving a business request requiring identity authentication;

[0006] signing the to-be-signed message using a local private key to obtain a first signed message;

[0007] obtaining an encrypted signed message based on an application public key and the first signed message;

[0008] obtaining a second signed message decrypted by the application platform based on an application private key from the encrypted signed message;

[0009] determining a decryption result based on a local public key and the second signed message; and determining that the identity authentication result of the business request is passed in a case where the decryption result indicates that the decryption is successful.

[0010] In one of the embodiments, the to-be-signed message includes an application digital identity; and obtaining the encrypted signed message based on the application public key and the first signed message comprises:

[0011] determining the application public key according to the application digital identity;

[0012] obtaining the local digital identity;

[0013] packaging the local digital identity and the first signature information to obtain packaging information;

[0014] encrypting the packaging information by using the application public key to obtain the encrypted signature message.

[0015] In one of the embodiments, the determining the application public key according to the application digital identity comprises:

[0016] initiating an application public key query request to the distributed digital identity system based on the application digital identity, so that the distributed digital identity system judges the validity of the application digital identity, and queries the application digital identity document from the block chain network in the case that the validity judgment result indicates that the application digital identity is valid; and analyzing the application digital identity document to obtain the application public key;

[0017] receiving the application public key sent by the distributed digital identity system.

[0018] In one of the embodiments, the obtaining the second signature message decrypted by the application platform based on the application private key from the encrypted signature message comprises:

[0019] sending the encrypted signature message to the message center, so that the message center updates the to-be-signed message to the encrypted signature message, and sends the encrypted signature message to the application platform;

[0020] obtaining the second signature information decrypted by the application platform based on the application private key from the encrypted signature message.

[0021] In one of the embodiments, the second signature information comprises the decrypted verifiable digital credential, the decrypted local digital identity and the decrypted signature message; and the determining the decryption result based on the local public key and the second signature message comprises:

[0022] obtaining a verification result obtained by verifying the decrypted verifiable digital credential;

[0023] in the case that the verification result indicates that the verification is passed, querying the local public key from the block chain network by using the decrypted local digital identity;

[0024] decrypting the decrypted signature message by using the local public key to obtain the decryption result.

[0025] In one of the embodiments, the application platform generates a to-be-signed message when receiving a service request requiring identity authentication, and the to-be-signed message includes:

[0026] The application platform generates a signed two-dimensional code when receiving a service request requiring identity authentication.

[0027] The signed two-dimensional code is parsed to obtain a message index.

[0028] Based on the message index, a to-be-signed message is obtained from the message center.

[0029] In a second aspect, the application further provides an identity authentication device. The device includes:

[0030] A message acquisition module is configured to acquire a to-be-signed message generated by an application platform when receiving a service request requiring identity authentication.

[0031] A signature module is configured to sign the to-be-signed message using a local private key to obtain a first signed message.

[0032] An encryption module is configured to obtain an encrypted signed message based on an application public key and the first signed message.

[0033] A decryption module is configured to acquire a second signed message obtained by decrypting the encrypted signed message by the application platform based on an application private key.

[0034] A result determination module is configured to determine a decryption result based on a local public key and the second signed message, and determine that the identity authentication result of the service request is passed in a case where the decryption result indicates that the decryption is successful.

[0035] In a third aspect, the application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0036] The application platform generates a to-be-signed message when receiving a service request requiring identity authentication.

[0037] The to-be-signed message is signed using a local private key to obtain a first signed message.

[0038] An encrypted signed message is obtained based on an application public key and the first signed message.

[0039] A second signed message obtained by decrypting the encrypted signed message by the application platform based on an application private key is acquired.

[0040] A decryption result is determined based on a local public key and the second signed message, and it is determined that the identity authentication result of the service request is passed in a case where the decryption result indicates that the decryption is successful.

[0041] In a fourth aspect, the present application provides a computer readable storage medium. The computer readable storage medium has a computer program stored thereon, and the computer program, when executed by a processor, implements the following steps:

[0042] obtaining a to-be-signed message generated by the application platform when receiving a service request requiring identity authentication;

[0043] signing the to-be-signed message by using a local private key to obtain a first signed message;

[0044] obtaining an encrypted signed message based on the application public key and the first signed message;

[0045] obtaining a second signed message decrypted by the application platform based on the application private key from the encrypted signed message;

[0046] determining a decryption result based on the local public key and the second signed message; and in a case where the decryption result indicates that the decryption is successful, determining that the identity authentication result of the service request is passed.

[0047] In a fifth aspect, the present application provides a computer program product. The computer program product comprises a computer program, and the computer program, when executed by a processor, implements the following steps:

[0048] obtaining a to-be-signed message generated by the application platform when receiving a service request requiring identity authentication;

[0049] signing the to-be-signed message by using a local private key to obtain a first signed message;

[0050] obtaining an encrypted signed message based on the application public key and the first signed message;

[0051] obtaining a second signed message decrypted by the application platform based on the application private key from the encrypted signed message;

[0052] determining a decryption result based on the local public key and the second signed message; and in a case where the decryption result indicates that the decryption is successful, determining that the identity authentication result of the service request is passed.

[0053] The aforementioned authentication methods, devices, computer equipment, storage media, and computer program products obtain a message to be signed generated by the application platform when it receives a business request requiring authentication. The message is then signed using a local private key to obtain a first signed message. Based on the application public key and the first signed message, an encrypted signed message is obtained. Finally, a second signed message is obtained by the application platform decrypting the encrypted signed message using its application private key. This method of encryption using the application platform's public key and decryption using its private key improves the security of the signed message. Based on the local public key and the second signed message, the decryption result is determined. If the decryption result indicates successful decryption, the authentication result of the business request is determined to be successful. This method of signing with a local private key and decrypting with a local public key ensures that the message to be signed is not tampered with, which is beneficial to the security and efficiency of authentication. Attached Figure Description

[0054] Figure 1 This is a diagram illustrating the application environment of an identity authentication method in one embodiment.

[0055] Figure 2 This is a flowchart illustrating an identity authentication method in one embodiment;

[0056] Figure 3 This is a schematic diagram of a sub-process of S203 in one embodiment;

[0057] Figure 4 This is a schematic diagram of a sub-process of S204 in one embodiment;

[0058] Figure 5 This is a schematic diagram of a sub-process of S205 in one embodiment;

[0059] Figure 6 This is a schematic diagram of a sub-process of S201 in one embodiment;

[0060] Figure 7 This is a schematic diagram of the composition of an identity authentication system in one embodiment;

[0061] Figure 8 This is a flowchart illustrating the method before obtaining the message to be signed in one embodiment;

[0062] Figure 9 This is a schematic diagram of the overall process of an identity authentication method in one embodiment;

[0063] Figure 10 This is a structural block diagram of an identity authentication device in one embodiment;

[0064] Figure 11 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0065] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application.

[0066] The identity authentication method provided by the embodiments of the present application can be applied in an application environment as shown in Figure 1 The terminal 102 communicates with the server 104 through a network. The data storage system can store data required to be processed by the server 104. The data storage system can be integrated on the server 104, or placed on a cloud or other network server. The identity authentication method provided by the embodiments of the present application can be executed by the terminal 102 or the server 104 alone, or executed by the terminal 102 and the server 104 in cooperation. Taking the case of being executed by the terminal 102 alone as an example: obtaining a to-be-signed message generated by an application platform when receiving a service request requiring identity authentication; signing the to-be-signed message by using a local private key to obtain a first signed message; obtaining an encrypted signed message based on an application public key and the first signed message; obtaining a second signed message decrypted by the application platform based on an application private key; determining a decryption result based on a local public key and the second signed message; and in the case that the decryption result indicates that the decryption is successful, determining that the identity authentication result of the service request is passed. The terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle-mounted device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0067] In one embodiment, as shown in Figure 2 An identity authentication method is provided. Taking the case of the method being applied to a computer device (which can be the terminal 102 or the server 104 in Figure 1 as an example, the method includes the following steps:

[0068] S201, obtaining a to-be-signed message generated by an application platform when receiving a service request requiring identity authentication.

[0069] The application platform is a software application platform that needs identity authentication in a business processing process. The identity authentication method provided in the application is applied to an identity authentication platform in a computer device. In some embodiments, the identity authentication platform is an identity authentication applet, which can be a small program developed on a communication software and can be used without downloading and installing. When the application platform receives a business request that needs identity authentication, a to-be-signed message is generated, and the identity authentication platform signs and verifies the to-be-signed message. For the to-be-signed message that passes the verification of the identity authentication platform, the application platform determines that the identity authentication of the business request passes, so as to perform the business processing corresponding to the business request.

[0070] The to-be-signed message is a message data that has not been signed. The application does not specifically limit the data type of the to-be-signed message. The identity authentication platform in the computer device obtains the to-be-signed message generated by the application platform when the application platform receives a business request that needs identity authentication.

[0071] S202, signing the to-be-signed message by using a local private key to obtain a first signed message.

[0072] The local private key refers to the private key of the identity authentication platform of the computer device. The private key is a small part of the code paired with the public key, which is used for encryption and decryption algorithms. The public key and the private key are a key pair obtained through an encryption algorithm (that is, one public key and one private key, that is, an asymmetric encryption method). The key pair obtained through the encryption algorithm can ensure that it is unique in the world. When using the key pair, if one of the keys is used to encrypt a piece of data, only the other key in the key pair can be used to decrypt the data. If the private key is used for encryption, the corresponding public key must be used for decryption, otherwise the decryption will fail. The private key is the non-public part, which is kept by the target object. The local private key of the identity authentication platform is saved in the computer device where the identity authentication platform is installed. The first signed message is the signed message obtained after signing the to-be-signed message. The computer device signs the to-be-signed message by using the local private key to obtain the first signed message.

[0073] S203, obtaining an encrypted signed message based on the application public key and the first signed message.

[0074] The encrypted signed message is the encrypted message obtained by encrypting the application public key. The application public key refers to the public key of the application platform. Optionally, the application public key can be saved in the computer device where the application platform is installed, or saved on the block chain. The public key is the public part of the key pair, which can encrypt the session and verify the digital signature. Only the corresponding private key can decrypt the session data, thereby ensuring the security of data transmission. The identity authentication platform in the computer device obtains the encrypted signed message based on the application public key and the first signed message.

[0075] S204, obtaining a second signature message decrypted by the application platform based on the application private key from the encrypted signature message.

[0076] The application private key is a private key of the application platform, and is stored in a computer device where the application platform is installed. The application private key and the application public key are a pair of key pairs, and the application private key can decrypt data encrypted by the application public key. The application platform decrypts the encrypted signature message obtained by encrypting the signature message by the application private key to obtain a decrypted signature message, which is the second signature message. The identity authentication platform in the computer device obtains the second signature message decrypted by the application platform based on the application private key from the encrypted signature message.

[0077] S205, determining a decryption result based on the local public key and the second signature message; in the case that the decryption result indicates that the decryption is successful, determining that the identity authentication result of the service request is passed.

[0078] The local public key is a public key of the identity authentication platform in the computer device. Optionally, the local public key can be stored locally in the computer device or on a block chain. The local public key and the local private key are a pair of key pairs, and the local public key can decrypt data encrypted by the local private key.

[0079] The identity authentication platform in the computer device determines a decryption result based on the local public key and the second signature message. The decryption result is used to represent whether the local public key is decrypted successfully. The decryption result includes decryption success and decryption failure. In the case that the decryption result indicates that the decryption is successful, the identity authentication platform in the computer device determines that the local public key is decrypted successfully, and the signature message in the second signature message will be decrypted by the local public key to obtain a decrypted message. The identity authentication platform in the computer device determines that the identity authentication result of the service request is passed based on the decrypted message, and the application platform will perform the service processing corresponding to the service request.

[0080] In the identity authentication method, the application platform generates a to-be-signed message when receiving a service request requiring identity authentication, and a local private key is used to sign the to-be-signed message to obtain a first signature message. Based on the application public key and the first signature message, an encrypted signature message is obtained. The application platform decrypts the encrypted signature message based on the application private key to obtain a second signature message. This method of using the application public key of the application platform for encryption and the application private key for decryption can improve the security of the signature message. Based on the local public key and the second signature message, the decryption result is determined. If the decryption result indicates that the decryption is successful, the identity authentication result of the service request is determined to be passed. This method of using the local private key for signing and the local public key for decryption can ensure that the to-be-signed message is not tampered with, which is conducive to the security of identity authentication and improves the efficiency of identity authentication.

[0081] In one embodiment, as shown in Figure 3 The to-be-signed message includes an application digital identity. Based on the application public key and the first signature message, an encrypted signature message is obtained, including:

[0082] S302, determining the application public key according to the application digital identity.

[0083] The application digital identity is a digital identity of the application platform. In some embodiments, the type of the application digital identity can be a distributed digital identity (DID, Decentralized Identity). The DID identity is a string in a specific format, which represents the digital identity of an entity. The entity can be a person, a machine, or an object. The DID digital identity system based on the blockchain has the characteristics of ensuring data authenticity and credibility, protecting user privacy and security, and strong portability. Each application digital identity corresponds to a DID document, and the DID document includes the application public key. In some embodiments, the DID document is saved in the blockchain. The identity authentication platform in the computer device determines the application public key according to the application digital identity.

[0084] S304, obtaining a local digital identity.

[0085] The local digital identity refers to the digital identity of the target object logged into the identity authentication platform. Optionally, the type of the local digital identity can be a distributed digital identity DID. The identity authentication platform in the computer device obtains the local digital identity.

[0086] S306, encapsulating the local digital identity and the first signature information to obtain encapsulation information.

[0087] The identity authentication platform encapsulates the local digital identity and the first signature information to obtain encapsulation information. Specifically, the local digital identity and the first signature information are encapsulated into a structure to obtain the encapsulation information, so as to facilitate the encrypted transmission of the local digital identity and the first signature information together.

[0088] In S308, the encapsulation information is encrypted by using the application public key to obtain an encrypted signature message.

[0089] The identity authentication platform encrypts the encapsulation information by using the application public key to obtain the encrypted signature message. Optionally, the encryption method of the application public key can be RSA256 (a kind of asymmetric encryption algorithm) or national standard SM2 (elliptic curve public key encryption algorithm). The encrypted signature information includes the encrypted local digital identity and the encrypted first signature information.

[0090] In this embodiment, the application digital identity is used to determine the application public key, obtain the local digital identity, encapsulate the local digital identity and the first signature information, encrypt the encapsulation information by using the application public key, and obtain the encrypted signature message. This method of encrypting the encapsulated local digital identity and the first signature information by using the application public key can encrypt the local digital identity and the first signature information together, facilitate the encrypted transmission of the encapsulation information, improve the security of data, and improve the efficiency of identity authentication.

[0091] In one embodiment, determining the application public key according to the application digital identity includes: initiating an application public key query request to the distributed digital identity system based on the application digital identity, so that the distributed digital identity system judges the validity of the application digital identity, and queries the application digital identity document from the block chain network in the case that the validity judgment result indicates that the application digital identity is valid; analyzing the application digital identity document to obtain the application public key; and receiving the application public key sent by the distributed digital identity system.

[0092] The identity authentication platform initiates an application public key query request to the distributed digital identity system by applying the digital identity. The distributed digital identity system is a software platform for providing digital identity management in a computer device. After receiving the application digital identity, the distributed digital identity system judges the validity of the application digital identity, thereby verifying the validity and authenticity of the application digital identity. In the case where the validity judgment result indicates that the application digital identity is valid, the application digital identity document is queried from the blockchain network. The application digital identity document is stored in the blockchain, which can guarantee the security and reliability of the digital identity document. Each application digital identity corresponds to an application digital identity document, and the application digital key is saved in the application digital identity document. The distributed digital identity system queries the application digital identity document from the blockchain network, and receives the application digital identity document returned by the blockchain. The distributed digital identity system parses the application digital identity document to obtain the application public key, and returns the application public key to the identity authentication platform.

[0093] The identity authentication platform receives the application public key sent by the distributed digital identity system.

[0094] In this embodiment, by applying the digital identity, an application public key query request is initiated to the distributed digital identity system, so that the distributed digital identity system judges the validity of the application digital identity, in the case where the validity judgment result indicates that the application digital identity is valid, the application digital identity document is queried from the blockchain network, the application digital identity document is parsed to obtain the application public key; the application public key sent by the distributed digital identity system is received. This method based on the application digital identity, querying and parsing the application public key from the blockchain network through the distributed digital identity system, can guarantee the security of the application public key, and is conducive to improving the efficiency of identity authentication.

[0095] In one embodiment, as shown in FIG. 10, the second signature message obtained by decrypting the encrypted signature message based on the application private key of the application platform comprises: Figure 4

[0096] S402, the encrypted signature message is sent to the message center, so that the message center updates the to-be-signed message to the encrypted signature message, and sends the encrypted signature message to the application platform.

[0097] The message center is a message storage unit. Optionally, the message center can be a structure or a database. The to-be-signed message is stored in the message center. The identity authentication platform sends the encrypted signature message to the message center. The message center updates the stored to-be-signed message to the encrypted signature message. The message center sends the encrypted signature message to the application platform.

[0098] ​S404, obtaining second signature information obtained by the application platform by decrypting the encrypted signature message based on the application private key.

[0099] The application platform decrypts the encrypted signature message based on the application private key to obtain second signature information.

[0100] In this embodiment, the encrypted signature message is sent to the message center, so that the message center updates the to-be-signed message to the encrypted signature message and sends the encrypted signature message to the application platform. The application platform decrypts the encrypted signature message based on the application private key to obtain second signature information. Sending the encrypted signature message to the message center can ensure that the message center contains the encrypted signature message, which is conducive to improving the security of the message.

[0101] In one embodiment, as shown in Figure 5 The second signature information includes the decrypted verifiable digital credential, the decrypted local digital identity, and the decrypted signature message. Based on the local public key and the second signature message, the decryption result is determined, including:

[0102] S502, obtaining a verification result obtained by performing credential verification based on the decrypted verifiable digital credential.

[0103] The verifiable digital credential (VC) is a digital form of physical credentials in the real world, which can transfer the practicality and portability of physical identity credentials to digital devices. The second signature information includes the decrypted verifiable digital credential, the decrypted local digital identity, and the decrypted signature message. The application platform performs credential verification on the decrypted local digital identity to obtain a verification result. The identity authentication platform obtains the verification result sent by the application platform.

[0104] S504, in the case where the verification result indicates that the verification is passed, querying the local public key from the blockchain network by using the decrypted local digital identity.

[0105] In a case where the verification result corresponding to the decrypted local digital identity indicates that the verification is passed, the identity authentication platform queries the local public key from the blockchain network by using the decrypted local digital identity. Specifically, the identity authentication platform sends the decrypted local digital identity to the distributed digital identity system, and the distributed digital identity system judges the validity of the decrypted local digital identity, thereby verifying the validity and authenticity of the decrypted local digital identity. In a case where the validity judgment result indicates that the decrypted local digital identity is valid, the target digital identity document is queried from the blockchain network. The target digital identity document is stored in the blockchain, which can ensure the security and reliability of the digital identity document. Each decrypted local digital identity corresponds to a target digital identity document, and the local public key is saved in the target digital identity document. The distributed digital identity system queries the target digital identity document from the blockchain network, and receives the target digital identity document returned by the blockchain. The distributed digital identity system analyzes the target digital identity document to obtain the local public key, and returns the local public key to the identity authentication platform.

[0106] The identity authentication platform receives the local public key sent by the distributed digital identity system.

[0107] S506, the decrypted signature message is decrypted by using the local public key to obtain a decryption result.

[0108] The identity authentication platform decrypts the decrypted signature message by using the local public key to obtain a decryption result. The decrypted signature message has the same content as the first signature message, and since the first signature message is obtained by signing the to-be-signed message by using the local private key, the decrypted signature message can be decrypted by using the local public key to obtain the message before signing, which is the to-be-signed message. The decryption result is used to indicate that the local public key decryption is successful or failed.

[0109] In this embodiment, by obtaining the verification result obtained by verifying the decrypted verifiable digital credential, in a case where the verification result indicates that the verification is passed, the local public key is queried from the blockchain network by using the decrypted local digital identity, the decrypted signature message is decrypted by using the local public key to obtain a decryption result. This verification of the decrypted verifiable digital credential is beneficial to ensure that the decrypted verifiable digital credential is a reliable credential that has been verified, and is beneficial to improve the security of data. The local public key is queried from the blockchain network by using the decrypted local digital identity, thereby the decrypted signature message is decrypted, which further improves the security of data and is beneficial to improve the efficiency of identity authentication.

[0110] In one embodiment, as Figure 6As shown, the application platform generates a to-be-signed message when receiving a service request requiring identity authentication, and the to-be-signed message includes:

[0111] S602, the application platform generates a signed two-dimensional code when receiving a service request requiring identity authentication.

[0112] The signed two-dimensional code is a two-dimensional code containing a message index of the to-be-signed message. The application platform generates a signed two-dimensional code when receiving a service request requiring identity authentication, and the identity authentication platform receives the signed two-dimensional code generated by the application platform.

[0113] S604, the signed two-dimensional code is parsed to obtain the message index.

[0114] The identity authentication platform parses the signed two-dimensional code to obtain the message index. The message index is used to indicate the corresponding message content in the message center.

[0115] S606, based on the message index, the to-be-signed message is queried from the message center.

[0116] The identity authentication platform queries the to-be-signed message corresponding to the message index from the message center through the message index.

[0117] In this embodiment, by obtaining the signed two-dimensional code generated by the application platform when receiving a service request requiring identity authentication, the signed two-dimensional code is parsed to obtain the message index, and the to-be-signed message corresponding to the message index is queried from the message center. By saving the message index in the signed two-dimensional code, the to-be-signed message is indexed through the signed two-dimensional code when the service request is initiated, which is conducive to improving the efficiency of identity authentication.

[0118] In one embodiment, the step of creating a local digital identity includes: creating a local identity; generating a mnemonic word for the local identity that has passed real-name authentication; and creating a local digital identity based on the mnemonic word when a security code is received.

[0119] The identity authentication system creates a local identity for the target object that logs in. Each target object corresponds to a local identity. The identity authentication system generates a mnemonic for the local identity that passes the real-name authentication. In some embodiments, the method of generating the mnemonic can be to create a random sequence of 128 to 256 bits (entropy), create a checksum of the random sequence by taking the first (entropy length / 32) bits of the SHA256 hash, add the checksum to the end of the random sequence, divide the random sequence into 11-bit parts, map each 11-bit value to a word from a predefined dictionary of 2048 words, and obtain the mnemonic. When the identity authentication system receives an input security code of the target object, the identity system creates a local digital identity based on the mnemonic. The input security code is a security code customized by the target object. The type of the input security code can be a number type, a character type, or a character plus number type.

[0120] In this embodiment, a mnemonic is generated for the local identity that passes the real-name authentication, and a local digital identity is created based on the mnemonic when an input security code is received. Since the local identity is authenticated by real name, the security of the local digital identity is improved.

[0121] In one embodiment, the message to be signed further includes a verifiable digital credential; before obtaining the message to be signed generated by the application platform when receiving a service request requiring identity authentication, further comprising: obtaining digital credential proof information; sending the digital credential proof information to the credential auditing agency for auditing, so that the credential auditing agency generates a verifiable digital credential based on the digital credential proof, and saves the verifiable credential to the blockchain network; obtaining the verifiable digital credential sent by the credential auditing agency.

[0122] The verifiable digital credential is included in the message to be signed. Before the application platform generates the message to be signed, the digital credential proof information of the identity authentication platform needs to be sent to the credential auditing agency for auditing, so as to generate a verifiable digital credential. Specifically, the target object that logs in the identity authentication platform needs to apply for a proof of signature right, such as an administrator's proof or a legal representative's proof. The target object submits relevant digital credential proof information to the identity authentication platform, the identity authentication platform obtains the digital credential proof information, and sends the digital credential proof information to the credential auditing agency for auditing, so that the credential auditing agency generates a verifiable digital credential based on the digital credential proof. At the same time, the credential auditing agency saves the verifiable credential to the blockchain network. The identity authentication platform obtains the verifiable digital credential sent by the credential auditing agency from the blockchain network.

[0123] In this embodiment, by obtaining the digital certificate proof information, the digital certificate proof information is sent to the certificate auditing agency for auditing, so that the certificate auditing agency generates a verifiable digital certificate based on the digital certificate proof, and saves the verifiable certificate into the blockchain network, thereby obtaining the verifiable digital certificate sent by the certificate auditing agency. The verifiable digital certificate generated by the certificate auditing agency can guarantee the effectiveness of the verifiable digital certificate. At the same time, the verifiable digital certificate is saved in the blockchain, which can guarantee the security of the verifiable digital certificate, and is beneficial to improve the security and accuracy of the identity authentication result, and improve the efficiency of the identity authentication.

[0124] To illustrate the identity authentication method and effect in this scheme in detail, a most detailed embodiment is described below:

[0125] The identity authentication method corresponds to an identity authentication system including a blockchain network layer, a two-layer network layer, a distributed digital identity service layer, and a trusted exchange layer. Specifically, as Figure 7 shown. Among them, the blockchain network layer is used to provide the service of the underlying chain. The two-layer network layer is used to provide alliance management, contract management and other services. The distributed digital identity service layer is used to provide DID management services, VC management services, authority agency management services and DID resolver services. The trusted exchange layer is used to provide ecological applications, including certificate issuing agencies, holders and verification parties.

[0126] The identity authentication platform in the computer device obtains a signed two-dimensional code generated by the application platform when receiving a business request requiring identity authentication, parses the signed two-dimensional code, and obtains a message index. In some embodiments, the content parsed from the signed two-dimensional code is in the following format: msgIndex=msg0000001&type=msg-sign. Among them, msgIndex represents the message index. type represents the message type. Based on the message index, the to-be-signed message is obtained from the message center. The to-be-signed message includes an application digital identity. The to-be-signed message is signed by using a local private key to obtain a first signed message. The to-be-signed message also includes a verifiable digital certificate; as Figure 8 shown is a method flow diagram before obtaining the to-be-signed message. Before the signed two-dimensional code generated by the application platform when receiving a business request requiring identity authentication, it also includes obtaining digital certificate proof information, sending the digital certificate proof information to the certificate auditing agency for auditing, so that the certificate auditing agency generates a verifiable digital certificate based on the digital certificate proof, and saves the verifiable certificate into the blockchain network, and obtains the verifiable digital certificate sent by the certificate auditing agency.

[0127] As Figure 9An overall flowchart of an identity authentication method is shown. The identity authentication platform in the computer device obtains an encrypted signature message based on an application public key and a first signature message. Specifically, the application public key is determined according to an application digital identity identifier. The local digital identity identifier is obtained, and the local digital identity identifier and the first signature information are encapsulated to obtain encapsulation information. The encapsulation information is encrypted using the application public key to obtain the encrypted signature message. Wherein, the application public key is determined according to the application digital identity identifier, including: based on the application digital identity identifier, initiating an application public key query request to the distributed digital identity system, so that the distributed digital identity system judges the validity of the application digital identity identifier, and in the case that the validity judgment result indicates that the application digital identity identifier is valid, querying the application digital identity document from the block chain network; the application digital identity document is parsed to obtain the application public key; and the application public key sent by the distributed digital identity system is received. Wherein, the creation steps of the local digital identity identifier include: creating a local identity identifier, generating a mnemonic word for the local identity identifier that has passed the real-name authentication, and creating a local digital identity identifier based on the mnemonic word when a security code is received.

[0128] The identity authentication platform in the computer device sends the encrypted signature message to the message center, so that the message center updates the to-be-signed message to the encrypted signature message, and sends the encrypted signature message to the application platform, and obtains the second signature information obtained by the application platform based on the application private key decrypting the encrypted signature message. The second signature information includes the decrypted verifiable digital credential, the decrypted local digital identity identifier, and the decrypted signature message.

[0129] The identity authentication platform in the computer device determines the decryption result based on the local public key and the second signature message. Specifically, the verification result obtained by verifying the decrypted verifiable digital credential is obtained, and in the case that the verification result indicates that the verification is passed, the local public key is queried from the block chain network using the decrypted local digital identity identifier, the decrypted signature message is decrypted using the local public key to obtain the decryption result. In the case that the decryption result indicates that the decryption is successful, it is determined that the identity authentication result of the business request is authentication passed.

[0130] The identity authentication method, by obtaining the to-be-signed message generated by the application platform when receiving the service request requiring identity authentication, signing the to-be-signed message by using the local private key to obtain a first signature message, obtaining the encrypted signature message based on the application public key and the first signature message, and obtaining the second signature message decrypted by the application platform based on the application private key. The method of encrypting by using the application public key of the application platform and decrypting by using the application private key can improve the security of the signature message. Based on the local public key and the second signature message, the decryption result is determined, and in the case that the decryption result indicates that the decryption is successful, the identity authentication result of the service request is determined as passing authentication. The method of signing by using the local private key and decrypting by using the local public key can ensure that the to-be-signed message is not tampered with, which is beneficial to the security of identity authentication and improves the efficiency of identity authentication.

[0131] It should be understood that, although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the order of the arrow. Unless otherwise specified herein, there is no strict order limitation for the execution of these steps, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0132] Based on the same inventive concept, the embodiments of the present application also provide an identity authentication device for implementing the above-mentioned identity authentication method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more identity authentication device embodiments provided below can refer to the limitations of the identity authentication method described above, which will not be repeated here.

[0133] In one embodiment, as shown in Figure 10 An identity authentication device 100 is provided, comprising: a message obtaining module 110, a signature module 120, an encryption module 130, a decryption module 140 and a result determining module 150, wherein:

[0134] The message obtaining module 110 is configured to obtain a to-be-signed message generated by an application platform when receiving a service request requiring identity authentication.

[0135] The signature module 120 is configured to sign the to-be-signed message by using a local private key to obtain a first signature message.

[0136] The encryption module 130 is configured to obtain an encrypted signature message based on the application public key and the first signature message.

[0137] The decryption module 140 is configured to obtain a second signature message decrypted by the application platform based on the application private key.

[0138] The result determination module 150 is configured to determine a decryption result based on the local public key and the second signature message, and determine that the identity authentication result of the service request is passed in a case where the decryption result indicates that the decryption is successful.

[0139] The identity authentication apparatus described above obtains a to-be-signed message generated by the application platform when receiving a service request requiring identity authentication, signs the to-be-signed message based on a local private key to obtain a first signature message, obtains an encrypted signature message based on an application public key and the first signature message, and obtains a second signature message decrypted by the application platform based on an application private key. The method of encrypting by using the application public key of the application platform and decrypting by using the application private key can improve the security of the signature message. The decryption result is determined based on the local public key and the second signature message, and the identity authentication result of the service request is passed in a case where the decryption result indicates that the decryption is successful. The method of signing by using the local private key and decrypting by using the local public key can ensure that the to-be-signed message is not tampered with, and is conducive to the security and efficiency of identity authentication.

[0140] In one embodiment, in a case where the to-be-signed message includes an application digital identity, and the encrypted signature message is obtained based on the application public key and the first signature message, the encryption module 130 is further configured to: determine the application public key according to the application digital identity; obtain a local digital identity; encapsulate the local digital identity and the first signature information to obtain encapsulated information; and encrypt the encapsulated information by using the application public key to obtain the encrypted signature message.

[0141] In one embodiment, in a case where the application public key is determined according to the application digital identity, the encryption module 130 is further configured to: initiate an application public key query request to a distributed digital identity system based on the application digital identity, so that the distributed digital identity system judges the validity of the application digital identity, and queries an application digital identity document from a block chain network in a case where the validity judgment result indicates that the application digital identity is valid; parses the application digital identity document to obtain the application public key; and receives the application public key sent by the distributed digital identity system.

[0142] In an embodiment, in the aspect of obtaining the second signature message obtained by the application platform by decrypting the encrypted signature message based on the application private key, the decryption module 140 is further configured to: send the encrypted signature message to the message center, so that the message center updates the to-be-signed message to the encrypted signature message, and sends the encrypted signature message to the application platform; and obtain the second signature information obtained by the application platform by decrypting the encrypted signature message based on the application private key.

[0143] In an embodiment, in the aspect of determining the decryption result based on the local public key and the second signature message, the result determination module 150 is further configured to: obtain a verification result obtained by performing verification on the decrypted verifiable digital credential; in a case where the verification result indicates that the verification is passed, query the local public key from the blockchain network by using the decrypted local digital identity; and decrypt the decrypted signature message by using the local public key to obtain the decryption result.

[0144] In an embodiment, in the aspect of obtaining the to-be-signed message generated by the application platform when the service request requiring identity authentication is received, the message obtaining module 110 is further configured to: obtain a signature two-dimensional code generated by the application platform when the service request requiring identity authentication is received; parse the signature two-dimensional code to obtain a message index; and obtain the to-be-signed message from the message center based on the message index.

[0145] The above modules in the identity authentication apparatus can be all or partially implemented by software, hardware, or a combination thereof. The above modules can be embedded in or independent of a processor in a computer device in a hardware form, or stored in a memory in a computer device in a software form, so as to be called and executed by a processor to perform operations corresponding to the above modules.

[0146] In an embodiment, a computer device is provided, which can be a terminal, and an internal structure diagram of the computer device can be as shown in Figure 11As shown in the figure. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through the system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capability. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used for wired or wireless communication with external terminals, and wireless communication can be realized through WIFI, mobile cellular network, NFC (near field communication) or other technologies. The computer program is executed by the processor to implement an identity authentication method.

[0147] Those skilled in the art can understand that, Figure 11 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0148] In one embodiment, a computer device is provided, comprising a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the following steps:

[0149] Obtaining a to-be-signed message generated by the application platform when receiving a service request requiring identity authentication; signing the to-be-signed message using a local private key to obtain a first signed message; obtaining an encrypted signed message based on the application public key and the first signed message; obtaining a second signed message decrypted by the application platform based on the application private key; determining a decryption result based on the local public key and the second signed message; and in the case that the decryption result indicates that the decryption is successful, determining that the identity authentication result of the service request is passed.

[0150] In one embodiment, the processor executing the computer program further implements the following steps:

[0151] The to-be-signed message includes an application digital identity identifier; the application public key is determined according to the application digital identity identifier; the local digital identity identifier is obtained; the local digital identity identifier and the first signed information are encapsulated to obtain encapsulation information; and the encapsulation information is encrypted using the application public key to obtain the encrypted signed message.

[0152] In one embodiment, the processor executing the computer program further implements the following steps:

[0153] Based on the application digital identity, an application public key query request is initiated to the distributed digital identity system, so that the distributed digital identity system judges the validity of the application digital identity, and in the case that the validity judgment result indicates that the application digital identity is valid, the application digital identity document is queried from the blockchain network; the application public key is obtained by analyzing the application digital identity document; and the application public key sent by the distributed digital identity system is received.

[0154] In one embodiment, the processor also implements the following steps when executing the computer program:

[0155] The encrypted signed message is sent to the message center, so that the message center updates the to-be-signed message to the encrypted signed message, and sends the encrypted signed message to the application platform; and the second signature information obtained by the application platform based on the application private key decrypting the encrypted signed message is obtained.

[0156] In one embodiment, the processor also implements the following steps when executing the computer program:

[0157] The second signature information includes the decrypted verifiable digital credential, the decrypted local digital identity, and the decrypted signed message; a verification result obtained by verifying the decrypted verifiable digital credential is obtained; in the case that the verification result indicates that the verification is passed, the local public key is queried from the blockchain network by using the decrypted local digital identity; and the decrypted result is obtained by decrypting the decrypted signed message by using the local public key.

[0158] In one embodiment, the processor also implements the following steps when executing the computer program:

[0159] The signature two-dimensional code generated by the application platform when receiving the business request requiring identity authentication is obtained; the message index is obtained by analyzing the signature two-dimensional code; and the to-be-signed message is obtained from the message center based on the message index.

[0160] In one embodiment, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the following steps:

[0161] The to-be-signed message generated by the application platform when receiving the business request requiring identity authentication is obtained; the first signature message is obtained by signing the to-be-signed message by using the local private key; the encrypted signed message is obtained based on the application public key and the first signature message; the second signature message obtained by the application platform based on the application private key decrypting the encrypted signed message is obtained; the decryption result is determined based on the local public key and the second signature message; and in the case that the decryption result indicates that the decryption is successful, the identity authentication result of the business request is determined to be authentication passed.

[0162] In one embodiment, the computer program, when executed by the processor, further implements the following steps:

[0163] The to-be-signed message includes an application digital identity; an application public key is determined according to the application digital identity; a local digital identity is obtained; the local digital identity and the first signature information are encapsulated to obtain encapsulation information; and the encapsulation information is encrypted by using the application public key to obtain the encrypted signed message.

[0164] In one embodiment, the computer program, when executed by the processor, further implements the following steps:

[0165] Based on the application digital identity, an application public key query request is initiated to the distributed digital identity system, so that the distributed digital identity system judges the validity of the application digital identity, and in the case that the validity judgment result indicates that the application digital identity is valid, the application digital identity document is queried from the block chain network; the application public key is obtained by analyzing the application digital identity document; and the application public key sent by the distributed digital identity system is received.

[0166] In one embodiment, the computer program, when executed by the processor, further implements the following steps:

[0167] The encrypted signed message is sent to the message center, so that the message center updates the to-be-signed message to the encrypted signed message, and sends the encrypted signed message to the application platform; and the second signature information obtained by decrypting the encrypted signed message by the application platform based on the application private key is obtained.

[0168] In one embodiment, the computer program, when executed by the processor, further implements the following steps:

[0169] The second signature information includes the decrypted verifiable digital credential, the decrypted local digital identity, and the decrypted signed message; a verification result obtained by verifying the verifiable digital credential based on the decrypted verifiable digital credential is obtained; in the case that the verification result indicates that the verification is passed, the local public key is queried from the block chain network by using the decrypted local digital identity; and the decrypted signed message is decrypted by using the local public key to obtain a decryption result.

[0170] In one embodiment, the computer program, when executed by the processor, further implements the following steps:

[0171] The signature two-dimensional code generated by the application platform when receiving a service request requiring identity authentication is obtained; the signature two-dimensional code is parsed to obtain a message index; and the to-be-signed message is obtained from the message center based on the message index.

[0172] In one embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the following steps:

[0173] Obtaining a to-be-signed message generated by the application platform when receiving a service request requiring identity authentication; signing the to-be-signed message using a local private key to obtain a first signed message; obtaining an encrypted signed message based on the application public key and the first signed message; obtaining a second signed message decrypted by the application platform based on the application private key; determining a decryption result based on the local public key and the second signed message; and determining that the identity authentication result of the service request is passed in a case where the decryption result indicates that the decryption is successful.

[0174] In one embodiment, the computer program, when executed by the processor, further implements the following steps:

[0175] The to-be-signed message includes an application digital identity; the application public key is determined according to the application digital identity; the local digital identity is obtained; the local digital identity and the first signed information are encapsulated to obtain encapsulation information; and the encapsulation information is encrypted using the application public key to obtain the encrypted signed message.

[0176] In one embodiment, the computer program, when executed by the processor, further implements the following steps:

[0177] Based on the application digital identity, an application public key query request is initiated to the distributed digital identity system, so that the distributed digital identity system judges the validity of the application digital identity, and in a case where the validity judgment result indicates that the application digital identity is valid, the application digital identity document is queried from the block chain network; the application public key is obtained by parsing the application digital identity document; and the application public key sent by the distributed digital identity system is received.

[0178] In one embodiment, the computer program, when executed by the processor, further implements the following steps:

[0179] The encrypted signed message is sent to the message center, so that the message center updates the to-be-signed message to the encrypted signed message, and sends the encrypted signed message to the application platform; and the second signed information decrypted by the application platform based on the application private key is obtained.

[0180] In one embodiment, the computer program, when executed by the processor, further implements the following steps:

[0181] The second signature information includes the decrypted verifiable digital certificate, the decrypted local digital identity, and the decrypted signature message; a verification result obtained based on the decrypted verifiable digital certificate is acquired; in a case where the verification result indicates that the verification is passed, the local public key is queried from the block chain network by using the decrypted local digital identity; and the decrypted signature message is decrypted by using the local public key to obtain a decryption result.

[0182] In one embodiment, the computer program, when executed by the processor, further implements the following steps:

[0183] The signature two-dimensional code generated by the application platform when receiving a service request requiring identity authentication is acquired; the signature two-dimensional code is parsed to obtain a message index; and the to-be-signed message is obtained from the message center based on the message index.

[0184] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of the related data need to comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0185] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric memory (Ferroelectric Random Access Memory, FRAM), phase change memory (Phase Change Memory, PCM), graphene memory, etc. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0186] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0187] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. An identity authentication method, characterized by, An identity authentication platform applied to a computer device, the identity authentication platform being an identity authentication applet, the method comprising: obtaining a to-be-signed message generated by an application platform when receiving a service request requiring identity authentication; signing the to-be-signed message using a local private key to obtain a first signed message; obtaining an encrypted signed message based on an application public key and the first signed message; the application public key being a public key of the application platform; obtaining a second signed message decrypted by the application platform based on an application private key from the encrypted signed message; determining a decryption result based on a local public key and the second signed message; in a case where the decryption result indicates that decryption is successful, determining that an identity authentication result of the service request is passed; the to-be-signed message comprising an application digital identity; the obtaining of the encrypted signed message based on the application public key and the first signed message comprises: determining an application public key according to the application digital identity; each application digital identity corresponds to an application digital identity document, the application digital identity document containing an application public key, and the application digital identity document being stored in a blockchain; obtaining a local digital identity; the local digital identity being a digital identity of a target object logging in the identity authentication platform; encapsulating the local digital identity and the first signed information to obtain encapsulated information; encrypting the encapsulated information using the application public key to obtain the encrypted signed message; the encrypted signed information comprising an encrypted local digital identity and an encrypted first signed information.

2. The method of claim 1, wherein, the determining of the application public key according to the application digital identity comprises: initiating an application public key query request to a distributed digital identity system based on the application digital identity, so that the distributed digital identity system judges the validity of the application digital identity, and in a case where a validity judgment result indicates that the application digital identity is valid, queries an application digital identity document from a blockchain network; parsing the application digital identity document to obtain an application public key; receiving the application public key sent by the distributed digital identity system.

3. The method of claim 1, wherein, the obtaining of the second signed message decrypted by the application platform based on the application private key from the encrypted signed message comprises: sending the encrypted signed message to a message center, so that the message center updates the to-be-signed message to the encrypted signed message, and sends the encrypted signed message to the application platform; obtaining the second signed information decrypted by the application platform based on the application private key from the encrypted signed message.

4. The method of claim 1, wherein, the second signed information comprising a decrypted verifiable digital credential, a decrypted local digital identity, and a decrypted signed message; the determining of the decryption result based on the local public key and the second signed message comprises: obtaining a verification result obtained by verifying the decrypted verifiable digital credential; in a case where the verification result indicates that verification is passed, querying a local public key from a blockchain network using the decrypted local digital identity; Decrypt the decrypted signature message using the local public key to obtain a decryption result.

5. The method of claim 1, wherein, The application platform generates a signature two-dimensional code when receiving a service request requiring identity authentication. The application platform generates a signature two-dimensional code when receiving a service request requiring identity authentication. The signature two-dimensional code is parsed to obtain a message index. Based on the message index, the to-be-signed message is queried from the message center.

6. An identity authentication apparatus characterized by comprising: An identity authentication platform applied to a computer device, the identity authentication platform being an identity authentication applet, and the device comprising: A message acquisition module configured to acquire a to-be-signed message generated by an application platform when receiving a service request requiring identity authentication; A signature module configured to sign the to-be-signed message using a local private key to obtain a first signature message; An encryption module configured to obtain an encrypted signature message based on an application public key and the first signature message, the application public key being a public key of the application platform; A decryption module configured to acquire a second signature message obtained by decrypting the encrypted signature message based on an application private key by the application platform; A result determination module configured to determine a decryption result based on a local public key and the second signature message, and determine that an identity authentication result of the service request is passed in a case where the decryption result indicates that decryption is successful; The to-be-signed message includes an application digital identity; the encryption module is further configured to determine an application public key according to the application digital identity; each application digital identity corresponds to an application digital identity document, the application digital identity document containing an application public key, and the application digital identity document being saved in a block chain; a local digital identity is acquired; the local digital identity is a digital identity of a target object logging in the identity authentication platform; the local digital identity and the first signature information are encapsulated to obtain encapsulated information; the encapsulated information is encrypted using the application public key to obtain the encrypted signature message; the encrypted signature information includes an encrypted local digital identity and encrypted first signature information. 7.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-6 when the computer program is executed by the processor. The processor executes the computer program to implement the steps of the method of any one of claims 1 to 5.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 5.

9. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 5.

Images