Methods, apparatus, equipment and media for establishing peer-to-peer distributed digital identity connections

Abstract

This application discloses a method, apparatus, device, and medium for establishing a point-to-point distributed digital identity connection, relating to the field of computer technology. The method includes: generating a hash value through an initiating node; establishing a TCP connection between the initiating node and the target node based on the initiating node, an index server, a target node, and the hash value; controlling the target node to acquire and save its first distributed digital identity, and sending a first document of the first distributed digital identity to the initiating node based on the TCP connection; controlling the initiating node to acquire and save the first document sent by the target node, acquiring and saving its second distributed digital identity, and sending a second document of the second distributed digital identity to the target node based on the TCP connection; and controlling the target node to acquire and save the second document sent by the initiating node, thereby establishing a point-to-point distributed digital identity connection between the target node and the initiating node. This application enables the direct point-to-point establishment of connections between distributed digital identities.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, and medium for establishing peer-to-peer distributed digital identity connections. Background Technology

[0002] Currently, in distributed digital identity networks, each digital identity owner must first establish a connection with a cloud agent (i.e., an edge agent) through their own agent before they can communicate with each other. A cloud agent can establish connections with multiple edge agents, and there are multiple cloud agents on the network.

[0003] Edge proxies typically run on clients directly controlled by the distributed digital identity owner, while cloud proxies are nodes on the network, similar to servers. Cloud proxies are responsible for connecting multiple edge proxies and handling the routing of distributed digital identity connections, such as... Figure 1 As shown.

[0004] However, this method of using cloud proxies has drawbacks, mainly: 1. Communication via cloud proxies weakens the decentralization of distributed digital identities; 2. Every interaction needs to pass through the cloud proxy server, thus overloading the server and affecting its throughput. While deploying more cloud proxies can alleviate this problem, a large number of cloud proxy servers significantly increases costs; 3. The addition of cloud proxies increases network complexity and requires handling complex routing.

[0005] In conclusion, how to establish direct point-to-point connections between distributed digital identities is a problem that urgently needs to be solved. Summary of the Invention

[0006] In view of this, the purpose of this invention is to provide a method, apparatus, device, and medium for establishing point-to-point distributed digital identity connections, capable of directly establishing connections between distributed digital identities. The specific solution is as follows:

[0007] In a first aspect, this application discloses a method for establishing a peer-to-peer distributed digital identity connection, applied to a peer-to-peer distributed digital identity connection establishment system, the peer-to-peer distributed digital identity connection establishment system comprising an index server, an initiating node, and a target node, including:

[0008] A hash value is generated through the initiating node;

[0009] A TCP connection between the initiating node and the target node is established based on the data transmission between the initiating node, the index server, and the target node, and the hash value.

[0010] The target node is controlled to acquire and save its first distributed digital identity, and the first document corresponding to the first distributed digital identity is sent to the initiating node based on the TCP connection;

[0011] The system controls the initiating node to acquire and save the first document sent by the target node, then acquires and saves the second distributed digital identity of the initiating node, and sends the second document corresponding to the second distributed digital identity to the target node based on the TCP connection.

[0012] The target node is controlled to acquire and save the second document sent by the initiating node, so as to establish a point-to-point distributed digital identity connection between the target node and the initiating node.

[0013] Optionally, generating a hash value through the initiating node includes:

[0014] The initiating node generates a hash value, a reference random number, and an initiating public key. Then, the initiating public key is divided into an odd-numbered initiating public key and an even-numbered initiating public key, and the reference random number is also divided into an odd-numbered reference random number and an even-numbered reference random number.

[0015] Accordingly, establishing a TCP connection between the initiating node and the target node based on data transmission between the initiating node, the index server, and the target node, and the hash value, includes:

[0016] The initiating node is controlled to send the hash value, the odd-numbered reference random number, and the odd-numbered initiating public key to the index server, so that the index server can obtain the first node address of the initiating node and send the hash value, the even-numbered reference random number, and the even-numbered initiating public key to the target node.

[0017] The target node is controlled and the odd-numbered reference random number and the odd-numbered initiation public key are obtained from the index server based on the hash value, so that the index server can obtain the second node address of the target node. Then, the reference random number is obtained based on the odd-numbered reference random number and the even-numbered reference random number, and the initiation public key is obtained based on the even-numbered initiation public key and the odd-numbered initiation public key.

[0018] The index server is used to establish a TCP connection between the initiating node and the target node based on the first node address and the second node address.

[0019] Optionally, controlling the target node to acquire and save the target node's first distributed digital identity, and sending the first document corresponding to the first distributed digital identity to the initiating node based on the TCP connection, includes:

[0020] The target node is controlled to acquire and save its first distributed digital identity, and the first encrypted information is obtained by encrypting the first document corresponding to the first distributed digital identity and the reference random number using the initiating public key.

[0021] The target node is controlled to sign the first encrypted information using the first private key corresponding to the first distributed digital identity to obtain a first signature, and then sends the first signature and the first encrypted information to the initiating node based on the TCP connection.

[0022] Optionally, generating the hash value, reference random number, and initiation public key through the initiating node includes:

[0023] The initiating node generates a hash value, a reference random number, an initiating public key, and an initiating private key.

[0024] Accordingly, controlling the initiating node to acquire and save the first document includes:

[0025] The initiating node is controlled to obtain the target signature and target encryption information, and to decrypt the target encryption information using the initiating private key;

[0026] If the target identity document and the target random number are obtained, the initiating node is controlled to verify the target signature using the target public key in the target identity document;

[0027] If the signature verification is successful, determine whether the target random number is the same as the reference random number;

[0028] If they are the same, then the target identity document is the first document, the target signature is the first signature, and then the initiating node is controlled to save the first document.

[0029] Optionally, the step of acquiring and saving the second distributed digital identity of the initiating node, and sending the second document corresponding to the second distributed digital identity to the target node based on the TCP connection, includes:

[0030] The system controls the initiating node to acquire and save the second distributed digital identity of the initiating node, and uses the first public key in the first document to encrypt the second document corresponding to the second distributed digital identity to obtain the second encrypted information;

[0031] The initiating node controls the second private key corresponding to the second distributed digital identity to sign the second encrypted information to obtain a second signature, and then sends the second encrypted information and the second signature to the target node.

[0032] Optionally, controlling the target node to acquire and save the second document sent by the initiating node to establish a peer-to-peer distributed digital identity connection between the target node and the initiating node includes:

[0033] Control the target node to obtain the reference encryption information and the reference signature;

[0034] Decrypt the reference encrypted information using the first private key corresponding to the first distributed digital identity;

[0035] If a reference identity document is obtained, the target node is controlled to verify the reference signature using the reference public key in the reference identity document;

[0036] If the signature verification is successful, the reference identity document becomes the second document, the reference signature becomes the second signature, and the target node is controlled to save the second document.

[0037] Optionally, the peer-to-peer distributed digital identity connection establishment method further includes:

[0038] If the TCP connection between the target node and the initiating node is broken, resulting in the disconnection of the peer-to-peer distributed digital identity connection between the target node and the initiating node, then the process jumps to generating a hash value through the initiating node to re-establish the peer-to-peer distributed digital identity connection between the target node and the initiating node.

[0039] Secondly, this application discloses a peer-to-peer distributed digital identity connection establishment device, applied to a peer-to-peer distributed digital identity connection establishment system, the peer-to-peer distributed digital identity connection establishment system including an index server, an initiating node, and a target node, the method including:

[0040] The generation module is used to generate hash values ​​through the initiating node;

[0041] The TCP connection establishment module is used to establish a TCP connection between the initiating node and the target node based on the data transmission between the initiating node, the index server and the target node and the hash value;

[0042] The first acquisition module is used to control the target node to acquire and save the first distributed digital identity of the target node;

[0043] The first sending module is used to send the first document corresponding to the first distributed digital identity to the initiating node based on the TCP connection;

[0044] The second acquisition module is used to control the initiating node to acquire and save the first document sent by the target node, and then acquire and save the second distributed digital identity of the initiating node;

[0045] The second sending module is used to send the second document corresponding to the second distributed digital identity to the target node based on the TCP connection;

[0046] The third acquisition module is used to control the target node to acquire and save the second document sent by the initiating node, so as to establish a point-to-point distributed digital identity connection between the target node and the initiating node.

[0047] Thirdly, this application discloses an electronic device, including a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the aforementioned peer-to-peer distributed digital identity connection establishment method.

[0048] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned peer-to-peer distributed digital identity connection establishment method.

[0049] As can be seen, this application generates a hash value through the initiating node; establishes a TCP connection between the initiating node and the target node based on the data transmission between the initiating node, the index server, and the target node, and the hash value; controls the target node to acquire and save its first distributed digital identity, and sends a first document corresponding to the first distributed digital identity to the initiating node based on the TCP connection; controls the initiating node to acquire and save the first document sent by the target node, then acquires and saves its second distributed digital identity, and sends a second document corresponding to the second distributed digital identity to the target node based on the TCP connection; controls the target node to acquire and save the second document sent by the initiating node, thereby establishing a point-to-point distributed digital identity connection between the target node and the initiating node. As can be seen, this application establishes a TCP connection between the initiating node and the target node, sends the first document corresponding to the first distributed digital identity of the target node to the initiating node, and sends the second document corresponding to the second distributed identity of the initiating node to the target node. This establishes a connection between the target node and the initiating node, reduces the use of the index server, which is equivalent to reducing the use of the cloud proxy. Therefore, it reduces network complexity, enhances the decentralization of the distributed digital identity, reduces the throughput of the cloud proxy or index server, and reduces costs. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0051] Figure 1 This is a schematic diagram of an existing distributed digital identity network;

[0052] Figure 2 A flowchart of a peer-to-peer distributed digital identity connection establishment method provided in this application;

[0053] Figure 3 A network topology diagram of a peer-to-peer distributed digital identity connection is provided for this application;

[0054] Figure 4 A flowchart illustrating a specific peer-to-peer distributed digital identity connection establishment method provided in this application;

[0055] Figure 5 A schematic diagram illustrating a peer-to-peer distributed digital identity connection establishment method provided in this application;

[0056] Figure 6 A flowchart of a peer-to-peer distributed digital identity connection establishment method provided in this application;

[0057] Figure 7 A schematic diagram of a peer-to-peer distributed digital identity connection establishment device provided in this application;

[0058] Figure 8 This application provides a structural diagram of an electronic device. Detailed Implementation

[0059] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] Currently, this method of using cloud proxies has drawbacks, mainly: 1. Communication via cloud proxies weakens the decentralization of distributed digital identities; 2. Every interaction needs to pass through the cloud proxy server, overloading the server and affecting its throughput. While deploying more cloud proxies can alleviate this problem, a large number of cloud proxy servers significantly increases costs; 3. The addition of cloud proxies increases network complexity and requires handling complex routing.

[0061] To overcome the above problems, this application provides a peer-to-peer distributed digital identity connection establishment scheme, which can directly establish connections between distributed digital identities point-to-point.

[0062] See Figure 2 As shown in the figure, this application discloses a peer-to-peer distributed digital identity connection establishment method, applied to a peer-to-peer distributed digital identity connection establishment system. The peer-to-peer distributed digital identity connection establishment system includes an index server, an initiating node, and a target node. The method includes:

[0063] Step S11: Generate a hash value through the initiating node.

[0064] In this embodiment of the application, the hash value is a unique hash value generated by the proxy of the initiating node. i (Used to uniquely identify each node); It should be noted that, in order to ensure the uniqueness of the hash value, the input value should be unique when generating the hash value, such as the node's MAC address (Media Access Control Address).

[0065] Step S12: Establish a TCP connection between the initiating node and the target node based on the data transmission between the initiating node, the index server, and the target node, and the hash value.

[0066] In this embodiment of the application, the index server acts as an intermediary and the hash value is used to establish a TCP connection between the initiating node and the target node.

[0067] Step S13: Control the target node to acquire and save the first distributed digital identity of the target node, and send the first document corresponding to the first distributed digital identity to the initiating node based on the TCP connection.

[0068] In this embodiment, each node runs an agent and a wallet, which are directly controlled by the Distributed Identity (DID) owner. The agent is software that helps the DID owner communicate with other DID owners (also through the agent).

[0069] In this embodiment of the application, when the target node is controlled to acquire and save the first distributed digital identity of the target node, the first distributed digital identity may be temporarily generated using the proxy of the target node, or it may be an idle distributed digital identity in the proxy's wallet.

[0070] In this embodiment, each Distributed Digital Identity (DID) consists of a DID identifier and a DID document. The DID identifier is a string with a specific format used to represent a digital identity. Each DID identifier corresponds to a DID document, which mainly contains the following information: the DID identifier, the public key and verification method, and one or more representations. A representation is information that shows the past, present, or desired state of a resource.

[0071] In this embodiment of the application, the first document corresponding to the first distributed digital identity is sent to the initiating node based on the TCP (Transmission Control Protocol) connection, so as to establish a distributed digital identity connection between the target node and the sending node.

[0072] Step S14: Control the initiating node to obtain and save the first document sent by the target node, then obtain and save the second distributed digital identity of the initiating node, and send the second document corresponding to the second distributed digital identity to the target node based on the TCP connection.

[0073] In this embodiment, controlling the initiating node to acquire and save the first document sent by the target node specifically involves storing the first document in the wallet of the initiating node's proxy, thereby establishing a distributed digital identity connection between the target node and the sending node. It should be noted that before storing, the first document needs to be checked for any issues (specifically, the first document can be checked according to the DID specification). If issues are found, it is not saved; otherwise, it is saved.

[0074] In this embodiment of the application, the second distributed digital identity of the initiating node can be temporarily generated using the proxy of the initiating node, or it can be an idle distributed digital identity in the proxy's wallet.

[0075] In this embodiment of the application, the second document corresponding to the second distributed digital identity is sent to the target node based on the TCP connection, so as to establish a distributed digital identity connection between the target node and the sending node.

[0076] Step S15: Control the target node to obtain and save the second document sent by the initiating node, so as to establish a point-to-point distributed digital identity connection between the target node and the initiating node.

[0077] In this embodiment, controlling the target node to obtain and save the second document sent by the initiating node specifically involves storing the second document in the wallet of the target node's proxy, thereby establishing a distributed digital identity connection between the target node and the sending node. It should be noted that before storing, the second document needs to be checked for any issues (specifically, the second document can be checked according to the DID specification). If issues are found, it is not saved; otherwise, it is saved.

[0078] In this embodiment, the wallet of the proxy of the initiating node stores the first document of the target node, and the wallet of the proxy of the target node stores the second document of the initiating node. Thus, a point-to-point distributed digital identity connection is established between the target node and the initiating node. Subsequently, business based on the DID connection (such as credential issuance and verification) can be carried out. At this time, the identity owner only needs to use the proxy on his / her terminal (mobile phone, PC (Personal Computer) etc.) to directly participate in distributed digital identity activities (such as credential issuance and verification) at the DID layer in a point-to-point manner.

[0079] In this embodiment of the application, if the TCP connection between the target node and the initiating node is disconnected, resulting in the disconnection of the point-to-point distributed digital identity connection between the target node and the initiating node, then the process jumps to generating a hash value through the initiating node to re-establish the point-to-point distributed digital identity connection between the target node and the initiating node.

[0080] It should be noted that the reasons for the TCP connection to be disconnected include: First, the local private IP address (Internet Protocol Address) of the device may change, which may also cause its public IP address to change (for example, NAT (Network Address Translation) uses dynamic translation), which further leads to the TCP connection being disconnected; Second, the mobile phone turns off Wi-Fi and mobile data.

[0081] In this embodiment, the DID connection is secure, but the index server needs to further enhance its security; conventional server registration is sufficient.

[0082] In the embodiments of this application, such as Figure 3 The diagram illustrates the network topology of a peer-to-peer distributed digital identity connection. The network consists of an index server and other nodes. The index server maintains TCP connections with each node, while the nodes themselves establish DID connections. The index server's role is to assist nodes in establishing peer-to-peer TCP connections (P2P). Once these TCP connections are established, the index server ceases to participate in node operations, and each node independently establishes its own peer-to-peer DID connections. In this scheme, the DID connection is built on a bidirectional TCP protocol, unlike some industry solutions that rely on a unidirectional HTTP (Hypertext Transfer Protocol) protocol.

[0083] As can be seen, this application generates a hash value through the initiating node; establishes a TCP connection between the initiating node and the target node based on the data transmission between the initiating node, the index server, and the target node, and the hash value; controls the target node to acquire and save its first distributed digital identity, and sends a first document corresponding to the first distributed digital identity to the initiating node based on the TCP connection; controls the initiating node to acquire and save the first document sent by the target node, then acquires and saves its second distributed digital identity, and sends a second document corresponding to the second distributed digital identity to the target node based on the TCP connection; controls the target node to acquire and save the second document sent by the initiating node, thereby establishing a point-to-point distributed digital identity connection between the target node and the initiating node. As can be seen, this application establishes a TCP connection between the initiating node and the target node, sends the first document corresponding to the first distributed digital identity of the target node to the initiating node, and sends the second document corresponding to the second distributed identity of the initiating node to the target node. This establishes a connection between the target node and the initiating node, reduces the use of the index server, which is equivalent to reducing the use of the cloud proxy. Therefore, it reduces network complexity, enhances the decentralization of the distributed digital identity, reduces the throughput of the cloud proxy or index server, and reduces costs.

[0084] See Figure 4 As shown in the illustration, this application discloses a specific method for establishing a peer-to-peer distributed digital identity connection, applied to a peer-to-peer distributed digital identity connection establishment system. The system includes an index server, an initiating node, and a target node. The method includes:

[0085] Step S21: Generate a hash value, a reference random number, an initiating public key, and an initiating private key through the initiating node. Then, divide the initiating public key into an odd-numbered initiating public key and an even-numbered initiating public key, and divide the reference random number into an odd-numbered reference random number and an even-numbered reference random number.

[0086] In this embodiment of the application, the odd-numbered digits of the random number constitute the odd-numbered sub-random number Rand. io (Odd-numbered digits refer to the random number), and the even-numbered digits in the random number form the even-numbered sub-random number Rand. ie (Even-numbered bits refer to random numbers); construct an odd-numbered sub-public key Pub from the odd-numbered bits of the public key. io (Odd-numbered bits initiate the public key), and the even-numbered bits of the public key form the even-numbered sub-public key Pub. ie (Even-numbered public key).

[0087] Step S22: Control the initiating node to send the hash value, the odd-numbered reference random number, and the odd-numbered initiating public key to the index server, so that the index server can obtain the first node address of the initiating node and send the hash value, the even-numbered reference random number, and the even-numbered initiating public key to the target node.

[0088] In this embodiment, the initiating node transmits the hash via an out-of-band connection (referring to other communication methods besides the DID connection being established, such as email, SMS, telephone, etc.). i (hash value), Rand ie (Even-numbered digits refer to random numbers), Pub ie (Even-numbered public keys) are sent to the target node.

[0089] Step S23: Control the target node and obtain the odd-numbered reference random number and the odd-numbered initiation public key from the index server based on the hash value, so that the index server can obtain the second node address of the target node, and then obtain the reference random number based on the odd-numbered reference random number and the even-numbered reference random number, and obtain the initiation public key based on the even-numbered initiation public key and the odd-numbered initiation public key.

[0090] In this embodiment, the channel through which the odd-numbered reference random number and the odd-numbered initiating public key are obtained from the index server based on the hash value is a different channel from the out-of-band connection. By transmitting the sub-random number and sub-public key through the out-of-band connection, the risk of man-in-the-middle attacks can be reduced. When the data of one channel is intercepted, it has no impact on the overall system.

[0091] Step S24: Establish a TCP connection between the initiating node and the target node through the index server, based on the first node address and the second node address.

[0092] In this embodiment, sending the hash value, the odd-numbered reference random number, and the odd-numbered initiation public key to the index server enables the index server to obtain the first node address of the initiating node; controlling the target node and obtaining the odd-numbered reference random number and the odd-numbered initiation public key from the index server based on the hash value enables the index server to obtain the second node address of the target node; the index server can establish a TCP connection between the initiating node and the target node based on the first node address and the second node address, and with the help of existing NAT traversal technology.

[0093] Step S25: Control the target node to acquire and save the first distributed digital identity of the target node, and use the initiating public key to encrypt the first document corresponding to the first distributed digital identity and the reference random number to obtain the first encrypted information; control the target node to sign the first encrypted information using the first private key corresponding to the first distributed digital identity to obtain the first signature, and send the first signature and the first encrypted information to the initiating node based on the TCP connection.

[0094] The corresponding first document Did_doc o and the received reference random number Rand i Use the initiating public key Pub i Encryption, the encryption method is first Did_doc o Cascaded Rand i Then, the concatenated data is encrypted using the initiating public key to obtain the first encrypted information; the encryption process increases the security of transmission between the target node and the initiating node.

[0095] In this embodiment of the application, the corresponding first document Did_doc o and the received reference random number Rand i Use the initiating public key Pub i After encryption, the encryption result also needs to be encrypted using the first private key Did_priv corresponding to the first distributed digital identity. o The signature is then appended to the encrypted result and sent to the initiating node; the signing process ensures the correspondence between the sending and receiving target nodes and the initiating node.

[0096] Step S26: Control the initiating node to obtain the target signature and target encryption information, and decrypt the target encryption information using the initiating private key; if the target identity document and target random number are obtained, control the initiating node to verify the target signature using the target public key in the target identity document; if the verification is successful, determine whether the target random number is the same as the reference random number; if they are the same, the target identity document is the first document, the target signature is the first signature, and then control the initiating node to save the first document.

[0097] In this embodiment, the initiating node obtains the target encrypted information and needs to determine if the target encrypted information is the first encrypted information. If decryption and signature verification are successful, and the random numbers are the same, it indicates that the target encrypted information is the first encrypted information, and then the initiating node saves the first document. The signature verification process further enhances the security of data transmission.

[0098] It should be noted that using the initiating private key Priv iDecrypt. The initiating private key and the initiating public key are a key pair.

[0099] It should be noted that the target identity document Did_doc is used. o The target public key in the signature is used to verify the signature. It should be noted that the first private key, Did_priv, corresponding to the first distributed digital identity is used. o When signing, only the first public key Did_pub in the first document corresponding to the first distributed digital identity can be used. o Signature verification: Successful signature verification indicates that the target identity document is the first document from the target node.

[0100] Step S27: Control the initiating node to obtain and save the second distributed digital identity of the initiating node, and use the first public key in the first document to encrypt the second document corresponding to the second distributed digital identity to obtain the second encrypted information; control the initiating node to use the second private key corresponding to the second distributed digital identity to sign the second encrypted information to obtain the second signature, and send the second encrypted information and the second signature to the target node based on the TCP connection.

[0101] In this embodiment of the application, the initiating node uses the first document Did_doc received from the target node. o The first public key in Did_pub o The encrypted second document, Did_doc i The second encrypted information is obtained; the encryption process increases the security of transmission between the target node and the initiating node.

[0102] In this embodiment of the application, the initiating node uses the first document Did_doc received from the target node. o The first public key in Did_pub o The encrypted second document, Did_doc i After obtaining the second encrypted information, it is also necessary to use the second private key Did_priv corresponding to the second distributed digital identity. i The signature is then appended to the encrypted result and sent to the target node. This signing process ensures the correspondence between the sending and receiving initiating and target nodes.

[0103] Step S28: Control the target node to obtain the reference encrypted information and the reference signature; decrypt the reference encrypted information using the first private key corresponding to the first distributed digital identity; if a reference identity document is obtained, control the target node to verify the reference signature using the reference public key in the reference identity document; if the verification is successful, the reference identity document is the second document, the reference signature is the second signature, and control the target node to save the second document.

[0104] In this embodiment of the application, the target node obtains the reference encrypted information and needs to determine that the reference encrypted information is the second encrypted information. If the decryption is successful and the signature verification is successful, it means that the target encrypted information is the second encrypted information, and then the target node saves the second document.

[0105] It should be noted that encryption using the first public key in the first document can only be decrypted using the first private key corresponding to the first distributed digital identity. The first private key and the first document Did_doc of the target node... o The first public key in the key pair is the key pair.

[0106] It should be noted that the second private key Did_priv corresponding to the second distributed digital identity is used. i When signing, only the second document, Did_doc, can be used. i The second public key Did_pub i Verify the signature; successful signature verification indicates that the target identity document is the first document from the target node.

[0107] In this embodiment of the application, when transmitting data between the initiating node and the target node, asymmetric encryption is used for encryption. The asymmetric encryption process is completed in the node, rather than in the index server, thus making full use of node resources and reducing the burden on the index server.

[0108] As can be seen, this application establishes a TCP connection between the initiating node and the target node, sending the first document corresponding to the first distributed digital identity of the target node to the initiating node, and sending the second document corresponding to the second distributed identity of the initiating node to the target node. This establishes a connection between the target node and the initiating node, reducing the use of the index server, which is equivalent to reducing the use of the cloud proxy. Therefore, it reduces network complexity, enhances the decentralization of the distributed digital identity, reduces the throughput of the cloud proxy or index server, and lowers costs. Furthermore, during point-to-point transmission between distributed digital identities, asymmetric encryption is not performed through the index server; instead, the encryption and decryption process is transferred to the initiating node and the target node, making full use of the resources of each node and reducing the burden on the index server. In addition, this application adds a signature and verification process to the encryption and decryption process, thereby increasing the security of the transmission process between the initiating node and the target node.

[0109] See Figure 5 The diagram shown illustrates a method for establishing a peer-to-peer distributed digital identity connection. Correspondingly, as shown... Figure 6 The diagram shown is a flowchart of the peer-to-peer distributed digital identity connection establishment method; the overall steps are as follows:

[0110] 1. When two nodes wish to establish a DID connection, the initiating node's proxy generates a unique hash value. i (used to uniquely identify each node), a random number Rand i A public-private key pair (Pub) i and Priv i Then, random number Rand i Divide into two sub-random numbers: the odd-numbered digits of the random number form the odd-numbered sub-random number Rand. io The even-numbered digits in the random number form the even-numbered sub-random number Rand ie ;Construct an odd-numbered sub-public key Pub from the odd-numbered bits of the public key. io The even-numbered bits of the public key are used to construct the even-numbered sub-public key Pub. ie ;

[0111] Note: To ensure the uniqueness of the hash value, the input value should be unique, such as the node's MAC address.

[0112] 2. The initiating node will hash i Rand io Pub io Stored in the index server;

[0113] 3. The initiating node transmits the hash via an out-of-band connection (referring to communication methods other than the DID connection being established, such as email, SMS, telephone, etc.). i Rand ie Pub ie Send to the target node;

[0114] 4. The target node is determined by hash. i Query the index server for Rand io Pub io This path is different from the out-of-band transmission. The dual-path transmission of sub-random numbers and sub-public keys can reduce the risk of man-in-the-middle attacks.

[0115] 5. The initiating node, target node, and index server establish a point-to-point TCP connection using existing NAT traversal technology;

[0116] 6. The target node will use Rand io and Rand ie Restore the original random number Rand i Pub io and Pub ie Restore the original public key Pub i ;

[0117] 7. The target node uses its proxy to generate and save the Did in its wallet. o (Alternatively, you can utilize idle DIDs in a proxy wallet), and then use the corresponding Did_doc o and received Rand i Using the public key Pub i Encryption, encryption method is Did_doc o Cascaded Rand i Then, the encryption result is used with the corresponding Did_priv o Sign the encryption result, then attach the signature to the encrypted result and send it to the initiating node.

[0118] 8. Initiating node uses Priv i Decrypt the data and extract the Did_doc of the target node from the decrypted data. o and random number Rand i Then use Did_doc o The public key Did_pub o Verify the signature, then verify the received random number Rand. i Check if it matches the random number generated in step 1. Once everything is in order, then check the received Did_doc. o Are there any issues? If there are no issues, then change the Did_doc file. o Deposit into your own agent's wallet

[0119] Note: Did_doc can be modified according to the DID specification. o Conduct an inspection;

[0120] 9. The initiating node uses its proxy to generate and store the Did in its wallet. i (Alternatively, you can utilize idle DIDs in the proxy wallet), and then use the received DID_doc from the target node. o The public key Did_pub o The corresponding Did_doc for encryption i Then use the corresponding Did_priv i Sign the encryption result, then attach the signature to the encrypted result and send it to the target node.

[0121] 10. After receiving the data, the target node first uses its own private key Did_priv o Decrypt the data and extract the Did_doc of the initiating node. i Then use Did_doc i Did_pub i Verify the signature. Once everything is in order, then check the Did_doc. iCheck for any issues. If there are no issues, store the data in your own proxy wallet. At this point, the peer-to-peer DID connection has been established, and subsequent DID-based business operations (such as credential issuance and verification) can proceed.

[0122] Note: Did_doc can be modified according to the DID specification. i Conduct an inspection.

[0123] In summary, firstly, regarding the issue that "communication via cloud proxies weakens the decentralization of distributed digital identities," this application establishes a peer-to-peer distributed identity connection, eliminating index servers, enhancing the decentralization of the distributed digital identity network, and enabling direct peer-to-peer communication. Secondly, regarding the issue that "each interaction requires cloud proxies to authenticate digital identities, and the asymmetric encryption / decryption algorithm for authentication is time-consuming, thus increasing the burden on cloud proxy servers and affecting their throughput. Although deploying more cloud proxies can alleviate this problem, a large number of cloud proxy servers significantly increases costs," the asymmetric encryption / decryption process is completed by the nodes themselves, without going through index servers or cloud proxies, avoiding the problem of high server load on index servers or cloud proxies affecting throughput (improving network throughput), or avoiding the problem of deploying a large number of cloud proxy servers. Thirdly, regarding the issue that "the addition of cloud proxies increases network complexity and requires handling complex routing," a peer-to-peer distributed identity connection is established, simplifying the network topology.

[0124] It should be noted that the data for each identifier is as follows:

[0125] Pub i : The public key of the initiating node (initiating public key);

[0126] Pub io : The odd-numbered sub-public key of the initiating node (odd-numbered initiating public key);

[0127] Pub ie : The even-numbered sub-public key of the initiating node (even-numbered initiating public key);

[0128] Priv i : The private key of the initiating node (initiating private key);

[0129] Did i The initiating node's DID (Second Distributed Digital Identity);

[0130] Did_doc i : The DID document (second document) of the initiating node;

[0131] Did_pub i The public key (second public key) in the DID document of the initiating node;

[0132] Did_priv i : The DID private key (second private key) of the initiating node;

[0133] Did o The target node's DID (first distributed digital identity);

[0134] Did_doc o The DID document (first document) of the target node;

[0135] Did_pub o The public key (first public key) in the DID document of the target node;

[0136] Did_priv o The target node's DID private key (first private key);

[0137] Rand i : The random number generated by the initiating node (reference random number);

[0138] Rand io : The odd-numbered random number generated by the initiating node (odd-numbered reference random number);

[0139] Rand ie : The even-numbered random number generated by the initiating node (the even-numbered reference random number);

[0140] Hash i : The unique hash value generated by the initiating node.

[0141] See Figure 7 As shown in the figure, this application discloses a peer-to-peer distributed digital identity connection establishment device, which is applied to a peer-to-peer distributed digital identity connection establishment system. The peer-to-peer distributed digital identity connection establishment system includes an index server, an initiating node, and a target node. The device includes:

[0142] Generation module 11 is used to generate hash values ​​through the initiating node;

[0143] TCP connection establishment module 12 is used to establish a TCP connection between the initiating node and the target node based on the data transmission between the initiating node, the index server and the target node and the hash value;

[0144] The first acquisition module 13 is used to control the target node to acquire and save the first distributed digital identity of the target node;

[0145] The first sending module 14 is used to send the first document corresponding to the first distributed digital identity to the initiating node based on the TCP connection;

[0146] The second acquisition module 15 is used to control the initiating node to acquire and save the first document sent by the target node, and then acquire and save the second distributed digital identity of the initiating node;

[0147] The second sending module 16 is used to send the second document corresponding to the second distributed digital identity to the target node based on the TCP connection;

[0148] The third acquisition module 17 is used to control the target node to acquire and save the second document sent by the initiating node, so as to establish a point-to-point distributed digital identity connection between the target node and the initiating node.

[0149] For more detailed information on the working process of each of the above modules, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0150] As can be seen, this application generates a hash value through the initiating node; establishes a TCP connection between the initiating node and the target node based on the data transmission between the initiating node, the index server, and the target node, and the hash value; controls the target node to acquire and save its first distributed digital identity, and sends a first document corresponding to the first distributed digital identity to the initiating node based on the TCP connection; controls the initiating node to acquire and save the first document sent by the target node, then acquires and saves its second distributed digital identity, and sends a second document corresponding to the second distributed digital identity to the target node based on the TCP connection; controls the target node to acquire and save the second document sent by the initiating node, thereby establishing a point-to-point distributed digital identity connection between the target node and the initiating node. As can be seen, this application establishes a TCP connection between the initiating node and the target node, sends the first document corresponding to the first distributed digital identity of the target node to the initiating node, and sends the second document corresponding to the second distributed identity of the initiating node to the target node. This establishes a connection between the target node and the initiating node, reduces the use of the index server, which is equivalent to reducing the use of the cloud proxy. Therefore, it reduces network complexity, enhances the decentralization of the distributed digital identity, reduces the throughput of the cloud proxy or index server, and reduces costs.

[0151] Furthermore, embodiments of this application also provide an electronic device. Figure 8This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0152] Figure 8 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, an input / output interface 24, a communication interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the peer-to-peer distributed digital identity connection establishment method disclosed in any of the foregoing embodiments.

[0153] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 25 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 24 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0154] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The memory 22 can be a random access memory that can be used as running memory and a non-volatile memory used for external memory storage. The storage resources on it include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0155] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 on the source host and the computer program 222. The operating system 221 can be Windows, Unix, Linux, etc. In addition to including a computer program that can be used to perform the peer-to-peer distributed digital identity connection establishment method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program that can be used to perform other specific tasks.

[0156] In this embodiment, the input / output interface 24 may include, but is not limited to, a USB interface, a hard disk read interface, a serial interface, a voice input interface, a fingerprint input interface, etc.

[0157] Furthermore, embodiments of this application also disclose a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned peer-to-peer distributed digital identity connection establishment method.

[0158] For the specific steps of this method, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0159] The computer-readable storage medium referred to herein includes random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, magnetic disks, optical disks, or any other form of storage medium known in the art. When the computer program is executed by a processor, it implements the aforementioned peer-to-peer distributed digital identity connection establishment method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0160] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. The apparatus disclosed in the embodiments is described simply because it corresponds to the peer-to-peer distributed digital identity connection establishment method disclosed in the embodiments; relevant parts can be referred to the method section.

[0161] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0162] The steps of the algorithm described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0163] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0164] The present invention has provided a detailed description of a peer-to-peer distributed digital identity connection establishment method, apparatus, device, and medium. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for establishing a peer-to-peer distributed digital identity connection, characterized in that, An application is made in a peer-to-peer distributed digital identity connection establishment system, the system comprising an index server, an initiating node, and a target node, the method comprising: A hash value is generated through the initiating node; A TCP connection between the initiating node and the target node is established based on the data transmission between the initiating node, the index server, and the target node, as well as the hash value. The target node is controlled to acquire and save its first distributed digital identity, and the first document corresponding to the first distributed digital identity is sent to the initiating node based on the TCP connection; The system controls the initiating node to acquire and save the first document sent by the target node, then acquires and saves the second distributed digital identity of the initiating node, and sends the second document corresponding to the second distributed digital identity to the target node based on the TCP connection. The target node is controlled to acquire and save the second document sent by the initiating node, so as to establish a point-to-point distributed digital identity connection between the target node and the initiating node; The step of generating a hash value through the initiating node includes: The initiating node generates a hash value, a reference random number, and an initiating public key. Then, the initiating public key is divided into an odd-numbered initiating public key and an even-numbered initiating public key, and the reference random number is also divided into an odd-numbered reference random number and an even-numbered reference random number. Accordingly, establishing a TCP connection between the initiating node and the target node based on data transmission between the initiating node, the index server, and the target node, and the hash value, includes: The initiating node is controlled to send the hash value, the odd-numbered reference random number, and the odd-numbered initiating public key to the index server, so that the index server can obtain the first node address of the initiating node and send the hash value, the even-numbered reference random number, and the even-numbered initiating public key to the target node; The target node is controlled to obtain the odd-numbered reference random number and the odd-numbered initiation public key from the index server based on the hash value, so that the index server can obtain the second node address of the target node, and then obtain the reference random number based on the odd-numbered reference random number and the even-numbered reference random number, and obtain the initiation public key based on the even-numbered initiation public key and the odd-numbered initiation public key; The index server is used to establish a TCP connection between the initiating node and the target node based on the first node address and the second node address.

2. The peer-to-peer distributed digital identity connection establishment method according to claim 1, characterized in that, The step of controlling the target node to acquire and save the first distributed digital identity of the target node, and sending the first document corresponding to the first distributed digital identity to the initiating node based on the TCP connection, includes: The target node is controlled to acquire and save its first distributed digital identity, and the first encrypted information is obtained by encrypting the first document corresponding to the first distributed digital identity and the reference random number using the initiating public key. The target node is controlled to sign the first encrypted information using the first private key corresponding to the first distributed digital identity to obtain a first signature, and then sends the first signature and the first encrypted information to the initiating node based on the TCP connection.

3. The method for establishing a point-to-point distributed digital identity connection according to claim 2, characterized in that, The process of generating a hash value, a reference random number, and an initiating public key through the initiating node includes: The initiating node generates a hash value, a reference random number, an initiating public key, and an initiating private key. Accordingly, controlling the initiating node to acquire and save the first document includes: The initiating node is controlled to obtain the target signature and target encryption information, and to decrypt the target encryption information using the initiating private key; If the target identity document and the target random number are obtained, the initiating node is controlled to verify the target signature using the target public key in the target identity document; If the signature verification is successful, determine whether the target random number is the same as the reference random number; If they are the same, then the target identity document is the first document, the target signature is the first signature, and then the initiating node is controlled to save the first document.

4. The method for establishing a point-to-point distributed digital identity connection according to claim 3, characterized in that, The step of acquiring and saving the second distributed digital identity of the initiating node, and sending the second document corresponding to the second distributed digital identity to the target node based on the TCP connection, includes: The system controls the initiating node to acquire and save the second distributed digital identity of the initiating node, and uses the first public key in the first document to encrypt the second document corresponding to the second distributed digital identity to obtain the second encrypted information; The initiating node controls the second private key corresponding to the second distributed digital identity to sign the second encrypted information to obtain a second signature, and then sends the second encrypted information and the second signature to the target node.

5. The method for establishing a point-to-point distributed digital identity connection according to claim 4, characterized in that, The step of controlling the target node to acquire and save the second document sent by the initiating node to establish a peer-to-peer distributed digital identity connection between the target node and the initiating node includes: Control the target node to obtain reference encryption information and reference signature; Decrypt the reference encrypted information using the first private key corresponding to the first distributed digital identity; If a reference identity document is obtained, the target node is controlled to verify the reference signature using the reference public key in the reference identity document; If the signature verification is successful, the reference identity document becomes the second document, the reference signature becomes the second signature, and the target node is controlled to save the second document.

6. The method for establishing a point-to-point distributed digital identity connection according to any one of claims 1 to 5, characterized in that, Also includes: If the TCP connection between the target node and the initiating node is broken, resulting in the disconnection of the peer-to-peer distributed digital identity connection between the target node and the initiating node, then the process jumps to generating a hash value through the initiating node to re-establish the peer-to-peer distributed digital identity connection between the target node and the initiating node.

7. A peer-to-peer distributed digital identity connection establishment device, characterized in that, An apparatus for establishing a peer-to-peer distributed digital identity connection, the system comprising an index server, an initiating node, and a target node, wherein the apparatus comprises: The generation module is used to generate hash values ​​through the initiating node; The TCP connection establishment module is used to establish a TCP connection between the initiating node and the target node based on the data transmission between the initiating node, the index server and the target node and the hash value; The first acquisition module is used to control the target node to acquire and save the first distributed digital identity of the target node; The first sending module is used to send the first document corresponding to the first distributed digital identity to the initiating node based on the TCP connection; The second acquisition module is used to control the initiating node to acquire and save the first document sent by the target node, and then acquire and save the second distributed digital identity of the initiating node; The second sending module is used to send the second document corresponding to the second distributed digital identity to the target node based on the TCP connection; The third acquisition module is used to control the target node to acquire and save the second document sent by the initiating node, so as to establish a point-to-point distributed digital identity connection between the target node and the initiating node; The generation module is configured to: generate a hash value, a reference random number, and an initiation public key through the initiating node; then divide the initiation public key into an odd-numbered initiation public key and an even-numbered initiation public key; and divide the reference random number into an odd-numbered reference random number and an even-numbered reference random number. The TCP connection establishment module is configured to: control the initiating node to send the hash value, the odd-numbered reference random number, and the odd-numbered initiating public key to the index server, so that the index server can obtain the first node address of the initiating node, and send the hash value, the even-numbered reference random number, and the even-numbered initiating public key to the target node; control the target node to obtain the odd-numbered reference random number and the odd-numbered initiating public key from the index server based on the hash value, so that the index server can obtain the second node address of the target node, then obtain the reference random number based on the odd-numbered reference random number and the even-numbered reference random number, and obtain the initiating public key based on the even-numbered initiating public key and the odd-numbered initiating public key; and establish a TCP connection between the initiating node and the target node through the index server and based on the first node address and the second node address.

8. An electronic device, characterized in that, It includes a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the peer-to-peer distributed digital identity connection establishment method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein, when the computer programs are executed by a processor, they implement the peer-to-peer distributed digital identity connection establishment method as described in any one of claims 1 to 6.

Images