A blockchain-based identity authentication method and device

Abstract

The application discloses a kind of identity authentication methods based on blockchain, including receiving the original identity certificate issued by identity certificate provider in any blockchain;Original identity certificate is digitally signed by identity private key stored locally by identity certificate provider;Identity public key stored by identity certificate provider is inquired from the blockchain where identity certificate provider is located, and original identity certificate is verified based on identity public key;In the case where verification passes, original identity certificate is digitally signed based on locally stored device private key, and digitally signed to-be-verified identity certificate is issued to identity certificate verifier in any blockchain;So that identity verification verifier inquires device public key stored by identity certificate user from any blockchain, and to-be-verified identity certificate is verified based on device public key;And in the case where verification passes, it is determined that identity authentication to identity certificate user passes.

Description

TECHNICAL FIELD

[0001] The present application relates to a blockchain technology, in particular to a blockchain-based identity authentication method and device. BACKGROUND

[0002] Blockchain technology, also known as distributed ledger technology, is a new technology in which a plurality of computing devices jointly participate in "accounting" and jointly maintain a complete distributed database. Due to the characteristics of decentralization, openness and transparency, each computing device can participate in database recording, and data synchronization between computing devices can be quickly performed, so that the blockchain technology is widely applied in many fields.

[0003] Decentralized identity (DID) is a digital identity system based on blockchain technology, which has the characteristics of ensuring data authenticity and credibility, protecting user privacy and security, and strong portability.

[0004] Since the decentralized digital identities generated by different blockchains may conflict, cross-chain authentication of decentralized digital identities cannot be achieved. SUMMARY

[0005] One of the purposes of the present application is to provide a blockchain-based identity authentication method which can achieve cross-chain authentication of decentralized digital identities.

[0006] Based on the above-mentioned purpose of the application, a blockchain-based identity authentication method is provided, which is applied to an identity certificate user in an identity authentication system, the identity authentication system is composed of at least two blockchains for realizing decentralized digital identity, and the blockchain stores identity public keys associated with decentralized digital identities uploaded by blockchain members in each blockchain; wherein the identity private key corresponding to the identity public key is stored locally by the blockchain member; the blockchain member includes an identity certificate provider, an identity certificate user and an identity certificate verifier; the blockchain also stores device public keys uploaded by the identity certificate user in each blockchain based on trusted computing, and the device private key corresponding to the device public key is stored locally by the identity authentication user, and the method comprises:

[0007] Receiving the original identity certificate issued by the identity certificate provider in any blockchain; wherein the original identity certificate includes the identity of the identity certificate user, and the original identity certificate is digitally signed by the identity private key stored locally by the identity certificate provider;

[0008] querying, from a blockchain where the identity provider is located, an identity public key stored by the identity provider, and verifying the original identity certificate based on the identity public key;

[0009] In the case of successful verification, digitally signing the original identity certificate based on a locally stored device private key, and issuing the digitally signed identity certificate to be verified to an identity certificate verifier in any blockchain, so that the identity verifier queries a device public key stored by the identity certificate user from any blockchain, and verifies the identity certificate to be verified based on the device public key; and in the case of successful verification, determining that the identity authentication for the identity certificate user is passed.

[0010] In the present application, by introducing a device private key and a device public key, the problem of conflict of decentralized digital identity when cross-chain can be avoided.

[0011] Further, in some embodiments, the device private key is stored in a trusted execution environment local to the identity certificate user; the trusted execution environment contains logic code for performing data signature and logic code for performing verification:

[0012] The verification of the original identity certificate based on the identity public key comprises:

[0013] calling the logic code for performing verification stored in the local trusted execution environment to verify the original identity certificate based on the identity public key;

[0014] The digitally signing of the original identity certificate based on the locally stored device private key comprises:

[0015] calling the logic code for performing digital signature stored in the local trusted execution environment to digitally sign the original identity certificate based on the device private key in the trusted execution environment.

[0016] Further, in some embodiments, the method further comprises:

[0017] obtaining logic code for performing data signature and logic code for performing verification from any blockchain, and storing the obtained logic code for performing data signature and logic code for performing verification in a local trusted execution environment.

[0018] Further, in some embodiments, the original identity certificate issued further comprises a decentralized digital identity of the identity certificate provider; wherein the decentralized digital identity is provided with an identification bit, and the identification bit records a blockchain identification of a blockchain where the decentralized digital identity is registered;

[0019] The querying of the identity public key stored by the identity provider from the blockchain where the identity provider is located comprises:

[0020] Based on the identity public key corresponding to the identity provider, the identity authentication system obtains the blockchain identifier of the identity public key stored by the identity provider.

[0021] The identity public key stored by the identity provider is queried from the target blockchain corresponding to the blockchain identifier.

[0022] Further, in some embodiments, the method further comprises:

[0023] In response to the registration request initiated for the device public key of the identity provider, the device public key is stored in each blockchain in the identity authentication system.

[0024] Further, in some embodiments, the logic code for performing digital signature in the blockchain corresponds to a unique code identifier;

[0025] The calling of the logic code for performing digital signature stored in the local trusted execution environment comprises:

[0026] The calling of the logic code for performing digital signature stored in the local trusted execution environment comprises:

[0027] The same purpose as the foregoing method, the present application also provides another identity authentication method based on blockchain, applied to an identity authentication system comprising at least two blockchains for realizing decentralized digital identity, wherein the identity public key associated with the decentralized digital identity uploaded by each blockchain member is stored in the blockchain; wherein the identity private key corresponding to the identity public key is stored locally by the blockchain member; the blockchain member comprises an identity provider, an identity provider and an identity authentication provider; the identity authentication system also stores the device public key based on trusted computing uploaded by the identity provider in each blockchain, and the device private key corresponding to the device public key is stored locally by the identity authentication provider, and the method comprises:

[0028] Receiving the identity proof to be verified sent by the identity provider in any blockchain; wherein the identity proof to be verified is digitally signed by the device private key of the identity provider;

[0029] query, from a blockchain, a device public key corresponding to the device private key of the identity provider and corresponding to the identity proof usage party;

[0030] verify the identity proof to be verified based on the device public key, and in a case where the verification is passed, determine that the identity authentication for the identity proof usage party is passed.

[0031] Further, in some embodiments, the identity proof to be verified includes an original identity proof issued by the identity provider to the identity proof usage party; wherein the original identity proof is used to prove the identity of the identity proof usage party, and the original identity proof is digitally signed by an identity private key stored locally by the identity provider.

[0032] Further, in some embodiments, the identity proof to be verified is generated in a trusted execution environment local to the identity proof usage party, and the trusted execution environment contains logic code for performing data signing and a device private key of the identity proof usage party;

[0033] The identity proof to be verified is further digitally signed by the logic code for performing data signing stored in the trusted execution environment, based on the device private key in the trusted execution environment.

[0034] Further, in some embodiments, the logic code for performing verification is obtained from a blockchain and stored in the trusted execution environment, and the logic code for performing data signing in the blockchain corresponds to a unique code identifier;

[0035] The identity proof to be verified is further digitally signed by the trusted execution environment using the device private key in the trusted execution environment, taking the original identity proof and the code identifier of the logic code for performing data signing as a whole;

[0036] In the case where the verification is passed, further comprising:

[0037] In response to a query request for the code identifier in the identity proof to be verified for which the verification is passed, querying the logic code corresponding to the code identifier in the blockchain.

[0038] The application also provides a blockchain-based identity authentication device, which is applied to an identity certificate user in an identity authentication system, the identity authentication system is composed of at least two blockchains for realizing decentralized digital identity, identity public keys associated with the decentralized digital identity uploaded by respective blockchain members are stored in the blockchains; wherein identity private keys corresponding to the identity public keys are stored locally by the blockchain members; the blockchain members include identity certificate providers, identity certificate users and identity certificate verification parties; device public keys based on trusted computing uploaded by the identity certificate users in each blockchain are also stored in the blockchains, and device private keys corresponding to the device public keys are stored locally by the identity authentication users, and the device comprises:

[0039] A receiving module is configured to receive original identity certificates issued by identity certificate providers in any blockchain; wherein the original identity certificates are used to prove the identity of the identity certificate users, and the original identity certificates are digitally signed by identity private keys stored locally by the identity certificate providers;

[0040] A verifying module is configured to query identity public keys stored by the identity certificate providers from the blockchains where the identity certificate providers are located, and to verify the original identity certificates based on the identity public keys;

[0041] A signing module is configured to, in the case that the verification is passed, digitally sign the original identity certificates based on the locally stored device private keys, and issue the digitally signed identity certificates to be verified to identity certificate verification parties in any blockchain; so that the identity certificate verification parties query device public keys stored by the identity certificate users from any blockchain, and verify the identity certificates to be verified based on the device public keys; and in the case that the verification is passed, determine that the identity authentication for the identity certificate users is passed.

[0042] The application also provides a blockchain-based identity authentication device, which is applied to an identity certificate verification party in an identity authentication system, the identity authentication system is composed of at least two blockchains for realizing decentralized digital identity, identity public keys associated with the decentralized digital identity uploaded by respective blockchain members are stored in the blockchains; wherein identity private keys corresponding to the identity public keys are stored locally by the blockchain members; the blockchain members include identity certificate providers, identity certificate users and identity certificate verification parties; device public keys based on trusted computing uploaded by the identity certificate users in each blockchain are also stored in the blockchains, and device private keys corresponding to the device public keys are stored locally by the identity authentication users, and the device comprises:

[0043] The receiving module is used for receiving a to-be-verified identity certificate sent by an identity certificate user in any blockchain, wherein the to-be-verified identity certificate is digitally signed by a device private key of the identity certificate user;

[0044] The querying module is used for querying a device public key corresponding to the device private key and stored by the identity certificate user from any blockchain;

[0045] The verifying module verifies the to-be-verified identity certificate based on the device public key, and determines that the identity authentication for the identity certificate user is passed in a case where the verification is passed.

[0046] The identity authentication method and device based on the blockchain have the following beneficial effects:

[0047] In the cross-chain scenario, the device public key and the device private key of the identity certificate user are introduced, the device public key used for verification is stored in all blockchains in the identity authentication system, and the device private key is used instead of the identity private key to digitally sign the original identity certificate when the original identity certificate is authorized to the identity certificate verification party by the identity certificate user. Since the device public key has global uniqueness, the decentralized digital identity conflict is not affected, so that the cross-chain authentication of the decentralized digital identity is realized. BRIEF DESCRIPTION OF DRAWINGS

[0048] Figure 1 The identity authentication system in the same blockchain is exemplarily shown in the schematic diagram.

[0049] Figure 2 The identity authentication system in the cross-chain scenario is exemplarily shown in the schematic diagram.

[0050] Figure 3 The identity authentication method based on the blockchain with the identity certificate user as the execution subject is exemplarily shown in the flowchart.

[0051] Figure 4 The improved identity authentication system in the cross-chain scenario is exemplarily shown in the schematic diagram.

[0052] Figure 5 The identity authentication method based on the blockchain with the identity certificate verification party as the execution subject is exemplarily shown in the flowchart.

[0053] Figure 6 The identity authentication device based on the blockchain is exemplarily shown in the module schematic diagram.

[0054] Figure 7 The identity authentication device based on the blockchain is exemplarily shown in the module schematic diagram. Detailed Implementation

[0055] The blockchain-based identity authentication method and apparatus, computer-readable storage medium, and electronic device described in this invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. However, this detailed description does not constitute a limitation of this invention.

[0056] First, let me introduce some of the technical concepts involved in this invention.

[0057] Decentralized Digital Identity (DID) is a digital identity system based on blockchain technology, which features guaranteed data authenticity and trustworthiness, protection of user privacy and security, and strong portability.

[0058] In its implementation, DID also requires the assistance of a decentralized public key infrastructure (DPKI). A blockchain based on DPKI can provide an infrastructure for secure services based on cryptographic technology. Specifically, it generates a public-private key pair associated with the DID and digitally signs and verifies the data to be transmitted based on the public-private key pair to ensure the authenticity and trustworthiness of the transmitted data.

[0059] Generally, in most existing DID schemes, DPKI is implemented within the same blockchain. Please refer to the following: Figure 1 The diagram illustrates an identity authentication system under the same blockchain.

[0060] Based on their roles, blockchain members can be divided into identity verification providers, identity verification users, and identity verification verifiers.

[0061] First, the identity proof provider, identity proof user, and identity proof verifier all need to store their own DID-linked identity public key in the blockchain, while the identity private key corresponding to the identity public key is stored locally by the blockchain members.

[0062] like Figure 1 In this blockchain, the public key pubkey1 of the identity verification provider, the public key pubkey2 of the identity verification user, and the public key pubkey3 of the identity verification verifier all need to be stored on the blockchain, while the private key prikey1 of the identity verification provider, the private key prikey2 of the identity verification user, and the private key prikey3 of the identity verification verifier are stored locally by each of them.

[0063] The identity provider can provide an identity to the identity user, which can be an endorsement of the identity user's identity authenticity. Specifically, the identity provider can digitally sign the identity data using a local identity private key prikeyl to obtain a signed identity prikeyl (data).

[0064] The identity user can authorize the identity to the identity verifier. Specifically, the identity user digitally signs the identity prikeyl (data) signed by the identity provider using a local identity private key prikey2 to obtain a second signed identity prikey2 (prikeyl (data)).

[0065] The identity verifier needs to verify the authenticity of the identity after receiving the identity prikey2 (prikeyl (data)). Specifically, the identity verifier can query the identity public key pubkeyl of the identity provider and the identity public key pubkey2 of the identity user recorded in the blockchain. More specifically, based on the DID of the identity provider, the identity public key pubkeyl associated with the DID is queried from the blockchain; based on the DID of the identity user, the identity public key pubkey2 associated with the DID is queried from the blockchain.

[0066] Further, the identity prikey2 (prikeyl (data)) is verified using the identity public key pubkey2 (to verify that the identity is indeed provided by the identity user), and if the verification is passed, the identity prikeyl (data) can be obtained; further, the identity prikeyl (data) is verified using the identity public key pubkeyl (to verify that the identity is indeed provided by the identity provider), and if the verification is passed, the identity data can be obtained, and it is determined that the identity authentication for the identity user is passed.

[0067] It should be noted that the identity public key and the identity private key of the identity verifier in the above example are not used, because they will not be used when acting as an identity verifier. In fact, the roles among the identity provider, the identity user and the identity verifier can be changed, when Figure 1 The identity private key prikey3 and the identity public key pubkey3 in the identity verifier will be used when the identity private key prikey3 and the identity public key pubkey3 in the identity verifier correspond to the identity provider or the identity user.

[0068] DPKI under the same blockchain can realize DID, however, if multiple blockchains are involved, since the identity public keys of different blockchain members are only stored in the blockchain where they are located, the identity verification party will face the problem of which blockchain to query when querying the identity public key.

[0069] Reference is made below Figure 2 The schematic diagram of DPKI under cross-chain scenario is shown. In the cross-chain scenario, multiple different blockchains can be involved. Figure 1 As shown in the figure, there are two blockchains, blockchain 1 and blockchain 2, which use the same DPKI.

[0070] Firstly, the identity provider, the identity user and the identity verifier need to store the identity public key associated with their own DID in the blockchain where they are located, and the identity private key corresponding to the identity public key is stored locally by the blockchain member.

[0071] As Figure 2 In the figure, the identity public key pubkey1 of the identity provider is stored in blockchain 1, the identity public key pubkey2 of the identity user is stored in blockchain 2, and the identity public key pubkey3 of the identity verifier is stored in blockchain 1; the identity private key prikey1 of the identity provider, the identity private key prikey2 of the identity user and the identity private key prikey3 of the identity verifier are stored locally.

[0072] The identity provider provides an identity to the identity user, and the identity user authorizes the identity to the identity verifier, which is the same as the foregoing same blockchain, and will not be described again.

[0073] Further, after receiving the identity prikey2(prikey1(data)) provided by the identity user, the identity verifier also needs to verify the authenticity of the identity. To this end, the identity verifier needs to query the identity public keys pubkey1 and pubkey2 from the blockchain; since there are multiple blockchains, the problem of which blockchain to query will be faced.

[0074] Figure 2 In the example of the figure, only two blockchains are given, which may not intuitively feel the problem, so assume that there are 100 blockchains at this time, and if traversal query is performed, at most 100 blockchains need to be accessed to find the identity public keys pubkey1 and pubkey2, i.e. the query efficiency is low.

[0075] In the related art, the identity public keys in each blockchain can be synchronized, so that all identity public keys can be queried from any blockchain. However, since the different blockchains use the same DID technology, there is an inevitable DID conflict problem. The existence of DID conflict leads to the failure to achieve cross-chain authentication of decentralized digital identity. Specifically, once there is a DID conflict, the identity public key associated with the DID is no longer unique, resulting in confusion between the identity public keys stored in the blockchain. More specifically, when an identity proof verifier queries a blockchain based on a certain DID, it may query multiple identity public keys associated with the DID, and the wrong identity public key signature may result in the wrong identity proof; therefore, the existence of DID conflict leads to the failure to achieve cross-chain authentication of decentralized digital identity.

[0076] In an embodiment of the present application, a blockchain-based identity authentication method is provided. Figure 3 The flowchart of the blockchain-based identity authentication method according to the present application in an exemplary embodiment is shown, which can be applied to an identity proof user in an identity authentication system.

[0077] The improved identity authentication system in the cross-chain scenario is shown below Figure 4 The improved identity authentication system in the cross-chain scenario is shown below

[0078] As Figure 4 shown, the identity authentication system is composed of at least two blockchains for implementing decentralized digital identity (DID), and the identity public keys associated with the decentralized digital identity uploaded by the members of each blockchain are stored in the blockchain; wherein the identity private key corresponding to the identity public key is stored locally by the blockchain member; the blockchain members include identity proof providers, identity proof users and identity proof verifiers; the blockchain also stores the device public key uploaded by the identity proof user in each blockchain based on trusted computing, and the device private key corresponding to the device public key is stored locally by the identity authentication user.

[0079] The device public key can include Figure 4 the device public key of the Internal Internet Finance Authentication Alliance (IIFAA) shown in Figure 4 the device public key of the Internet Finance Authentication Alliance (IFAA) not shown in

[0080] Back to Figure 3The aforementioned blockchain-based identity authentication method may include the following steps:

[0081] 310: Receive an original identity certificate issued by an identity certificate provider in any blockchain; wherein the original identity certificate includes proof of the identity of the identity certificate user, and the original identity certificate is digitally signed by the identity private key stored locally by the identity certificate provider.

[0082] by Figure 4 For example, an identity provider in Blockchain 1 can provide an identity certificate to an identity user in Blockchain 2. This identity certificate can serve as an endorsement of the authenticity of the identity of the identity user. Specifically, the identity provider can digitally sign the identity certificate data using its local private key prikey1 to obtain the signed original identity certificate prikey1(data).

[0083] 320: Query the public key of the identity certificate provider stored in the blockchain where the identity certificate provider is located, and verify the original identity certificate based on the public key of the identity certificate.

[0084] After receiving the original identity document, the user can verify its authenticity. Figure 4 For example, the user of the identity certificate can query the public key pubkey1 of the identity certificate provider stored in the blockchain, and use the public key pubkey1 to verify the original identity certificate prikey1(data) (to verify that the original identity certificate was indeed provided by the identity certificate provider). If the verification is successful, the original identity certificate data can be obtained.

[0085] 330: If the signature verification is successful, the original identity certificate is digitally signed based on the device private key stored locally, and the digitally signed identity certificate to be verified is sent to any identity certificate verification party in any blockchain; so that the identity verification party can query the device public key stored by the identity certificate user from any blockchain, and verify the identity certificate to be verified based on the device public key; and, if the signature verification is successful, it is determined that the identity authentication for the identity certificate user is successful.

[0086] The application introduces the device public key and the device private key of the identity certificate user in the cross-chain scene, on the one hand, the device public key used for signature verification is stored in all blockchains in the identity authentication system, on the other hand, when the original identity certificate is authorized to the identity certificate verification party, the device private key is used instead of the identity private key to digitally sign the original identity certificate; since the device public key has global uniqueness, it will not be affected by the conflict of decentralized digital identity, thereby realizing the cross-chain authentication of decentralized digital identity.

[0087] In some embodiments, the device private key can be stored in a trusted execution environment (Trusted Execution Environment, TEE) local to the identity certificate user; the trusted execution environment can include logic code for performing data signature and logic code for performing signature verification:

[0088] Correspondingly, the signature verification of the original identity certificate based on the identity public key in the above step 320 can include:

[0089] calling the logic code for performing signature verification stored in the local trusted execution environment to perform signature verification on the original identity certificate based on the identity public key;

[0090] And, the digital signature of the original identity certificate based on the locally stored device private key in the above step 330 can include:

[0091] calling the logic code for performing digital signature stored in the local trusted execution environment to perform digital signature on the original identity certificate based on the device private key in the trusted execution environment.

[0092] It should be noted that the logic code for performing signature verification and the logic code for performing digital signature are both run in the TEE, thereby ensuring the data security of the signature verification and digital signature process.

[0093] The following will be described in conjunction with Figure 4 As shown in the figure, the identity certificate user calls the local TEE, runs the logic code for performing signature verification stored in the TEE, uses the identity public key pubkey1 of the identity certificate provider queried from the blockchain to perform signature verification on the original identity certificate prikey1(data), and if the verification is passed, data can be obtained; then, the logic code for performing digital signature stored in the TEE is continuously run, the device private key stored in the TEE is used to perform digital signature on data again, and the identity certificate to be verified newdata=device private key(data) is obtained.

[0094] The digital signature and signature verification are performed through the TEE, thereby ensuring the data security of the signature verification and digital signature process.

[0095] Further, in some embodiments, the method further comprises:

[0096] obtaining, from a blockchain, logic code for performing data signature and logic code for performing signature verification, and storing the obtained logic code for performing data signature and logic code for performing signature verification in a local trusted execution environment.

[0097] In the present application, the logic code for performing data signature and the logic code for performing signature verification can be disclosed on the blockchain, ensuring the transparency of the disclosure of the logic code, on the one hand, facilitating the identity proof user to obtain accurate logic code; on the other hand, even if the logic code transmitted outside the blockchain is tampered with, the tampered logic code can be quickly identified by querying the logic code stored in the blockchain.

[0098] Further, in some embodiments, the logic code for performing data signature in the blockchain corresponds to a unique code identifier;

[0099] Correspondingly, the calling of the logic code for performing digital signature stored in the local trusted execution environment, the digital signature of the original identity proof based on the device private key in the trusted execution environment can include:

[0100] Calling the logic code for performing digital signature stored in the local trusted execution environment, using the device private key in the trusted execution environment to digitally sign the original identity proof and the code identifier of the logic code for performing digital signature as a whole.

[0101] In the present application, by transmitting the code identifier of the logic code for performing digital signature to the identity proof verifier, the identity proof verifier verifies the identity proof to be verified and the verification is passed, and based on the code identifier obtained by the verification, the corresponding logic code is traced back from the blockchain.

[0102] Further, in some embodiments, the original identity proof further includes a decentralized digital identity of the identity proof provider; wherein the decentralized digital identity is provided with an identification bit, and the identification bit records a blockchain identifier of a blockchain where the decentralized digital identity is registered;

[0103] The querying of the identity public key stored by the identity proof provider from the blockchain where the identity proof provider is located comprises:

[0104] Based on the corresponding decentralized digital identity of the identity proof provider, the blockchain identifier recorded by the identification bit of the decentralized digital identity is obtained;

[0105] The identity public key stored by the identity proof provider is queried from the target blockchain corresponding to the blockchain identifier.

[0106] In the present application, in order to quickly determine the identity public key of the identity to be queried in the cross-chain scenario, an identification bit is set in the decentralized digital identity, and the identification bit records the blockchain identification of the blockchain where the decentralized digital identity is registered.

[0107] In implementation, since the DID is actually a string, the identity authentication system can agree on the rules of the DID string with all blockchains; for example, an identification bit can be added to the original string, or a character at a specific position in the original string can be used as an identification bit.

[0108] For example, the string of the DID generated by the blockchain 01 is DID: ION: dfaefaejflin098fanfeixxxfeafe9. Taking adding an identification bit as an example, assuming that the identity authentication system agrees to add an identification bit after the character "ION", then based on the agreement, the string of the DID generated by the blockchain 01 will become DID: ION01: dfaefaejflin098fanfeixxxfeafe9.

[0109] In this way, through the identification bit set after the character "ION", it can be determined that the DID is generated by the blockchain 01, and thus the identity public key associated with the DID is also recorded in the blockchain 01.

[0110] Further, in some embodiments, the method further comprises:

[0111] In response to a registration request initiated for the device public key of the identity proof user, the device public key is recorded in each blockchain in the identity authentication system.

[0112] As mentioned earlier, the identity proof user needs to synchronize its own device public key to all blockchains in the identity authentication system, so that the identity proof verifier can obtain the device public key used to verify the identity proof from any blockchain.

[0113] It should be noted that the identity proof verifier, as a blockchain member of the blockchain where it is located, can query the device public key from the blockchain where it is located with relatively high efficiency; of course, it can also query the device public key from other blockchains through cross-chain technology of the blockchain.

[0114] Figure 3The identity authentication verification party queries the device public key stored by the identity certificate user from any of the blockchains, and verifies the identity certificate based on the device public key; and in the case of passing the verification, determines that the identity authentication of the identity certificate user is passed. Please refer to another identity authentication method based on the blockchain shown in the present application.

[0115] In addition to the above, Figure 3 , Figure 5 An exemplary flowchart of another identity authentication method based on the blockchain in an embodiment of the present application is shown, which can be applied to the identity authentication system of the identity certificate verification party. The identity authentication system can also refer to Figure 4 , which will not be repeated here.

[0116] As Figure 5 shown, the above identity authentication method based on the blockchain can include the following steps:

[0117] 510, receiving the identity certificate to be verified sent by the identity certificate user in any of the blockchains; wherein the identity certificate to be verified is digitally signed by the device private key of the identity certificate user.

[0118] As shown in the foregoing Figure 3 , the identity certificate to be verified can include the original identity certificate issued by the identity certificate provider to the identity certificate user; wherein the original identity certificate is used to prove the identity of the identity certificate user, and the original identity certificate is digitally signed by the identity private key stored locally by the identity certificate provider.

[0119] Further, in some embodiments, the identity certificate to be verified is generated in a trusted execution environment locally of the identity certificate user, and the trusted execution environment contains logic code for performing digital signature and the device private key of the identity certificate user.

[0120] The identity certificate to be verified is further digitally signed by the logic code for performing digital signature stored in the trusted execution environment based on the device private key in the trusted execution environment.

[0121] As shown in the foregoing Figure 3 embodiments, performing digital signature by TEE can ensure the data security of the digital signature process. More specifically, performing digital signature in the TEE locally of the identity certificate user can ensure the secure generation of the identity certificate to be verified.

[0122] 520, querying the device public key corresponding to the device private key stored by the identity certificate user from any of the blockchains.

[0123] by Figure 4 For example, after receiving the identity verification newdata sent by the identity verification user, the identity verification party needs to verify the authenticity of this identity verification newdata. Specifically, since this identity verification newdata is signed by the identity verification user's device private key, and the device public key IIFAA used to verify the signature is pre-stored on all blockchains, the identity verification party can query the device public key IIFAA corresponding to the device private key stored by the identity verification user from any blockchain.

[0124] It should be noted that, as a member of the blockchain, the identity verification party can relatively efficiently query the device's public key from its own blockchain; of course, it can also query the device's public key from other blockchains through cross-chain technology.

[0125] 530. Verify the identity certificate to be verified based on the device public key, and if the verification is successful, determine that the identity authentication for the user of the identity certificate is successful.

[0126] by Figure 4 For example, the identity verification party can use the device public key IIFAA to verify the identity certificate to be verified, newdata = device private key (data). If the verification is successful, the original identity certificate data can be obtained, confirming that the identity authentication for the user of the identity certificate is successful.

[0127] In cross-chain scenarios, this invention introduces the device public key and device private key of the identity verification user. On the one hand, the device public key used for signature verification is stored in all blockchains of the identity authentication system. On the other hand, when the identity verification user authorizes the original identity verification party, the device private key is used instead of the identity private key to digitally sign the original identity verification. Since the device public key is globally unique, it will not be affected by decentralized digital identity conflicts, thus realizing cross-chain authentication of decentralized digital identities.

[0128] Furthermore, in some embodiments, the logic code for performing digital signatures is obtained from the blockchain and stored in the trusted execution environment, and the logic code for performing digital signatures in the blockchain corresponds to a unique code identifier;

[0129] The identity certificate to be verified is further digitally signed by the trusted execution environment using the device private key in the trusted execution environment, taking the original identity certificate and the code identifier of the logic code for executing the digital signature as a whole.

[0130] Accordingly, if the signature verification is successful, the method may further include:

[0131] in response to a query request for the code identifier in the identity proof to be verified that passes the verification, querying the logical code corresponding to the code identifier in the blockchain.

[0132] In the present application, by storing the logical code performing digital signature in the blockchain and setting the code identifier corresponding to the logical code, after the identity proof verification party verifies the identity proof to be verified and the verification passes, the corresponding logical code is traced from the blockchain based on the code identifier obtained by the verification.

[0133] Corresponding to the foregoing embodiment of the blockchain-based identity authentication method, the present application also provides an embodiment of a blockchain-based identity authentication device.

[0134] Please refer to Figure 6 The module diagram of the blockchain-based identity authentication device shown in the present application, the device corresponds to Figure 3 The embodiment shown, the device can be applied to the identity proof user in the identity authentication system composed of at least two blockchains for realizing decentralized digital identity authentication, the blockchain stores the identity public key associated with the decentralized digital identity uploaded by each blockchain member; wherein the identity private key corresponding to the identity public key is stored locally by the blockchain member; the blockchain member includes the identity proof provider, the identity proof user and the identity proof verifier; the blockchain also stores the device public key uploaded by each identity proof user in the blockchain based on trusted computing, and the device private key corresponding to the device public key is stored locally by the identity authentication user; the device comprises:

[0135] The receiving module 610 is configured to receive the original identity proof issued by the identity proof provider in any blockchain; wherein the original identity proof is used to prove the identity of the identity proof user, and the original identity proof is digitally signed by the identity private key stored locally by the identity proof provider;

[0136] The verification module 620 is configured to query the identity public key stored by the identity proof provider from the blockchain where the identity proof provider is located, and verify the original identity proof based on the identity public key;

[0137] The signature module 630 is configured to, in a case where the signature verification is passed, digitally sign the original identity certificate based on the locally stored device private key, and deliver the digitally signed identity certificate to an identity certificate verifier in any blockchain; so that the identity certificate verifier queries the device public key stored by the identity certificate user from any blockchain, and verifies the identity certificate based on the device public key; and in a case where the signature verification is passed, determines that the identity authentication for the identity certificate user is passed.

[0138] Further, in some embodiments, the device private key is stored in a trusted execution environment local to the identity certificate user; the trusted execution environment comprises logic code for performing data signature and logic code for performing signature verification:

[0139] The signature verification on the original identity certificate in the verification module 620 can specifically include: calling the logic code for performing signature verification stored in the local trusted execution environment, and verifying the original identity certificate based on the identity public key;

[0140] The digital signature on the original identity certificate based on the locally stored device private key in the signature module 630 can specifically include: calling the logic code for performing digital signature stored in the local trusted execution environment, and digitally signing the original identity certificate based on the device private key in the trusted execution environment.

[0141] Further, in some embodiments, the apparatus can further include:

[0142] The storage module is configured to acquire the logic code for performing data signature and the logic code for performing signature verification from any blockchain, and store the acquired logic code for performing data signature and the logic code for performing signature verification in a local trusted execution environment.

[0143] Further, in some embodiments, the original identity certificate further includes a decentralized digital identity of the identity certificate provider; wherein the decentralized digital identity is provided with an identification bit, and the identification bit records a blockchain identification of a blockchain in which the decentralized digital identity is registered;

[0144] The identity public key stored by the identity certificate provider in the blockchain where the identity certificate provider is located in the verification module 620 can specifically include: acquiring the blockchain identification recorded by the identification bit of the decentralized digital identity corresponding to the identity certificate provider; and querying the identity public key stored by the identity certificate provider from a target blockchain corresponding to the blockchain identification.

[0145] Further, in some embodiments, the apparatus can further include:

[0146] a registration module configured to, in response to a registration request initiated by a device public key of the identity provider, notarize the device public key to each blockchain in the identity authentication system.

[0147] Further, in some embodiments, the logical code for performing data signature in the blockchain corresponds to a unique code identifier;

[0148] The calling of the logical code for performing digital signature stored in the local trusted execution environment in the signature module 630, based on the device private key in the trusted execution environment, digitally signs the original identity certificate, specifically can include: calling the logical code for performing digital signature stored in the local trusted execution environment, taking the original identity certificate and the code identifier of the logical code for performing digital signature as a whole, and using the device private key in the trusted execution environment for digital signature.

[0149] Please see Figure 7 , the module diagram of the identity authentication apparatus based on blockchain shown in the present application, the apparatus corresponds to Figure 5 The embodiment shown, the apparatus can be applied to the identity certificate verifier in the identity authentication system composed of at least two blockchains for realizing decentralized digital identity authentication, the identity public key associated with the decentralized digital identity uploaded by each blockchain member is notarized in the blockchain; wherein the identity private key corresponding to the identity public key is stored locally by the blockchain member; the blockchain member includes the identity certificate provider, the identity certificate user and the identity certificate verifier; the identity certificate user uploads the device public key based on trusted computing in each blockchain, and the device private key corresponding to the device public key is stored locally by the identity authentication user; the apparatus includes:

[0150] The receiving module 710 is configured to receive the identity certificate to be verified sent by the identity certificate user in any blockchain; wherein the identity certificate to be verified is digitally signed by the device private key of the identity certificate user;

[0151] The query module 720 is configured to query the device public key corresponding to the device private key notarized by the identity certificate user from any blockchain;

[0152] The verification module 730 verifies the identity certificate to be verified based on the device public key; and in the case of passing the verification, determines that the identity authentication for the identity certificate user is passed.

[0153] Further, in some embodiments, the identity certificate to be verified comprises an original identity certificate issued by the identity certificate provider to the identity certificate user; wherein the original identity certificate is used to prove the identity of the identity certificate user, and the original identity certificate is digitally signed by an identity private key stored locally by the identity certificate provider.

[0154] Further, in some embodiments, the identity certificate to be verified is generated in a trusted execution environment local to the identity certificate user, and the trusted execution environment contains logic code for performing data signing and a device private key of the identity certificate user.

[0155] The identity certificate to be verified is further digitally signed by the logic code for performing data signing stored in the trusted execution environment based on the device private key in the trusted execution environment.

[0156] Further, in some embodiments, the logic code for performing data signing is obtained from a blockchain and stored in the trusted execution environment, and the logic code for performing data signing in the blockchain corresponds to a unique code identifier.

[0157] The identity certificate to be verified is further digitally signed by the trusted execution environment using the device private key in the trusted execution environment as a whole based on the original identity certificate and the code identifier of the logic code for performing data signing.

[0158] The verification module 730 is further configured to, in the case of verification passing, in response to a query request for the code identifier in the identity certificate to be verified that passes verification, query the logic code corresponding to the code identifier in the blockchain.

[0159] The implementation process of the functions and roles of each module in the above device is specifically described in the implementation process of the corresponding steps in the above method, which will not be repeated here.

[0160] For the device embodiment, since it basically corresponds to the method embodiment, the related parts are described in the part of the method embodiment. The device embodiments described above are only illustrative, and the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e. they can be located in one place or distributed on multiple network units. According to actual needs, some or all of the modules can be selected to achieve the purpose of the present application. Those skilled in the art can understand and implement it without creative labor.

[0161] With the internal function modules and structural diagram of the described blockchain-based identity authentication device, the substantive execution subject can be an electronic device, including:

[0162] a processor;

[0163] a memory for storing processor-executable instructions;

[0164] The processor is configured to execute any of the above embodiments of the blockchain-based identity authentication method.

[0165] In the above embodiments of the electronic device, it should be understood that the processor can be a processing unit (English: Central Processing Unit, CPU for short), and can also be other general-purpose processors, digital signal processors (English: Digital Signal Processor, DSP for short), application specific integrated circuits (English: Application Specific Integrated Circuit, ASIC for short), etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc., and the aforementioned memory can be a read-only memory (English: read-only memory, ROM for short), a random access memory (English: random access memory, RAM for short), a flash memory, a hard disk or a solid state disk. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as hardware processor execution or executed by hardware and software modules in the processor.

[0166] In addition, the present application also provides a computer readable storage medium, the instructions in the computer readable storage medium are executed by the processor of the electronic device, so that the electronic device can execute any of the above embodiments of the blockchain-based identity authentication method.

[0167] It should be noted that the above enumeration is only a specific embodiment of the present application, and obviously the present application is not limited to the above embodiments, and there are many similar changes. All the modifications directly derived or conceived by those skilled in the art from the content disclosed in the present application should belong to the protection scope of the present application.

Claims

1. A blockchain-based identity authentication method applied to an identity certificate user in an identity authentication system, the identity authentication system consisting of at least two blockchains for implementing decentralized digital identity authentication, identity public keys associated with decentralized digital identities uploaded by respective blockchain members being stored in the blockchains; wherein, An identity private key corresponding to the identity public key is stored locally by a blockchain member; the blockchain member includes an identity provider, an identity user, and an identity verifier; the blockchain also stores a device public key uploaded by the identity user in each blockchain based on trusted computing, and a device private key corresponding to the device public key is stored locally by the identity authentication user, and the method comprises: Receiving an original identity certificate issued by an identity provider in any blockchain; wherein the original identity certificate includes an identity of the identity user, and the original identity certificate is digitally signed by an identity private key stored locally by the identity provider; Querying the identity public key stored by the identity provider from the blockchain where the identity provider is located, and verifying the original identity certificate based on the identity public key; In the case where the verification is passed, the original identity certificate is digitally signed based on the locally stored device private key, and the digitally signed identity certificate to be verified is issued to an identity verifier in any blockchain; so that the identity verifier queries the device public key stored by the identity user from any blockchain, and verifies the identity certificate to be verified based on the device public key; and in the case where the verification is passed, it is determined that the identity authentication for the identity user is passed.

2. The identity authentication method based on blockchain according to claim 1, wherein the device private key is stored in a trusted execution environment locally of the identity user; the trusted execution environment contains logical code for performing data signature and logical code for performing verification: The verification of the original identity certificate based on the identity public key comprises: Calling the logical code for performing verification stored in the local trusted execution environment to verify the original identity certificate based on the identity public key; The digital signature of the original identity certificate based on the locally stored device private key comprises: Calling the logical code for performing digital signature stored in the local trusted execution environment to digitally sign the original identity certificate based on the device private key in the trusted execution environment.

3. The identity authentication method based on blockchain according to claim 2, further comprising: Obtaining logical code for performing data signature and logical code for performing verification from any blockchain, and storing the obtained logical code for performing data signature and logical code for performing verification in a local trusted execution environment. 4.The blockchain-based identity authentication method of claim 2, wherein the original identity certificate issuing further comprises a decentralized digital identity of the identity certificate provider; and An identification bit is arranged in the decentralized digital identity, and the identification bit records a blockchain identification of a blockchain where the decentralized digital identity is registered; The querying of the identity public key stored by the identity provider from the blockchain where the identity provider is located comprises: Based on the decentralized digital identity corresponding to the identity provider, obtaining the blockchain identification recorded by the identification bit of the decentralized digital identity; Querying the identity public key stored by the identity provider from a target blockchain corresponding to the blockchain identification. 5.The blockchain-based identity authentication method of claim 1, further comprising: in response to a registration request initiated for a device public key of the identity provider, notarizing the device public key to each blockchain in the identity authentication system. 6.The blockchain-based identity authentication method of claim 3, wherein the logic code for performing data signature in the blockchain corresponds to a unique code identifier; the step of signing the original identity proof based on a device private key in the trusted execution environment comprises: signing the original identity proof and the code identifier of the logic code for performing data signature as a whole using the device private key in the trusted execution environment. 7.A blockchain-based identity authentication method applied to an identity certificate verifier in an identity authentication system, the identity authentication system consisting of at least two blockchains for implementing decentralized digital identities, identity public keys associated with the decentralized digital identities uploaded by respective blockchain members being stored in the blockchains; wherein, an identity private key corresponding to the identity public key is stored locally by a blockchain member; the blockchain members include an identity provider, an identity user, and an identity verifier; the blockchain further notarizes a device public key based on trusted computing uploaded by the identity user in each blockchain, and a device private key corresponding to the device public key is stored locally by the identity authentication user, and the method comprises: receiving a to-be-verified identity proof sent by the identity user in any blockchain; wherein the to-be-verified identity proof is information obtained by signing an original identity proof with a device private key of the identity user, the original identity proof is used to prove the identity of the identity user, and the original identity proof is signed by an identity private key stored locally by the identity provider and then issued to the identity user; querying the device public key corresponding to the device private key notarized by the identity user from any blockchain; verifying the to-be-verified identity proof based on the device public key, and determining that the identity authentication for the identity user is passed if the verification is passed. 8.The blockchain-based identity authentication method of claim 7, wherein the to-be-verified identity proof is generated in a trusted execution environment locally of the identity user, and the trusted execution environment contains a logic code for performing data signature and a device private key of the identity user; the to-be-verified identity proof is further signed by the logic code for performing data signature stored in the trusted execution environment based on the device private key in the trusted execution environment. 9.The blockchain-based identity authentication method of claim 8, wherein the logic code for performing data signature is obtained from a blockchain and stored in the trusted execution environment, and the logic code for performing data signature in the blockchain corresponds to a unique code identifier; the to-be-verified identity proof is further signed by the trusted execution environment using the device private key in the trusted execution environment, taking the original identity proof and the code identifier of the logic code for performing data signature as a whole. in the case of the signature verification passing, further comprising: in response to a query request for a code identifier in the identity proof to be verified for the signature verification passing, querying logical code corresponding to the code identifier in the blockchain. 10.A blockchain-based identity authentication apparatus, applied to an identity certificate user in an identity authentication system, the identity authentication system consisting of at least two blockchains for implementing decentralized digital identity, identity public keys associated with the decentralized digital identity uploaded by respective blockchain members being stored in the blockchains; wherein, An identity private key corresponding to the identity public key is stored locally by a blockchain member; the blockchain member includes an identity proof provider, an identity proof user, and an identity proof verifier; the blockchain also stores a device public key uploaded by the identity proof user in each blockchain based on trusted computing, and a device private key corresponding to the device public key is stored locally by the identity authentication user, and the device includes: The receiving module is configured to receive an original identity proof issued by an identity proof provider in any blockchain; wherein the original identity proof is used to prove the identity of the identity proof user, and the original identity proof is digitally signed by an identity private key stored locally by the identity proof provider; The verification module is configured to query the identity public key stored by the identity proof provider from the blockchain where the identity proof provider is located, and to verify the original identity proof based on the identity public key; The signature module is configured to digitally sign the original identity proof based on the locally stored device private key in the case of the signature verification passing, and to issue the digitally signed identity proof to be verified to the identity proof verifier in any blockchain; so that the identity proof verifier queries the device public key stored by the identity proof user from any blockchain, and verifies the identity proof to be verified based on the device public key; and in the case of the signature verification passing, determines that the identity authentication for the identity proof user is passed. 11.A blockchain-based identity authentication apparatus, applied to an identity certificate verifier in an identity authentication system, the identity authentication system consisting of at least two blockchains for implementing decentralized digital identities, identity public keys associated with the decentralized digital identities uploaded by respective blockchain members being stored in the blockchains; wherein, An identity private key corresponding to the identity public key is stored locally by a blockchain member; the blockchain member includes an identity proof provider, an identity proof user, and an identity proof verifier; the blockchain also stores a device public key uploaded by the identity proof user in each blockchain based on trusted computing, and a device private key corresponding to the device public key is stored locally by the identity authentication user, and the device includes: The receiving module is configured to receive an original identity proof issued by an identity proof provider in any blockchain; wherein the original identity proof is used to prove the identity of the identity proof user, and the original identity proof is digitally signed by an identity private key stored locally by the identity proof provider; The query module is configured to query the device public key corresponding to the device private key stored by the identity proof user from any blockchain; The verification module verifies the identity proof to be verified based on the device public key; and In the case of the signature verification passing, it is determined that the identity authentication for the identity proof user is passed.

12. A computer readable storage medium, the storage medium having stored thereon a computer program which, when executed by a processor, implements the method of any of claims 1-9.

13. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the method of any of claims 1-9 when executing the program.

Images