A blockchain-based identity authentication method and device

Abstract

The application discloses a kind of identity authentication methods based on blockchain, comprising: receiving the authorization request of identity certification initiated by user in blockchain;Wherein, the authorization request includes the real identity certification of user and real-name identity certification;Real identity certification is the identity certification that is digitally signed by first provider in blockchain using first identity private key stored locally;Real-name identity certification is the identity certification that is digitally signed by second provider in blockchain using second identity private key stored locally;In response to authorization request, first identity public key and second identity public key are queried from blockchain;The digital signature of real identity certification is verified based on first identity public key, and the digital signature of real-name identity certification is verified based on second identity public key;After the digital signature of real identity certification and real-name identity certification is verified, it is determined that the identity authentication for user is passed.

Description

Technical Field

[0001] This invention relates to blockchain technology, and more particularly to a blockchain-based identity authentication method and apparatus. Background Technology

[0002] Blockchain technology, also known as distributed ledger technology, is an emerging technology in which multiple computing devices jointly participate in "accounting" and maintain a complete distributed database. Due to its decentralized, transparent, and database-driven characteristics, allowing each computing device to participate in recording data and enabling rapid data synchronization between devices, blockchain technology is widely used in numerous fields.

[0003] Decentralized Digital Identity (DID) is a digital identity system based on blockchain technology, which features guaranteed data authenticity and trustworthiness, protection of user privacy and security, and strong portability. Summary of the Invention

[0004] One of the objectives of this invention is to provide a blockchain-based identity authentication method that enables cross-chain authentication of decentralized digital identities.

[0005] Based on the aforementioned objectives, this invention proposes a blockchain-based identity authentication method, applied to the verification party of identity proof in a decentralized digital identity blockchain. The blockchain stores the public keys associated with the decentralized digital identities uploaded by its members; the blockchain members include the identity proof provider, the identity proof user, and the identity proof verifier; the method includes:

[0006] The system receives an authorization request for identity verification initiated by a user in the blockchain. The authorization request includes the user's real-person identity verification and real-name identity verification. The real-person identity verification is performed by a first provider in the blockchain, after the user's real-person verification is successful, using a locally stored first identity private key for digital signature verification. The real-name identity verification is performed by a second provider in the blockchain, after the real-person identity verification is successful, using a locally stored second identity private key for digital signature verification.

[0007] In response to the authorization request, query the first identity public key stored by the first provider and the second identity public key stored by the second provider from the blockchain;

[0008] The digital signature of the real person's identity certificate is verified based on the first identity public key, and the digital signature of the real name identity certificate is verified based on the second identity public key.

[0009] After both the real-person identity verification and the digital signature of the real-name identity verification are verified, the identity authentication for the user is confirmed to be successful.

[0010] Furthermore, in some embodiments, the identity certificate issued by the provider is equipped with a level field indicating the type of identity certificate;

[0011] The field values ​​of the grade field include a first field value for representing real-person identity verification, a second field value for representing real-name identity verification, and a third field value for representing ordinary identity verification.

[0012] Furthermore, in some embodiments, the real-name identity certificate is also provided with an association field indicating the associated real-person identity certificate; the associated real-person identity certificate refers to the real-person identity certificate that has passed verification before the second provider issues the real-name identity certificate.

[0013] Furthermore, in some embodiments, the real-person identity verification and real-name identity verification in the authorization request are encrypted by the user using a third-party identity public key of the verification method stored in the blockchain;

[0014] Before querying the first identity public key stored by the first provider and the second identity public key stored by the second provider from the blockchain, the method further includes:

[0015] The encrypted real-person identity certificate and real-name identity certificate are decrypted using the locally stored third-party private key to obtain the plaintext real-person identity certificate and real-name identity certificate.

[0016] Furthermore, in some embodiments, after determining that the authentication of the user's identity has passed, the method further includes:

[0017] Obtain the identity information from the real-person identity certificate in the plaintext, and the business information from the real-name identity certificate; perform relevant business operations based on the identity information and business information.

[0018] Similar to the aforementioned methods, this invention also provides another blockchain-based identity authentication method, applied to users of identity verification in a decentralized digital identity blockchain, wherein the blockchain stores public keys associated with decentralized digital identities uploaded by its respective blockchain members; the blockchain members include identity verification providers, identity verification users, and identity verification verifiers; the method includes:

[0019] A first request for real-person identity verification is sent to a first provider in the blockchain, the first request containing the user's decentralized digital identity; so that the first provider can perform real-person verification on the user, and generate real-person identity verification based on the user's decentralized digital identity and the user's identity information obtained during the real-person verification process after the real-person verification is passed;

[0020] The real-person identity certificate issued by the first provider is stored; wherein the real-person identity certificate is digitally signed by the first provider using a first identity private key stored locally.

[0021] A second request for real-name identity verification is sent to a second provider in the blockchain. The second request includes the user's decentralized digital identity and the real-person identity verification. This enables the second provider to verify the real-person identity verification and generate a real-name identity verification based on the user's decentralized digital identity and the real-person identity verification after the verification is successful.

[0022] The real-name identity certificate issued by the second provider is stored; wherein the real-name identity certificate is digitally signed by the second provider using a second identity private key stored locally.

[0023] Furthermore, in some embodiments, it also includes:

[0024] An authorization request for identity verification is initiated to the verifier in the blockchain; wherein the authorization request includes the user's real-person identity verification and real-name identity verification; so that the verifier can verify the real-person identity verification and real-name identity verification.

[0025] Furthermore, in some embodiments, the identity certificate issued by the blockchain provider is equipped with a level field indicating the type of identity certificate;

[0026] The field values ​​of the grade field include a first field value for representing real-person identity verification, a second field value for representing real-name identity verification, and a third field value for representing ordinary identity verification.

[0027] Furthermore, in some embodiments, the real-name identity certificate is also provided with an association field indicating the associated real-person identity certificate; the associated real-person identity certificate refers to the real-person identity certificate that has passed verification before the second provider issues the real-name identity certificate.

[0028] Furthermore, in some embodiments, the real-person identity verification and real-name identity verification in the authorization request are encrypted by the user using a third-party identity public key of the verification method stored in the blockchain;

[0029] The verification party verifies the identity verification certificate and the real-name identity verification certificate, including:

[0030] The verifier uses a locally stored third-party private key to decrypt the encrypted real-person identity certificate and real-name identity certificate, obtaining the plaintext real-person identity certificate and real-name identity certificate; queries the blockchain for the first identity public key stored by the first provider and the second identity public key stored by the second provider; verifies the digital signature of the real-person identity certificate based on the first identity public key, and verifies the digital signature of the real-name identity certificate based on the second identity public key; after both the real-person identity certificate and the real-name identity certificate have passed verification, the identity authentication for the user is confirmed to be successful.

[0031] The present invention also provides a blockchain-based identity authentication device, applied to the verification party of identity proof in a decentralized digital identity blockchain, wherein the blockchain stores the identity public keys associated with decentralized digital identities uploaded by their respective blockchain members; the blockchain members include identity proof providers, identity proof users, and identity proof verifiers; the device includes:

[0032] A receiving module is used to receive authorization requests for identity verification initiated by users in the blockchain; wherein, the authorization request includes the user's real-person identity verification and real-name identity verification; the real-person identity verification is performed by a first provider in the blockchain using a locally stored first identity private key after the user's real-person verification is passed; the real-name identity verification is performed by a second provider in the blockchain using a locally stored second identity private key after the real-person identity verification is passed.

[0033] The query module is used to query the first identity public key stored by the first provider and the second identity public key stored by the second provider from the blockchain;

[0034] The signature verification module is used to verify the digital signature of the real person's identity certificate based on the first identity public key, and to verify the digital signature of the real name identity certificate based on the second identity public key.

[0035] The determination module is used to determine that the identity authentication for the user is successful after both the real person identity certificate and the digital signature of the real name identity certificate have been verified.

[0036] The present invention also provides a blockchain-based identity authentication device, applied to users of identity verification in a decentralized digital identity blockchain, wherein the blockchain stores the public keys associated with decentralized digital identities uploaded by their respective blockchain members; the blockchain members include identity verification providers, identity verification users, and identity verification verifiers; the device includes:

[0037] The first application module is used to send a first request for real-person identity verification to a first provider in the blockchain. The first request includes the decentralized digital identity of the user. This enables the first provider to perform real-person verification on the user and generate real-person identity verification based on the user's decentralized digital identity and the user's identity information obtained during the real-person verification process after the real-person verification is passed.

[0038] The first storage module is used to store the real-person identity certificate issued by the first provider; wherein the real-person identity certificate is digitally signed by the first provider using a locally stored first identity private key;

[0039] The second application module is used to send a second request for real-name identity verification to a second provider in the blockchain. The second request includes the user's decentralized digital identity and the real-person identity verification. This allows the second provider to verify the real-person identity verification and generate a real-name identity verification based on the user's decentralized digital identity and the real-person identity verification after the verification is successful.

[0040] The second storage module is used to store the real-name identity certificate issued by the second provider; wherein the real-name identity certificate is digitally signed by the second provider using a second identity private key stored locally.

[0041] The blockchain-based identity authentication method and apparatus described in this invention have the following beneficial effects:

[0042] This invention introduces a level field into the traditional identity verification format, thereby expanding the types of identity verification, specifically extending real-person identity verification and real-name identity verification. Thus, in scenarios requiring real-name verification, the combined use of real-name and real-person identity verification ensures that the user's identity verification has been verified; while in scenarios where real-name verification is not required, traditional identity verification can still be used. Attached Figure Description

[0043] Figure 1 An exemplary schematic diagram of a blockchain for decentralized digital identity is shown;

[0044] Figure 2An exemplary flowchart of the blockchain-based identity authentication method of the present invention, with the user as the executing entity, is shown.

[0045] Figure 3 An exemplary schematic diagram of the blockchain for the improved decentralized digital identity of the present invention is shown;

[0046] Figure 4 An exemplary diagram of the data structure for the extended real-person identity verification and real-name identity verification of this invention is shown;

[0047] Figure 5 An exemplary flowchart of the blockchain-based identity authentication method of the present invention, with the verifier as the executing entity, is shown.

[0048] Figure 6 An exemplary schematic diagram of the blockchain-based identity authentication device of the present invention is shown;

[0049] Figure 7 An exemplary schematic diagram of the blockchain-based identity authentication device described in this invention is shown. Detailed Implementation

[0050] The blockchain-based identity authentication method and apparatus, computer-readable storage medium, and electronic device described in this invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. However, this detailed description does not constitute a limitation of this invention.

[0051] First, let me introduce some of the technical concepts involved in this invention.

[0052] Decentralized Digital Identity (DID) is a digital identity system based on blockchain technology, which features guaranteed data authenticity and trustworthiness, protection of user privacy and security, and strong portability.

[0053] In its implementation, DID also requires the assistance of a decentralized public key infrastructure (DPKI). A blockchain based on DPKI can provide an infrastructure for secure services based on cryptographic technology. Specifically, it generates a public-private key pair associated with the DID and digitally signs and verifies the data to be transmitted based on the public-private key pair to ensure the authenticity and trustworthiness of the transmitted data.

[0054] Please refer to the following. Figure 1 The diagram illustrates a blockchain for decentralized digital identity.

[0055] Based on their roles, blockchain members can be divided into identity providers, identity users, and identity verifiers. Each of these three parties needs to register their own DID (Distributed ID) in the blockchain.

[0056] During the application phase, the user can apply to the provider for proof of identity, and the provider will endorse certain identity information of the user and generate proof of identity for the user.

[0057] During the usage phase, if the user has certain business requirements that require the verification party to perform, the user can authorize the verification party to verify the identity certificate, so that the verification party can verify the identity certificate to confirm its authenticity; and after confirming the authenticity of the identity certificate, the verification party can perform the relevant business operations for the user.

[0058] In some application scenarios, in addition to verifying the authenticity of the identity certificate provided by the user, the verifier may also need to confirm whether the user corresponding to the identity certificate has performed real-name verification.

[0059] For example, a decentralized digital identity (DID) holds a digital blind person's identity certificate and uses this identity certificate to apply to the verification party for relevant business operations.

[0060] At this point, in addition to verifying the validity of the identity document, the verifier also needs to determine whether the user of the digital blind person's identity document is actually blind.

[0061] Correspondingly, similar scenarios also involve the application process for identity verification. Before issuing identity verification to users, providers also have the need to verify users' real names.

[0062] For example, when a user uses their DID to apply for a digital blind person's identity certificate from the Association for the Blind, the Association needs to verify the real identity of the DID to ensure that the user is indeed blind.

[0063] In related technologies, real-name verification can be performed during the user registration DID process. However, the identity certificates generated in this way are all subject to real-name verification, which not only violates the original intention of decentralized digital identity, but also means that not all application scenarios require real-name verification.

[0064] Based on this, the present invention aims to provide a blockchain-based identity authentication solution that meets the needs of different application scenarios. A level field is introduced into the traditional identity verification format, thereby expanding the types of identity verification, specifically extending real-person identity verification and real-name identity verification. Thus, in scenarios requiring real-name verification, the combined use of real-name and real-person identity verification ensures that the user's identity verification has been verified; while in scenarios where real-name verification is not required, traditional identity verification can still be used (without real-name verification).

[0065] In one embodiment of the present invention, a blockchain-based identity authentication method is proposed. Figure 2 The flowchart of the blockchain-based identity authentication method of the present invention is illustrated in one embodiment and can be applied to users of identity verification in a blockchain.

[0066] Please refer to the following: Figure 3 The diagram illustrates the improved decentralized digital identity blockchain.

[0067] As previously stated, this invention expands upon different types of identity verification, including real-person identity verification and real-name identity verification, as well as traditional identity verification (hereinafter referred to as ordinary identity verification). Figure 3 As shown, this invention also categorizes the providers of identity verification. Providers capable of generating real-person identity verification are referred to as first providers, those capable of generating identity verification with real names are referred to as second providers, and those capable of generating ordinary identity verification are referred to as third providers. Generally, first providers may include authoritative institutions with real-name verification capabilities.

[0068] Users of identity documents can apply for ordinary identity documents, real-person identity documents, and / or real-name identity documents according to their actual needs.

[0069] It should be noted that a valid identity document is required before applying for real-name identity verification. Correspondingly, when authorizing real-name identity verification, both the physical identity document and the identity document must be authorized to the verification party.

[0070] Back Figure 2 The aforementioned blockchain-based identity authentication method may include the following steps:

[0071] 210. Send a first request for real-person identity verification to the first provider in the blockchain, the first request containing the decentralized digital identity of the user; so that the first provider can perform real-person verification on the user, and generate real-person identity verification based on the user's decentralized digital identity and the user's identity information obtained during the real-person verification process after the real-person verification is passed.

[0072] In practice, users can apply to the first provider for real-person identity verification. After obtaining the user's DID, the first provider can verify the user's identity.

[0073] Specifically, the real-person verification may include collecting the user's identity information and determining whether the user corresponding to the DID is the actual person based on the identity information.

[0074] The identity information may include, but is not limited to, name, ID number, biometric features, etc.

[0075] The biometrics involved may include, for example, eye features, voiceprints, fingerprints, palm prints, heartbeats, pulses, chromosomes, DNA, and dental bite marks. Eye prints may include biometric features such as the iris and sclera.

[0076] If the identity information collected by the first provider matches the identity information reserved by the user, the identity verification is confirmed to be successful.

[0077] Furthermore, after the real-person verification is passed, a real-person identity certificate is generated based on the user's DID and the user's (all or part) identity information obtained during the real-person verification process.

[0078] In this invention, a level field is introduced into the traditional identity verification format, so that the identity verification issued by the blockchain provider has a level field indicating the type of identity verification.

[0079] The field values ​​of the grade field include a first field value for representing real-person identity verification, a second field value for representing real-name identity verification, and a third field value for representing ordinary identity verification.

[0080] The aforementioned identity verification, real-name identity verification, and ordinary identity verification can all, for example, include verifiable claims (or verifiable credentials, VCs). In addition to the endorsed identity information, verifiable credentials may also include the digital signature of the identity verification provider.

[0081] For real-person identity verification, it can be represented as the first provider's endorsement of certain identity information of the user.

[0082] Generally, existing standards, such as the W3C (World Wide Web Consortium) standard, can be used as a reference for the format of identity verification.

[0083] Under the W3C standard, the fields included in identity verification and their meanings are as follows:

[0084] The "issuser" field represents the provider DID corresponding to this VC;

[0085] The “issuanceDate” field indicates the generation time of this VC;

[0086] The "VCID" field represents the identifier ID of the current VC;

[0087] The “SubjectDID” field indicates the user of this VC;

[0088] The "values" field indicates the identity information of the user of this VC endorsement;

[0089] The "proof" field indicates the digital signature of the provider that generated this VC.

[0090] The following is combined Figure 4 The diagram shows the data structure of the extended real-person identity verification and real-name identity verification of the present invention.

[0091] by Figure 4 The upper middle section shows a real-person identity certificate (real-person VC) as an example. Based on the traditional VC format of the W3C standard, a level field has been extended. According to this level field, this VC is a real-person VC. According to other fields, the identifier of this real-person VC is "VC001ID", which is generated by the first provider of "DID002" and provided to the user of "DID001". The endorsed identity information is "{Name: Zhang San; ID number: 112334466}", and the signature string of the first provider of "DID002" for digital signature is "xx001".

[0092] 220, storing the real-person identity certificate issued by the first provider; wherein the real-person identity certificate is digitally signed by the first provider using a locally stored first identity private key.

[0093] After receiving the identity verification certificate issued by the first provider, the user can store it locally. This identity verification certificate can then be digitally signed by the first provider using the locally stored private key of the first identity. Figure 4 For example, the signature string "xx001" in the "proof" field of the real-person VC is the result of the first provider performing digital signature.

[0094] 230. Send a second request for real-name identity verification to a second provider in the blockchain. The second request includes the user's decentralized digital identity and the real-person identity verification. This enables the second provider to verify the real-person identity verification and generate a real-name identity verification based on the user's decentralized digital identity and the real-person identity verification after the verification is successful.

[0095] After successfully applying for real-person identity verification, users can further apply for real-name identity verification.

[0096] In implementation, the user can apply for real-person identity verification from the second provider, and submit the user's own DID along with the aforementioned real-person identity verification to the second provider. After obtaining the user's real-person identity verification, the second provider can verify the real-person identity verification to confirm its authenticity.

[0097] Since the real-person identity certificate is digitally signed by the first provider using the first identity private key, the real-person identity certificate can be verified using the first identity public key corresponding to the first identity private key.

[0098] If the verification is successful, it means that the identity certificate was indeed generated and digitally signed by the first provider. Based on the credit of the first provider, the identity information in the identity certificate can be considered to be true and valid.

[0099] After the signature verification is successful, the second provider can generate a real-name identity certificate based on the user's decentralized digital identity and the real-person identity certificate.

[0100] Similar to the real-person identity verification, the real-name identity verification also adds a level field, but the value of the level field is the value of the second field (representing real-name identity verification).

[0101] Furthermore, in some embodiments, the real-name identity certificate is also provided with an association field indicating the associated real-person identity certificate; the associated real-person identity certificate refers to the real-person identity certificate that has passed verification before the second provider issues the real-name identity certificate.

[0102] Refer again Figure 4 ,by Figure 4 Taking the real-name identity verification (real-name VC) shown in the lower middle section as an example, the level field indicates that this VC is a real-name VC, and the association field indicates that the associated "VC001ID" is a real-person VC (i.e. Figure 4The upper and middle part is the real person VC; according to other fields, the identifier of this real person VC is "VC002ID", which is generated by the second provider of "DID003" and provided to the user of "DID001"; the endorsement identity information is "{business type: XX}", and the digital signature string of this "DID003" second provider is "xx002".

[0103] By adding a related field to the real-name identity certificate, the real-person identity certificate submitted when applying for this real-name identity certificate can be traced.

[0104] 240, storing the real-name identity certificate issued by the second provider; wherein the real-name identity certificate is digitally signed by the second provider using a locally stored second identity private key.

[0105] After receiving the identity verification certificate issued by the second provider, the user can store it locally. This identity verification certificate can then be digitally signed by the second provider using the locally stored private key of the second identity; Figure 4 For example, the signature string "xx002" in the "proof" field of the real-name VC is the result of digital signature by the second provider.

[0106] It should be noted that the first provider and the second provider shown in this invention are different providers. In practical applications, the first provider and the second provider may also be the same provider.

[0107] Through the above embodiments, a level field is introduced into the traditional identity verification format, thereby expanding the types of identity verification, specifically expanding real-person identity verification and real-name identity verification. Thus, in scenarios requiring real-name verification, the combined use of real-name and real-person identity verification ensures that the user's identity verification has been verified; while in scenarios where real-name verification is not required, traditional identity verification can still be used (without real-name verification).

[0108] For scenarios requiring real-name registration, some embodiments further include:

[0109] An authorization request for identity verification is initiated to the verifier in the blockchain; wherein the authorization request includes the user's real-person identity verification and real-name identity verification; so that the verifier can verify the real-person identity verification and real-name identity verification.

[0110] In implementation, since both the real-person identity verification and the real-name identity verification are digitally signed, the verifying party needs to verify the signatures of the real-person identity verification and the real-name identity verification authorized by the user to confirm their authenticity. Specific details regarding the verification process will be provided later. Figure 5 The relevant embodiments are described below.

[0111] Furthermore, in some embodiments, the real-person identity verification and real-name identity verification in the authorization request are encrypted by the user using a third-party identity public key of the verification method stored in the blockchain;

[0112] The verification party verifies the identity verification certificate and the real-name identity verification certificate, including:

[0113] The verifier uses a locally stored third-party private key to decrypt the encrypted real-person identity certificate and real-name identity certificate, obtaining the plaintext real-person identity certificate and real-name identity certificate; queries the blockchain for the first identity public key stored by the first provider and the second identity public key stored by the second provider; verifies the digital signature of the real-person identity certificate based on the first identity public key, and verifies the digital signature of the real-name identity certificate based on the second identity public key; after both the real-person identity certificate and the real-name identity certificate have passed verification, the identity authentication for the user is confirmed to be successful.

[0114] In implementation, since the identity verification documents (both real-person and real-name verification documents) are encrypted by the user, the verifier needs to decrypt them to obtain the plaintext versions. Specific details regarding encryption and decryption will be discussed later. Figure 5 The relevant embodiments are described below.

[0115] In addition to the present invention Figure 2 In addition, Figure 5 An exemplary flowchart of another blockchain-based identity authentication method of the present invention is shown in one implementation. This method can be applied to the verifier in a blockchain.

[0116] like Figure 5 As shown, the above-mentioned blockchain-based identity authentication method may include the following steps:

[0117] 510: Receive an authorization request for identity verification initiated by a user in the blockchain; wherein the authorization request includes the user's real-person identity verification and real-name identity verification; the real-person identity verification is a digitally signed identity verification using a locally stored first identity private key by a first provider in the blockchain after the user's real-person verification is passed; the real-name identity verification is a digitally signed identity verification using a locally stored second identity private key by a second provider in the blockchain after the real-person identity verification is passed.

[0118] In practical applications, some services require users to prove their identity. This requires users to authorize the verification party to verify their identity so that the verification party can verify the identity and provide relevant services or perform relevant business operations after the verification is successful (indicating that the user's identity is genuine).

[0119] In scenarios requiring real-name authentication, the verification party needs to provide the user's real-person identity verification and real-name identity verification.

[0120] For information on real-person identity verification and real-name identity verification, please refer to the aforementioned examples, for example:

[0121] In some embodiments, the identity certificate issued by the provider has a level field indicating the type of identity certificate;

[0122] The field values ​​of the grade field include a first field value for representing real-person identity verification, a second field value for representing real-name identity verification, and a third field value for representing ordinary identity verification.

[0123] In some embodiments, the real-name identity certificate is further provided with an association field indicating the associated real-person identity certificate; the associated real-person identity certificate refers to the real-person identity certificate that has passed the verification before the second provider issues the real-name identity certificate.

[0124] For specific technical details, please refer to the foregoing embodiments, which will not be repeated here.

[0125] 520: In response to the authorization request, query the blockchain for the first identity public key stored by the first provider and the second identity public key stored by the second provider.

[0126] 530: Verify the digital signature of the real person's identity certificate based on the first identity public key, and verify the digital signature of the real name identity certificate based on the second identity public key.

[0127] Since both the real-person identity certificate and the real-name identity certificate are digitally signed, the verifier needs to verify the signature of the real-person identity certificate and the real-name identity certificate authorized by the user in order to determine their authenticity.

[0128] In this invention, the provider, user, and verifier can all store their own DID-associated public identity key in the blockchain, while the private identity key corresponding to the public identity key is stored locally by the blockchain members.

[0129] In implementation, the verifier can query the first identity public key stored by the first provider and the second identity public key stored by the second provider from the blockchain; and verify the digital signature of the real person identity certificate based on the first identity public key, and verify the digital signature of the real name identity certificate based on the second identity public key.

[0130] 240: After both the real person identity certificate and the digital signature of the real name identity certificate have been verified, it is determined that the identity authentication for the user has been successful.

[0131] If both the real-person identity certificate and the real-name identity certificate pass verification, it means that the real-person identity certificate was indeed generated by the first provider and the real-name identity certificate was indeed generated by the second provider. Based on the credit of the first and second providers, it can be assumed that both the real-person identity certificate and the real-name identity certificate are genuine, thus proving that the user's identity is also real and trustworthy. In this way, it can be determined that the identity authentication for the user has passed.

[0132] Through the above embodiments, a level field is introduced into the traditional identity verification format, thereby expanding the types of identity verification, specifically expanding real-person identity verification and real-name identity verification. Thus, in scenarios requiring real-name verification, the combined use of real-name and real-person identity verification ensures that the user's identity verification has been verified; while in scenarios where real-name verification is not required, traditional identity verification can still be used (without real-name verification).

[0133] Furthermore, in some embodiments, after determining that the authentication of the user's identity has passed, the method further includes:

[0134] Obtain the identity information from the real-person identity certificate in the plaintext, and the business information from the real-name identity certificate; perform relevant business operations based on the identity information and business information.

[0135] by Figure 4 For example, the real-person identity verification includes the user's identity information {name: Zhang San; ID number: 112334466}, while the real-name identity verification includes the service type: XX. Assuming that "XX" is a phone bill inquiry and the verifier is a telecommunications operator, then after confirming that the user's identity has been verified, the verifier can query the phone bill of the user "Zhang San, ID number 112334466" and return the queried phone bill to the user.

[0136] Through the above embodiments, real-person identity verification and real-name identity verification can not only meet the real-name authentication requirements in real-name scenarios, but also use the relevant information in real-person identity verification and real-name identity verification to execute relevant business operations in the scenario and feed back the business operation results to the user; thereby completing the complete process of the relevant business.

[0137] Furthermore, in some embodiments, the real-person identity verification and real-name identity verification in the authorization request are encrypted by the user using a third-party identity public key of the verification method stored in the blockchain;

[0138] Before querying the first identity public key stored by the first provider and the second identity public key stored by the second provider from the blockchain, the method further includes:

[0139] The encrypted real-person identity certificate and real-name identity certificate are decrypted using the locally stored third-party private key to obtain the plaintext real-person identity certificate and real-name identity certificate.

[0140] In practical applications, due to the risk of data leakage during data transmission, users can encrypt the identity verification documents and real-name identity verification documents sent to the verification party.

[0141] The specific encryption process can be described as follows:

[0142] As mentioned earlier, providers, users, and verifiers can all store their own DID-related identity public keys in the blockchain, while the identity private keys corresponding to the identity public keys are stored locally by blockchain members.

[0143] Users can query the third-party public key corresponding to the verifier's DID from the blockchain; and encrypt the real person identity certificate and real name identity certificate based on the third-party public key, and then encrypt the real person identity certificate and real name identity certificate and send them to the verifier.

[0144] After receiving the encrypted real-person identity certificate and real-name identity certificate, the verifier can decrypt them based on the third-party private key stored locally to obtain the plaintext real-person identity certificate and real-name identity certificate.

[0145] Through the above embodiments, since the identity verification documents and real-name verification documents are encrypted, even if they are intercepted by other third parties, the plaintext identity verification documents cannot be obtained without the third party's private key for decryption. Therefore, data security can be effectively guaranteed.

[0146] Corresponding to the aforementioned embodiments of blockchain-based identity authentication methods, the present invention also provides embodiments of blockchain-based identity authentication devices.

[0147] Please see Figure 6 This is a block diagram of a blockchain-based identity authentication device according to the present invention. The device corresponds to... Figure 5 The illustrated embodiment shows that the device can be applied to the verification party of identity proof in a decentralized digital identity blockchain, wherein the blockchain stores the identity public keys associated with decentralized digital identities uploaded by their respective blockchain members; the blockchain members include identity proof providers, identity proof users, and identity proof verifiers; the device includes:

[0148] The receiving module 610 receives an authorization request for identity verification initiated by a user in the blockchain; wherein, the authorization request includes the user's real-person identity verification and real-name identity verification; the real-person identity verification is performed by a first provider in the blockchain using a locally stored first identity private key after the user's real-person verification is successful; the real-name identity verification is performed by a second provider in the blockchain using a locally stored second identity private key after the real-person identity verification is successful;

[0149] The query module 620 is used to query the first identity public key stored by the first provider and the second identity public key stored by the second provider from the blockchain;

[0150] The signature verification module 630 is used to verify the digital signature of the real person identity certificate based on the first identity public key, and to verify the digital signature of the real name identity certificate based on the second identity public key.

[0151] The determination module 640 is used to determine that the identity authentication for the user is successful after both the real person identity certificate and the digital signature of the real name identity certificate have been verified.

[0152] Furthermore, in some embodiments, the identity certificate issued by the provider is equipped with a level field indicating the type of identity certificate;

[0153] The field values ​​of the grade field include a first field value for representing real-person identity verification, a second field value for representing real-name identity verification, and a third field value for representing ordinary identity verification.

[0154] Furthermore, in some embodiments, the real-name identity certificate is also provided with an association field indicating the associated real-person identity certificate; the associated real-person identity certificate refers to the real-person identity certificate that has passed verification before the second provider issues the real-name identity certificate.

[0155] Furthermore, in some embodiments, the real-person identity verification and real-name identity verification in the authorization request are encrypted by the user using a third-party identity public key of the verification method stored in the blockchain;

[0156] Prior to the query module 620, the following is also included:

[0157] The decryption module is used to decrypt the encrypted real-person identity certificate and real-name identity certificate using a locally stored third-party private key, so as to obtain the plaintext real-person identity certificate and real-name identity certificate.

[0158] Furthermore, in some embodiments, after the determining module 640, the following is also included:

[0159] The execution module is used to obtain the identity information from the real-person identity certificate in the plaintext, and the business information from the real-name identity certificate; and to perform relevant business operations based on the identity information and business information.

[0160] Please see Figure 7 This is a block diagram of a blockchain-based identity authentication device according to the present invention. The device corresponds to... Figure 2 The illustrated embodiment describes a device that can be applied to users of identity verification in a decentralized digital identity blockchain. The blockchain stores public keys associated with decentralized digital identities uploaded by its members. These blockchain members include identity verification providers, identity verification users, and identity verification verifiers. The device comprises:

[0161] The first application module 710 is used to send a first request for real-person identity verification to a first provider in the blockchain. The first request includes the decentralized digital identity of the user. This enables the first provider to perform real-person verification on the user and generate real-person identity verification based on the user's decentralized digital identity and the user's identity information obtained during the real-person verification process after the real-person verification is passed.

[0162] The first storage module 720 is used to store the real-person identity certificate issued by the first provider; wherein the real-person identity certificate is digitally signed by the first provider using a locally stored first identity private key;

[0163] The second application module 730 is used to send a second request for real-name identity verification to a second provider in the blockchain. The second request includes the user's decentralized digital identity and the real-person identity verification. This allows the second provider to verify the real-person identity verification and generate a real-name identity verification based on the user's decentralized digital identity and the real-person identity verification after the verification is successful.

[0164] The second storage module 740 is used to store the real-name identity certificate issued by the second provider; wherein the real-name identity certificate is digitally signed by the second provider using a locally stored second identity private key.

[0165] Furthermore, in some embodiments, it also includes:

[0166] The authorization module is used to initiate an authorization request for identity verification to the verifier in the blockchain; wherein the authorization request includes the user's real person identity verification and real name identity verification, so that the verifier can verify the real person identity verification and real name identity verification.

[0167] Furthermore, in some embodiments, the identity certificate issued by the blockchain provider is equipped with a level field indicating the type of identity certificate;

[0168] The field values ​​of the grade field include a first field value for representing real-person identity verification, a second field value for representing real-name identity verification, and a third field value for representing ordinary identity verification.

[0169] Furthermore, in some embodiments, the real-name identity certificate is also provided with an association field indicating the associated real-person identity certificate; the associated real-person identity certificate refers to the real-person identity certificate that has passed verification before the second provider issues the real-name identity certificate.

[0170] Furthermore, in some embodiments, the real-person identity verification and real-name identity verification in the authorization request are encrypted by the user using a third-party identity public key of the verification method stored in the blockchain;

[0171] The verification party in the second application module 730 verifies the identity certificate and the real-name identity certificate, further including:

[0172] The verifier uses a locally stored third-party private key to decrypt the encrypted real-person identity certificate and real-name identity certificate, obtaining the plaintext real-person identity certificate and real-name identity certificate; queries the blockchain for the first identity public key stored by the first provider and the second identity public key stored by the second provider; verifies the digital signature of the real-person identity certificate based on the first identity public key, and verifies the digital signature of the real-name identity certificate based on the second identity public key; after both the real-person identity certificate and the real-name identity certificate have passed verification, the identity authentication for the user is confirmed to be successful.

[0173] The specific implementation process of the functions and roles of each module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0174] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the present invention according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0175] The internal functional modules and structural diagrams of the blockchain-based identity authentication device described above can essentially be executed by an electronic device, including:

[0176] processor;

[0177] Memory used to store processor-executable instructions;

[0178] The processor is configured to execute any of the above-described blockchain-based identity authentication methods.

[0179] In the embodiments of the above-described electronic device, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor, and the aforementioned memory can be read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or solid-state drive. The steps of the method disclosed in the embodiments of this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.

[0180] In addition, the present invention also provides a computer-readable storage medium, wherein the instructions in the computer-readable storage medium, when executed by a processor of an electronic device, enable the electronic device to perform any of the above-described embodiments of the blockchain-based identity authentication method.

[0181] It should be noted that the above examples are merely specific embodiments of the present invention, and the present invention is obviously not limited to the above embodiments, with many similar variations. All modifications that can be directly derived or conceived by those skilled in the art from the content disclosed in this invention should fall within the protection scope of this invention.

Claims

1. A blockchain-based identity authentication method, applied to a verifier of identity proof in a blockchain of decentralized digital identity, wherein identity public keys associated with decentralized digital identities uploaded by respective blockchain members are stored in the blockchain. The blockchain members include a provider of identity proof, a user of identity proof, and a verifier of identity proof; and the method includes: receiving an authorization request for identity proof initiated by a user in a blockchain; wherein the authorization request includes a real person identity proof of the user and a real name identity proof; the real person identity proof is a digital signature identity proof of the first provider in the blockchain, which is signed by a locally stored first identity private key after passing the real person verification of the user, the real person verification includes collecting identity information of the user, and determining whether the corresponding user is the real person based on the identity information; the real name identity proof is a digital signature identity proof generated by the second provider in the blockchain based on the decentralized digital identity of the user and the real person identity proof after passing the signature verification of the real person identity proof, and signed by a locally stored second identity private key; the real name identity proof is provided with an association field representing the associated real person identity proof, which is used to trace the real person identity proof submitted when applying for the real name identity proof; in response to the authorization request, querying the first identity public key stored by the first provider and the second identity public key stored by the second provider in the blockchain; verifying the digital signature of the real person identity proof based on the first identity public key, and verifying the digital signature of the real name identity proof based on the second identity public key; after the digital signatures of the real person identity proof and the real name identity proof are verified, determining that the identity authentication of the user is passed.

2. The blockchain-based identity authentication method of claim 1, wherein the identity proof issued by the provider is provided with a level field representing the type of identity proof; the field value of the level field includes a first field value representing the real person identity proof, a second field value representing the real name identity proof, and a third field value representing the ordinary identity proof.

3. The blockchain-based identity authentication method of claim 1, wherein the real person identity proof and the real name identity proof in the authorization request are encrypted by the user using a third identity public key of the verifier stored in the blockchain; before the first identity public key stored by the first provider and the second identity public key stored by the second provider are queried from the blockchain, the method further includes: decrypting the encrypted real person identity proof and real name identity proof using a locally stored third identity private key to obtain the plaintext real person identity proof and real name identity proof.

4. The blockchain-based identity authentication method of claim 3, after determining that the identity authentication of the user is passed, the method further includes: obtaining identity information in the plaintext real person identity proof and business information in the real name identity proof; performing relevant business operations based on the identity information and business information. 5.A blockchain-based identity authentication method applied to a user of an identity certificate in a blockchain of decentralized digital identities, wherein identity public keys associated with the decentralized digital identities uploaded by respective blockchain members are stored in the blockchain, and wherein the blockchain members include an identity certificate provider, an identity certificate user, and an identity certificate verifier; the method comprising: sending a first request for an in-person identity certificate to a first provider in the blockchain, wherein the first request contains a decentralized digital identity of the user; so that the first provider verifies the user in person, and generates an in-person identity certificate based on the decentralized digital identity of the user and identity information of the user obtained during the in-person verification, after the in-person verification is passed; the in-person verification includes collecting identity information of the user, and determining whether the corresponding user is the person himself / herself based on the identity information; storing the in-person identity certificate issued by the first provider; wherein the in-person identity certificate is digitally signed by the first provider using a first identity private key stored locally; sending a second request for a real-name identity certificate to a second provider in the blockchain, wherein the second request contains the decentralized digital identity of the user and the in-person identity certificate; so that the second provider verifies the in-person identity certificate, and generates a real-name identity certificate based on the decentralized digital identity of the user and the in-person identity certificate, after the verification is passed; the real-name identity certificate is provided with an association field representing the associated in-person identity certificate, and the association field is used to trace the in-person identity certificate submitted when the real-name identity certificate is applied for; storing the real-name identity certificate issued by the second provider; wherein the real-name identity certificate is digitally signed by the second provider using a second identity private key stored locally; initiating an authorization request for the identity certificate to a verifier in the blockchain; wherein the authorization request contains the in-person identity certificate and the real-name identity certificate of the user; so that the verifier verifies the in-person identity certificate and the real-name identity certificate. 6.The blockchain-based identity authentication method of claim 5, wherein the identity certificate issued by the provider of the blockchain is provided with a level field representing a type of the identity certificate; the field value of the level field includes a first field value representing the in-person identity certificate, a second field value representing the real-name identity certificate, and a third field value representing a common identity certificate. 7.The blockchain-based identity authentication method of claim 5, wherein the in-person identity certificate and the real-name identity certificate in the authorization request are encrypted by the user using a third identity public key of the verifier stored in the blockchain; the verification of the in-person identity certificate and the real-name identity certificate by the verifier includes: The verifier decrypts the encrypted real person identity and real name identity using a locally stored third identity private key to obtain plaintext real person identity and real name identity, queries the first identity public key stored by the first provider and the second identity public key stored by the second provider from the blockchain, verifies the digital signature of the real person identity based on the first identity public key, verifies the digital signature of the real name identity based on the second identity public key, and determines that the identity authentication for the user passes when the digital signatures of the real person identity and the real name identity both pass verification. 8.A blockchain-based identity authentication apparatus, applied to a verifier of identity proof in a blockchain of decentralized digital identity, wherein identity public keys associated with decentralized digital identities uploaded by respective blockchain members are stored in the blockchain. The blockchain members include a provider of identity proof, a user of identity proof, and a verifier of identity proof; and the device includes: A receiving module is configured to receive an authorization request for identity proof initiated by a user in a blockchain; wherein the authorization request includes real person identity and real name identity of the user; the real person identity is a digital signature identity proof of the user generated by a first provider in the blockchain after real person verification of the user passes, using a locally stored first identity private key; the real person verification includes collecting identity information of the user, and determining whether the corresponding user is the real person based on the identity information; the real name identity is a digital signature identity proof of the user generated by a second provider in the blockchain after verification of the real person identity passes, based on a decentralized digital identity of the user and the real person identity, using a locally stored second identity private key; the real name identity is provided with an association field representing the associated real person identity, which is used to trace the real person identity submitted when the real name identity is applied; A querying module is configured to query the first identity public key stored by the first provider and the second identity public key stored by the second provider from the blockchain; A verifying module is configured to verify the digital signature of the real person identity based on the first identity public key, and verify the digital signature of the real name identity based on the second identity public key; A determining module is configured to determine that the identity authentication for the user passes when the digital signatures of the real person identity and the real name identity both pass verification. 9.A blockchain-based identity authentication apparatus, applied to a user of an identity certificate in a blockchain of a decentralized digital identity, wherein identity public keys associated with the decentralized digital identity uploaded by respective blockchain members are stored in the blockchain. The blockchain members include a provider of identity proof, a user of identity proof, and a verifier of identity proof; and the device includes: A first applying module is configured to send a first request for applying real person identity to a first provider in a blockchain, the first request including a decentralized digital identity of the user; so that the first provider performs real person verification on the user, and generates real person identity based on the decentralized digital identity of the user and identity information of the user obtained during the real person verification process after the real person verification passes; the real person verification includes collecting identity information of the user, and determining whether the corresponding user is the real person based on the identity information; A second applying module is configured to send a second request for applying real name identity to a second provider in the blockchain, the second request including the real person identity and the identity information of the user; so that the second provider generates real name identity based on the real person identity and the identity information of the user after verification of the real person identity passes, using a locally stored second identity private key; the real name identity is provided with an association field representing the associated real person identity, which is used to trace the real person identity submitted when the real name identity is applied. A first storage module is configured to store the real person identity certificate issued by the first provider, wherein the real person identity certificate is digitally signed by the first provider using a locally stored first identity private key. A second application module is configured to send a second request for applying for a real-name identity certificate to a second provider in a blockchain, wherein the second request includes the decentralized digital identity of the user and the real person identity certificate; the second provider verifies the real person identity certificate, and generates a real-name identity certificate based on the decentralized digital identity of the user and the real person identity certificate after the verification is passed; the real-name identity certificate is provided with an association field indicating the associated real person identity certificate, and the association field is used to trace the real person identity certificate submitted when the real-name identity certificate is applied for. A second storage module is configured to store the real-name identity certificate issued by the second provider, wherein the real-name identity certificate is digitally signed by the second provider using a locally stored second identity private key. An authorization module is configured to send an authorization request for the identity certificate to a verification party in a blockchain, wherein the authorization request includes the real person identity certificate and the real-name identity certificate of the user; and the verification party verifies the real person identity certificate and the real-name identity certificate. 10.A computer readable storage medium, wherein the storage medium stores a computer program, and the computer program is executed by a processor to implement the method of any one of claims 1-4, or the method of any one of claims 5-7. 11.An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method of any one of claims 1-4, or the method of any one of claims 5-7 when executing the program.

Images