Authentication methods, devices, equipment and storage media

Abstract

This invention relates to the field of blockchain technology and discloses an identity verification method, apparatus, device, and storage medium. The method includes: acquiring a user's decentralized identity and facial data to be verified; searching for the user's facial data proof string based on the decentralized identity; verifying the facial data to be verified based on the facial data proof string; and obtaining the user's identity verification result. Since the user's facial data in this invention is the private key of the user's decentralized identity, the user can be directly identified through the user's facial data, thereby overcoming the problems of difficult-to-remember keys and lost keys, thus improving the reliability of identity verification and enhancing the user experience.

Description

Technical Field

[0001] This invention relates to the field of blockchain technology, and in particular to an authentication method, apparatus, device, and storage medium. Background Technology

[0002] Currently, the commonly used authentication method is the decentralized identity (DID) technology solution based on Identity Hub. In this method, users use their own DID's private key and the third-party application's DID's public key to generate a re-encryption key. They then authorize the third-party application's DID to access the application through Identity Hub, attaching the re-encryption key. Identity Hub uses the re-encryption key to re-encrypt the claim ciphertext and the key ciphertext. Identity Hub generates an endpoint for the authorized third-party DID to access the application. The private key is stored in the DID wallet, and verification is completed on the blockchain using the re-encryption key.

[0003] However, the above authentication methods suffer from drawbacks because the private key is a complex string of data, making it difficult to remember and easy to lose. Summary of the Invention

[0004] The main objective of this invention is to provide an authentication method, apparatus, device, and storage medium, which aims to solve the technical problems of existing authentication methods, where the private key is a complex string of data, making the key difficult to remember and easy to lose.

[0005] To achieve the above objectives, the present invention provides an authentication method, the authentication method comprising:

[0006] Obtain the user's decentralized identity and facial data to be verified;

[0007] The user's facial data verification string is retrieved based on the decentralized identity;

[0008] The facial data to be verified is verified based on the facial data proof string to obtain the user's identity verification result.

[0009] Optionally, the step of searching for the user's facial data proof string based on the decentralized identity includes:

[0010] Based on the decentralized identity, search for the corresponding decentralized identity document on the blockchain;

[0011] Obtain the storage path of the facial data proof string from the decentralized identity document;

[0012] The user's facial data verification string is retrieved on the blockchain according to the storage path.

[0013] Optionally, the authentication method further includes:

[0014] After collecting the user's facial data, a decentralized identity for the user is generated based on the facial data.

[0015] Key points are selected from the entered facial data, and a facial data verification string is generated based on the key points;

[0016] The facial data proof string is stored in the blockchain, and the storage path of the facial data proof string is written into the decentralized identity document;

[0017] Establish a mapping relationship between the decentralized identity and the decentralized identity document, and store the decentralized identity document corresponding to the decentralized identity in the blockchain.

[0018] Optionally, the step of selecting key points from the entered facial data and generating a facial data verification string based on the key points includes:

[0019] Key points are selected from the input facial data, and a preset number of key points are selected from the key points as data leaves;

[0020] A Merkle tree is generated based on the data leaves, and the Merkle tree is encrypted using the user's private key to obtain a face data proof string.

[0021] Optionally, the decentralized identity document points to a decentralized identity access path, which is used to locate the storage location of the decentralized identity.

[0022] Optionally, the data format of the decentralized identity access path includes the blockchain layer to which the face data belongs, the face data content identifier, the system random number, and the face data storage path. The face data content identifier is an identifier obtained by hashing the entered face data. The data format of the decentralized identity includes the blockchain layer to which the face data belongs, the face data content identifier, and the system random number.

[0023] Optionally, the authentication method further includes:

[0024] A random number is generated based on the height of the blockchain, and facial data on the block corresponding to the random number is randomly checked.

[0025] The facial data is decrypted and verified to obtain a random verification result.

[0026] In addition, to achieve the above objectives, the present invention also proposes an identity verification device, which includes: an acquisition module, a search module, and a verification module;

[0027] The acquisition module is used to acquire the user's decentralized identity and the face data to be verified;

[0028] The search module is used to search for the user's facial data proof string based on the decentralized identity;

[0029] The verification module is used to verify the face data to be verified based on the face data proof string, and obtain the user's identity verification result.

[0030] In addition, to achieve the above objectives, the present invention also proposes an authentication device, which includes a memory, a processor, and an authentication program stored in the memory and executable on the processor, the authentication program being configured to implement the authentication method as described above.

[0031] In addition, to achieve the above objectives, the present invention also proposes a storage medium storing an authentication program, which, when executed by a processor, implements the authentication method as described above.

[0032] This invention discloses a method for obtaining a user's decentralized identity and facial data to be verified, finding the user's facial data proof string based on the decentralized identity, and verifying the facial data to be verified based on the facial data proof string to obtain the user's identity verification result. Since the user's facial data in this invention is the private key of the user's decentralized identity, the user can be directly identified through the user's facial data, thereby overcoming the problems of key difficulty in remembering and key loss, thus improving the reliability of identity verification and enhancing the user experience. Attached Figure Description

[0033] Figure 1 This is a schematic diagram of the structure of the authentication device in the hardware operating environment involved in the embodiments of the present invention;

[0034] Figure 2 This is a flowchart illustrating the first embodiment of the authentication method of the present invention;

[0035] Figure 3 This is an interactive schematic diagram of an embodiment of the authentication method of the present invention;

[0036] Figure 4 This is a flowchart illustrating the second embodiment of the authentication method of the present invention;

[0037] Figure 5This is a schematic diagram of the data format of an embodiment of the authentication method of the present invention;

[0038] Figure 6 This is a schematic diagram illustrating the user's identity across various platforms, as an embodiment of the authentication method of the present invention.

[0039] Figure 7 This is a flowchart illustrating the third embodiment of the authentication method of the present invention;

[0040] Figure 8 This is a structural block diagram of the first embodiment of the authentication device of the present invention.

[0041] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0042] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0043] Reference Figure 1 , Figure 1 This is a schematic diagram of the authentication device structure of the hardware operating environment involved in the embodiments of the present invention.

[0044] like Figure 1 As shown, the authentication device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen, and optionally, it may also include a standard wired interface or a wireless interface. In this invention, the wired interface of the user interface 1003 may be a USB interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wireless-Fidelity (Wi-Fi) interface). The memory 1005 may be high-speed random access memory (RAM) or non-volatile memory (NVM), such as a disk storage device. The memory 1005 may also optionally be a storage device independent of the aforementioned processor 1001.

[0045] Those skilled in the art will understand that Figure 1 The structure shown does not constitute a limitation on the authentication device and may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0046] like Figure 1 As shown, the memory 1005, which is identified as a computer storage medium, may include an operating system, a network communication module, a user interface module, and an authentication program.

[0047] exist Figure 1 In the authentication device shown, the network interface 1004 is mainly used to connect to the backend server and communicate data with the backend server; the user interface 1003 is mainly used to connect to the user device; the authentication device calls the authentication program stored in the memory 1005 through the processor 1001 and executes the authentication method provided in this embodiment of the invention.

[0048] Based on the above hardware structure, an embodiment of the authentication method of the present invention is proposed.

[0049] Reference Figure 2 , Figure 2 This is a flowchart illustrating the first embodiment of the authentication method of the present invention, which presents the first embodiment of the authentication method of the present invention.

[0050] It should be understood that the commonly used authentication method is the Decentralized Identity (DID) technology solution based on Identity Hub. That is, the user uses his own DID's private key and the third-party application's DID's public key to generate a re-encryption key, authorizes the third-party application DID to access it to Identity Hub, and attaches the re-encryption key. Identity Hub uses the re-encryption key to re-encrypt the claim ciphertext and the key ciphertext. Identity Hub generates an endpoint for the authorized third-party DID to access. The private key is stored in the DID wallet, and the verification is completed in the blockchain using the re-encryption key.

[0051] The DID technology solution based on Identity Hub primarily consists of a three-layer structure: Layer 1: Blockchain Layer, Layer 2: Decentralized Layer 2 Network, and Layer 3: Trusted Exchange Layer. The blockchain layer is the infrastructure of the entire solution. Distributed storage stores DID documents, the most crucial element of which is the mapping between DIDs and public keys. This mapping is anchored on the blockchain. Layer 2 is the node layer. The node layer packages DID-related operations from the upper layers and creates an L1 on-chain transaction, embedding the hash of the operation batch within the transaction. This improves the system's processing performance. Layer 3 is the trusted exchange layer, where various ecosystem participants in the DID system establish secure identity authentication and data exchange.

[0052] Within the DID ecosystem, a service is needed to store and manage user data; this is Identity Hub. The implementation of Identity Hub meets several requirements: 1. User control: Identity Hub can be deployed anywhere by the user, including their own mobile phone, PC, etc. 2. User data is stored encrypted. 3. Identity Hub does not store any private keys. 4. Access to user data requires authentication. 5. Third-party access to user data is permitted only after user authorization.

[0053] However, the above authentication methods still suffer from drawbacks because the private key is a complex string of data, and even after processing with a mnemonic phrase, it is still difficult to remember and the key is easy to lose.

[0054] To overcome the aforementioned shortcomings, in this embodiment, the user's facial data is the private key of the user's decentralized identity. Therefore, the user can be directly identified through the user's facial data, thereby overcoming the problems of hard-to-remember keys and key loss, thus improving the reliability of identity verification and enhancing the user experience.

[0055] In the first embodiment, the authentication method includes:

[0056] Step S10: Obtain the user's decentralized identity and the face data to be verified.

[0057] It is understood that the execution subject of this embodiment may be an identity verification device with data processing, network communication and program running functions, such as a decentralized identity management device, or other electronic devices that can achieve the same or similar functions. This embodiment does not limit this.

[0058] It's important to note that decentralized identity (DID), compared to traditional identity systems based on Public Key Infrastructure (PKI), offers several advantages over traditional DID systems. A blockchain-based distributed digital identity system guarantees data authenticity and trustworthiness, protects user privacy and security, and boasts strong portability. 1) Decentralization: Based on blockchain, it avoids identity data being controlled by a single centralized authority. 2) Autonomous and Controllable Identity: Based on Distributed Public Key Infrastructure (DPKI), each user's identity is not controlled by a trusted third party but by its owner, allowing individuals to manage their own identities autonomously. 3) Trusted Data Exchange: Identity-related data is anchored on the blockchain, and the authentication process does not rely on the application providing the identity.

[0059] It should be understood that obtaining a user's facial data to be verified can be achieved through facial recognition technology. Facial recognition technology can include modeling facial feature points; this modeling process is the process of constructing a facial model. Facial landmark detection, also known as facial landmark detection, localization, or face alignment, refers to locating the key regions of a given facial image, including eyebrows, eyes, nose, mouth, and facial contours. These landmarks reflect the facial features of each part. The process of constructing facial landmarks involves selecting a reference image and using it as a reference to transform (scale scaling / rotation) the images in the training set relative to this reference image, resulting in a processed training set. Based on the location of the facial landmarks in the training set, feature extraction is performed on each point. A local image region is extracted centered on this landmark. Then, feature extraction is performed on this local image region (features can include color, texture, etc.). Thus, the neighborhood information of this point can be used to represent it.

[0060] In this embodiment, 68 facial key points are used for annotation. Specifically, the facial key points are divided into internal key points and outline key points. The internal key points include 51 key points including eyebrows, eyes, nose, and mouth, and the outline key points include 17 key points.

[0061] Step S20: Find the user's facial data proof string based on the decentralized identity.

[0062] Understandably, the facial data verification string can be pre-generated based on the user's entered facial data, and it can be stored in the blockchain. Therefore, finding a user's facial data verification string based on a decentralized identity can be equivalent to finding the user's facial data verification string on the blockchain based on the decentralized identity.

[0063] Step S30: Verify the face data to be verified based on the face data proof string to obtain the user's identity verification result.

[0064] For ease of understanding, please refer to Figure 3 This explanation does not limit the scope of this solution. Figure 3This is an interactive schematic diagram of an embodiment of the identity verification method of the present invention. In the diagram, the decentralized identity management device includes at least one of the following: Issuer, DID wallet, DID Resolver, random verification module, and face data processing module; Verifier is a third-party application that can use DID; and the decentralized storage system includes a blockchain for storing decentralized identity (DID), decentralized identity document (DID Document), and face data proof string, etc.

[0065] The issuing party provides services primarily by issuing declarations, with the following specific functions: 1. Reviewing user declaration requests and issuing declarations to eligible users; 2. Providing a revocation list of revoked declarations. The DID wallet stores user DIDs. The DID parser provides DID parsing services, enabling querying the corresponding DID Document based on the DID, and also provides CRUD functions (Create, Read, Update, and Delete). In this embodiment, the DID parser specifically performs the following: 1. Accessing the decentralized storage system and verifying the data on the blockchain within the decentralized storage system; 2. Establishing a mapping relationship between DIDs and DID Documents, and reading DID Documents from the blockchain; 3. Verifying the face data to be verified using the face data proof string on the blockchain, and returning the verification result to the verifier. The random verification module performs random verification of the face data content. The face data processing module processes the entered face data.

[0066] The specific process of this embodiment is as follows: When a user needs to verify their identity, the user can obtain their DID from the DID wallet and input it. After receiving the DID input by the user, the third-party application authorized by the user collects the user's face data to be verified and transmits the DID and the face data to be verified to the verifier. The verifier calls the verification interface of the DID parser. When the DID parser is called by the verifier, it searches for the user's face data verification string on the blockchain based on the DID, verifies the face data to be verified according to the face data verification string, obtains the verification result, and returns the verification result to the verifier.

[0067] Furthermore, to improve the reliability of facial data, in this embodiment, the content of the facial data can also be randomly verified. The identity verification method further includes: generating a random number based on the height of the blockchain and randomly checking the facial data on the block corresponding to the random number; decrypting and verifying the facial data to obtain a random verification result.

[0068] In a practical implementation, for example, a random number is generated every second based on the height of the blockchain, and the content of facial data on the block at the height of that random number is checked to decrypt and verify the facial key point data.

[0069] In the first embodiment, the following steps are disclosed: obtaining the user's decentralized identity and the face data to be verified; finding the user's face data proof string based on the decentralized identity; verifying the face data to be verified based on the face data proof string; and obtaining the user's identity verification result. Since the user's face data in this embodiment is the user's decentralized identity private key, the user can be directly identified through the user's face data, thereby overcoming the problems of hard-to-remember keys and lost keys, thus improving the reliability of identity verification and enhancing the user experience.

[0070] Reference Figure 4 , Figure 4 This is a flowchart illustrating the second embodiment of the authentication method of the present invention, based on the above. Figure 2 The first embodiment shown is followed by a second embodiment of the authentication method of the present invention.

[0071] In the second embodiment, step S20 includes:

[0072] Step S201: Search for the corresponding decentralized identity document on the blockchain based on the decentralized identity.

[0073] It should be understood that, in order to improve the efficiency of finding the facial data proof string, in this embodiment, the decentralized identity corresponding to the decentralized identity can be found on the blockchain first, then the storage path of the facial data proof string can be obtained from the decentralized identity document, and then the user's facial data proof string can be found on the blockchain according to the storage path.

[0074] To further improve the efficiency of finding facial data proof strings, in this embodiment, the decentralized identity document points to a decentralized identity access path, and the decentralized identity access path is used to locate the storage location of the decentralized identity.

[0075] Furthermore, the data format of the decentralized identity access path includes the blockchain layer to which the face data belongs, the face data content identifier, the system random number, and the face data storage path. The face data content identifier is an identifier obtained by hashing the entered face data. The data format of the decentralized identity includes the blockchain layer to which the face data belongs, the face data content identifier, and the system random number.

[0076] It should be understood that this addresses the issue of inconsistent usernames and passwords across different application platforms (websites). This embodiment defines a DID data standard, allowing users to authenticate themselves across all applications with only one unified DID.

[0077] For ease of understanding, the following references Figure 5 This explanation does not limit the scope of this solution. Figure 5 This diagram illustrates the data format of an embodiment of the identity verification method of the present invention. In the diagram, the decentralized identity verification system (i.e., the identity verification system in this solution) is the foundation of digital identity. Its core is a DID created based on the decentralized and immutable characteristics of blockchain. Then, multiple parties access the distributed trust network through access tools, establishing secure communication between different identity identifiers based on the blockchain, thus creating a prerequisite for the transfer of verifiable claims (facial data, which can be considered a type of digital certificate).

[0078] 1. Data standard design for decentralized identity verification systems (DID):

[0079] To address the issue of inconsistent usernames and passwords across different application platforms (websites), a decentralized identity data structure based on facial data is defined, enabling users to complete identity verification across all applications with only a single unified DID.

[0080] 2. By collecting users' facial data, 3D facial data is constructed and defined as a DIDSubject. This 3D facial data is a descriptive statement of a user's identity, attached with a digital signature to prove the user's authenticity; it can be considered a digital certificate. Decentralized Identity (DID) is the unique identifier of the DID Subject, specifically in the format "did:face-blockchain-level:{Face Data CID}:{System Random Number}", where the Face Data CID is the content identifier (CID) of the user's facial data, a 256-bit identifier obtained by processing the user's facial data using the SHA256 algorithm. The DID URL is the Uniform Resource Locator (URL) for locating the DID within the network. The specific data format of the DID URL (access path) for facial data is "did:face-blockchain-level:{Face Data CID}{System Random Number}:{Face Data Storage Path}". The DID Document for facial data contains all information related to the DID subject. It includes identity verification methods (including encrypted public keys, relevant addresses, etc.). The DID Document is a general data structure, typically managed by the DID controller for writing and modifying facial data. It contains key information and verification methods related to DID verification, providing a set of mechanisms that allow the DID controller to prove their control over the corresponding DID. The identity verification database is a distributed database (shared ledger) that stores the facial data DID, the DID Document, and the storage path of the facial data on the blockchain. Access to facial data requires the use of the DID Document.

[0081] The decentralized identity verification (DID) system for facial recognition data addresses the problem of user information being repeatedly collected and stored across different platforms under a centralized management model. In a centralized management model, a user's identity exists on various platforms, such as... Figure 6 As shown, Figure 6 This is a schematic diagram of a user's identity on various platforms, illustrating an embodiment of the authentication method of the present invention.

[0082] This embodiment addresses the problem of inconsistent usernames and passwords across different application platforms (websites) and the privacy exposure caused by the collection of user identity information by different platforms. It defines a decentralized identity data structure based on facial data and writes the user's identity (facial data) into a unified identity verification database. This database stores facial data DIDs, facial data DID Documents, and a distributed database (shared ledger) of facial data. This allows users to complete identity verification across all applications with only a single unified DID.

[0083] Step S202: Obtain the storage path of the face data proof string from the decentralized identity document.

[0084] It is understandable that the storage path of the facial data proof string in the decentralized identity document can be pre-generated based on the user's entered facial data, and this embodiment does not impose any restrictions on this.

[0085] Step S203: Search for the user's facial data proof string on the blockchain according to the storage path.

[0086] For ease of understanding, please refer to Figure 3 This explanation does not limit the scope of this solution. Figure 3 This is an interactive diagram illustrating an embodiment of the identity verification method of the present invention. The specific process of this embodiment is as follows: When a user needs to verify their identity, the user can obtain their DID from their DID wallet and input it. A third-party application authorized by the user receives the DID input by the user, collects the user's face data to be verified, and transmits the DID and face data to the verifier. The verifier calls the verification interface of the DID parser. When the DID parser is called by the verifier, it searches for the DID Document on the blockchain based on the DID, obtains the storage path of the face data verification string from the DID Document, searches for the user's face data verification string on the blockchain according to the storage path, verifies the face data to be verified according to the face data verification string, obtains the verification result, and returns the verification result to the verifier.

[0087] In this embodiment, the decentralized identity corresponding to the decentralized identity is first searched on the blockchain, then the storage path of the face data proof string is obtained from the decentralized identity document, and then the user's face data proof string is searched on the blockchain according to the storage path, thereby improving the search efficiency of the face data proof string.

[0088] Reference Figure 7 , Figure 7This is a flowchart illustrating the third embodiment of the authentication method of the present invention. Based on the second embodiment described above, a third embodiment of the authentication method of the present invention is proposed.

[0089] In the third embodiment, before step S10, the method further includes:

[0090] Step S01: After collecting the user's facial data, generate the user's decentralized identity based on the facial data.

[0091] It should be understood that, in order to facilitate subsequent identity verification, in this embodiment, the user's facial data can be collected in advance, and a decentralized identity and facial data proof string can be generated based on the facial data. The decentralized identity and facial data proof string can then be stored in the blockchain.

[0092] Step S02: Select key points from the entered face data and generate a face data proof string based on the key points.

[0093] It is understood that key points can be selected from the input face data based on a preset key point model. The preset key point extraction model is used to extract key points from the image data and can be set in advance. This embodiment does not limit this.

[0094] Furthermore, to improve the security of the face data proof string, step S02 includes: selecting key points from the input face data, and selecting a preset number of key points as data leaves from the key points; generating a Merkle tree based on the data leaves, and encrypting the Merkle tree using the user's private key to obtain the face data proof string.

[0095] It should be noted that the preset quantity can be set in advance; for example, the preset quantity can be 68.

[0096] In a specific implementation, for example, 68 key points are selected from the input facial data. Each of the 68 key points is used as a data leaf to generate a Merkle tree. The Merkle tree is then encrypted using the user's private key to obtain a facial data verification string.

[0097] Step S03: Store the face data proof string in the blockchain and write the storage path of the face data proof string into the decentralized identity document.

[0098] Step S04: Establish a mapping relationship between the decentralized identity and the decentralized identity document, and store the decentralized identity document corresponding to the decentralized identity in the blockchain.

[0099] For ease of understanding, please refer to Figure 3 This explanation does not limit the scope of this solution. Figure 3 This is an interactive schematic diagram of an embodiment of the identity verification method of the present invention. In the diagram, the specific workflow of this embodiment is as follows: After the Issuer collects the user's input facial data, it generates the user's decentralized identity (DID) based on the input facial data and stores it in the DID wallet. The input facial data is then transmitted to the facial data processing module. The facial data processing module extracts 68 key points from the input facial data, treats each of the 68 key points as a data leaf, generates a Merkle tree, encrypts the Merkle tree using the user's private key, obtains the facial data proof string, and stores the facial data proof string in the blockchain. The storage path of the facial data proof string is written into the decentralized identity document (DID Document). The DID Resolver establishes the mapping relationship between the DID and the DID Document and stores the DID corresponding to the DID in the blockchain. When user authentication is required, the user can obtain their DID from their DID wallet and input it. After receiving the DID input by the user, the authorized third-party application collects the user's facial data to be verified and transmits the DID and facial data to the verifier. The verifier calls the verification interface of the DID resolver. When the DID resolver is called by the verifier, it searches for the DID Document on the blockchain based on the DID, obtains the storage path of the facial data verification string from the DID Document, searches for the user's facial data verification string on the blockchain according to the storage path, verifies the facial data to be verified according to the facial data verification string, obtains the verification result, and returns the verification result to the verifier.

[0100] In this embodiment, the user's facial data is collected in advance, and a decentralized identity and facial data verification string are generated based on the collected facial data. The decentralized identity and facial data verification string are stored in the blockchain, which facilitates subsequent identity verification.

[0101] In addition, refer to Figure 8 The present invention also proposes an identity verification device.

[0102] It should be understood that the commonly used authentication method is the Decentralized Identity (DID) technology solution based on Identity Hub. That is, the user uses his own DID's private key and the third-party application's DID's public key to generate a re-encryption key, authorizes the third-party application DID to access it to Identity Hub, and attaches the re-encryption key. Identity Hub uses the re-encryption key to re-encrypt the claim ciphertext and the key ciphertext. Identity Hub generates an endpoint for the authorized third-party DID to access. The private key is stored in the DID wallet, and the verification is completed in the blockchain using the re-encryption key.

[0103] The DID technology solution based on Identity Hub primarily consists of a three-layer structure: Layer 1: Blockchain Layer, Layer 2: Decentralized Layer 2 Network, and Layer 3: Trusted Exchange Layer. The blockchain layer is the infrastructure of the entire solution. Distributed storage stores DID documents, the most crucial element of which is the mapping between DIDs and public keys. This mapping is anchored on the blockchain. Layer 2 is the node layer. The node layer packages DID-related operations from the upper layers and creates an L1 on-chain transaction, embedding the hash of the operation batch within the transaction. This improves the system's processing performance. Layer 3 is the trusted exchange layer, where various ecosystem participants in the DID system establish secure identity authentication and data exchange.

[0104] Within the DID ecosystem, a service is needed to store and manage user data; this is Identity Hub. The implementation of Identity Hub meets several requirements: 1. User control: Identity Hub can be deployed anywhere by the user, including their own mobile phone, PC, etc. 2. User data is stored encrypted. 3. Identity Hub does not store any private keys. 4. Access to user data requires authentication. 5. Third-party access to user data is permitted only after user authorization.

[0105] However, the above authentication methods still suffer from drawbacks because the private key is a complex string of data, and even after processing with a mnemonic phrase, it is still difficult to remember and the key is easy to lose.

[0106] To overcome the aforementioned shortcomings, in this embodiment, the user's facial data is the private key of the user's decentralized identity. Therefore, the user can be directly identified through the user's facial data, thereby overcoming the problems of hard-to-remember keys and key loss, thus improving the reliability of identity verification and enhancing the user experience.

[0107] In this embodiment, the authentication device includes: an acquisition module 10, a search module 20, and an authentication module 30;

[0108] The acquisition module 10 is used to acquire the user's decentralized identity and the face data to be verified.

[0109] It's important to note that decentralized identity (DID), compared to traditional identity systems based on Public Key Infrastructure (PKI), offers several advantages over traditional DID systems. A blockchain-based distributed digital identity system guarantees data authenticity and trustworthiness, protects user privacy and security, and boasts strong portability. 1) Decentralization: Based on blockchain, it avoids identity data being controlled by a single centralized authority. 2) Autonomous and Controllable Identity: Based on Distributed Public Key Infrastructure (DPKI), each user's identity is not controlled by a trusted third party but by its owner, allowing individuals to manage their own identities autonomously. 3) Trusted Data Exchange: Identity-related data is anchored on the blockchain, and the authentication process does not rely on the application providing the identity.

[0110] It should be understood that obtaining a user's facial data to be verified can be achieved through facial recognition technology. Facial recognition technology can include modeling facial feature points; this modeling process is the process of constructing a facial model. Facial landmark detection, also known as facial landmark detection, localization, or face alignment, refers to locating the key regions of a given facial image, including eyebrows, eyes, nose, mouth, and facial contours. These landmarks reflect the facial features of each part. The process of constructing facial landmarks involves selecting a reference image and using it as a reference to transform (scale scaling / rotation) the images in the training set relative to this reference image, resulting in a processed training set. Based on the location of the facial landmarks in the training set, feature extraction is performed on each point. A local image region is extracted centered on this landmark. Then, feature extraction is performed on this local image region (features can include color, texture, etc.). Thus, the neighborhood information of this point can be used to represent it.

[0111] In this embodiment, 68 facial key points are used for annotation. Specifically, the facial key points are divided into internal key points and outline key points. The internal key points include 51 key points including eyebrows, eyes, nose, and mouth, and the outline key points include 17 key points.

[0112] The search module 20 is used to search for the user's facial data proof string based on the decentralized identity.

[0113] Understandably, the facial data verification string can be pre-generated based on the user's entered facial data, and it can be stored in the blockchain. Therefore, finding a user's facial data verification string based on a decentralized identity can be equivalent to finding the user's facial data verification string on the blockchain based on the decentralized identity.

[0114] The verification module 30 is used to verify the face data to be verified based on the face data proof string, and obtain the user's identity verification result.

[0115] For ease of understanding, please refer to Figure 3 This explanation does not limit the scope of this solution. Figure 3 This is an interactive schematic diagram of an embodiment of the identity verification method of the present invention. In the diagram, the decentralized identity management device includes at least one of the following: Issuer, DID wallet, DID Resolver, random verification module, and face data processing module; Verifier is a third-party application that can use DID; and the decentralized storage system includes a blockchain for storing decentralized identity (DID), decentralized identity document (DID Document), and face data proof string, etc.

[0116] The issuing party provides services primarily by issuing declarations, with the following specific functions: 1. Reviewing user declaration requests and issuing declarations to eligible users; 2. Providing a revocation list of revoked declarations. The DID wallet stores user DIDs. The DID parser provides DID parsing services, enabling querying the corresponding DID Document based on the DID, and also provides CRUD functions (Create, Read, Update, and Delete). In this embodiment, the DID parser specifically performs the following: 1. Accessing the decentralized storage system and verifying the data on the blockchain within the decentralized storage system; 2. Establishing a mapping relationship between DIDs and DID Documents, and reading DID Documents from the blockchain; 3. Verifying the face data to be verified using the face data proof string on the blockchain, and returning the verification result to the verifier. The random verification module performs random verification of the face data content. The face data processing module processes the entered face data.

[0117] The specific process of this embodiment is as follows: When a user needs to verify their identity, the user can obtain their DID from the DID wallet. After receiving the DID input by the user, the third-party application authorized by the user collects the user's face data to be verified and transmits the DID and the face data to be verified to the verifier. The verifier calls the verification interface of the DID parser. When the DID parser is called by the verifier, it searches for the user's face data verification string on the blockchain based on the DID, verifies the face data to be verified according to the face data verification string, obtains the verification result, and returns the verification result to the verifier.

[0118] In this embodiment, the following steps are disclosed: obtaining the user's decentralized identity and the face data to be verified; finding the user's face data proof string based on the decentralized identity; verifying the face data to be verified based on the face data proof string; and obtaining the user's identity verification result. Since the user's face data in this embodiment is the user's decentralized identity private key, the user can be directly identified through the user's face data, thereby overcoming the problems of hard-to-remember keys and lost keys, thus improving the reliability of identity verification and enhancing the user experience.

[0119] In one embodiment, the search module 20 is further configured to: search for a corresponding decentralized identity document on the blockchain based on the decentralized identity; obtain the storage path of the face data proof string from the decentralized identity document; and search for the user's face data proof string on the blockchain based on the storage path.

[0120] In one embodiment, the authentication device further includes: an input module;

[0121] The input module is used to generate a decentralized identity for the user based on the input facial data after collecting the user's input facial data; select key points from the input facial data and generate a facial data verification string based on the key points; store the facial data verification string in the blockchain and write the storage path of the facial data verification string into the decentralized identity document; establish a mapping relationship between the decentralized identity and the decentralized identity document, and store the decentralized identity document corresponding to the decentralized identity in the blockchain.

[0122] In one embodiment, the input module is further configured to select key points from the input face data, and select a preset number of key points as data leaves; generate a Merkle tree based on the data leaves, and encrypt the Merkle tree using the user's private key to obtain a face data proof string.

[0123] In one embodiment, the decentralized identity document points to a decentralized identity access path, which is used to locate the storage location of the decentralized identity.

[0124] In one embodiment, the data format of the decentralized identity access path includes the blockchain layer to which the face data belongs, the face data content identifier, the system random number, and the face data storage path. The face data content identifier is an identifier obtained by hashing the entered face data. The data format of the decentralized identity includes the blockchain layer to which the face data belongs, the face data content identifier, and the system random number.

[0125] In one embodiment, the authentication device further includes: a verification module;

[0126] The verification module is used to generate a random number based on the height of the blockchain and randomly check the face data on the block corresponding to the random number; decrypt and verify the face data to obtain a random verification result.

[0127] Other embodiments or specific implementations of the authentication device described in this invention can be found in the above-described method embodiments, and will not be repeated here.

[0128] Furthermore, this embodiment of the invention also proposes a storage medium storing an authentication program, which, when executed by a processor, implements the authentication method described above.

[0129] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0130] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0131] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as a read-only memory image (ROM) / random access memory (RAM), magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0132] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. An authentication method, characterized in that, The authentication method includes: Obtain the user's decentralized identity and facial data to be verified; The user's facial data verification string is retrieved based on the decentralized identity; The facial data to be verified is verified based on the facial data proof string to obtain the user's identity verification result; The step of finding the user's facial data proof string based on the decentralized identity includes: Based on the decentralized identity, search for the corresponding decentralized identity document on the blockchain; obtain the storage path of the facial data proof string from the decentralized identity document; and search for the user's facial data proof string on the blockchain based on the storage path. The decentralized identity document points to a decentralized identity access path, which is used to locate the storage location of the decentralized identity. The data format of the decentralized identity access path includes the blockchain level to which the face data belongs, the face data content identifier, the system random number, and the face data storage path. The face data content identifier is an identifier obtained by hashing the entered face data. The data format of the decentralized identity includes the blockchain level to which the face data belongs, the face data content identifier, and the system random number. The authentication method further includes: A random number is generated based on the height of the blockchain, and facial data on the block corresponding to the random number is randomly sampled; the facial data is verified to obtain a random verification result.

2. The authentication method as described in claim 1, characterized in that, The authentication method further includes: After collecting the user's facial data, a decentralized identity for the user is generated based on the facial data. Key points are selected from the entered facial data, and a facial data verification string is generated based on the key points; The facial data proof string is stored in the blockchain, and the storage path of the facial data proof string is written into the decentralized identity document; Establish a mapping relationship between the decentralized identity and the decentralized identity document, and store the decentralized identity document corresponding to the decentralized identity in the blockchain.

3. The authentication method as described in claim 2, characterized in that, The step of selecting key points from the input facial data and generating a facial data verification string based on the key points includes: Key points are selected from the input facial data, and a preset number of key points are selected from the key points as data leaves; A Merkle tree is generated based on the data leaves, and the Merkle tree is encrypted using the user's private key to obtain a face data proof string.

4. An identity verification device, characterized in that, The identity verification device includes: an acquisition module, a search module, and a verification module; The acquisition module is used to acquire the user's decentralized identity and the face data to be verified; The search module is used to search for the user's facial data proof string based on the decentralized identity; The verification module is used to verify the face data to be verified based on the face data proof string, and obtain the user's identity verification result; The search module is further configured to: search for the corresponding decentralized identity document on the blockchain based on the decentralized identity; obtain the storage path of the face data proof string from the decentralized identity document; and search for the user's face data proof string on the blockchain based on the storage path. The decentralized identity document points to a decentralized identity access path, which is used to locate the storage location of the decentralized identity. The data format of the decentralized identity access path includes the blockchain level to which the face data belongs, the face data content identifier, the system random number, and the face data storage path. The face data content identifier is an identifier obtained by hashing the entered face data. The data format of the decentralized identity includes the blockchain level to which the face data belongs, the face data content identifier, and the system random number. The authentication device further includes: a verification module; The verification module is used to generate a random number based on the height of the blockchain and randomly check the face data on the block corresponding to the random number; verify the face data and obtain a random verification result.

5. An authentication device, characterized in that, The authentication device includes: a memory, a processor, and an authentication program stored in the memory and executable on the processor, wherein the authentication program, when executed by the processor, implements the authentication method as described in any one of claims 1 to 3.

6. A storage medium, characterized in that, The storage medium stores an authentication program, which, when executed by a processor, implements the authentication method as described in any one of claims 1 to 3.

Images