Blockchain authentication method and device, blockchain authentication system and computer equipment

Abstract

The application relates to a consortium chain authentication method and device, computer equipment, a computer readable storage medium and a computer program product, which can be applied to various scenes such as cloud technology, artificial intelligence, intelligent transportation and auxiliary driving. The method comprises the following steps: obtaining an initiator identifier request sent by an initiator public key in an initiator public-private key pair after a business initiator creates the initiator public-private key pair; determining an initiator identifier that matches the initiator identifier request and conforms to a decentralized identity protocol; receiving a second authorization transaction voucher extracted and sent by a business response node from a business request, matching second signature information in the second authorization transaction voucher with the initiator public key to obtain a signature verification result of the second authorization transaction voucher; and feeding back the signature verification result to the business response node; and the initiator identifier is used to generate a first authorization transaction voucher for enabling the business initiator to initiate a business request to a business response node on a consortium chain. The above method can improve security.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a consortium blockchain authentication method, apparatus, system, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] A consortium blockchain is a blockchain composed of multiple private blockchains and jointly managed by multiple institutions. The institution that performs the shared distributed ledger on the consortium blockchain is called the authoritative institution. In practical business scenarios using consortium blockchains, authentication is required before responding to business requests to ensure the legitimacy of the transaction and the immutability of the data.

[0003] Traditional consortium blockchain authentication methods implement authentication services within a centralized account system owned by authoritative nodes in the consortium blockchain. Essentially, this is a centralized account authentication model, which has the disadvantage of poor security. Summary of the Invention

[0004] Therefore, it is necessary to provide a consortium blockchain authentication method, apparatus, computer equipment, consortium blockchain authentication system, computer-readable storage medium, and computer program product that can improve security in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a consortium blockchain authentication method. The method includes:

[0006] Obtain the initiator identification request sent by the initiator using the initiator's public key in the initiator's public key pair after the initiator creates the initiator's public-private key pair;

[0007] A source identifier is determined that matches the source identifier request and conforms to the decentralized identity protocol; the source identifier is used to generate a first authorized transaction credential; the first authorized transaction credential carries the source identifier, business parameters, and a first signature information corresponding to the source private key in the source public-private key pair; the first authorized transaction credential is used to enable the business initiator to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain;

[0008] The system receives the second authorized transaction credential extracted and sent by the business response node from the business request, matches the second signature information in the second authorized transaction credential with the initiator's public key, and obtains the signature verification result of the second authorized transaction credential.

[0009] The signature verification result is fed back to the business response node.

[0010] Secondly, this application provides a consortium blockchain authentication method. The method includes:

[0011] Create an initiator public-private key pair, and use the initiator public key in the initiator public-private key pair to send an initiator identifier request to the identity service node on the consortium blockchain; the initiator identifier request is used to instruct the identity service node to determine an initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol.

[0012] Determine the first signature information corresponding to the initiator's private key in the initiator's public-private key pair; the first signature information is used to generate a first authorized transaction certificate; the first authorized transaction certificate carries the initiator's identifier, business parameters, and the first signature information;

[0013] The first authorized transaction credential is used to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain; the business request is used to instruct the business response node to perform business processing corresponding to the business request if the second signature information in the second authorized transaction credential matches the initiator's public key; the second authorized transaction credential is extracted by the business response node from the business request.

[0014] Thirdly, this application provides a consortium blockchain authentication system. The system includes an identity service node and a business response node;

[0015] The identity service node obtains the initiator's public-private key pair after the business initiator creates it, and uses the initiator's public key in the initiator's public-private key pair to send an initiator identifier request, and determines the initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol; the initiator identifier is used to generate a first authorized transaction credential; the first authorized transaction credential carries the initiator identifier, business parameters, and a first signature information corresponding to the initiator's private key in the initiator's public-private key pair;

[0016] The service response node receives a service request initiated by the service initiator based on the first authorized transaction credential, and extracts a second authorized transaction credential from the service request; the service request corresponds to the service parameters.

[0017] The identity service node receives the second authorized transaction credential sent by the business response node, matches the second signature information in the second authorized transaction credential with the initiator's public key to obtain the verification result of the second authorized transaction credential, and feeds back the verification result to the business response node.

[0018] Fourthly, this application provides a consortium blockchain authentication device. The device includes:

[0019] The identifier request acquisition module is used to acquire the initiator identifier request sent by the business initiator after creating the initiator public-private key pair using the initiator public key in the initiator public-private key pair;

[0020] The identifier determination module is used to determine an initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol; the initiator identifier is used to generate a first authorized transaction credential; the first authorized transaction credential carries the initiator identifier, business parameters, and a first signature information corresponding to the initiator's private key in the initiator's public-private key pair; the first authorized transaction credential is used to enable the business initiator to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain;

[0021] The signature verification module is used to receive the second authorized transaction credential extracted and sent by the business response node from the business request, match the second signature information in the second authorized transaction credential with the initiator's public key, and obtain the signature verification result of the second authorized transaction credential.

[0022] The signature verification result feedback module is used to feed back the signature verification result to the business response node.

[0023] Fifthly, this application provides a consortium blockchain authentication device. The device includes:

[0024] The identifier request sending module is used to create an initiator public-private key pair and use the initiator public key in the initiator public-private key pair to send an initiator identifier request to the identity service node on the consortium blockchain; the initiator identifier request is used to instruct the identity service node to determine an initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol.

[0025] The first signature information determination module is used to determine the first signature information corresponding to the initiator's private key in the initiator's public-private key pair; the first signature information is used to generate a first authorized transaction certificate; the first authorized transaction certificate carries the initiator's identifier, business parameters, and the first signature information.

[0026] A business request sending module is used to initiate a business request corresponding to the business parameters to a business response node on the consortium blockchain using the first authorized transaction credential; the business request is used to instruct the business response node to perform business processing corresponding to the business request if the second signature information in the second authorized transaction credential matches the initiator's public key; the second authorized transaction credential is extracted by the business response node from the business request.

[0027] Sixthly, this application provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0028] Obtain the initiator identification request sent by the initiator using the initiator's public key in the initiator's public key pair after the initiator creates the initiator's public-private key pair;

[0029] A source identifier is determined that matches the source identifier request and conforms to the decentralized identity protocol; the source identifier is used to generate a first authorized transaction credential; the first authorized transaction credential carries the source identifier, business parameters, and a first signature information corresponding to the source private key in the source public-private key pair; the first authorized transaction credential is used to enable the business initiator to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain;

[0030] The system receives the second authorized transaction credential extracted and sent by the business response node from the business request, matches the second signature information in the second authorized transaction credential with the initiator's public key, and obtains the signature verification result of the second authorized transaction credential.

[0031] The signature verification result is fed back to the business response node.

[0032] In a seventh aspect, this application provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0033] Create an initiator public-private key pair, and use the initiator public key in the initiator public-private key pair to send an initiator identifier request to the identity service node on the consortium blockchain; the initiator identifier request is used to instruct the identity service node to determine an initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol.

[0034] Determine the first signature information corresponding to the initiator's private key in the initiator's public-private key pair; the first signature information is used to generate a first authorized transaction certificate; the first authorized transaction certificate carries the initiator's identifier, business parameters, and the first signature information;

[0035] The first authorized transaction credential is used to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain; the business request is used to instruct the business response node to perform business processing corresponding to the business request if the second signature information in the second authorized transaction credential matches the initiator's public key; the second authorized transaction credential is extracted by the business response node from the business request.

[0036] Eighthly, this application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0037] Obtain the initiator identification request sent by the initiator using the initiator's public key in the initiator's public key pair after the initiator creates the initiator's public-private key pair;

[0038] A source identifier is determined that matches the source identifier request and conforms to the decentralized identity protocol; the source identifier is used to generate a first authorized transaction credential; the first authorized transaction credential carries the source identifier, business parameters, and a first signature information corresponding to the source private key in the source public-private key pair; the first authorized transaction credential is used to enable the business initiator to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain;

[0039] The system receives the second authorized transaction credential extracted and sent by the business response node from the business request, matches the second signature information in the second authorized transaction credential with the initiator's public key, and obtains the signature verification result of the second authorized transaction credential.

[0040] The signature verification result is fed back to the business response node.

[0041] Ninthly, this application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0042] Create an initiator public-private key pair, and use the initiator public key in the initiator public-private key pair to send an initiator identifier request to the identity service node on the consortium blockchain; the initiator identifier request is used to instruct the identity service node to determine an initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol.

[0043] Determine the first signature information corresponding to the initiator's private key in the initiator's public-private key pair; the first signature information is used to generate a first authorized transaction certificate; the first authorized transaction certificate carries the initiator's identifier, business parameters, and the first signature information;

[0044] The first authorized transaction credential is used to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain; the business request is used to instruct the business response node to perform business processing corresponding to the business request if the second signature information in the second authorized transaction credential matches the initiator's public key; the second authorized transaction credential is extracted by the business response node from the business request.

[0045] Tenthly, this application provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0046] Obtain the initiator identification request sent by the initiator using the initiator's public key in the initiator's public key pair after the initiator creates the initiator's public-private key pair;

[0047] A source identifier is determined that matches the source identifier request and conforms to the decentralized identity protocol; the source identifier is used to generate a first authorized transaction credential; the first authorized transaction credential carries the source identifier, business parameters, and a first signature information corresponding to the source private key in the source public-private key pair; the first authorized transaction credential is used to enable the business initiator to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain;

[0048] The system receives the second authorized transaction credential extracted and sent by the business response node from the business request, matches the second signature information in the second authorized transaction credential with the initiator's public key, and obtains the signature verification result of the second authorized transaction credential.

[0049] The signature verification result is fed back to the business response node.

[0050] In one aspect, this application provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0051] Create an initiator public-private key pair, and use the initiator public key in the initiator public-private key pair to send an initiator identifier request to the identity service node on the consortium blockchain; the initiator identifier request is used to instruct the identity service node to determine an initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol.

[0052] Determine the first signature information corresponding to the initiator's private key in the initiator's public-private key pair; the first signature information is used to generate a first authorized transaction certificate; the first authorized transaction certificate carries the initiator's identifier, business parameters, and the first signature information;

[0053] The first authorized transaction credential is used to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain; the business request is used to instruct the business response node to perform business processing corresponding to the business request if the second signature information in the second authorized transaction credential matches the initiator's public key; the second authorized transaction credential is extracted by the business response node from the business request.

[0054] The aforementioned consortium blockchain authentication method, device, system, computer equipment, computer-readable storage medium, and computer program product acquire an initiator identifier request sent by the business initiator using the initiator's public key in the initiator's public-private key pair after the business initiator creates the initiator's public-private key pair. The initiator identifier matches the request and conforms to the decentralized identity protocol. This initiator identifier is used to generate a first authorized transaction credential carrying the initiator identifier, business parameters, and a first signature information corresponding to the initiator's private key in the initiator's public-private key pair. This first authorized transaction credential enables the business initiator to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain. Then, the second authorized transaction credential extracted and sent by the business response node from the business request is received. The second signature information in the second authorized transaction credential is matched with the initiator's public key to obtain the verification result of the second authorized transaction credential, and the verification result is fed back to the business response node. Since the initiator's identifier is a decentralized identity identifier determined based on the initiator's public key, and the first authorized transaction certificate carries the first signature information corresponding to the initiator's private key, and the verification result of the second authorized transaction certificate is obtained by matching the second signature information in the second authorized transaction certificate with the initiator's public key, it is equivalent to the business initiator represented by the decentralized identity identifier achieving off-chain signing, and the consortium blockchain authentication is achieved through public and private key signature verification technology. This can realize the decentralization of the consortium blockchain authentication process, which is conducive to improving security. Attached Figure Description

[0055] Figure 1 This is a schematic diagram of the structure of a data sharing system in one embodiment;

[0056] Figure 2 This is a schematic diagram of the blockchain structure in one embodiment;

[0057] Figure 3 This is a schematic diagram illustrating the process of generating a new block in one embodiment;

[0058] Figure 4 This is a diagram illustrating the application environment of a consortium blockchain authentication method in one embodiment.

[0059] Figure 5 This is a flowchart illustrating a consortium blockchain authentication method in one embodiment;

[0060] Figure 6 This is a schematic diagram illustrating the identifier structure of a decentralized object identifier in one embodiment;

[0061] Figure 7 This is a flowchart illustrating the consortium blockchain authentication method in another embodiment;

[0062] Figure 8This is a schematic diagram of the interaction process of consortium blockchain business processing in one embodiment;

[0063] Figure 9 This is a schematic diagram of the interaction process of consortium blockchain business processing in another embodiment;

[0064] Figure 10 This is a schematic diagram of the interaction process of consortium blockchain business processing in another embodiment;

[0065] Figure 11 This is a schematic diagram of the interaction process of consortium blockchain business processing in yet another embodiment;

[0066] Figure 12 This is a structural block diagram of a consortium blockchain authentication device in one embodiment;

[0067] Figure 13 This is a structural block diagram of a consortium blockchain authentication device in another embodiment;

[0068] Figure 14 This is a structural block diagram of a consortium blockchain authentication system in one embodiment;

[0069] Figure 15 Here is a block diagram of the consortium blockchain authentication system in another embodiment;

[0070] Figure 16 This is an internal structural diagram of a computer device in one embodiment;

[0071] Figure 17 This is a diagram of the internal structure of a computer device in another embodiment. Detailed Implementation

[0072] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0073] Before proceeding with the specific details, let me first explain some of the terms used in this application.

[0074] A consortium blockchain system is a blockchain network in which multiple consortium nodes participate. In a consortium blockchain system, each node has completely equal permissions, allowing for trusted data exchange without requiring complete trust between nodes. Each node in a consortium blockchain system typically corresponds to a specific entity or organization, and joining or leaving the system requires authorization. In a consortium blockchain system, each organization represents a consortium member, which can be a company or department.

[0075] Smart contracts are contract programs that execute automatically based on specific conditions. Smart contracts are a key feature of blockchain and a crucial way to implement business logic using blockchain. Smart contracts are not limited to executing contracts for transactions; they can also execute contracts that process received information.

[0076] Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and cryptographic algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying platform, a platform product and service layer, and an application service layer.

[0077] Based on read and write permissions, blockchains can be categorized into public chains, private chains, and consortium chains. A public chain is one where anyone can read data, send transactions that are effectively confirmed, and participate in the consensus process. A private chain is one where write permissions are held by a single organization; in other words, read permissions in a private chain may be open to the public or restricted to varying degrees. Consortium chains have limited openness and decentralization. Participants are pre-selected or directly designated, and read permissions may be public or, like write permissions, restricted to system participants.

[0078] The consortium blockchain authentication method provided in this application can be applied to data sharing systems. See also... Figure 1 The data sharing system shown, data sharing system 100, refers to a system for data sharing between nodes. This data sharing system may include multiple nodes 101, which can refer to various clients within the data sharing system. In this embodiment, they may include business response nodes, identity service nodes, etc. Each node 101, during normal operation, can receive input information and maintain shared data within the data sharing system based on the received input information. To ensure information interoperability within the data sharing system, information connections can exist between each node, allowing information transmission between nodes. For example, when any node in the data sharing system receives input information, other nodes in the system obtain the input information according to a consensus algorithm and store it as data in the shared data, ensuring consistency of data stored on all nodes in the data sharing system.

[0079] Each node in the data sharing system has a corresponding node identifier, and each node can also store the node identifiers of other nodes in the data sharing system. This allows for the subsequent broadcasting of generated blocks to other nodes in the data sharing system based on their node identifiers. Each node can maintain a node identifier list as shown in the table below, storing the node name and node identifier in this list. The node identifier can be an IP (Internet Protocol) address or any other information that can be used to identify the node.

[0080] Each node in the data-sharing system stores the same blockchain. A blockchain consists of multiple blocks; see [link to relevant documentation]. Figure 2 A blockchain consists of multiple blocks. The genesis block includes a block header and a block body. The block header stores input information feature values, version number, timestamp, and difficulty value, while the block body stores the input information. The next block after the genesis block takes the genesis block as its parent block. The next block also includes a block header and a block body. The block header stores the input information feature values ​​of the current block, the block header feature values ​​of the parent block, version number, timestamp, and difficulty value, and so on. This ensures that the block data stored in each block is related to the block data stored in the parent block, guaranteeing the security of the input information in the blocks.

[0081] When generating the individual blocks in the blockchain, see Figure 3 When a node in the blockchain receives input information, it verifies the input. After verification, it stores the input information in a memory pool and updates its hash tree used to record the input. Then, it updates the timestamp to the time the input information was received and attempts to calculate feature values ​​multiple times using different random numbers. Upon completion of the calculation, it stores the corresponding information, generating a block header and block body to obtain the current block. Subsequently, the node sends the newly generated block to other nodes in its data sharing system based on their node identifiers. These other nodes verify the newly generated block and, after verification, add it to their stored blockchain.

[0082] The consortium blockchain authentication method provided in this application can be applied to, for example... Figure 4The application environment shown contains a business initiator 401, an identity service node 402, and a business response node 403 on the consortium blockchain. These three entities can communicate over the network, and the identity service node 402 and business response node 403 can implement blockchain functions such as consensus, data recording, and on-chain processing based on smart contracts. Specifically, the business initiator 401 can create an initiator public-private key pair and send an initiator identifier request to the identity service node 402 using the initiator's public key. The identity service node 402 can determine an initiator identifier that matches the request and conforms to the decentralized identity protocol. This initiator identifier is used to generate a first authorized transaction credential carrying the initiator identifier, business parameters, and a first signature corresponding to the initiator's private key in the public-private key pair. The business initiator 401 can then initiate a business request corresponding to the business parameters to the business response node 403 based on the first authorized transaction credential. The business response node 403 can extract the second authorization transaction credential from the business request and send it to the identity service node 402. The identity service node 402 matches the second signature information in the second authorization transaction credential with the initiator's public key to obtain the verification result of the second authorization transaction credential, and sends the verification result back to the business response node 403. If the verification result is successful, the business response node 403 executes the business processing corresponding to the business request; if the verification result is unsuccessful, the identity service node 402, through the business response node 403, sends a verification failure message to the business initiator 401.

[0083] Furthermore, the business initiator 401, identity service node 402, and business response node 403 can all be implemented through terminals or servers. Terminals include, but are not limited to, mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, and aircraft. Servers can be implemented using independent servers or server clusters composed of multiple servers. This invention can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving.

[0084] In one embodiment, such as Figure 5 As shown, a consortium blockchain authentication method is provided. This embodiment applies this method to... Figure 4 Taking the identity service node 402 in the example, the explanation includes the following steps:

[0085] Step S502: Obtain the initiator identification request sent by the initiator using the initiator's public key in the initiator's public key pair after the initiator creates the initiator's public key pair.

[0086] In this context, the business initiator refers to the party that initiates a business request during the business processing based on the consortium blockchain. This initiator can be a terminal device, such as a user's mobile phone or other terminal capable of receiving user operation information, or an application or mini-program. Additionally, the terminal device can also be an institution's terminal, such as a computer used by a court to authenticate the characteristic information provided by the plaintiff, or a computer used by an employer to authenticate the certificates provided by job applicants.

[0087] A public-private key pair consists of a public key and a private key, typically used in asymmetric encryption technologies. During the application of a public-private key pair, different keys are needed to perform encryption and decryption operations. For example, data encrypted with the public key of the public-private key pair needs to be decrypted with the private key of the same pair; data encrypted with the private key of the public-private key pair needs to be decrypted with the public key of the same pair. Specifically, in this application, the initiator's public-private key pair includes an initiator's public key and an initiator's private key. The initiator's private key is held by the business initiator and is not publicly disclosed. It is used to encrypt business information during the business request process to obtain the first signature information. The initiator's public key can be published by the business initiator to the identity service node on the consortium blockchain. This serves two purposes: firstly, to send an initiator identification request to the identity service node; and secondly, to facilitate the identity service node in subsequently determining the verification result of the second authorized transaction statement corresponding to the initiator's private key based on the initiator's public key. The initiator identification request carries the initiator's public key, which instructs the identity service node to generate an initiator identification to represent the business initiator.

[0088] Specifically, after creating an initiator public-private key pair, the business initiator uses the initiator public key in the pair to send an initiator identifier request to the identity service node on the consortium blockchain. The identity service node then retrieves this initiator identifier request. This identity service node is the node in the consortium blockchain that manages the identity information of objects. For example, this identity service node could be a DID (Decentralized Identity) service node, used to manage decentralized identity information.

[0089] Step S504: Determine the initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol.

[0090] The Decentralized Identity (DID) protocol is a decentralized identification protocol released by the W3C (World Wide Web Consortium) to identify target objects in a decentralized manner. These target objects can be individuals, organizations, abstract entities, or virtual entities. Specifically, the DID protocol specifies the concrete composition of the object identifier, such as... Figure 6As shown, a decentralized object identifier consists of three parts, separated by colons. The first part, "did," indicates that the identifier conforms to the DID protocol. The second part is the DID method identifier, typically the name of the DID method. DID methods are maintained uniformly by the W3C CCG working group, and different DID methods can correspond to different operating standards. The third part is the identifier corresponding to the DID method in the second part.

[0091] Specifically, after obtaining the initiator identifier request sent by the business initiator, the identity service node determines the initiator identifier that matches the request and conforms to the DID protocol. This initiator identifier is used to generate the first authorization transaction credential. The first authorization transaction credential carries the initiator identifier, business parameters, and first signature information corresponding to the initiator's private key in the initiator's public-private key pair. Furthermore, this first authorization transaction credential is used to enable the business initiator to send a business request corresponding to the business parameters to the business response node on the consortium blockchain. In a specific application, the initiator identifier, business parameters, and first signature information can be carried by different fields in the first authorization transaction credential. Specifically, the initiator identifier is carried by an identifier field, the business parameters by a custom parameter field, and the first signature information by a signature field. For example, the identifier field could be "Holder", the custom parameter field could be "CredentialSubject", and the signature field could be "proofValue".

[0092] Furthermore, the first authorized transaction credential refers to an authorized transaction credential generated based on the initiator's identifier, business parameters, and first signature information. The specific form of this first authorized transaction credential can be a Verifiable Claim (VC) or a Verifiable Presentation (VP). The initiator's identifier is a unique identifier representing the initiator of the business. A business request refers to a request initiated by the business initiator to the business service node on the consortium blockchain based on its own business needs. Business parameters refer to the parameter information corresponding to the business request. For example, if the business request is a data storage request, the business parameters may include the data name, data size, purpose, original description, etc.; or, if the business request is a data authentication request, the business parameters may include the data type to be authenticated, data number, data holder information, etc. The first signature information refers to the encrypted information obtained by the business initiator using the initiator's private key from the initiator's public-private key pair to encrypt the business information corresponding to the business request, or the message digest corresponding to the business information. The business information refers to the data information that needs to be uploaded to the blockchain during the business processing. For example, if the business request is a data storage request, the business information can be the data to be stored or the information summary corresponding to the data to be stored. Similarly, if the business request is a data authentication request, the business information can be the data to be authenticated or the information summary corresponding to the data to be authenticated.

[0093] Furthermore, a business response node on a consortium blockchain refers to a node on the consortium blockchain that can respond to business requests. This business response node can be, for example, an authoritative node in the consortium blockchain's distributed ledger, or a non-authoritative node. This initial authorized transaction credential can be stored on the terminal or the consortium blockchain to provide traceability credentials during subsequent auditing and regulatory processes.

[0094] Step S506: Receive the second authorized transaction credential extracted and sent by the business response node from the business request, match the second signature information in the second authorized transaction credential with the initiator's public key, and obtain the signature verification result of the second authorized transaction credential.

[0095] The verification result can be either successful or unsuccessful. Specifically, after receiving the business request, the business response node extracts the second authorized transaction credential from the request and sends it to the identity service node. The identity service node then verifies the second authorized transaction credential based on the initiator's public key that matches the first signature information, obtaining the verification result: if the second signature information in the second authorized transaction credential matches the initiator's public key, the verification is successful; otherwise, the verification fails.

[0096] Furthermore, there is no single way to match the second signature information with the initiator's public key.

[0097] In a specific application, after the business initiator determines the first signature information based on the initiator's private key, the first signature information is sent to the identity service node. The identity service node then compares the second signature information in the second authorized transaction credential with the first signature information to determine the matching result between the second signature information and the initiator's public key, thereby obtaining the verification result of the second authorized transaction credential.

[0098] In a specific application, matching the second signature information in the second authorized transaction credential with the initiator's public key includes: decrypting the second signature information in the second authorized transaction credential based on the initiator's public key corresponding to the first signature information to obtain second decrypted information, and determining the first decrypted information corresponding to the first signature information; comparing the second decrypted information with the first decrypted information to determine the matching result between the second signature information and the initiator's public key, thereby obtaining the verification result of the second authorized transaction credential. The first decrypted information can be obtained by performing calculations on the business information carried in the business request. The specific algorithm for this calculation is consistent with the specific algorithm used to determine the information to be encrypted corresponding to the business information during the generation of the first signature information.

[0099] Furthermore, before sending the second authorization transaction credential to the identity service node, the business response node can first verify the validity of the authorization transaction credential. If the validity verification passes, the second authorization transaction credential is sent to the identity service node; otherwise, an invalid credential message is sent to the business initiator. The specific content of this validity verification may include at least one of the following: determining whether the fields of the second authorization transaction credential meet the protocol requirements, determining whether the second authorization transaction credential is within its validity period, or determining whether the second authorization transaction credential has been recorded on the consortium blockchain. Correspondingly, passing the validity verification may include at least one of the following: the fields of the second authorization transaction credential meet the protocol requirements, the second authorization transaction credential is within its validity period, or determining that the second authorization transaction credential is not recorded on the consortium blockchain. Here, the protocol requirements refer to the requirements of the protocol corresponding to the first authorization transaction credential.

[0100] In one embodiment, receiving the second authorized transaction credential extracted and sent by the business response node from the business request includes: receiving the second authorized transaction credential extracted and sent by the business response node from the business request when the second authorized transaction credential is not recorded on the consortium blockchain.

[0101] The signature verification result is used to instruct the business response node to execute the business processing corresponding to the business request if the signature verification is successful. The second authorized transaction credential is recorded on the consortium blockchain after the business response node completes the business processing. Furthermore, the specific method of recording the second authorized transaction credential is not unique; for example, it could be recording a credential identifier used to represent the second authorized transaction credential, or it could be recording the specific content of the second authorized transaction credential.

[0102] Specifically, after retrieving the second authorized transaction credential from the business request, the business response node can check if the second authorized transaction credential has been recorded on the consortium blockchain. If so, it sends the second authorized transaction credential to the identity service node; otherwise, it sends an invalid credential message to the business initiator. Upon completion of the business processing, the business response node can record the second authorized transaction credential corresponding to that processing on the blockchain, or it can send a notification to the identity service node indicating that the processing is complete, instructing the identity service node to record the corresponding second authorized transaction credential on the blockchain.

[0103] It should be noted that, in some embodiments, the second authorized transaction certificate recorded on the consortium blockchain can also serve as a stub for business operations, facilitating subsequent supervision and auditing.

[0104] In this embodiment, when the second authorization transaction credential is not recorded on the consortium blockchain, the identity service node receives the second authorization transaction credential extracted and sent by the business response node from the business request. This can prevent the business initiator from submitting multiple business requests using the same authorization transaction credential, which is equivalent to filtering the validity of the business requests. This can reduce the number of invalid business requests while ensuring security, and is conducive to improving the business response efficiency in the consortium blockchain scenario while ensuring security.

[0105] In one embodiment, matching the second signature information in the second authorized transaction credential with the initiator's public key to obtain the verification result of the second authorized transaction credential includes: extracting the credential validity period carried in the second authorized transaction credential; if the second authorized transaction credential is within the credential validity period, matching the second signature information in the second authorized transaction credential with the initiator's public key to obtain the verification result of the second authorized transaction credential.

[0106] The second authorization transaction credential carries a validity period. This validity period can be represented by an expiration date or by a time interval including both a start and end date. The validity period can be carried by a validity period field, such as "ExpirationDate". Specifically, the identity service node can extract the validity period carried in the second authorization transaction credential based on the validity period field corresponding to the credential's validity period, and determine whether the second authorization transaction credential is within its validity period based on the current time. If so, the second signature information in the second authorization transaction credential is matched with the initiator's public key to obtain the signature verification result of the second authorization transaction credential; otherwise, the business response node sends a message indicating that the credential is invalid to the business initiator.

[0107] It should be noted that, in some embodiments, the business response node may also extract the validity period of the second authorized transaction credential and verify the validity period of the second authorized transaction credential, and feed back the verification result to the identity service node. If the verification is successful, the identity service node will perform subsequent signature verification processing; if the verification fails, the identity service node will not perform subsequent signature verification processing, and the business response node will send a message to the business initiator indicating that the credential is invalid.

[0108] In this embodiment, before matching the second signature information in the second authorized transaction credential with the initiator's public key to obtain the signature verification result of the second authorized transaction credential, the validity period of the credential is also verified. This can ensure the legality of the second authorized transaction credential and further improve security.

[0109] Step S508: Feed back the signature verification result to the business response node.

[0110] Specifically, after receiving the verification result of the second authorized transaction credential, the identity service node sends the verification result back to the business response node. If the verification result is successful, the business response node executes the business processing corresponding to the business request; if the verification result is unsuccessful, the business response node sends a message indicating that the verification failed to the business initiator.

[0111] The aforementioned consortium blockchain authentication method obtains the initiator's identifier request sent by the business initiator using the initiator's public key in the initiator's public-private key pair after creating the initiator's public-private key pair. It then determines the initiator identifier that matches the request and conforms to the decentralized identity protocol. This initiator identifier is used to generate a first authorized transaction credential carrying the initiator identifier, business parameters, and a first signature information corresponding to the initiator's private key in the initiator's public-private key pair. This first authorized transaction credential is used to enable the business initiator to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain. Next, it receives a second authorized transaction credential extracted and sent from the business request by the business response node, matches the second signature information in the second authorized transaction credential with the initiator's public key to obtain the verification result of the second authorized transaction credential, and feeds back the verification result to the business response node. Since the initiator's identifier is a decentralized identity identifier determined based on the initiator's public key, and the first authorized transaction certificate carries the first signature information corresponding to the initiator's private key, and the verification result of the second authorized transaction certificate is obtained by matching the second signature information in the second authorized transaction certificate with the initiator's public key, it is equivalent to the business initiator represented by the decentralized identity identifier performing off-chain signatures and achieving consortium blockchain authentication through public-private key signature verification technology. This achieves decentralization of the consortium blockchain authentication process, which is beneficial to improving security. Furthermore, the business initiator does not need to connect to the consortium blockchain network, which can meet the needs of the business initiator to initiate on-chain business requests based on off-chain signatures. It can be applied to scenarios where the business initiator cannot connect to the consortium blockchain network, which is beneficial to expanding the application scenarios of consortium blockchain authentication methods.

[0112] In one embodiment, the process of generating a first authorized transaction credential includes: creating a verifiable transaction credential that conforms to a decentralized identity protocol and carries an initiator identifier and business parameters; obtaining the initiator's private key for the first signature information of the verifiable transaction credential; and generating a first authorized transaction credential corresponding to the verifiable transaction credential based on the first signature information.

[0113] In this context, a verifiable transaction credential refers to a transaction credential that does not contain signature information, i.e., an unauthorized transaction credential. Specifically, in this application, the verifiable transaction credential corresponding to the first authorized transaction credential refers to a transaction credential that does not contain the first signature information corresponding to the initiator's private key. As mentioned above, the specific form of an authorized transaction credential can be an authorized transaction statement or an authorized transaction expression; correspondingly, the specific form of a verifiable transaction credential can be a verifiable transaction statement or a verifiable transaction expression. If the first authorized transaction credential is a first authorized transaction statement, then the verifiable transaction credential is a verifiable transaction statement; if the first authorized transaction credential is a first authorized transaction expression, then the verifiable transaction credential is a verifiable transaction expression.

[0114] Specifically, the first authorization transaction credential can be generated by the business initiator or the identity service node, or it can be generated jointly by both. Taking the case where the identity service node generates the first authorization transaction credential as an example: After obtaining the business parameters determined by the business initiator and identifying the initiator identifier that matches the initiator's identifier request, the identity service node creates a verifiable transaction credential that conforms to the DID protocol and carries the initiator identifier and the business parameters. Then, it obtains the first signature information of the verifiable transaction credential from the business initiator using the initiator's private key, and based on the DID protocol, adds this first signature information as a signature field to the verifiable transaction credential, thus obtaining the first authorization transaction credential corresponding to the verifiable transaction credential.

[0115] Furthermore, when the business initiator and the identity service node jointly generate the first authorized transaction credential, the identity service node can generate the verifiable transaction credential, and the business initiator can use the initiator's private key to sign the verifiable transaction credential and generate the first authorized transaction credential; alternatively, the business initiator can generate the verifiable transaction credential and send the verifiable transaction credential, along with the first signature information for the verifiable transaction credential, to the identity service node, which can then generate the first authorized transaction credential based on the verifiable transaction credential and the first signature information.

[0116] In the above embodiments, a verifiable transaction credential that conforms to the DID protocol and carries the initiator's identifier and business parameters is first created, and then a first authorized transaction credential corresponding to the verifiable transaction credential is generated based on the first signature information. This can ensure that the first authorized transaction credential also conforms to the DID protocol, which is equivalent to standardizing the authentication protocol in the consortium blockchain authentication process. This helps to achieve protocol interoperability among various business response nodes in the consortium blockchain and can improve the compatibility and scalability of the consortium blockchain authentication method while ensuring security.

[0117] As mentioned above, verifiable transaction credentials can be either verifiable transaction statements or verifiable transaction expressions, and the creation process differs for different types of verifiable transaction credentials. In one embodiment, a verifiable transaction credential is a verifiable transaction statement. In this embodiment, creating a verifiable transaction credential that conforms to the decentralized identity protocol and carries the initiator's identifier and business parameters includes: creating a verifiable statement that conforms to the decentralized identity protocol and carries the initiator's identifier; adding the business parameters to the verifiable statement to generate a verifiable transaction statement corresponding to the verifiable statement.

[0118] In this context, a verifiable claim refers to an unauthorized claim that does not contain business parameters. Similarly, verifiable transaction claims can be generated by either the business initiator or the identity service node. Taking the case where the identity service node generates a verifiable transaction claim as an example: Specifically, after determining the initiator identifier that matches the initiator's identifier request, the identity service node creates a verifiable claim that conforms to the decentralized identity protocol and carries the initiator identifier. It then obtains the business parameters determined by the business initiator, adds a custom parameter field to the verifiable claim to carry these business parameters, and adds this business parameter to the verifiable claim, thus generating the verifiable transaction claim corresponding to the verifiable claim. This custom parameter field could be, for example, "CredentialSubject".

[0119] In the above embodiments, a verifiable claim that conforms to the DID protocol and carries the initiator's identifier is first created, and then business parameters are added to the verifiable claim to obtain the corresponding verifiable transaction claim. This can ensure that the verifiable transaction claims in various business scenarios conform to the DID protocol, which is conducive to further expanding the application scenarios of consortium blockchain authentication methods.

[0120] In one embodiment, the first authorized transaction credential is a first authorized transaction statement, and the second authorized transaction credential is a second authorized transaction statement. In this embodiment, step S506 includes: receiving the second authorized transaction statement extracted and sent by the service response node from the service request; decrypting the second signature information in the second authorized transaction statement using the initiator's public key to obtain second decrypted information; and matching the second decrypted information with the initiator's public key to obtain the signature verification result of the second authorized transaction statement.

[0121] Specifically, in the encryption scenario, the business initiator encrypts the information to be encrypted corresponding to the business information using its private key to obtain the first signature information. In the decryption scenario, the identity service node receives the second authorized transaction statement extracted and sent by the business response node from the business request, extracts the second signature information from the second authorized transaction statement, and decrypts the second signature information using the initiator's public key to obtain the second decrypted information. The identity service node also obtains the first decrypted information corresponding to the initiator's public key. The first decrypted information can be obtained by performing a calculation on the business information carried in the business request. The specific algorithm for this calculation is consistent with the algorithm used to determine the information to be encrypted corresponding to the business information during the generation of the first signature information. The information to be encrypted corresponding to the business information can be the business information itself or a message digest of the business information determined based on a message digest algorithm. This message digest algorithm can be, for example, CRC (Cyclic Redundancy Check), MD (Message Digest), or SHA (Security Hash Algorithm), etc.

[0122] Since the specific computation used to determine the first decryption information is consistent with the specific algorithm used to determine the information to be encrypted corresponding to the business information during the generation of the first signature information, the first decryption information is consistent with the information to be encrypted in the encryption scenario. Then, the identity service node compares the second decryption information with the first decryption information corresponding to the first signature information: if the second decryption information matches the first decryption information, it means the second decryption information matches the initiator's public key, the first authorized transaction declaration has not been tampered with, and a successful signature verification result is obtained; otherwise, if the second decryption information does not match the first decryption information, it means the second decryption information does not match the initiator's public key, the first authorized transaction declaration has been tampered with, and a failed signature verification result is obtained.

[0123] It should be noted that the identity service node or the business response node can obtain the first decrypted information by performing calculations on the business information carried in the business request. In one specific application, the business response node performs calculations on the business information carried in the business request to obtain the first decrypted information and sends it to the identity service node, which receives the first decrypted information for subsequent comparison processing. In another specific application, the business response node sends the business information carried in the business request to the identity service node, which then performs calculations on the business information carried in the business request to obtain the first decrypted information.

[0124] In the above embodiments, the second decrypted information is obtained by decrypting the second signature information, and the verification result of the second authorized transaction statement is obtained by matching the second decrypted information with the initiator's public key. This is equivalent to obtaining the verification result of the second authorized transaction statement using the public-private key signature verification technology in asymmetric encryption. The algorithm is simple and helps to improve the authentication efficiency of the consortium blockchain authentication method.

[0125] In one embodiment, the verifiable transaction credential is a verifiable transaction expression, and the first authorized transaction credential is a first authorized transaction expression. In this embodiment, creating a verifiable transaction credential that conforms to the decentralized identity protocol and carries the initiator's identifier and business parameters includes: obtaining a third authorized transaction statement that conforms to the decentralized identity protocol and carries third-party signature information, a third-party identifier, and business parameters; adding the initiator's identifier to the third authorized transaction statement; and generating a verifiable transaction expression corresponding to the third authorized transaction statement.

[0126] In this context, a third-party authorized transaction statement refers to a transaction statement authorized by a third party. The third-party authorization in the third-party authorized transaction statement is based on third-party signature information. This third-party signature information is determined by the third party, represented by the third-party identifier, using the third-party private key. This third-party identifier matches the third-party identifier request and conforms to the decentralized identity protocol. The third-party private key is the private key in the third-party public-private key pair created by the third party. The third-party identifier request is sent by the third party using the third-party public key in the third-party public-private key pair after it has been created.

[0127] Furthermore, a third party can be a terminal device, application, or mini-program used by a third-party user or organization. A third-party user or organization refers to an entity associated with the business request, possessing a certain level of authority, and capable of authorizing the business request. For example, if the business request is for data storage, authorization from the copyright holder of the data to be stored is required; therefore, the copyright holder can act as a third party for that business request. Similarly, if the business request is for information authentication, authorization from the information management department is required; therefore, the information management department can act as a third party for that business request. It can be understood that the roles of the business requester and the third party can be interchangeable in different business scenarios. That is, a third party in one business request can be the business initiator in another business request, and similarly, the business initiator in one business request can be a third party in another business request. For example, the copyright holder and the information management department mentioned above can both act as business requesters in a blockchain business scenario.

[0128] Specifically, the third-party authorization transaction statement can be generated by a third party or the identity service node, or it can be jointly generated by the third party and the identity service node. Taking the case where the identity service node generates the third-party authorization transaction statement as an example: In scenarios where a business request involves a third party and requires third-party authorization, the identity service node can obtain the business parameters determined by the business initiator and, based on these parameters, identify the third party in the business, and then determine the corresponding third-party identifier. This third-party identifier is generated by the identity service node: after the third party creates a third-party public-private key pair, the identity service node obtains the third-party identifier request sent using the third party's public key in the third-party public-private key pair, and determines the third-party identifier that matches the third-party identifier request and conforms to the DID protocol.

[0129] Then, the identity service node creates a third transaction claim that conforms to the DID protocol and carries a third-party identifier and business parameters. It then obtains the third signature information of the third transaction claim using the third-party's private key, and adds this third signature information to the third transaction claim as a signature field to obtain the third authorized transaction claim corresponding to the third transaction claim. The third-party identifier can be carried by an identifier field, which can be, for example, "Issuer".

[0130] It is understandable that when a third party and an identity service node jointly generate a third-authorized transaction statement, the identity service node may generate the third transaction statement, and the third party may sign the third transaction statement using its private key to generate a third-authorized transaction statement; alternatively, the third party may generate the third transaction statement and send it, along with the third signature information for the third transaction statement, to the identity service node, which may then generate a third-authorized transaction statement based on the third transaction statement and the third signature information.

[0131] Furthermore, a verifiable transaction expression refers to a transaction expression that has not been authorized by the business initiator; that is, a verifiable transaction expression does not carry the first signature information corresponding to the initiator's private key. Based on the generation of a third-authorized transaction statement, a verifiable transaction expression can be generated by either the business initiator or the identity service node. Taking the case where the identity service node generates a verifiable transaction expression as an example: The identity service node obtains the third-authorized transaction statement, adds the initiator's identifier to the third-authorized transaction statement, and generates the verifiable transaction expression corresponding to the third-authorized transaction statement. After determining the verifiable transaction expression, either the business initiator or the identity service node can further generate a first-authorized transaction expression. Again, taking the case where the identity service node generates a first-authorized transaction expression as an example: The identity service node obtains the first signature information of the verifiable transaction expression from the business initiator using the initiator's private key, and based on the DID protocol, adds this first signature information as a signature field to the verifiable transaction expression, obtaining the first-authorized transaction expression corresponding to the verifiable transaction expression.

[0132] It should be noted that in authentication scenarios requiring authorization from multiple third parties, the corresponding third-party authorization transaction statements can be obtained separately for each third party, and a verifiable transaction expression carrying the initiator's identifier and each third-party authorization transaction statement can be generated.

[0133] In the above embodiments, in scenarios requiring third-party authorization, the third-party authorized transaction statement is first obtained, and then a verifiable transaction expression carrying the third-party authorized transaction statement is generated. Since both VC and VP are standard data texts that conform to the DID protocol, they have good protocol interoperability and can be applied to authentication scenarios that require multiple third-party authorizations. This can further expand the application scenarios of consortium blockchain authentication methods while ensuring security.

[0134] It is understandable that in scenarios requiring third-party authorization, the second authorization transaction credential is a second authorization transaction expression, which carries a transaction declaration authorized by the third party. That is, the second authorization transaction expression contains the signature information of both the business initiator and the third party. Therefore, during the subsequent verification of the second authorization transaction expression, it is possible to verify only the signature information of the business initiator, or to verify the signature information of both the business initiator and the third party.

[0135] In one embodiment, the second authorized transaction credential is a second authorized transaction expression. In this embodiment, step S506 includes: receiving the second authorized transaction expression extracted and sent by the service response node from the service request, and the fourth authorized transaction statement extracted and sent from the second authorized transaction expression; matching the second signature information in the second authorized transaction expression with the initiator's public key to obtain a first matching result; matching the fourth signature information in the fourth authorized transaction statement with the third party's public key to obtain a second matching result; and determining the verification result of the second authorized transaction expression based on the first matching result and the second matching result.

[0136] The specific method for matching the second signature information with the initiator's public key is described above. The specific method for matching the fourth signature information with the third party's public key is described above, and will not be repeated here.

[0137] Specifically, after obtaining a business request, the business response node can extract the second authorization transaction expression from the business request based on the field structure corresponding to the authorization transaction statement and the authorization transaction expression, and further extract the fourth authorization transaction statement from the second authorization transaction expression, and send the second authorization transaction expression and the fourth authorization transaction statement to the identity service node.

[0138] On one hand, the identity service node matches the second signature information in the second authorized transaction expression with the initiator's public key to obtain the first matching result. Since the initiator's public key and the initiator's private key that determines the first signature information constitute an initiator public-private key pair, the first matching result of the second signature information and the initiator's public key is equivalent to the matching result of the second signature information and the first signature information. That is, based on the first matching result, it can be determined whether the first authorized transaction expression has been tampered with: if the second signature information matches the initiator's public key, then the first authorized transaction expression has not been tampered with; otherwise, the first authorized transaction expression has been tampered with.

[0139] On the other hand, the identity service node matches the fourth signature information in the fourth authorized transaction statement with the third party's public key, obtaining a second matching result. Since the third party's public key and the third party's private key that determines the third signature information form a third party public-private key pair, the second matching result of the fourth signature information and the third party's public key is equivalent to the matching result of the fourth signature information and the third signature information. That is, based on the second matching result, it can be determined whether the third authorized transaction statement has been tampered with: if the fourth signature information matches the third party's public key, then the third authorized transaction statement has not been tampered with; otherwise, the third authorized transaction statement has been tampered with.

[0140] Finally, the identity service node determines the signature verification result of the second authorized transaction expression based on the first and second matching results. That is, if the second signature information matches the initiator's public key and the fourth signature information matches the third party's public key, the signature verification passes; otherwise, the signature verification fails.

[0141] In the above embodiments, in scenarios requiring third-party authorization, obtaining the verification result of the second authorized transaction expression through dual verification can ensure the accuracy of the verification result and further improve security.

[0142] In one embodiment, such as Figure 7 As shown, a consortium blockchain authentication method is provided. This embodiment applies this method to... Figure 4 Taking the business initiator 401 in the example, the explanation includes the following steps:

[0143] Step S702: Create an initiator public-private key pair and use the initiator public key in the initiator public-private key pair to send an initiator identifier request to the identity service node on the consortium blockchain.

[0144] The initiator identifier request is used to instruct the identity service node to determine the initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol.

[0145] Step S704: Determine the first signature information corresponding to the initiator's private key in the initiator's public-private key pair.

[0146] The first signature information is used to generate the first authorized transaction certificate; the first authorized transaction certificate carries the initiator's identifier, business parameters, and the first signature information.

[0147] Step S706: Use the first authorized transaction certificate to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain.

[0148] The business request is used to instruct the business response node to perform the business processing corresponding to the business request when the second signature information in the second authorized transaction credential matches the initiator's public key; the second authorized transaction credential is extracted by the business response node from the business request.

[0149] About Applications Figure 4 For specific limitations on the consortium blockchain authentication method of the business initiator 401, please refer to the above section on its application. Figure 4 The specific limitations of the consortium blockchain authentication method of identity service node 402 in the system will not be elaborated here.

[0150] The aforementioned consortium blockchain authentication method creates an initiator's public-private key pair. Using the initiator's public key, a request is sent to the identity service node on the consortium blockchain to instruct the node to determine an initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol. This initiator then determines the first signature information corresponding to the initiator's private key. This first signature information is used to generate a first authorized transaction credential carrying the initiator identifier, business parameters, and the first signature information. The first authorized transaction credential is then used to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain. Since the initiator identifier is a decentralized identity identifier determined based on the initiator's public key, and the first authorized transaction credential carries the first signature information corresponding to the initiator's private key, and the verification result of the second authorized transaction credential is obtained by matching the second signature information in the second authorized transaction credential with the initiator's public key, it is equivalent to the business initiator represented by the decentralized identity identifier performing off-chain signing and consortium blockchain authentication through public-private key signature verification technology. This achieves decentralization of the consortium blockchain authentication process, which is beneficial for improving security. Furthermore, the business initiator does not need to connect to the consortium blockchain network, which can meet the business initiator's need to initiate on-chain business requests based on off-chain signatures. It can be applied to scenarios where the business initiator cannot connect to the consortium blockchain network, which is conducive to expanding the application scenarios of consortium blockchain authentication methods.

[0151] The following example uses a scenario where the business initiator is the user terminal, the identity service node is the DID service node, the business response node is the authoritative institution node, and the third party is the third-party terminal. Figures 8 to 11 This section provides a detailed explanation of the authentication methods for consortium blockchains. Specifically, Figure 8 and Figure 9For scenarios that do not require third-party authorization, Figure 10 and Figure 11 For scenarios that require third-party authorization.

[0152] In one embodiment, such as Figure 8 As shown, a consortium blockchain business processing method is provided, wherein steps S801 to S813 involve a consortium blockchain authentication method, which includes the following steps:

[0153] Step S801: The user terminal creates a user public-private key pair; the user public-private key pair includes the user public key and the user private key;

[0154] Step S802: The user terminal requests a user DID from the DID service node based on the user's public key;

[0155] Step S803: The DID service node generates the user's DID;

[0156] Step S804: The DID service node generates a VC carrying the user's DID;

[0157] Step S805: The user terminal sends service parameters to the DID service node;

[0158] Step S806: The DID service node generates a transaction VC; the transaction VC carries the VC and transaction parameters.

[0159] Step S807: The DID service node sends the transaction VC to the user terminal;

[0160] Step S808: The user terminal uses the user's private key to sign the transaction VC to obtain the authorized transaction VC;

[0161] Step S809: The user terminal initiates a business request to the authoritative institution node based on the authorized transaction VC;

[0162] In step S810, the authoritative institution node extracts the authorized transaction VC from the business request and performs a valid verification; if the valid verification fails, the authoritative institution node sends a message to the user terminal indicating that the credential is invalid, and the authentication process terminates; if the valid verification passes, step S811 is executed.

[0163] Step S811: The authoritative node sends the validly verified authorized transaction VC to the DID service node;

[0164] Step S812: The DID service node performs VC verification on the authorized transaction VC that has been legally verified based on the user's public key; if the verification fails, the DID service node sends a message to the user terminal through the authoritative node indicating that the verification failed, and the authentication process is terminated; if the verification succeeds, proceed to step S813.

[0165] Step S813: The DID service node sends the verification result indicating that the signature has been verified to the authoritative agency.

[0166] Step S814: The authoritative institution performs the business processing corresponding to the business request;

[0167] Step S815: The authoritative organization provides feedback on the business processing results to the user terminal.

[0168] In one embodiment, such as Figure 9 As shown, a consortium blockchain business processing method is provided, wherein steps S901 to S911 involve a consortium blockchain authentication method, which includes the following steps:

[0169] Step S901: The user terminal creates a user public-private key pair; the user public-private key pair includes the user public key and the user private key;

[0170] Step S902: The user terminal requests a user DID from the DID service node based on the user's public key;

[0171] Step S903: The DID service node generates the user's DID;

[0172] Step S904: The DID service node sends the user's DID to the user terminal;

[0173] Step S905: The user terminal generates a transaction VC carrying the user DID and business parameters;

[0174] Step S906: The user terminal uses the user's private key to sign the transaction VC to obtain the authorized transaction VC;

[0175] Step S907: The user terminal initiates a business request to the authoritative institution node based on the authorized transaction VC;

[0176] In step S908, the authoritative institution node extracts the authorized transaction VC from the business request and performs a valid verification; if the valid verification fails, the authoritative institution node sends a message to the user terminal indicating that the credential is invalid, and the authentication process terminates; if the valid verification passes, step S909 is executed.

[0177] Step S909: The authoritative node sends the validly verified authorized transaction VC to the DID service node;

[0178] In step S910, the DID service node verifies the VC signature of the authorized transaction VC based on the user's public key; if the verification fails, the DID service node sends a message to the user terminal via the authoritative node indicating that the verification failed, and the authentication process terminates; if the verification succeeds, step S911 is executed.

[0179] Step S911: The DID service node sends the verification result indicating that the signature has been verified to the authoritative agency.

[0180] Step S912: The authoritative institution performs the business processing corresponding to the business request;

[0181] Step S913: The authoritative institution provides feedback on the business processing results to the user terminal.

[0182] In one embodiment, such as Figure 10 As shown, a consortium blockchain business processing method is provided, wherein steps S1001 to S1019 involve a consortium blockchain authentication method, which includes the following steps:

[0183] Step S1001: The user terminal creates a user public-private key pair; the user public-private key pair includes the user public key and the user private key;

[0184] Step S1002: The user terminal requests a user DID from the DID service node based on the user's public key;

[0185] Step S1003: The DID service node generates the user's DID;

[0186] Step S1004: The third-party terminal creates a third-party public-private key pair; the third-party public-private key pair includes a third-party public key and a third-party private key;

[0187] Step S1005: The third-party terminal applies for a third-party DID from the DID service node based on the third-party public key;

[0188] Step S1006: The DID service node generates a third-party DID;

[0189] Step S1007: The user terminal sends service parameters to the DID service node;

[0190] Step S1008: The DID service node generates a transaction VC; this transaction VC carries a third-party DID and transaction parameters;

[0191] Step S1009: The DID service node sends the transaction VC to the third-party terminal;

[0192] Step S1010: The third-party terminal uses its third-party private key to sign the transaction VC to obtain the authorized transaction VC;

[0193] Step S1011: The third-party terminal sends the authorization transaction VC to the DID service node;

[0194] Step S1012: The DID service node generates a transaction VP; the transaction VP carries the authorized transaction VC;

[0195] Step S1013: The DID service node sends a transaction VP to the user terminal;

[0196] Step S1014: The user terminal uses the user's private key to sign the transaction VP to obtain the authorized transaction VP;

[0197] Step S1015: The user terminal initiates a business request to the authoritative institution node based on the authorized transaction VP;

[0198] In step S1016, the authoritative node extracts the authorization transaction VP and authorization transaction VC from the business request and performs a validity verification on the authorization transaction VP and authorization transaction VC; if the validity verification of the authorization transaction VP and authorization transaction VC both pass, then step S1017 is executed; otherwise, the authoritative node sends a message to the user terminal indicating that the credentials are invalid, and the authentication process is terminated.

[0199] Step S1017: The authoritative node sends the validly verified authorized transaction VC and authorized transaction VP to the DID service node;

[0200] In step S1018, the DID service node performs VP signature verification on the authorized transaction VP that has passed the legitimate verification based on the user's public key, and performs VC signature verification on the authorized transaction VC that has passed the legitimate verification based on the third party's public key; if the results of both VP signature verification and VC signature verification are successful, then step S1019 is executed; otherwise, the DID service node sends a message to the user terminal via the authoritative node indicating that the signature verification failed, and the authentication process is terminated.

[0201] Step S1019: The DID service node sends the verification result indicating that the signature has been verified to the authoritative agency.

[0202] Step S1020: The authoritative institution performs the business processing corresponding to the business request;

[0203] Step S1021: The authoritative institution provides feedback on the business processing results to the user terminal.

[0204] In one embodiment, such as Figure 11 As shown, a consortium blockchain business processing method is provided, wherein steps S1101 to S1120 involve a consortium blockchain authentication method, which includes the following steps:

[0205] Step S1101: The user terminal creates a user public-private key pair; the user public-private key pair includes the user public key and the user private key;

[0206] Step S1102: The user terminal requests a user DID from the DID service node based on the user's public key;

[0207] Step S1103: The DID service node generates the user's DID;

[0208] Step S1104: The DID service node sends the user's DID to the user terminal;

[0209] Step S1105: The third-party terminal creates a third-party public-private key pair; the third-party public-private key pair includes a third-party public key and a third-party private key;

[0210] Step S1106: The third-party terminal applies for a third-party DID from the DID service node based on the third-party public key;

[0211] Step S1107: The DID service node generates a third-party DID;

[0212] Step S1108: The DID service node sends the third-party DID to the third-party terminal;

[0213] Step S1109: The third-party terminal sends the third-party DID to the user terminal;

[0214] Step S1110: The user terminal generates a transaction VC carrying the user DID and business parameters;

[0215] Step S1111: The user terminal sends the transaction VC to the third-party terminal;

[0216] In step S1112, the third-party terminal uses its third-party private key to sign the transaction VC to obtain the authorized transaction VC;

[0217] Step S1113: The third-party terminal sends the authorized transaction VC to the user terminal;

[0218] Step S1114: The user terminal generates a transaction VP; the transaction VP carries the authorized transaction VC;

[0219] Step S1115: The user terminal uses the user's private key to sign the transaction VP to obtain the authorized transaction VP;

[0220] Step S1116: The user terminal initiates a business request to the authoritative institution node based on the authorized transaction VP;

[0221] In step S1117, the authoritative node extracts the VP and VC of the authorization transaction from the business request and verifies their validity. If the validity verification of the VP and VC of the authorization transaction is successful, step S1118 is executed. Otherwise, the authoritative node sends a message to the user terminal indicating that the credentials are invalid, and the authentication process is terminated.

[0222] Step S1118: The authoritative node sends the validly verified authorized transaction VC and authorized transaction VP to the DID service node;

[0223] Step S1119: The DID service node performs VP signature verification on the authorized transaction VP that has passed the legitimate verification based on the user's public key, and performs VC signature verification on the authorized transaction VC that has passed the legitimate verification based on the third party's public key; if the results of both VP signature verification and VC signature verification are successful, then proceed to step S1120; otherwise, the DID service node sends a message to the user terminal via the authoritative node indicating that the signature verification failed, and the authentication process terminates.

[0224] Step S1120: The DID service node sends the verification result indicating that the signature has been verified to the authoritative institution.

[0225] Step S1121: The authoritative institution performs the business processing corresponding to the business request;

[0226] Step S1122: The authoritative institution provides feedback on the business processing results to the user terminal.

[0227] The aforementioned consortium blockchain authentication method applies verifiable credentials conforming to the DID protocol to the authentication process. Through public-private key signature technology, it effectively solves the centralization and security issues of traditional consortium blockchain authentication methods. Simultaneously, it standardizes the authentication protocol for authoritative institutions, contributing to improved protocol interoperability of user ledger systems within consortium blockchains, thus possessing high authority and promising development prospects. Furthermore, using the consortium blockchain authentication method described in this application, user terminals do not need to connect to the blockchain network; on-chain transactions can be achieved through off-chain signatures, making it suitable for scenarios where user terminals cannot connect to the blockchain network. Since the DID protocol is compatible with all identity recognition methods, such as biometric fingerprints and physical characteristics, the consortium blockchain authentication method of this application has significant room for development in terms of compatibility and scalability, providing greater flexibility for application scenarios. Meanwhile, since this application generates authorized VCs and authorized VPs that are not on the chain while implementing consortium blockchain authentication, these credentials are all JSON text and follow the DID specification, have good protocol interoperability, can be used as user transaction operation stubs, and can be used as verification credentials in business scenarios where needed, which can ensure the regulatory, traceability and auditability of consortium blockchain business.

[0228] In some embodiments, the consortium blockchain authentication method provided in this application can be applied to consortium blockchain data on-chain storage scenarios. Specifically, after creating a user public-private key pair, the user terminal sends a user identifier request to the identity service node on the consortium blockchain using the user public key in the user public-private key pair. The identity service node obtains the user identifier request and determines a user identifier that matches the user identifier request and conforms to the decentralized identity protocol. This user identifier is used to generate a first authorized transaction credential. The first authorized transaction credential carries the user identifier, business parameters, and a first signature information corresponding to the user private key in the user public-private key pair; the first authorized transaction credential is used to enable the user terminal to initiate a data storage request corresponding to the business parameters to the business response node on the consortium blockchain. The identity service node receives a second authorized transaction credential extracted and sent by the business response node from the data storage request, matches the second signature information in the second authorized transaction credential with the user public key, obtains the verification result of the second authorized transaction credential, and feeds back the verification result to the business response node. The business parameters may include data name, data size, purpose, original description, etc. The first signature information refers to the encrypted information obtained by the user terminal after encrypting the data to be stored or the message digest corresponding to the data to be stored using the initiator's private key.

[0229] In some embodiments, the consortium blockchain authentication method provided in this application can be applied to data authentication scenarios. Specifically, after creating a user public-private key pair, the user terminal sends a user identifier request to the identity service node on the consortium blockchain using the user public key in the user public-private key pair. The identity service node obtains the user identifier request and determines a user identifier that matches the user identifier request and conforms to the decentralized identity protocol. This user identifier is used to generate a first authorization transaction credential. The first authorization transaction credential carries the user identifier, business parameters, and a first signature information corresponding to the user private key in the user public-private key pair; the first authorization transaction credential is used to enable the user terminal to initiate a data authentication request corresponding to the business parameters to the business response node on the consortium blockchain. The identity service node receives a second authorization transaction credential extracted and sent by the business response node from the data authentication request, matches the second signature information in the second authorization transaction credential with the user public key, obtains the verification result of the second authorization transaction credential, and feeds back the verification result to the business response node. The business parameters may include the data type to be authenticated, data number, data holder information, etc. The first signature information refers to the encrypted information obtained by the user terminal after encrypting the data to be authenticated or the message digest of the data to be authenticated using the initiator's private key.

[0230] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0231] Based on the same inventive concept, this application also provides a consortium blockchain authentication device for implementing the aforementioned consortium blockchain authentication method. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more embodiments of the consortium blockchain authentication device provided below can be found in the limitations of the consortium blockchain authentication method described above, and will not be repeated here.

[0232] In one embodiment, such as Figure 12 As shown, a consortium blockchain authentication device 1200 is provided, including: an identifier request acquisition module 1202, an identifier determination module 1204, a signature verification module 1206, and a signature verification result feedback module 1208, wherein:

[0233] The identifier request acquisition module 1202 is used to acquire the initiator identifier request sent by the business initiator after creating the initiator public-private key pair using the initiator public key in the initiator public-private key pair;

[0234] The identifier determination module 1204 is used to determine the initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol; the initiator identifier is used to generate the first authorized transaction certificate; the first authorized transaction certificate carries the initiator identifier, business parameters, and first signature information corresponding to the initiator's private key in the initiator's public-private key pair; the first authorized transaction certificate is used to enable the business initiator to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain;

[0235] The signature verification module 1206 is used to receive the second authorized transaction credential extracted and sent by the business response node from the business request, match the second signature information in the second authorized transaction credential with the initiator's public key, and obtain the signature verification result of the second authorized transaction credential.

[0236] The signature verification result feedback module 1208 is used to provide the signature verification result to the business response node.

[0237] In one embodiment, the consortium blockchain authentication device 1200 further includes: a verifiable transaction credential creation module, used to create a verifiable transaction credential that conforms to a decentralized identity protocol and carries the initiator's identifier and business parameters; a first signature information acquisition module, used to acquire the initiator's private key to the first signature information of the verifiable transaction credential; and a first authorized transaction credential generation module, used to generate a first authorized transaction credential corresponding to the verifiable transaction credential based on the first signature information.

[0238] In one embodiment, the verifiable transaction credential is a verifiable transaction statement. In this embodiment, the verifiable transaction credential creation module is specifically used to: create a verifiable statement that conforms to the decentralized identity protocol and carries the initiator's identifier; add business parameters to the verifiable statement, and generate a verifiable transaction statement corresponding to the verifiable statement.

[0239] In one embodiment, the first authorized transaction credential is a first authorized transaction statement; the second authorized transaction credential is a second authorized transaction statement. In this embodiment, the signature verification module 1206 is specifically used to: receive the second authorized transaction statement extracted and sent by the business response node from the business request; decrypt the second signature information in the second authorized transaction statement using the initiator's public key to obtain second decrypted information; and match the second decrypted information with the initiator's public key to obtain the signature verification result of the second authorized transaction statement.

[0240] In one embodiment, the verifiable transaction credential is a verifiable transaction expression, and the first authorized transaction credential is a first authorized transaction expression. In this embodiment, the verifiable transaction credential creation module is specifically used to: obtain a third authorized transaction statement that conforms to the decentralized identity protocol and carries third signature information, a third-party identifier, and business parameters; add the initiator identifier to the third authorized transaction statement to generate a verifiable transaction expression corresponding to the third authorized transaction statement; the third signature information is determined by the third party represented by the third-party identifier based on the third-party private key; the third-party identifier matches the third-party identifier request and conforms to the decentralized identity protocol; the third-party identifier request is sent by the third party using the third-party public key; the third-party public key and the third-party private key constitute a third-party public-private key pair; the third-party public-private key pair is created by the third party.

[0241] In one embodiment, the second authorized transaction credential is a second authorized transaction expression. In this embodiment, the signature verification module 1206 is specifically configured to: receive the second authorized transaction expression extracted and sent by the business response node from the business request, and the fourth authorized transaction statement extracted and sent from the second authorized transaction expression; match the second signature information in the second authorized transaction expression with the initiator's public key to obtain a first matching result; match the fourth signature information in the fourth authorized transaction statement with the third party's public key to obtain a second matching result; and determine the signature verification result of the second authorized transaction expression based on the first matching result and the second matching result.

[0242] In one embodiment, the signature verification module 1206 includes a second authorized transaction credential receiving unit, configured to: receive the second authorized transaction credential extracted and sent by the business response node from the business request when the second authorized transaction credential is not recorded on the consortium blockchain; the signature verification result is used to instruct the business response node to perform business processing corresponding to the business request if the signature verification is successful; and the second authorized transaction credential is recorded on the consortium blockchain when the business response node completes the business processing.

[0243] In one embodiment, the consortium blockchain authentication device 1200 further includes a recording module for recording the second authorized transaction credential on the consortium blockchain when the business response node completes the business processing.

[0244] In one embodiment, the second authorized transaction credential is a second authorized transaction expression carrying a fourth authorized transaction statement. In this embodiment, the recording module is specifically used to record the second authorized transaction expression and the fourth authorized transaction statement on the consortium blockchain when the business response node completes the business processing.

[0245] In one embodiment, the signature verification module 1206 includes a signature verification unit, used to: extract the validity period of the certificate carried in the second authorized transaction certificate; if the second authorized transaction certificate is within the validity period, match the second signature information in the second authorized transaction certificate with the initiator's public key to obtain the signature verification result of the second authorized transaction certificate.

[0246] In one embodiment, such as Figure 13 As shown, another consortium blockchain authentication device 1300 is provided, including: an identifier request sending module 1302, a first signature information determination module 1304, and a business request sending module 1306, wherein:

[0247] The identifier request sending module 1302 is used to create an initiator public-private key pair and use the initiator public key in the initiator public-private key pair to send an initiator identifier request to the identity service node on the consortium blockchain; the initiator identifier request is used to instruct the identity service node to determine an initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol.

[0248] The first signature information determination module 1304 is used to determine the first signature information corresponding to the initiator's private key in the initiator's public-private key pair; the first signature information is used to generate the first authorized transaction certificate; the first authorized transaction certificate carries the initiator's identifier, business parameters and the first signature information.

[0249] The business request sending module 1306 is used to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain using the first authorized transaction certificate; the business request is used to instruct the business response node to perform the business processing corresponding to the business request when the second signature information in the second authorized transaction certificate matches the initiator's public key; the second authorized transaction certificate is extracted by the business response node from the business request.

[0250] In one embodiment, the consortium blockchain authentication device 1300 further includes: a verifiable transaction credential creation module, used to create a verifiable transaction credential that conforms to a decentralized identity protocol and carries the initiator's identifier and business parameters; a first signature information acquisition module, used to acquire the initiator's private key to the first signature information of the verifiable transaction credential; and a first authorized transaction credential generation module, used to generate a first authorized transaction credential corresponding to the verifiable transaction credential based on the first signature information.

[0251] In one embodiment, the verifiable transaction credential is a verifiable transaction statement. In this embodiment, the verifiable transaction credential creation module is specifically used to: create a verifiable statement that conforms to the decentralized identity protocol and carries the initiator's identifier; add business parameters to the verifiable statement, and generate a verifiable transaction statement corresponding to the verifiable statement.

[0252] In one embodiment, the verifiable transaction credential is a verifiable transaction expression, and the first authorized transaction credential is a first authorized transaction expression. In this embodiment, the verifiable transaction credential creation module is specifically used to: obtain a third authorized transaction statement that conforms to the decentralized identity protocol and carries third signature information, a third-party identifier, and business parameters; add the initiator identifier to the third authorized transaction statement to generate a verifiable transaction expression corresponding to the third authorized transaction statement; the third signature information is determined by the third party represented by the third-party identifier based on the third-party private key; the third-party identifier matches the third-party identifier request and conforms to the decentralized identity protocol; the third-party identifier request is sent by the third party using the third-party public key; the third-party public key and the third-party private key constitute a third-party public-private key pair; the third-party public-private key pair is created by the third party.

[0253] Each module in the aforementioned consortium blockchain authentication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0254] Based on the same inventive concept, this application also provides a consortium blockchain authentication system for implementing the aforementioned consortium blockchain authentication method. The solution provided by this system is similar to the implementation described in the above method; therefore, the specific limitations in one or more consortium blockchain authentication system embodiments provided below can be found in the limitations of the consortium blockchain authentication method described above, and will not be repeated here.

[0255] In one embodiment, such as Figure 14 As shown, a consortium blockchain authentication system 1400 is provided, including an identity service node 1401 and a business response node 1402. The identity service node 1401 obtains the initiator's public-private key pair after the business initiator creates it, and uses the initiator's public key in the public-private key pair to send an initiator identifier request, determining an initiator identifier that matches the request and conforms to the decentralized identity protocol. This initiator identifier is used to generate a first authorized transaction credential; the first authorized transaction credential carries the initiator identifier, business parameters, and a first signature information corresponding to the initiator's private key in the public-private key pair. The business response node 1402 receives a business request initiated by the business initiator based on the first authorized transaction credential and extracts a second authorized transaction credential from the business request; this business request corresponds to the business parameters. The identity service node 1401 receives the second authorized transaction credential sent by the business response node 1402, matches the second signature information in the second authorized transaction credential with the initiator's public key to obtain the verification result of the second authorized transaction credential, and feeds back the verification result to the business response node 1402.

[0256] Among them, the identity service node 1401 and the business response node 1402 can realize the functions of consensus, data recording and on-chain in blockchain technology based on smart contracts.

[0257] The aforementioned consortium blockchain authentication system, because the initiator's identifier is a decentralized identity identifier determined based on the initiator's public key, and the first authorized transaction certificate carries the first signature information corresponding to the initiator's private key, and the verification result of the second authorized transaction certificate is obtained by matching the second signature information in the second authorized transaction certificate with the initiator's public key, is equivalent to the business initiator represented by the decentralized identity identifier performing off-chain signatures and achieving consortium blockchain authentication through public-private key signature verification technology. This achieves decentralization of the consortium blockchain authentication process, which is beneficial to improving security. Furthermore, the business initiator does not need to connect to the consortium blockchain network, which can meet the needs of business initiators to initiate on-chain business requests based on off-chain signatures. It can be applied to scenarios where the business initiator cannot connect to the consortium blockchain network, which is beneficial to expanding the application scenarios of consortium blockchain authentication methods.

[0258] In one embodiment, the consortium blockchain authentication system 1400 also includes a business initiator. The business initiator creates an initiator public-private key pair, uses the initiator public key in the initiator public-private key pair to send an initiator identification request, determines the first signature information corresponding to the initiator private key in the initiator public-private key pair, and uses the first authorized transaction credential to initiate a business request to the business response node 1402.

[0259] In one embodiment, the consortium blockchain authentication system 1400 also includes a third party. The third party creates a third-party public-private key pair, uses the third-party public key in the third-party public-private key pair to send a third-party identification request to the identity service node 1401, and determines third signature information corresponding to the third-party private key in the third-party public-private key pair. The first authorized transaction credential is a first authorized transaction expression, and the second authorized transaction credential is a second authorized transaction expression. The first authorized transaction expression carries a third authorized transaction statement, which carries the third-party identification, business parameters, and third signature information of the third party. The third-party identification matches the third-party identification request and conforms to the decentralized identity protocol. In this embodiment, receiving a business request initiated by a business initiator based on the first authorized transaction credential and extracting the second authorized transaction credential from the business request includes: receiving a business request initiated by a business initiator based on the first authorized transaction expression, extracting the second authorized transaction expression from the business request, and extracting a fourth authorized transaction statement from the second authorized transaction expression. The process involves receiving a second authorized transaction credential sent by a business response node, matching the second signature information in the second authorized transaction credential with the initiator's public key to obtain the verification result of the second authorized transaction credential, including: receiving a second authorized transaction expression and a fourth authorized transaction declaration sent by a business response node, matching the second signature information in the second authorized transaction expression with the initiator's public key to obtain a first matching result, matching the fourth signature information in the fourth authorized transaction declaration with a third party's public key to obtain a second matching result, and determining the verification result of the second authorized transaction expression based on the first and second matching results.

[0260] In a specific application, such as Figure 15 As shown, the consortium blockchain authentication system includes a user terminal and an authoritative institution and a DID platform connected to the user terminal. Both the authoritative institution and the DID platform can be configured with both applications and smart contracts, and implement blockchain on-chain functionality through their respective smart contracts. The user terminal can specifically include user terminals and third-party institution terminals, which interact with the authoritative institution and the DID platform through their respective blockchain applications.

[0261] Taking the scenario where the business request originates from a user terminal and does not require authorization from a third-party institution as an example: Specifically, the user terminal creates a user public-private key pair and uses the user's public key from the pair to send a user identifier request to the DID platform. The DID platform obtains the user identifier request and determines a user DID identifier that matches the request and conforms to the DID protocol. Then, the user terminal creates an unsigned VC carrying the user DID identifier and business parameters, and uses the user's private key from the public-private key pair to determine the user signature corresponding to the unsigned VC, thus obtaining a first authorized VC containing the user signature. Next, the user terminal uses this first authorized VC to send a transaction request to an authoritative institution. The authoritative institution calls the blockchain application to extract a second authorized VC carried in the transaction request. After verifying the legality of the fields in the second authorized VC, it calls a smart contract to send the second authorized VC to the DID platform. The DID platform matches the signature information in the second authorized VC with the user's public key to obtain the verification result of the second authorized VC and sends the verification result back to the authoritative institution. Once the signature verification is successful, the authoritative institution uses on-chain certificates or accounts to invoke smart contracts to respond to business requests, execute the corresponding business processing, and provide feedback on the execution results to the user terminal.

[0262] Taking the scenario where the user terminal initiates the business request and the request requires authorization from a third-party organization as an example: Specifically, the user terminal creates a user public-private key pair and sends a user identifier request to the DID platform using the user public key. The DID platform obtains this user identifier request and determines a user DID identifier that matches the request and conforms to the DID protocol. The third-party organization terminal creates a third-party public-private key pair and sends a third-party identifier request to the DID platform using the third-party public key. The DID platform obtains this third-party identifier request and determines a third-party DID identifier that matches the request and conforms to the DID protocol. Then, the third-party organization terminal sends the third-party DID identifier to the user terminal, which creates an unsigned VC carrying the third-party DID identifier and business parameters. The third-party organization terminal then uses the third-party private key from the third-party public-private key pair to determine the organization signature corresponding to the unsigned VC, thus obtaining a third-party authorized VC containing the organization signature.

[0263] After obtaining the third authorized VC, the user terminal creates an unsigned VP (Transaction Verifier) ​​carrying the third authorized VC and the user's DID (Digital ID). Based on the user's private key in the user's public-private key pair, the user terminal determines the user's signature corresponding to this unsigned VP, thus obtaining a first authorized VP containing the user's signature. The user terminal then uses this first authorized VP to send a transaction request to an authoritative institution. The authoritative institution invokes a blockchain application to extract the second authorized VP and the fourth authorized VC carried in the transaction request. After verifying the legality of the fields in the second and fourth authorized VPs, it invokes a smart contract to send them to the DID platform. The DID platform matches the signature information in the second authorized VP with the third-party public key to obtain a first matching result, and matches the signature information in the fourth authorized VC with the user's public key to obtain a second matching result. Based on the first and second matching results, it determines the verification result of the second authorized VP and then reports this verification result back to the authoritative institution. If the verification is successful, the authoritative institution invokes a smart contract to respond to the business request, executes the corresponding business processing, and reports the execution result back to the user terminal.

[0264] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 16 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data involved in the consortium blockchain authentication method. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a consortium blockchain authentication method.

[0265] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 17As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a consortium blockchain authentication method. The display unit of the computer device is used to form a visually visible image. It can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0266] Those skilled in the art will understand that Figure 16 and Figure 17 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0267] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the consortium blockchain authentication method described above.

[0268] In one embodiment, a computer-readable storage medium is provided on which a computer program is stored, which, when executed by a processor, implements the steps in the consortium blockchain authentication method described above.

[0269] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the consortium blockchain authentication method described above.

[0270] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0271] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0272] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0273] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A consortium blockchain authentication method, characterized in that, The method includes: Obtain the initiator identification request sent by the initiator using the initiator's public key in the initiator's public key pair after the initiator creates the initiator's public-private key pair; A source identifier is determined that matches the source identifier request and conforms to the decentralized identity protocol; the source identifier is used to generate a first authorized transaction credential; the first authorized transaction credential carries the source identifier, business parameters, and a first signature information corresponding to the source private key in the source public-private key pair; the first authorized transaction credential is used to enable the business initiator to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain; The system receives the second authorized transaction credential extracted and sent by the business response node from the business request, matches the second signature information in the second authorized transaction credential with the initiator's public key, and obtains the signature verification result of the second authorized transaction credential. The signature verification result is fed back to the business response node; The process of generating the first authorized transaction certificate includes: Create a verifiable transaction credential that conforms to the decentralized identity protocol and carries the initiator's identifier and the business parameters; Obtain the first signature information of the verifiable transaction credential using the initiator's private key; A first authorized transaction certificate corresponding to the verifiable transaction certificate is generated based on the first signature information; The verifiable transaction credential is a verifiable transaction representation, and the first authorized transaction credential is a first authorized transaction representation; the creation of a verifiable transaction credential that conforms to the decentralized identity protocol and carries the initiator identifier and the business parameters includes: Obtain a third authorized transaction statement that conforms to the decentralized identity protocol and carries third-party signature information, a third-party identifier, and the aforementioned business parameters; the third signature information is determined by the third party represented by the third-party identifier based on the third-party private key; the third-party identifier matches the third-party identifier request and conforms to the decentralized identity protocol; the third-party identifier request is sent by the third party using the third-party public key; the third-party public key and the third-party private key constitute a third-party public-private key pair; the third-party public-private key pair is created by the third party; Add the initiator identifier to the third authorized transaction statement to generate a verifiable transaction expression corresponding to the third authorized transaction statement.

2. The method according to claim 1, characterized in that, The verifiable transaction certificate is a verifiable transaction statement; The creation of a verifiable transaction credential that conforms to a decentralized identity protocol and carries the initiator's identifier and the business parameters includes: Create a verifiable claim that conforms to the decentralized identity protocol and carries the initiator's identifier; The business parameters are added to the verifiable statement to generate the verifiable transaction statement corresponding to the verifiable statement.

3. The method according to claim 2, characterized in that, The first authorized transaction certificate is a first authorized transaction statement; the second authorized transaction certificate is a second authorized transaction statement; The receiving node extracts and sends the second authorized transaction credential from the service request, and matches the second signature information in the second authorized transaction credential with the initiator's public key to obtain the signature verification result of the second authorized transaction credential, including: The system receives the second authorized transaction statement extracted and sent by the service response node from the service request, and uses the initiator's public key to decrypt the second signature information in the second authorized transaction statement to obtain the second decrypted information. The second decryption information is matched with the initiator's public key to obtain the signature verification result of the second authorized transaction statement.

4. The method according to claim 1, characterized in that, The second authorized transaction certificate is a second authorized transaction expression; The receiving node extracts and sends the second authorized transaction credential from the service request, and matches the second signature information in the second authorized transaction credential with the initiator's public key to obtain the signature verification result of the second authorized transaction credential, including: Receive the second authorized transaction expression extracted and sent by the service response node from the service request, and the fourth authorized transaction statement extracted and sent by the second authorized transaction expression; The second signature information in the second authorized transaction expression is matched with the initiator's public key to obtain the first matching result; The fourth signature information in the fourth authorized transaction statement is matched with the third party's public key to obtain a second matching result; Based on the first matching result and the second matching result, the signature verification result of the second authorized transaction expression is determined.

5. The method according to any one of claims 1 to 4, characterized in that, The second authorized transaction credential extracted and sent from the service request by the service response node includes: If the second authorized transaction credential is not recorded on the consortium blockchain, the second authorized transaction credential extracted and sent by the business response node from the business request shall be received. The signature verification result is used to instruct the business response node to perform the business processing corresponding to the business request if the signature verification is successful; the second authorized transaction certificate is recorded on the consortium blockchain when the business response node completes the business processing.

6. The method according to any one of claims 1 to 4, characterized in that, The step of matching the second signature information in the second authorized transaction credential with the initiator's public key to obtain the signature verification result of the second authorized transaction credential includes: Extract the validity period of the certificate carried in the second authorized transaction certificate; If the second authorized transaction certificate is within the validity period of the certificate, the second signature information in the second authorized transaction certificate is matched with the initiator's public key to obtain the signature verification result of the second authorized transaction certificate.

7. A consortium blockchain authentication method, characterized in that, The method includes: Create an initiator public-private key pair, and use the initiator public key in the initiator public-private key pair to send an initiator identifier request to the identity service node on the consortium blockchain; the initiator identifier request is used to instruct the identity service node to determine an initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol. Determine the first signature information corresponding to the initiator's private key in the initiator's public-private key pair; the first signature information is used to generate a first authorized transaction certificate; the first authorized transaction certificate carries the initiator's identifier, business parameters, and the first signature information; The first authorized transaction credential is used to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain; the business request is used to instruct the business response node to perform business processing corresponding to the business request if the second signature information in the second authorized transaction credential matches the initiator's public key; the second authorized transaction credential is extracted by the business response node from the business request. The process of generating the first authorized transaction certificate includes: Create a verifiable transaction credential that conforms to the decentralized identity protocol and carries the initiator's identifier and the business parameters; Obtain the first signature information of the verifiable transaction credential using the initiator's private key; A first authorized transaction certificate corresponding to the verifiable transaction certificate is generated based on the first signature information; The verifiable transaction credential is a verifiable transaction representation, and the first authorized transaction credential is a first authorized transaction representation; the creation of a verifiable transaction credential that conforms to the decentralized identity protocol and carries the initiator identifier and the business parameters includes: Obtain a third authorized transaction statement that conforms to the decentralized identity protocol and carries third-party signature information, a third-party identifier, and the aforementioned business parameters; the third signature information is determined by the third party represented by the third-party identifier based on the third-party private key; the third-party identifier matches the third-party identifier request and conforms to the decentralized identity protocol; the third-party identifier request is sent by the third party using the third-party public key; the third-party public key and the third-party private key constitute a third-party public-private key pair; the third-party public-private key pair is created by the third party; Add the initiator identifier to the third authorized transaction statement to generate a verifiable transaction expression corresponding to the third authorized transaction statement.

8. A consortium blockchain authentication system, characterized in that, This includes identity service nodes and business response nodes; The identity service node obtains the initiator's public-private key pair after the business initiator creates it, and uses the initiator's public key in the initiator's public-private key pair to send an initiator identifier request, and determines the initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol; the initiator identifier is used to generate a first authorized transaction credential; the first authorized transaction credential carries the initiator identifier, business parameters, and a first signature information corresponding to the initiator's private key in the initiator's public-private key pair; The service response node receives a service request initiated by the service initiator based on the first authorized transaction credential, and extracts a second authorized transaction credential from the service request; the service request corresponds to the service parameters. The identity service node receives the second authorization transaction credential sent by the business response node, matches the second signature information in the second authorization transaction credential with the initiator's public key to obtain the signature verification result of the second authorization transaction credential, and feeds back the signature verification result to the business response node; The process of generating the first authorized transaction certificate includes: Create a verifiable transaction credential that conforms to the decentralized identity protocol and carries the initiator's identifier and the business parameters; Obtain the first signature information of the verifiable transaction credential using the initiator's private key; A first authorized transaction certificate corresponding to the verifiable transaction certificate is generated based on the first signature information; The verifiable transaction credential is a verifiable transaction representation, and the first authorized transaction credential is a first authorized transaction representation; the creation of a verifiable transaction credential that conforms to the decentralized identity protocol and carries the initiator identifier and the business parameters includes: Obtain a third authorized transaction statement that conforms to the decentralized identity protocol and carries third-party signature information, a third-party identifier, and the aforementioned business parameters; the third signature information is determined by the third party represented by the third-party identifier based on the third-party private key; the third-party identifier matches the third-party identifier request and conforms to the decentralized identity protocol; the third-party identifier request is sent by the third party using the third-party public key; the third-party public key and the third-party private key constitute a third-party public-private key pair; the third-party public-private key pair is created by the third party; Add the initiator identifier to the third authorized transaction statement to generate a verifiable transaction expression corresponding to the third authorized transaction statement.

9. The system according to claim 8, characterized in that, The system also includes a business initiator; The business initiator creates an initiator public-private key pair, uses the initiator public key in the initiator public-private key pair to send an initiator identifier request, determines the first signature information corresponding to the initiator private key in the initiator public-private key pair, and uses the first authorized transaction credential to initiate the business request to the business response node.

10. The system according to claim 9, characterized in that, The system also includes third parties; The third party creates a third-party public-private key pair, uses the third-party public key in the third-party public-private key pair to send a third-party identifier request to the identity service node, and determines the third signature information corresponding to the third-party private key in the third-party public-private key pair; the first authorized transaction credential is a first authorized transaction expression, and the second authorized transaction credential is a second authorized transaction expression; the first authorized transaction expression carries a third authorized transaction statement, and the third authorized transaction statement carries the third-party identifier, the business parameters, and the third signature information; the third-party identifier matches the third-party identifier request and conforms to the decentralized identity protocol; The step of receiving the service request initiated by the service initiator based on the first authorized transaction credential and extracting the second authorized transaction credential from the service request includes: Receive a business request initiated by the business initiator based on the first authorized transaction expression, and extract a second authorized transaction expression from the business request, and extract a fourth authorized transaction statement from the second authorized transaction expression; The step of receiving the second authorized transaction credential sent by the service response node, matching the second signature information in the second authorized transaction credential with the initiator's public key to obtain the signature verification result of the second authorized transaction credential, includes: The system receives the second authorized transaction expression and the fourth authorized transaction statement sent by the business response node, matches the second signature information in the second authorized transaction expression with the initiator's public key to obtain a first matching result, matches the fourth signature information in the fourth authorized transaction statement with the third party's public key to obtain a second matching result, and determines the signature verification result of the second authorized transaction expression based on the first matching result and the second matching result.

11. A consortium blockchain authentication device, characterized in that, The device includes: The identifier request acquisition module is used to acquire the initiator identifier request sent by the business initiator after creating the initiator public-private key pair using the initiator public key in the initiator public-private key pair; The identifier determination module is used to determine an initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol; the initiator identifier is used to generate a first authorized transaction credential; the first authorized transaction credential carries the initiator identifier, business parameters, and a first signature information corresponding to the initiator's private key in the initiator's public-private key pair; the first authorized transaction credential is used to enable the business initiator to initiate a business request corresponding to the business parameters to the business response node on the consortium blockchain; The signature verification module is used to receive the second authorized transaction credential extracted and sent by the business response node from the business request, match the second signature information in the second authorized transaction credential with the initiator's public key, and obtain the signature verification result of the second authorized transaction credential. The signature verification result feedback module is used to feed back the signature verification result to the business response node; The device further includes: The verifiable transaction credential creation module is used to create verifiable transaction credentials that conform to the decentralized identity protocol and carry the initiator identifier and the business parameters; The first signature information acquisition module is used to acquire the first signature information of the initiator's private key on the verifiable transaction credential. The first authorized transaction certificate generation module is used to generate a first authorized transaction certificate corresponding to the verifiable transaction certificate based on the first signature information. The verifiable transaction certificate is a verifiable transaction representation, and the first authorized transaction certificate is a first authorized transaction representation; the verifiable transaction certificate creation module is specifically used for: Obtain a third authorized transaction statement that conforms to the decentralized identity protocol and carries third-party signature information, a third-party identifier, and the aforementioned business parameters; the third signature information is determined by the third party represented by the third-party identifier based on the third-party private key; the third-party identifier matches the third-party identifier request and conforms to the decentralized identity protocol; the third-party identifier request is sent by the third party using the third-party public key; the third-party public key and the third-party private key constitute a third-party public-private key pair; the third-party public-private key pair is created by the third party; Add the initiator identifier to the third authorized transaction statement to generate a verifiable transaction expression corresponding to the third authorized transaction statement.

12. The apparatus according to claim 11, characterized in that, The verifiable transaction certificate is a verifiable transaction statement; the verifiable transaction certificate creation module is specifically used for: Create a verifiable claim that conforms to the decentralized identity protocol and carries the initiator's identifier; The business parameters are added to the verifiable statement to generate the verifiable transaction statement corresponding to the verifiable statement.

13. The apparatus according to claim 12, characterized in that, The first authorized transaction certificate is a first authorized transaction statement; the second authorized transaction certificate is a second authorized transaction statement; The signature verification module is specifically used for: The system receives the second authorized transaction statement extracted and sent by the service response node from the service request, and uses the initiator's public key to decrypt the second signature information in the second authorized transaction statement to obtain the second decrypted information. The second decryption information is matched with the initiator's public key to obtain the signature verification result of the second authorized transaction statement.

14. The apparatus according to claim 11, characterized in that, The second authorized transaction certificate is a second authorized transaction expression; The signature verification module is specifically used for: Receive the second authorized transaction expression extracted and sent by the service response node from the service request, and the fourth authorized transaction statement extracted and sent by the second authorized transaction expression; The second signature information in the second authorized transaction expression is matched with the initiator's public key to obtain the first matching result; The fourth signature information in the fourth authorized transaction statement is matched with the third party's public key to obtain a second matching result; Based on the first matching result and the second matching result, the signature verification result of the second authorized transaction expression is determined.

15. The apparatus according to any one of claims 11 to 14, characterized in that, The signature verification module includes a second authorized transaction certificate receiving unit, used for: If the second authorized transaction credential is not recorded on the consortium blockchain, the second authorized transaction credential extracted and sent by the business response node from the business request shall be received. The signature verification result is used to instruct the business response node to perform the business processing corresponding to the business request if the signature verification is successful; the second authorized transaction certificate is recorded on the consortium blockchain when the business response node completes the business processing.

16. The apparatus according to any one of claims 11 to 14, characterized in that, The signature verification module includes a signature verification unit, used for: Extract the validity period of the certificate carried in the second authorized transaction certificate; If the second authorized transaction certificate is within the validity period of the certificate, the second signature information in the second authorized transaction certificate is matched with the initiator's public key to obtain the signature verification result of the second authorized transaction certificate.

17. A consortium blockchain authentication device, characterized in that, The device includes: The identifier request sending module is used to create an initiator public-private key pair and use the initiator public key in the initiator public-private key pair to send an initiator identifier request to the identity service node on the consortium blockchain; the initiator identifier request is used to instruct the identity service node to determine an initiator identifier that matches the initiator identifier request and conforms to the decentralized identity protocol. The first signature information determination module is used to determine the first signature information corresponding to the initiator's private key in the initiator's public-private key pair; the first signature information is used to generate a first authorized transaction certificate; the first authorized transaction certificate carries the initiator's identifier, business parameters, and the first signature information. A business request sending module is used to initiate a business request corresponding to the business parameters to a business response node on the consortium blockchain using the first authorized transaction credential; the business request is used to instruct the business response node to perform business processing corresponding to the business request if the second signature information in the second authorized transaction credential matches the initiator's public key; the second authorized transaction credential is extracted by the business response node from the business request. The device further includes: The verifiable transaction credential creation module is used to create verifiable transaction credentials that conform to the decentralized identity protocol and carry the initiator identifier and the business parameters; The first signature information acquisition module is used to acquire the first signature information of the initiator's private key on the verifiable transaction credential. The first authorized transaction certificate generation module is used to generate a first authorized transaction certificate corresponding to the verifiable transaction certificate based on the first signature information. The verifiable transaction certificate is a verifiable transaction representation, and the first authorized transaction certificate is a first authorized transaction representation; the verifiable transaction certificate creation module is specifically used for: Obtain a third authorized transaction statement that conforms to the decentralized identity protocol and carries third-party signature information, a third-party identifier, and the aforementioned business parameters; the third signature information is determined by the third party represented by the third-party identifier based on the third-party private key; the third-party identifier matches the third-party identifier request and conforms to the decentralized identity protocol; the third-party identifier request is sent by the third party using the third-party public key; the third-party public key and the third-party private key constitute a third-party public-private key pair; the third-party public-private key pair is created by the third party; Add the initiator identifier to the third authorized transaction statement to generate a verifiable transaction expression corresponding to the third authorized transaction statement.

18. The apparatus according to claim 17, characterized in that, The verifiable transaction certificate is a verifiable transaction statement; the verifiable transaction certificate creation module is specifically used for: Create a verifiable claim that conforms to the decentralized identity protocol and carries the initiator's identifier; The business parameters are added to the verifiable statement to generate the verifiable transaction statement corresponding to the verifiable statement.

19. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

20. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

21. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images