A decentralized identity authentication service system based on web3.0

Abstract

The present invention relates to the technical field of identity authentication, and discloses a decentralized identity authentication service system based on web3.0. The present invention constructs an alliance blockchain jointly constructed by an identity authentication authority (IDP), an Internet regulatory agency, and an application service provider, and utilizes the decentralized, open, transparent, traceable, and tamper-proof technical characteristics of the blockchain to establish a consensus among alliance members on identity authentication, usage verification, identity data management, and other aspects, thereby realizing a decentralized Internet user digital identity service. The user's digital identity real-name authentication is completed by the identity authentication authority, and the issued identity certificate is saved by the user in a ciphertext form; the verification of the digital ID card when in use is completed by the user and the blockchain, and the application service provider no longer constructs an identity authentication system independently, and does not retain the key data of the user's digital identity, thereby avoiding the leakage of user privacy and dishonest use.

Description

Technical Field

[0001] The present invention relates to the technical field of identity authentication, and in particular to a decentralized identity authentication service system based on web3.0. Background Art

[0002] Blockchain technology has the inherent characteristics of decentralization, openness, transparency, traceability, and non-tamperability. The security and trust mechanism of blockchain makes blockchain and transaction trust and privacy protection perfectly combined, and can effectively manage data transparency and transaction process. The alliance chain is a blockchain platform jointly built by the relevant participants of the business flow after forming a common business knowledge, and manages the open and transparent smart contract software to form a mutually trusted data operation. Smart contracts are deployed on the blockchain after the blockchain participants reach a consensus, and can be automatically executed according to external trigger conditions. The caller needs to send a transaction to the blockchain, and the chain operation can be completed only after the transaction reaches a consensus. Therefore, it can prevent unilateral tampering of the contract rules, and has the characteristics of openness, transparency, security and reliability. Decentralized applications (DAPP) are distributed applications supported by the underlying blockchain platform. It is an application form of service provision in the blockchain world. It interacts directly with blockchain smart contracts and has the characteristics and advantages of decentralization, transparency, anti-interference, trustlessness, and immutability. PKI technology based on public key cryptography is based on the theory of public key and uses technologies such as public key encryption and private key signature to achieve key and certificate generation, distribution, management and holder identity authentication based on the public key cryptography system.

[0003] The existing identity authentication service system has the following defects:

[0004] 1. User privacy leakage and dishonest use issues; 2. Inconvenience for users; 3. Single point failure issues in centralized systems; 4. Difficulties in law enforcement for Internet regulatory agencies. Summary of the invention

[0005] The purpose of the present invention is to provide a decentralized identity authentication service system based on web3.0 to solve the above technical problems.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] A decentralized identity authentication service system based on web3.0, including a user registration module, an authentication module, an identity authentication module and an identity management module;

[0008] The user registration module is used to complete the user registration application by cooperating with the identity real-name authentication institution IDP;

[0009] The authentication module is used to complete the user real-name information authentication to the identity real-name authentication institution IDP through the application service provider SP;

[0010] The identity verification module is used to verify the login verification method agreed upon by the user during registration, and the application service provider SP completes the use verification after successful verification;

[0011] The login verification methods include: username / password, SMS verification code, digital token, digital certificate;

[0012] The identity management module is used to edit and manage personal identity attribute information.

[0013] As a further description of the scheme of the present invention, the workflow of the system includes:

[0014] Step S1: An Internet user submits a user registration application to an application service provider SP;

[0015] Step S2: The application service provider SP requests the identity real-name authentication agency IDP to authenticate the user's real-name information;

[0016] Step S3: The identity real-name authentication institution IDP and the user interact to complete the real-name authentication process;

[0017] Step S4: The identity real-name authentication agency IDP feeds back the user real-name authentication result to the application service provider SP;

[0018] Step S5: The application service provider SP feeds back the registration and real-name authentication results to the user;

[0019] Step S6: When the user needs to use the service of the application service provider SP after successful registration, the application service provider SP will send a verification request to the user. The user responds to the verification according to the login verification method agreed upon during registration. The application service provider SP completes the use verification after successful verification.

[0020] Step S7: The user completes the editing and management of personal identity attribute information in the application service provider SP system.

[0021] As a further description of the solution of the present invention, the specific process of step S2 includes:

[0022] Step S21, the Internet user accesses the blockchain through the personal identity data management terminal ID_DAPP, generates the user private key Skuser and the public key PKuser, and completes the identity binding of the personal identity data management terminal ID_DAPP with the blockchain;

[0023] Step S22: The blockchain smart contract creates a decentralized distributed digital identity specification DID for the user, and assigns the user or the user selects an identity real-name authentication institution IDP to perform digital identity real-name authentication;

[0024] Step S23, the real-name authentication institution IDP interacts with the user's personal identity data management terminal ID_DAPP to complete the verification of the user's real identity and generate a user identity credible certificate;

[0025] Step S24, VC_IDP uses the regulatory agency public key and the user public key to encrypt the credential respectively to obtain VC_cipherTxTgov and VC_cipherTxtuser, and uses the IDP private key to sign the VC to obtain the hash value of the credential and the signature files VC_Hash and VC_Sign;

[0026] Step S25, the identity real-name authentication agency IDP sends the above four files to the blockchain, and the blockchain sends VC_cipherTxTgov to the regulatory agency for storage. VC_cipherTxtuser, VC_Hash and VC_Sign are recorded in the blockchain, recording that the user has obtained the certificate. VC_cipherTxtuser can be called by the user at any time to complete the user's digital identity real-name authentication and certificate issuance process.

[0027] As a further description of the scheme of the present invention, when Internet users need services from other application service providers SP, they need to apply for digital identity and usage verification from these application service providers SP, and repeat the steps S1-S8. Different application service providers SP will also reach cooperation models with different identity real-name authentication agencies IDP and adopt different real-name authentication methods.

[0028] As a further description of the solution of the present invention, the specific process of step S6 includes:

[0029] Step S65: The user requests service from the application service provider SP;

[0030] Step S66: The application service provider SP generates verification condition information verify_Info for the user. The user signs veri_Info and sends it along with the DID user public key to the application service provider SP. The application service provider SP verifies the signature and confirms the correspondence between the user's public and private keys.

[0031] Step S67: The application service provider SP verifies the correspondence between the user's public key and the DID on the blockchain;

[0032] Step S68: The user authorizes the blockchain to disclose the identity attribute information to the application service provider SP;

[0033] Step S69: The blockchain sends the identity verification result and the identity attribute information authorized by the user to the application service provider SP to complete the user digital identity authentication process.

[0034] As a further description of the solution of the present invention, the application service provider SP includes two modes when verifying the user identity: Mode 1, the application service provider SP develops the login verification front-end and back-end programs according to the relevant rules of the consensus protocol, interacts with the user ID_APP to complete the binding confirmation of the public and private keys, and verifies the user DID on the blockchain; Mode 2, the application service provider SP receives the identity information transmitted by the blockchain in the URL and confirms the user DID who is requesting the URL.

[0035] As a further description of the solution of the present invention, the specific working process of the mode 1 includes:

[0036] Step SS1: The user uses a browser to access the SP website service;

[0037] Step SS2, SP determines that the user is in an uncompleted identity authentication state, generates verification condition information verify_Info, including the DID and name of SP, namely SP_DID, SP_name, login verification background interface address Verify_URL, verification identifier hexadecimal random code HEX_nonce, condition information generation timestamp TimeStamp, and generates a QR code with the verification condition information and displays it on the verification page;

[0038] Step SS3, the user obtains the above verify_Info by scanning the QR code through ID_DAPP, signs the verify_Info with the user's private key to obtain verify_Info_Sign, calls the SP's background verification interface address verify_URL to send verify_Info_Sign, user DID, HEX_nonce, and user public key PK_user to SP;

[0039] Step SS4: After receiving the information, SP uses PK_user to verify the signature of verify_Info_Sign. If the signature verification is successful, it confirms that the verification with HEX_nonce as the identification code is successful, the public and private key pair is verified successfully, and the public key PK_user and the user DID are bound to verify the relationship, and a verification request is initiated to the blockchain;

[0040] Step SS5: After receiving the verification request, the blockchain verifies the correspondence between the DID status and the public key stored on the chain, and feeds back the verification result to the SP;

[0041] Step SS6: After SP obtains the verification success information, it notifies the user DID_DAPP and redirects the user's browser to the verification success page. The user identity verification process is completed.

[0042] As a further description of the solution of the present invention, the specific working process of the second mode includes:

[0043] Step SS10: The user uses a browser to complete identity authentication and login operations on the blockchain digital identity authentication service website;

[0044] Step SS20: When a user accesses an SP, the blockchain generates user identity notification information DID_pushInfo, encrypts DID_pushInfo using the SP public key to obtain DID_pushInfo_cipher, and sends DID_pushInfo_sign and DID_pushInfo_cipher to the SP along with the access request.

[0045] Step SS30: SP uses the private key to decrypt DID_pushInfo_cipher to obtain DID_pushInfo, and uses the blockchain public key to verify the consistency of DID_pushInfo_sign. If the user identity verification process is successful, the user DID is allowed to log in.

[0046] Step SS40: When the user visits other SPs while the user browser session is maintained and valid, steps SS20-SS30 are repeated to complete the user identity authentication process.

[0047] As a further description of the solution of the present invention, the user identity notification information DID_pushInfo includes user DID, SP_DID, timestamp TimeStamp, HEX_nonce, and a signature DID_pushInfo_sign of DID_pushInfo using a blockchain private key.

[0048] Beneficial effects of the present invention:

[0049] 1. The present invention builds a consortium blockchain jointly constructed by identity authentication authorities (IDPs), Internet regulatory agencies, and application service providers, and uses the decentralized, open, transparent, traceable, and tamper-proof technical characteristics of blockchain to establish a consensus among alliance members on identity authentication, usage verification, and identity data management, thereby realizing decentralized digital identity services for Internet users. The user's digital identity real-name authentication is completed by the identity authentication authority, and the issued identity certificate is saved by the user in encrypted form; the verification of the digital ID card during use is completed jointly by the user and the blockchain, and the application service provider no longer builds an identity authentication system independently and does not retain the user's digital identity key data;

[0050] 2. The present invention adopts the W3C decentralized distributed digital identity specification D ID. Willing application service providers can participate in the establishment and development of alliance blockchain nodes on behalf of all application service providers that comply with the alliance specifications, making the authentication, verification and management process of digital identity open and transparent, and forming corresponding digital identity data transmission standards, realizing one-time registration and shared use, one-time verification and multi-point use for Internet users;

[0051] 3. The identity authentication related services of the present invention are completed by the blockchain. The multi-node distributed application of the blockchain ensures the uninterrupted provision of services. The real-name authentication of digital identity can also be jointly undertaken by multiple IDPs participating in the construction of the alliance chain, eliminating the occurrence of single point failures.

[0052] 4. The digital identity certificate issued by the IDP is stored off-chain by the regulatory agency in the form of public key encryption. Neither the application service provider nor the alliance chain participating institutions have copies, which not only improves the efficiency of supervision, but also greatly reduces the risk of privacy leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The present invention will be further described below in conjunction with the accompanying drawings.

[0054] Figure 1 This is a partial process diagram of the decentralized identity authentication service system based on web3.0 provided by the present invention Figure 2 ;

[0055] Figure 2 It is a schematic diagram of a part of the workflow of the application service provider SP of the decentralized identity authentication service system based on web3.0 provided by the present invention when verifying the identity of the user;

[0056] Figure 3 It is a schematic diagram of a part of the workflow of an application service provider SP in a decentralized identity authentication service system based on web3.0 provided by the present invention when verifying the identity of a user. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] See also Figure 1 , the present invention is a decentralized identity authentication service system based on web3.0, including a user registration module, an authentication module, an identity authentication module and an identity management module;

[0059] The user registration module is used to complete the user registration application by cooperating with the identity real-name authentication institution IDP;

[0060] The authentication module is used to complete the user real-name information authentication to the identity real-name authentication institution IDP through the application service provider SP;

[0061] The identity verification module is used to verify the login verification method agreed upon by the user during registration, and the application service provider SP completes the use verification after successful verification;

[0062] The login verification methods include: username / password, SMS verification code, digital token, digital certificate;

[0063] The identity management module is used to edit and manage personal identity attribute information.

[0064] The workflow of the system includes:

[0065] Step S1: An Internet user submits a user registration application to an application service provider SP;

[0066] Step S2: The application service provider SP requests the identity real-name authentication agency IDP to authenticate the user's real-name information;

[0067] Step S3: The identity real-name authentication institution IDP and the user interact to complete the real-name authentication process;

[0068] Step S4: The identity real-name authentication agency IDP feeds back the user real-name authentication result to the application service provider SP;

[0069] Step S5: The application service provider SP feeds back the registration and real-name authentication results to the user;

[0070] Step S6: When the user needs to use the service of the application service provider SP after successful registration, the application service provider SP will send a verification request to the user. The user responds to the verification according to the login verification method agreed upon during registration. The application service provider SP completes the use verification after successful verification.

[0071] Step S7: The user completes the editing and management of personal identity attribute information in the application service provider SP system.

[0072] Through the above technical solution, in this embodiment, each application service provider SP constructs its own identity authentication system, and cooperates with the identity real-name authentication agency IDP to meet the user real-name requirements, and performs user registration, authentication, verification and management. Different application service providers SP will also reach cooperation models with different identity real-name authentication agencies IDP and adopt different real-name authentication methods.

[0073] The specific process of step S2 includes:

[0074] Step S21, the Internet user accesses the blockchain through the personal identity data management terminal ID_DAPP, generates the user private key Skuser and the public key PKuser, and completes the identity binding of the personal identity data management terminal ID_DAPP with the blockchain;

[0075] Step S22: The blockchain smart contract creates a decentralized distributed digital identity specification DID for the user, and assigns the user or the user selects an identity real-name authentication institution IDP to perform digital identity real-name authentication;

[0076] Step S23, the real-name authentication institution IDP interacts with the user's personal identity data management terminal ID_DAPP to complete the verification of the user's real identity and generate a user identity credible certificate;

[0077] Step S24, VC_IDP uses the regulatory agency public key and the user public key to encrypt the credential respectively to obtain VC_cipherTxTgov and VC_cipherTxtuser, and uses the IDP private key to sign the VC to obtain the hash value of the credential and the signature files VC_Hash and VC_Sign;

[0078] Step S25, the identity real-name authentication agency IDP sends the above four files to the blockchain, and the blockchain sends VC_cipherTxTgov to the regulatory agency for storage. VC_cipherTxtuser, VC_Hash and VC_Sign are recorded in the blockchain, recording that the user has obtained the certificate. VC_cipherTxtuser can be called by the user at any time to complete the user's digital identity real-name authentication and certificate issuance process.

[0079] When Internet users need services from other application service providers SP, they need to apply for digital identity and usage verification from these application service providers SP, and repeat the steps S1-S8. Different application service providers SP will also reach cooperation models with different identity real-name authentication agencies IDP and adopt different real-name authentication methods.

[0080] The specific process of step S6 includes:

[0081] Step S65: The user requests service from the application service provider SP;

[0082] Step S66: The application service provider SP generates verification condition information verify_Info for the user. The user signs veri_Info and sends it along with the DID user public key to the application service provider SP. The application service provider SP verifies the signature and confirms the correspondence between the user's public and private keys.

[0083] Step S67: The application service provider SP verifies the correspondence between the user's public key and the DID on the blockchain;

[0084] Step S68: The user authorizes the blockchain to disclose the identity attribute information to the application service provider SP;

[0085] Step S69: The blockchain sends the identity verification result and the identity attribute information authorized by the user to the application service provider SP to complete the user digital identity authentication process.

[0086] The application service provider SP includes two modes when verifying the user identity: Mode 1, the application service provider SP develops the login verification front-end and back-end programs according to the relevant rules of the consensus protocol, interacts with the user ID_APP to complete the binding confirmation of the public and private keys, and verifies the user DID on the blockchain; Mode 2, the application service provider SP receives the identity information transmitted by the blockchain in the URL and confirms the user DID who is requesting the URL.

[0087] The specific working process of Mode 1 includes:

[0088] Step SS1: The user uses a browser to access the SP website service;

[0089] Step SS2, SP determines that the user is in an uncompleted identity authentication state, generates verification condition information verify_Info, including the DID and name of SP, namely SP_DID, SP_name, login verification background interface address Verify_URL, verification identifier hexadecimal random code HEX_nonce, condition information generation timestamp TimeStamp, and generates a QR code with the verification condition information and displays it on the verification page;

[0090] Step SS3, the user obtains the above verify_Info by scanning the QR code through ID_DAPP, signs the verify_Info with the user's private key to obtain verify_Info_Sign, calls the SP's background verification interface address verify_URL to send verify_Info_Sign, user DID, HEX_nonce, and user public key PK_user to SP;

[0091] Step SS4: After receiving the information, SP uses PK_user to verify the signature of verify_Info_Sign. If the signature verification is successful, it confirms that the verification with HEX_nonce as the identification code is successful, the public and private key pair is verified successfully, and the public key PK_user and the user DID are bound to verify the relationship, and a verification request is initiated to the blockchain;

[0092] Step SS5: After receiving the verification request, the blockchain verifies the correspondence between the DID status and the public key stored on the chain, and feeds back the verification result to the SP;

[0093] Step SS6: After SP obtains the verification success information, it notifies the user DID_DAPP and redirects the user's browser to the verification success page. The user identity verification process is completed.

[0094] The specific working process of Mode 2 includes:

[0095] Step SS10: The user uses a browser to complete identity authentication and login operations on the blockchain digital identity authentication service website;

[0096] Step SS20: When a user accesses an SP, the blockchain generates user identity notification information DID_pushInfo, encrypts DID_pushInfo using the SP public key to obtain DID_pushInfo_cipher, and sends DID_pushInfo_sign and DID_pushInfo_cipher to the SP along with the access request.

[0097] Step SS30: SP uses the private key to decrypt DID_pushInfo_cipher to obtain DID_pushInfo, and uses the blockchain public key to verify the consistency of DID_pushInfo_sign. If the user identity verification process is successful, the user DID is allowed to log in.

[0098] Step SS40: When the user visits other SPs while the user browser session is maintained and valid, steps SS20-SS30 are repeated to complete the user identity authentication process.

[0099] The user identity notification information DID_pushInfo includes user DID, SP_DID, timestamp TimeStamp, HEX_nonce, and a signature DID_pushInfo_sign of DID_pushInfo using a blockchain private key.

[0100] Through the above technical solution, in this embodiment, the digital identity real-name authentication authority IDP, Internet regulatory agencies, Internet application service providers, and computing service agencies that are interested in joining jointly build a consortium blockchain, reach a consensus on the identity authentication service process and data management, and develop corresponding smart contracts according to the consensus rules. Among them, there can be multiple IDPs participating, and Internet application service providers who are willing to participate in the establishment of the blockchain can build consortium chain nodes on behalf of other SPs. The joint participation of various roles will ensure the solid and stable operation of the trust relationship and consensus of all parties.

[0101] The consensus rules include:

[0102] Consensus 1: Users download and install ID_DAPP, use ID_DAPP to access the identity authentication blockchain, generate a globally unique user DID and public-private key pair, and the blockchain records the binding relationship between ID_DAPP, public-private key pair and DID.

[0103] Consensus 2: The IDP completes the real-name authentication of the user and generates the user's digital identity certificate. The identity certificate is signed by the authenticated IDP. The IDP uses the public key of the regulatory agency and the public key of the user to encrypt the identity certificate, and sends the two encrypted files and the signature file to the blockchain. The blockchain sends the file encrypted by the regulatory agency's public key to the regulatory agency, records the user's public key encrypted file on the blockchain for the user to access at any time, saves the signature file on the blockchain, and sets the user's DID to the authenticated identity certificate status.

[0104] Consensus 3: When verifying the use of user digital identity, ID_DAPP and SP complete the correspondence between user DID and user public key through public-private key verification technology, verify the conditions, and initiate a verification query to the blockchain. The blockchain gives feedback based on the records on the chain. If the verification is successful, the identity verification process is completed.

[0105] Consensus 4: After completing the user identity verification, the blockchain can notify the SP that the user is requesting to log in to of the user's identity based on the user's access request to other SPs within the user session maintenance and agreed validity period, and the SP will no longer initiate identity authentication requests to the user.

[0106] It should be noted that the personal identity data management terminal ID_DAPP is the interactive interface between the user and the identity authentication service system, which realizes the generation, use and management of public and private key pairs, and is responsible for the real-name authentication, identity usage verification and identity attribute data management operations between the blockchain, application service provider system and IDP system.

[0107] Working principle: Through the above technical solution, in this embodiment, the Internet user submits a user registration application to the application service provider SP through the user registration module, and then the authentication module completes the real-name authentication process based on the identity real-name authentication agency IDP and the user interaction, and feedbacks the registration and real-name authentication results to the user through the application service provider SP. When the user needs to use the application service provider SP service, the identity authentication module will send a verification request to the user through the application service provider SP, and the user will respond to the verification according to the login verification method agreed upon during registration. After the application service provider SP successfully verifies, the usage verification is completed.

[0108] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A decentralized identity authentication service system based on web3.0, characterized in that: Including user registration module, authentication module, identity authentication module and identity management module; The user registration module is used to complete the user registration application by cooperating with the identity real-name authentication institution IDP; The authentication module is used to complete the user real-name information authentication to the identity real-name authentication institution IDP through the application service provider SP; The identity verification module is used to verify the login verification method agreed upon by the user during registration, and the application service provider SP completes the use verification after successful verification; The login verification methods include: username / password, SMS verification code, digital token, digital certificate; The identity management module is used to edit and manage personal identity attribute information; The workflow of the system includes: Step S1: An Internet user submits a user registration application to an application service provider SP; Step S2: The application service provider SP requests the identity real-name authentication agency IDP to authenticate the user's real-name information; Step S3: The identity real-name authentication institution IDP and the user interact to complete the real-name authentication process; Step S4: The identity real-name authentication agency IDP feeds back the user real-name authentication result to the application service provider SP; Step S5: The application service provider SP feeds back the registration and real-name authentication results to the user; Step S6: When the user needs to use the service of the application service provider SP after successful registration, the application service provider SP will send a verification request to the user. The user responds to the verification according to the login verification method agreed upon during registration. The application service provider SP completes the use verification after successful verification. Step S7: The user completes the editing and management of personal identity attribute information in the application service provider SP system; The specific process of step S6 includes: Step S65: The user requests service from the application service provider SP; Step S66: The application service provider SP generates verification condition information verify_Info for the user. The user signs veri_Info and sends it along with the DID user public key to the application service provider SP. The application service provider SP verifies the signature and confirms the correspondence between the user's public and private keys. Step S67: The application service provider SP verifies the correspondence between the user's public key and the DID on the blockchain; Step S68: The user authorizes the blockchain to disclose the identity attribute information to the application service provider SP; Step S69: The blockchain sends the identity verification result and the identity attribute information authorized by the user to the application service provider SP to complete the user digital identity authentication process; The application service provider SP includes two modes when verifying the user's identity: Mode 1, the application service provider SP develops the login verification front-end and back-end programs according to the relevant rules of the consensus protocol, interacts with the user ID_APP to complete the binding confirmation of the public and private keys, and verifies the user DID on the blockchain; Mode 2, the application service provider SP receives the identity information transmitted by the blockchain in the URL and confirms the user DID who is requesting the URL; The specific working process of Mode 1 includes: Step SS1: The user uses a browser to access the SP website service; Step SS2, SP determines that the user is in an uncompleted identity authentication state, generates verification condition information verify_Info, including the DID and name of SP, namely SP_DID, SP_name, login verification background interface address Verify_URL, verification identifier hexadecimal random code HEX_nonce, condition information generation timestamp TimeStamp, and generates a QR code with the verification condition information and displays it on the verification page; Step SS3, the user obtains the above verify_Info by scanning the QR code through ID_DAPP, signs the verify_Info with the user's private key to obtain verify_Info_Sign, calls the SP's background verification interface address verify_URL to send verify_Info_Sign, user DID, HEX_nonce, and user public key PK_user to SP; Step SS4: After receiving the information, SP uses PK_user to verify the signature of verify_Info_Sign. If the signature verification is successful, it confirms that the verification with HEX_nonce as the identification code is successful, the public and private key pair is verified successfully, and the public key PK_user and the user DID are bound to verify the relationship, and a verification request is initiated to the blockchain; Step SS5: After receiving the verification request, the blockchain verifies the correspondence between the DID status and the public key stored on the chain, and feeds back the verification result to the SP; Step SS6: After receiving the successful verification information, SP notifies the user DID_DAPP and redirects the user's browser to the successful verification page. The user identity verification process is completed. The specific working process of Mode 2 includes: Step SS10: The user uses a browser to complete identity authentication and login operations on the blockchain digital identity authentication service website; Step SS20: When a user accesses an SP, the blockchain generates user identity notification information DID_pushInfo, encrypts DID_pushInfo using the SP public key to obtain DID_pushInfo_cipher, and sends DID_pushInfo_sign and DID_pushInfo_cipher to the SP along with the access request. Step SS30: SP uses the private key to decrypt DID_pushInfo_cipher to obtain DID_pushInfo, and uses the blockchain public key to verify the consistency of DID_pushInfo_sign. If the user identity verification process is successful, the user DID is allowed to log in. Step SS40: When the user visits other SPs during the validity period of the user browser session, steps SS20-SS30 are repeated to complete the user identity authentication process; The rules of the consensus protocol include: Consensus 1: The user downloads and installs ID_DAPP, uses ID_DAPP to access the identity authentication blockchain, generates a globally unique user DID and public-private key pair, and the blockchain records the binding relationship between ID_DAPP, public-private key pair and DID; Consensus 2: The IDP completes the real-name authentication of the user and generates the user's digital identity certificate. The identity certificate is signed by the authenticated IDP. The IDP uses the regulator's public key and the user's public key to encrypt the identity certificate, and sends the two encrypted files and the signature file to the blockchain. The blockchain sends the regulator's public key encrypted file to the regulator, records the user's public key encrypted file on the blockchain for the user to access at any time, saves the signature file on the blockchain, and sets the user's DID to the authenticated identity certificate status; Consensus 3: When verifying the use of user digital identity, ID_DAPP and SP complete the correspondence between user DID and user public key through public-private key verification technology, verify the conditions, and SP initiates a verification query to the blockchain. The blockchain gives feedback based on the records on the chain. If the verification is successful, the identity verification process is completed; Consensus 4: After completing the verification of the user's identity, the blockchain will notify the SP that the user is requesting to log in to based on the user's access request to other SPs within the validity period of the user session. The SP will no longer initiate identity authentication requests to the user.

2. According to claim 1, a decentralized identity authentication service system based on web3.0 is characterized in that: The specific process of step S2 includes: Step S21, the Internet user accesses the blockchain through the personal identity data management terminal ID_DAPP, generates the user private key Skuser and the public key PKuser, and completes the identity binding of the personal identity data management terminal ID_DAPP with the blockchain; Step S22: The blockchain smart contract creates a decentralized distributed digital identity specification DID for the user, and assigns the user or the user selects an identity real-name authentication institution IDP to perform digital identity real-name authentication; Step S23, the real-name authentication institution IDP interacts with the user's personal identity data management terminal ID_DAPP to complete the verification of the user's real identity and generate a user identity credible certificate; Step S24, VC_IDP uses the regulatory agency public key and the user public key to encrypt the credential respectively to obtain VC_cipherTxTgov and VC_cipherTxtuser, and uses the IDP private key to sign the VC to obtain the hash value of the credential and the signature files VC_Hash and VC_Sign; Step S25, the identity real-name authentication agency IDP sends the above four files to the blockchain, and the blockchain sends VC_cipherTxTgov to the regulatory agency for storage. VC_cipherTxtuser, VC_Hash and VC_Sign are recorded in the blockchain, recording that the user has obtained the certificate. VC_cipherTxtuser can be called by the user at any time to complete the user's digital identity real-name authentication and certificate issuance process.

3. According to claim 2, a decentralized identity authentication service system based on web3.0 is characterized in that: When Internet users need services from other application service providers SP, they need to apply for digital identity and usage verification from these application service providers SP, and repeat the steps S1-S7. Different application service providers SP will also reach cooperation models with different identity real-name authentication agencies IDP and adopt different real-name authentication methods.

4. According to claim 1, a decentralized identity authentication service system based on web3.0 is characterized in that: The user identity notification information DID_pushInfo includes user DID, SP_DID, timestamp TimeStamp, HEX_nonce, and a signature DID_pushInfo_sign of DID_pushInfo using a blockchain private key.

Images