A self-derivable cross-domain identity authentication method and system based on blockchain

Abstract

The present invention relates to the field of blockchain security technology, and discloses a self-derivative cross-domain identity authentication method and system based on blockchain, the method comprising: a user client sends a commitment and a zero-knowledge proof of an attribute to the blockchain based on its own public-private key pair, and sends a certificate issuance request to the blockchain at the same time; the blockchain verifies the received data, signs the received data after the verification, generates an original identity certificate, and returns the original identity certificate to the user client; the user client obtains a self-derivative identity certificate; the self-derivative identity certificate is an unlinkable anonymous one-time identity certificate; the user client performs identity authentication on different service providing servers in different domains based on the self-derivative identity certificate; if the user client meets the access conditions of the target service providing server, the user client can obtain the access rights of the service after the identity authentication is passed. Secure accountability is achieved without a trusted arbitrator.

Description

Technical Field

[0001] The present invention relates to the field of blockchain security technology, and in particular to a blockchain-based self-derivative cross-domain identity authentication method and system. Background Art

[0002] With the rapid development of the Internet and information technology, the demand for user clients to authenticate and access services between different services is increasing. Traditional identity authentication systems usually rely on centralized authentication agencies, which not only face the risk of single point failure and abuse of power, but also the privacy information of user clients is easily leaked during the authentication and storage process. In order to improve the security and privacy protection capabilities of identity authentication, researchers and technical experts have begun to explore decentralized identity authentication methods based on blockchain technology.

[0003] The introduction of blockchain brings trust and irreplaceable security features to distributed trustless scenarios. It can provide a decentralized trust mechanism for different services in multiple domains, perform cross-domain identity authentication, and achieve cross-domain fine-grained access control.

[0004] However, due to the transparency of blockchain, cross-domain identity authentication based on blockchain has the following security issues: (1) Many anonymous identity certificate schemes used for cross-domain trust establishment on blockchain face the problem of privacy leakage. This is because they need to display plaintext attributes and certificates on the blockchain when issuing and verifying anonymous certificates, and transparent blockchain will leak this sensitive information. (2) Cross-domain identity authentication requires anonymous identity authentication without a central authority, while ensuring the traceability of malicious user clients to ensure that malicious behavior is traced to the user client. This is challenging to achieve. (3) User client identity certificates rely on central agencies to issue. As unique identity credentials, there may be identity association problems when accessing different services, resulting in mutual association and privacy leakage between different accesses and transactions. Summary of the invention

[0005] In order to solve the deficiencies of the prior art, the present invention provides a self-derivable cross-domain identity authentication method and system based on blockchain; blockchain is used to establish a multi-domain trust layer for cross-domain user client identity authentication based on anonymous digital certificates. Anonymity refers to the anonymity of the user client to the service provider server during the identity request, identity authentication, and service access process. In the scheme, the user client's long-term identity certificate is verified and issued by the blockchain, and can be self-derived by the user client to generate an anonymous, one-time identity certificate to achieve unassociated cross-domain multi-service fine-grained access. Optional accountability refers to the free choice of the traceability of the identity certificate negotiated by the user client and the service provider server during the self-derivation process. For user clients with high anonymity requirements, a completely untraceable one-time identity certificate can be generated during derivation; and for services with traceability requirements, the user client can embed an encrypted association prefix in the self-derived identity certificate to achieve secure accountability without a trusted arbitrator.

[0006] On the one hand, a self-derivative cross-domain identity authentication method based on blockchain is provided, including: a user client, a service provider server and a blockchain all generate their own public-private key pairs; the user client sends a commitment to an attribute and a zero-knowledge proof to the blockchain based on its own public-private key pair, and at the same time sends a certificate issuance request to the blockchain; the blockchain verifies the received data, signs the received data after the verification, generates an original identity certificate, and returns the original identity certificate to the user client; the user client self-derives an identity certificate based on the original identity certificate to obtain a self-derived identity certificate; the self-derived identity certificate is an anonymous one-time identity certificate that cannot be linked; the user client performs identity authentication on different service provider servers in different domains based on the self-derived identity certificate; if the user client meets the access conditions of the target service provider server, the access rights to the service can be obtained after the identity authentication is passed.

[0007] On the other hand, a self-derivative cross-domain identity authentication system based on blockchain is provided, including: a user client, a service provider server, and a blockchain; the user client, the service provider server, and the blockchain all generate their own public-private key pairs; the user client sends a commitment to attributes and a zero-knowledge proof to the blockchain based on its own public-private key pair, and at the same time sends a certificate issuance request to the blockchain; the blockchain verifies the received data, signs the received data after the verification, generates an original identity certificate, and returns the original identity certificate to the user client; the user client self-derives an identity certificate based on the original identity certificate to obtain a self-derived identity certificate; the self-derived identity certificate is an unlinkable anonymous one-time identity certificate; the user client performs identity authentication on different service provider servers in different domains based on the self-derived identity certificate; if the user client meets the access conditions of the target service provider server, the access rights to the service can be obtained after the identity authentication is passed.

[0008] The above technical solution has the following advantages or beneficial effects: Compared with the original cross-domain identity authentication method, the present invention realizes anonymous identity authentication in a decentralized environment, so that the user client can fully control its anonymous identity, and supports privacy-protected cross-domain fine-grained access control with flexible optional accountability without relying on a trusted arbitrator. The present invention adopts modifiable signature and zero-knowledge proof technology to avoid disclosing user client attributes and certificates on the blockchain when issuing and verifying anonymous identity certificates, thereby protecting user client sensitive information. Allowing the user client to derive a one-time identity certificate to avoid the correlation between multiple visits, the privacy protection capability is stronger than the existing solution. The cross-domain identity authentication architecture based on blockchain is easy to implement, because the blockchain's algorithms and content are publicly accessible and highly reliable, each domain only needs to be compatible with the blockchain's identity authentication algorithm without making too many changes, and the user client does not need to apply multiple times between different domains. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0010] Figure 1 This is a flow chart of the method of embodiment 1. DETAILED DESCRIPTION

[0011] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0012] Embodiment 1: This embodiment provides a self-derivative cross-domain identity authentication method based on blockchain, including: S101: the user client, the service provider server and the blockchain all generate their own public-private key pairs; S102: the user client sends a commitment to the attribute and a zero-knowledge proof to the blockchain based on its own public-private key pair, and sends a certificate issuance request to the blockchain at the same time; S103: the blockchain verifies the received data, signs the received data after the verification, generates an original identity certificate, and returns the original identity certificate to the user client; S104: the user client self-derives the identity certificate based on the original identity certificate to obtain a self-derived identity certificate; the self-derived identity certificate is an anonymous one-time identity certificate that cannot be linked; S105: the user client performs identity authentication to different service provider servers in different domains based on the self-derived identity certificate; if the user client meets the access conditions of the target service provider server, the access rights to the service can be obtained after the identity authentication is passed.

[0013] Furthermore, the S101: user client, service provider server, and blockchain all generate their own public and private key pairs, specifically including: S101-1: blockchain performs parameter setting and runs algorithm; Indicates the output of algorithm operation; is a bilinear pairing, where Three prime numbers Factorial cyclic groups, For mapping , for Generators of ; setup algorithm to run zero-knowledge proof ,in, is a public reference string, To extract the key, For security parameters; choose two secure hash functions and , is a prime number Integer cyclic group of order, let And output ; Indicates fixed length; S101-2: Key generation, user client, service provider server, and blockchain all generate their own public and private key pairs.

[0014] It should be understood that the zero-knowledge proof setting algorithm , from Jens G, Amit S. EFFICIENT NON-INTERACTIVE PROOF SYSTEMS FOR BILINEAR GROUPS [J]. SIAM Journal on Computing, 2012(5):41.

[0015] Furthermore, in S101-2: key generation, the user client, service provider server, and blockchain all generate their own public and private key pairs, including: S101-21: the user client calculates the public and private key pairs ,in ,Right now for A randomly selected element from Random selection; S101-22: The member management service in the blockchain runs the blockchain member management service key generation algorithm to obtain the certificate management public and private key pair ; S101-23: Each service provider server generates a public-private key pair ,in .

[0016] Furthermore, the member management service in the blockchain runs the blockchain member management service key generation algorithm to obtain the certificate management public and private key pair. , including: inputting security parameters into the blockchain and the number of attributes used to generate the original identity certificate .

[0017] Blockchain Selection ; Blockchain computing ; Blockchain computing .

[0018] Blockchain computing .

[0019] make ; Return the certificate management public and private key pair .

[0020] Furthermore, the S102: user client sends a commitment and a zero-knowledge proof of the attribute to the blockchain based on its own public-private key pair, and sends a certificate issuance request to the blockchain, including: S102-1: the user client selects a random secret key pair. For user client attributes and the user's client private key Make a commitment computation to ensure their privacy and unforgeability during identity issuance; .

[0021] S102-2: The user client calculates the zero-knowledge proof π.

[0022] .

[0023] in, The algorithm checks the public and private key pair of the user client Is it a pair of public and private keys? Algorithm judgment Is it equal to , if they are equal, then is 1 if not, 0 otherwise.

[0024] S102-3: User client sends Give the blockchain and complete the identity certificate request.

[0025] It should be understood that the , from Jens G, Amit S. EFFICIENT NON-INTERACTIVE PROOF SYSTEMS FOR BILINEAR GROUPS [J]. SIAM Journal on Computing, 2012(5):41.

[0026] It should be understood that certificate issuance is an interactive protocol between the user client U and BL, which can be implemented on or off the chain. The user client submits a long-term identity certificate application to the blockchain member management service. The user client first selects a random number Used to blind the attribute values ​​of the user client. and zero-knowledge proof Without revealing the attributes and private keys, convince the blockchain BL that it knows After receiving the user client request, the blockchain BL verifies the zero-knowledge proof, generates the user client master identity certificate and returns it to the user client for self-derivation.

[0027] Furthermore, the S103: blockchain verifies the received data, signs the received data after the verification, generates an original identity certificate, and returns the original identity certificate to the user client, including: S103-1: after receiving the certificate issuance request from the user client, the blockchain commits and zero-knowledge proof π to ensure the authenticity and integrity; if the blockchain verification succeeds, the blockchain randomly selects , compute the blinded identity certificate: and sends the blinded identity certificate to the user client.

[0028] S103-2: After the user client receives the blinded identity certificate, the blinded identity certificate is verified and unblinded to obtain the original identity certificate ,in, for The unit element on .

[0029] S103-3: Blockchain Records , complete the user client registration.

[0030] Furthermore, the S104: the user client derives an identity certificate based on the original identity certificate to obtain a self-derived identity certificate; the self-derived identity certificate is an anonymous one-time identity certificate that cannot be linked, including: S104-1: input , the private key of the blockchain , , Represents an attribute-based access policy, ; Indicates client attributes; the attribute-based access policy means that if the attribute conditions are met, 1 is returned, and if the attribute conditions are not met, 0 is returned.

[0031] S104-2: Select an attribute set for generating a one-time certificate so that the attribute subset Comply with the access policy of the target service ,satisfy ;in, If D meets the attribute policy, 1 is returned; if it does not meet the attribute policy, 0 is returned. S104-3: Random selection .

[0032] S104-4: Calculate derived signature ,in: .

[0033] .

[0034] S104-5: If the target service requires traceability, , otherwise randomly select ; Among them, traceability means that the anonymous identity certificate can be traced to the user's permanent identity.

[0035] S104-6: Calculate the associated prefix , and hash .

[0036] S104-7: Computing Zero-Knowledge Proofs :

[0037] .

[0038] S104-8: Return a one-time anonymous self-derived identity certificate .

[0039] The user client runs the DeriveShow algorithm of S104-1 to S104-8 to obtain multiple self-derived one-time short-term identity certificates for displaying and authenticating to different service provision servers in different domains.

[0040] For the target service provider server in the target domain, the user client obtains the public key of the target service provider server and attribute-based access policies , and runs the DeriveShow algorithm of S104-1~S104-8 to generate a self-derived identity certificate of the target service provider server.

[0041] It should be understood that in order to effectively prove that the user client complies with the access policy of the target service provider server (SP) To specify the identity attribute information, the user client first sets an attribute subset D such that Then, a one-time anonymous self-derived identity certificate is derived from the long-term identity certificate obtained on the blockchain. . Does not contain information that is not an attribute in D. In order to maintain optional accountability, There is a link hidden in the credentials , the link It is a random value indicating complete untraceability, or a user client public key indicating cryptographic linkability, which is passed to the SP after encryption and hashing for subsequent anonymous identity authentication and accountability.

[0042] Further, the S105: the user client performs identity authentication with different service providing servers in different domains based on the self-derived identity certificate; if the user client meets the access conditions of the target service providing server, after the identity authentication is passed, the user client can obtain access rights to the service, including: S105-1: Any party is allowed to run the verification Perform identity authentication. If the authentication is successful, it means that the access complies with the access policy. ; S105-2: User client tracking: To track the user client, the service provider server only needs to decrypt .

[0043] If a random , then the identity certificate is not traceable. The two visits can be associated, which is applicable to the scenario of multiple service provision visits for the same business.

[0044] If the decrypted If it is the user client public key, the original identity certificate of the user client can be traced by querying the blockchain.

[0045] For malicious access, the blockchain will implement punishment measures such as long-term identity revocation and blacklisting.

[0046] The model of the present invention consists of three roles, namely user client, service provider server, and blockchain: User client (U): The user client has a unique real-world identity uid and sensitive attributes that can be used for identity identification When user clients access cross-domain services, privacy must be maintained to avoid being associated with real-world identities through behaviors and transactions in the network.

[0047] Blockchain (BL): The membership service in the blockchain is responsible for issuing and verifying the long-term identity certificates of user clients. It can provide user client certificate related information for multiple domains and open query access rights to different domains.

[0048] Service Provider (SP): An entity distributed in different domains that provides services to user clients and plays the role of an authenticator to verify that the user client's access satisfies certain attribute-based fine-grained access policies.

[0049] like Figure 1 As shown in the figure, the model consists of two parts, namely certificate issuance and identity authentication. Certificate issuance is carried out between the blockchain BL and the user client U. The user client U initiates the request and sends the commitment and zero-knowledge proof of the attribute to the blockchain BL. The blockchain BL verifies these contents, signs them using an editable signature scheme, and then returns them to the user client U as the original identity certificate. The user client derives the certificate based on the original identity certificate, and can achieve attribute-based cross-domain anonymous identity authentication without being associated with the original certificate. The authentication process allows the user client U to derive an unlinkable anonymous one-time identity certificate as a one-time identity of the user client to authenticate to different SPs in different domains. If the user client U meets the access conditions of the target service provider server SP, it can obtain access rights to the service after successful verification.

[0050] Embodiment 2: This embodiment provides a self-derivative cross-domain identity authentication system based on blockchain, including: a user client, a service provider server and a blockchain; the user client, the service provider server and the blockchain all generate their own public-private key pairs; the user client sends a commitment to attributes and a zero-knowledge proof to the blockchain based on its own public-private key pair, and at the same time sends a certificate issuance request to the blockchain; the blockchain verifies the received data, signs the received data after the verification, generates an original identity certificate, and returns the original identity certificate to the user client; the user client self-derives an identity certificate based on the original identity certificate to obtain a self-derived identity certificate; the self-derived identity certificate is an anonymous one-time identity certificate that cannot be linked; the user client performs identity authentication on different service provider servers in different domains based on the self-derived identity certificate; if the user client meets the access conditions of the target service provider server, the access rights to the service can be obtained after the identity authentication is passed.

[0051] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A self-derivable cross-domain identity authentication method based on blockchain, characterized in that: include: The user client, service provider server and blockchain all generate their own public and private key pairs; The user client sends a commitment and zero-knowledge proof of the attribute to the blockchain based on its own public-private key pair, and sends a certificate issuance request to the blockchain, including: the user client selects a random secret For user client attributes and the user's client private key Make a commitment computation to ensure their privacy and unforgeability during identity issuance; ； The user client calculates the zero-knowledge proof π, ； The algorithm checks the public and private key pair of the user client Is it a pair of public and private keys? If yes, it is 1, otherwise it is 0: The user client sends Give the blockchain and complete the identity certificate request; The blockchain verifies the received data, signs the received data after verification, generates an original identity certificate, and returns the original identity certificate to the user client; the user client derives the identity certificate based on the original identity certificate to obtain a self-derived identity certificate; the self-derived identity certificate is an anonymous one-time identity certificate that cannot be linked; the user client performs identity authentication with different service provider servers in different domains based on the self-derived identity certificate; if the user client meets the access conditions of the target service provider server, after identity authentication, the user client can obtain access rights to the service; The self-derived identity certificate comprises: enter , the private key of the blockchain , , Represents an attribute-based access policy, ; Indicates client attributes; the attribute-based access policy means that if the attribute condition is met, 1 is returned, and if the attribute condition is not met, 0 is returned; Select the attribute set for generating a one-time certificate so that the attribute subset Comply with the access policy of the target service ,satisfy ;in, If D meets the attribute policy, 1 is returned, and if it does not meet the attribute policy, 0 is returned. Random Selection ; Calculate derived signature ,in: ； ； If the target service requires traceability, , otherwise randomly select ; Among them, traceability means that the anonymous identity certificate can be traced to the user's permanent identity; Calculate the associated prefix , and hash ; Computing Zero-Knowledge Proofs : ； Returns a one-time anonymous self-derived identity certificate ; The user client authenticates itself to different service providers in different domains based on the self-derived identity certificate. If the user client meets the access conditions of the target service provider, it can obtain access rights to the service after the authentication is passed, including: Any party is allowed to verify by running Perform identity authentication. If the authentication is successful, it means that the access complies with the access policy. ; User client tracking: To track the user client, the service provider server only needs to decrypt ; The self-derived identity certificate is a one-time identity certificate with optional accountability; optional accountability refers to the free choice of identity certificate traceability negotiated by the user client and the service provider server during the self-derivation process; for services that require traceability, the user client can achieve secure accountability by embedding an encrypted association prefix in the self-derived identity certificate; a link is hidden in the anonymous one-time identity certificate credential , the link Is a random value indicating complete untraceability, or, is the user client public key indicating cryptographic linkability, which is encrypted and hashed and passed to the service provider server; if it contains a random , then the identity certificate is not traceable, by including the same Associating the two visits is applicable to the scenario of multiple service provision visits for the same business; if the decrypted If it is the user client public key, the original identity certificate of the user client can be tracked by querying the blockchain; for malicious access, the blockchain will execute long-term identity revocation and blacklisting punishment measures.

2. A self-derivable cross-domain identity authentication method based on blockchain as claimed in claim 1, characterized in that: The user client, service provider server and blockchain all generate their own public and private key pairs, including: Blockchain sets parameters and runs algorithm; Represents the output of algorithm operation; Select is a bilinear pairing, where Three prime numbers Factorial cyclic groups, For mapping , for The generator of Setting up the algorithm to run a zero-knowledge proof ,in, is a public reference string, To extract the key, is a safety parameter; Choose two secure hash functions and , is a prime number Integer cyclic group of order, let And output ; Indicates fixed length; Key generation: user clients, service provider servers, and blockchains all generate their own public and private key pairs.

3. A self-derivable cross-domain identity authentication method based on blockchain as claimed in claim 2, characterized in that: Key generation: User clients, service providers, and blockchains all generate their own public and private key pairs, including: The user client calculates the public-private key pair ,in ,Right now for A randomly selected element from is randomly selected; The member management service in the blockchain runs the blockchain member management service key generation algorithm to obtain the certificate management public and private key pair ; Each service provider generates a public and private key pair ,in .

4. A self-derivable cross-domain identity authentication method based on blockchain as claimed in claim 3, characterized in that: The member management service in the blockchain runs the blockchain member management service key generation algorithm to obtain the certificate management public and private key pair ,include: Entering security parameters into the blockchain and the number of attributes used to generate the original identity certificate ; Blockchain Selection ; Blockchain computing ; Blockchain computing ; Blockchain computing ; make ; Return to Certificate Management Public and Private Key Pairs .

5. A self-derivable cross-domain identity authentication method based on blockchain as claimed in claim 1, characterized in that: The blockchain verifies the received data, signs the received data after verification, generates an original identity certificate, and returns the original identity certificate to the user client, including: After receiving the certificate issuance request from the user client, the blockchain commits and zero-knowledge proof π to ensure the authenticity and integrity; If the blockchain verification succeeds, the blockchain randomly selects , compute the blinded identity certificate: , and send the blinded identity certificate to the user client; After the user client receives the blinded identity certificate, the blinded identity certificate is verified and deblinded to obtain the original identity certificate ,in, for The unit element on ; Blockchain records , complete the user client registration.

6. A self-derivable cross-domain identity authentication system based on blockchain, characterized in that: include: User client, service provider server, blockchain; The user client, service provider server and blockchain all generate their own public and private key pairs; The user client sends a commitment and zero-knowledge proof of the attribute to the blockchain based on its own public-private key pair, and sends a certificate issuance request to the blockchain, including: the user client selects a random secret For user client attributes and the user's client private key Make a commitment computation to ensure their privacy and unforgeability during identity issuance; ； The user client calculates the zero-knowledge proof π, ； The algorithm checks the public and private key pair of the user client Is it a pair of public and private keys? If yes, it is 1, otherwise it is 0: The user client sends Give the blockchain and complete the identity certificate request; The blockchain verifies the received data, signs the received data after verification, generates an original identity certificate, and returns the original identity certificate to the user client; The user client derives an identity certificate based on the original identity certificate to obtain a self-derived identity certificate; the self-derived identity certificate is an anonymous one-time identity certificate that cannot be linked; The user client authenticates itself to different service providers in different domains based on the self-derived identity certificate. If the user client meets the access conditions of the target service provider, it can obtain access rights to the service after the authentication is passed. The self-derived identity certificate comprises: enter , the private key of the blockchain , , Represents an attribute-based access policy, ; Indicates client attributes; the attribute-based access policy means that if the attribute condition is met, 1 is returned, and if the attribute condition is not met, 0 is returned; Select the attribute set for generating a one-time certificate so that the attribute subset Comply with the access policy of the target service ,satisfy ;in, If D meets the attribute policy, 1 is returned, and if it does not meet the attribute policy, 0 is returned. Random Selection ; Calculate derived signature ,in: ； ； If the target service requires traceability, , otherwise randomly select ; Among them, traceability means that the anonymous identity certificate can be traced to the user's permanent identity; Calculate the associated prefix , and hash ; Computing Zero-Knowledge Proofs : ； Returns a one-time anonymous self-derived identity certificate ; The user client authenticates itself to different service providers in different domains based on the self-derived identity certificate. If the user client meets the access conditions of the target service provider, it can obtain access rights to the service after the authentication is passed, including: Any party is allowed to verify by running Perform identity authentication. If the authentication is successful, it means that the access complies with the access policy. ; User client tracking: To track the user client, the service provider server only needs to decrypt ; The self-derived identity certificate is a one-time identity certificate with optional accountability; optional accountability refers to the free choice of identity certificate traceability negotiated by the user client and the service provider server during the self-derivation process; for services that require traceability, the user client can achieve secure accountability by embedding an encrypted association prefix in the self-derived identity certificate; A link is hidden in the anonymous one-time identity certificate credential , the link Is a random value indicating complete untraceability, or, is the user client public key indicating cryptographic linkability, which is encrypted and hashed and passed to the service provider server; if it contains a random , then the identity certificate is not traceable, by including the same Associating the two visits is applicable to the scenario of multiple service provision visits for the same business; if the decrypted If it is the user client public key, the original identity certificate of the user client can be tracked by querying the blockchain; for malicious access, the blockchain will execute long-term identity revocation and blacklisting punishment measures.

7. A self-derivable cross-domain identity authentication system based on blockchain as claimed in claim 6, characterized in that: The blockchain verifies the received data, signs the received data after verification, generates an original identity certificate, and returns the original identity certificate to the user client, including: After receiving the certificate issuance request from the user client, the blockchain commits and zero-knowledge proof π to ensure the authenticity and integrity; If the blockchain verification succeeds, the blockchain randomly selects , compute the blinded identity certificate: , and send the blinded identity certificate to the user client; After the user client receives the blinded identity certificate, the blinded identity certificate is verified and deblinded to obtain the original identity certificate ,in, for The unit element on ; Blockchain records , complete the user client registration.

Images