Blockchain-based digital identity management method, system, electronic device and computer readable storage medium

Abstract

The application provides a blockchain-based digital identity management method, system, electronic device and computer readable storage medium. The method comprises: performing at least one of a digital identity query step, a digital identity verification step and a digital identity revocation step in a blockchain network; and generating an audit log entry in real time for each key event during the execution of the digital identity management step and storing the audit log entry to the blockchain after encryption for authorized users issuing audit log access to trace and view the audit log entry. The application can protect user privacy while ensuring the authenticity of user digital identity information, and at the same time realize tracking and auditing of the digital identity authentication process, thereby effectively improving the convenience and transparency of digital identity management.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a digital identity management method and system based on a blockchain, an electronic device, and a computer readable storage medium. BACKGROUND

[0002] Digital identity management plays an important role in business scenarios such as power. With the digital development of business scenarios such as power, the application of electronic certificates has important practical needs. The development of digital and Internet technologies makes the management of certificates and identity authentication in the power business more and more important. Industries such as power need effective identity authentication mechanisms to ensure that employees, enterprises, and users in industries such as power are reliable, secure, and trustworthy.

[0003] However, the traditional digital identity management method has the risk of single point of failure and data leakage, and cannot guarantee the security of user identity information. Centralized management also easily causes the "information island" effect, that is, the identity information between different organizations cannot be effectively shared and communicated, resulting in users needing to repeatedly submit the same information for identity authentication. Further, even if the existing digital identity management method can guarantee user privacy, it is difficult to ensure the degree of transparency of the digital identity management process on this basis, making it difficult to trace the digital identity authentication process and causing chaos in digital identity management.

[0004] Therefore, there is an urgent need to design a digital identity management method that can protect user privacy while ensuring the authenticity of identity information and simultaneously track the digital identity authentication process. SUMMARY

[0005] In view of this, the embodiments of the present application provide a digital identity management method and system based on a blockchain, an electronic device, and a computer readable storage medium to eliminate or improve one or more defects in the prior art.

[0006] One aspect of the present application provides a digital identity management method based on a blockchain, comprising:

[0007] executing a preset digital identity management step in a blockchain network, the digital identity management step comprising at least one of a digital identity registration step, a digital identity query step, a digital identity verification step, and a digital identity revocation step;

[0008] and, during the execution of the digital identity management step, based on a preset key event type, generating an audit log entry in real time for each key event in the digital identity management step, and storing the audit log entry in the blockchain after encryption, to send the audit log entry to an authorized user issuing an audit log access based on a preset log access interface and access rule.

[0009] In some embodiments of this application, the digital identity registration step is implemented based on CP-ABE encryption, IPFS system and AES encryption, the digital identity query step is implemented based on zero-knowledge proof, and the digital identity verification step is implemented based on multiple distributed verification nodes in the blockchain network.

[0010] In some embodiments of this application, if the current digital identity management step is the digital identity registration step, then the step of executing the preset digital identity management step in the blockchain network includes:

[0011] Receive a digital identity registration request from a target user in the blockchain network. The digital identity registration request includes: the target user's identity information and multiple verification nodes in the blockchain network specified by the target user.

[0012] The target user's identity information is encrypted using CP-ABE to obtain the corresponding identity information hash value. This identity information hash value is then stored in the IPFS system to obtain the unique IPFS address corresponding to the encrypted data generated and returned by the IPFS system.

[0013] The IPFS address is encrypted using AES to obtain an encrypted IPFS address;

[0014] Based on the target user's identity information, the verification node addresses corresponding to the multiple verification nodes specified by the target user, and the encrypted IPFS address, a unique identity identifier for the target user is generated.

[0015] The target user's unique identifier, the identity information hash value, the verification node addresses corresponding to the multiple verification nodes specified by the target user, the encrypted IPFS address, and the preset supplementary information are stored in the blockchain as the target user's identity credentials; wherein, the identity credentials also include the current credential verification status and credential expiration time of the identity credentials.

[0016] In some embodiments of this application, if the current digital identity management step is the digital identity query step, then executing the preset digital identity management step in the blockchain network includes:

[0017] In the blockchain network, a digital identity query request is received from a target user. The digital identity query request includes: the target user's unique identity identifier and a zero-knowledge proof generated in advance by the target user for its own identity information.

[0018] The zero-knowledge proof is verified; if the verification of the zero-knowledge proof passes, the smart contract is invoked based on the unique identity of the target user to query the identity credential corresponding to the target user in the blockchain.

[0019] The identity credentials are sent to the target user.

[0020] In some embodiments of this application, if the current digital identity management step is the digital identity verification step, then executing the preset digital identity management step in the blockchain network includes:

[0021] Receive a digital authentication request for the target user in the blockchain network, wherein the digital authentication request includes: the target user's unique identifier and the target user's identity information signature value;

[0022] Based on the unique identifier of the target user, find the verification node address corresponding to each of the multiple verification nodes pre-specified by the target user;

[0023] Based on the addresses of each verification node, the digital identity verification request for the target user is forwarded to each verification node pre-specified by the target user, so that each verification node invokes a smart contract according to the unique identity identifier of the target user, thereby enabling each verification node to verify the target user's identity information signature value and the target user's identity credentials pre-stored in the blockchain, and return the verification result data generated by each node.

[0024] Receive the verification result data sent back by each of the verification nodes;

[0025] Determine whether the number of verified result data that has passed verification meets a preset threshold. If so, determine that the target user has passed digital authentication and return the corresponding digital authentication pass message to the sender of the digital authentication request.

[0026] In some embodiments of this application, if the current digital identity management step is the digital identity revocation step, then executing the preset digital identity management step in the blockchain network includes:

[0027] Receive a digital identity revocation request issued by the target user in the blockchain network, wherein the digital identity revocation request includes: the identity information signature value of the target user;

[0028] The smart contract is invoked to verify the identity information signature value of the target user against the identity credentials of the target user pre-stored in the blockchain. If the verification is successful, the verification status in the identity credentials of the target user is modified from data indicating successful verification to data indicating identity revocation.

[0029] In some embodiments of this application, if the current digital identity management step is the digital identity revocation step, then executing the preset digital identity management step in the blockchain network includes:

[0030] In a blockchain network, a digital identity revocation request is received from a target verification node. The digital identity revocation request includes: a signature value of the identity information hash value; the signature value of the identity information hash value is obtained by the target verification node in advance signing the identity information hash value of the target user based on its own private key.

[0031] The private key of the target verification node is verified based on the signature value of the hash value of the identity information;

[0032] If the verification of the private key of the target verification node is successful, the smart contract is invoked to verify whether the target verification node is included in the various verification nodes specified in the identity credentials of the target user pre-stored in the blockchain.

[0033] If the target verification node is included in each of the verification nodes specified by the target user, then the verification status in the target user's identity credential is modified from data indicating successful verification to data indicating identity revocation.

[0034] In some embodiments of this application, the audit log entries are used to store the correspondence between timestamps, key event types, hash digests of identity information, and operator identifiers of key events.

[0035] Another aspect of this application provides a blockchain-based digital identity management system, comprising:

[0036] The digital identity management module is used to execute preset digital identity management steps in a blockchain network. The digital identity management steps include at least one of the following: digital identity registration step, digital identity query step, digital identity verification step, and digital identity revocation step.

[0037] The audit log recording and tracing module is used to generate audit log entries in real time for each key event in the digital identity management step based on preset key event types during the execution of the digital identity management step, and to encrypt and store the audit log entries in the blockchain, and to send the audit log entries to the authorized user who issues the audit log access based on the preset log access interface and access rules.

[0038] In some embodiments of this application, the digital identity registration step is implemented based on CP-ABE encryption, IPFS system and AES encryption, the digital identity query step is implemented based on zero-knowledge proof, and the digital identity verification step is implemented based on multiple distributed verification nodes in the blockchain network.

[0039] In some embodiments of this application, if the current digital identity management step is the digital identity registration step, then the digital identity management module includes: a digital identity registration unit, which is used to perform the following:

[0040] Receive a digital identity registration request from a target user in the blockchain network. The digital identity registration request includes: the target user's identity information and multiple verification nodes in the blockchain network specified by the target user.

[0041] The target user's identity information is encrypted using CP-ABE to obtain the corresponding identity information hash value. This identity information hash value is then stored in the IPFS system to obtain the unique IPFS address corresponding to the encrypted data generated and returned by the IPFS system.

[0042] The IPFS address is encrypted using AES to obtain an encrypted IPFS address;

[0043] Based on the target user's identity information, the verification node addresses corresponding to the multiple verification nodes specified by the target user, and the encrypted IPFS address, a unique identity identifier for the target user is generated.

[0044] The target user's unique identifier, the identity information hash value, the verification node addresses corresponding to the multiple verification nodes specified by the target user, the encrypted IPFS address, and the preset supplementary information are stored in the blockchain as the target user's identity credentials; wherein, the identity credentials also include the current credential verification status and credential expiration time of the identity credentials.

[0045] In some embodiments of this application, if the current digital identity management step is the digital identity query step, then the digital identity management module includes: a digital identity query unit, which is used to perform the following:

[0046] In the blockchain network, a digital identity query request is received from a target user. The digital identity query request includes: the target user's unique identity identifier and a zero-knowledge proof generated in advance by the target user for its own identity information.

[0047] The zero-knowledge proof is verified; if the verification of the zero-knowledge proof passes, the smart contract is invoked based on the unique identity of the target user to query the identity credential corresponding to the target user in the blockchain.

[0048] The identity credentials are sent to the target user.

[0049] In some embodiments of this application, if the current digital identity management step is the digital authentication step, then the digital identity management module includes: a digital authentication unit, which is used to perform the following:

[0050] Receive a digital authentication request for the target user in the blockchain network, wherein the digital authentication request includes: the target user's unique identifier and the target user's identity information signature value;

[0051] Based on the unique identifier of the target user, find the verification node address corresponding to each of the multiple verification nodes pre-specified by the target user;

[0052] Based on the addresses of each verification node, the digital identity verification request for the target user is forwarded to each verification node pre-specified by the target user, so that each verification node invokes a smart contract according to the unique identity identifier of the target user, thereby enabling each verification node to verify the target user's identity information signature value and the target user's identity credentials pre-stored in the blockchain, and return the verification result data generated by each node.

[0053] Receive the verification result data sent back by each of the verification nodes;

[0054] Determine whether the number of verified result data that has passed verification meets a preset threshold. If so, determine that the target user has passed digital authentication and return the corresponding digital authentication pass message to the sender of the digital authentication request.

[0055] In some embodiments of this application, if the current digital identity management step is the digital identity revocation step, then the digital identity management module includes: a first digital identity revocation unit, which is used to perform the following:

[0056] Receive a digital identity revocation request issued by the target user in the blockchain network, wherein the digital identity revocation request includes: the identity information signature value of the target user;

[0057] The smart contract is invoked to verify the identity information signature value of the target user against the identity credentials of the target user pre-stored in the blockchain. If the verification is successful, the verification status in the identity credentials of the target user is modified from data indicating successful verification to data indicating identity revocation.

[0058] In some embodiments of this application, if the current digital identity management step is the digital identity revocation step, then the digital identity management module includes: a second digital identity revocation unit, which is used to perform the following:

[0059] In a blockchain network, a digital identity revocation request is received from a target verification node. The digital identity revocation request includes: a signature value of the identity information hash value; the signature value of the identity information hash value is obtained by the target verification node in advance signing the identity information hash value of the target user based on its own private key.

[0060] The private key of the target verification node is verified based on the signature value of the hash value of the identity information;

[0061] If the verification of the private key of the target verification node is successful, the smart contract is invoked to verify whether the target verification node is included in the various verification nodes specified in the identity credentials of the target user pre-stored in the blockchain;

[0062] If the target verification node is included in each of the verification nodes specified by the target user, then the verification status in the target user's identity credential is modified from data indicating successful verification to data indicating identity revocation.

[0063] In some embodiments of this application, the audit log entries are used to store the correspondence between timestamps, key event types, hash digests of identity information, and operator identifiers of key events.

[0064] A third aspect of this application provides an electronic device including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor, when executing the computer program, implements the blockchain-based digital identity management method described above.

[0065] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the described blockchain-based digital identity management method.

[0066] The fifth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the described blockchain-based digital identity management method.

[0067] The blockchain-based digital identity management method provided in this application executes preset digital identity management steps in a blockchain network. These steps include at least one of the following: digital identity registration, digital identity query, digital identity verification, and digital identity revocation. Furthermore, during the execution of these steps, based on preset key event types, audit log entries are generated in real-time for each key event in the digital identity management steps. These audit log entries are then encrypted and stored on the blockchain. The audit log entries are then sent to authorized users who request audit log access based on preset log access interfaces and rules. This application can ensure the authenticity of users' digital identity information while protecting user privacy, and simultaneously achieves tracking and auditing of the digital identity authentication process, thereby effectively improving the convenience and transparency of digital identity management.

[0068] Additional advantages, objectives, and features of this application will be set forth in part in the description which follows, and will in part become apparent to those skilled in the art upon review of the following description, or may be learned by practice of the application. The objectives and other advantages of this application can be realized and obtained by means of the structures specifically pointed out in the specification and drawings.

[0069] Those skilled in the art will understand that the purposes and advantages that can be achieved with this application are not limited to those specifically described above, and that the above and other purposes that this application can achieve will be more clearly understood from the following detailed description. Attached Figure Description

[0070] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, do not constitute a limitation thereof. The components in the drawings are not drawn to scale but are merely for illustrating the principles of this application. For ease of illustration and description of certain parts of this application, corresponding portions in the drawings may be enlarged, i.e., may appear larger relative to other components in an exemplary device actually manufactured according to this application. In the drawings:

[0071] Figure 1 This is a flowchart illustrating a blockchain-based digital identity management method according to one embodiment of this application.

[0072] Figure 2 This is a schematic diagram of the first process of step 100 in a blockchain-based digital identity management method according to an embodiment of this application.

[0073] Figure 3 This is a schematic diagram illustrating the uploading of user digital identity credential information to the blockchain in one embodiment of this application.

[0074] Figure 4 This is a schematic diagram of the second process of step 100 in a blockchain-based digital identity management method according to an embodiment of this application.

[0075] Figure 5 This is a schematic diagram of the third process in step 100 of the blockchain-based digital identity management method in one embodiment of this application.

[0076] Figure 6 This is a schematic diagram of the fourth process in step 100 of the blockchain-based digital identity management method in one embodiment of this application.

[0077] Figure 7 This is a schematic diagram of the fifth process in step 100 of the blockchain-based digital identity management method in one embodiment of this application.

[0078] Figure 8 This is a schematic diagram illustrating the functional modules of a blockchain-based digital identity management system according to one embodiment of this application.

[0079] Figure 9 This is a schematic diagram illustrating the role interaction relationships in blockchain-based digital identity management for the power industry, as an application example of this application.

[0080] Figure 10 This is a schematic diagram of the user digital identity registration and authentication process in an application example of this application. Detailed Implementation

[0081] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and their descriptions are used to explain this application, but are not intended to limit it.

[0082] It should also be noted that, in order to avoid obscuring this application with unnecessary details, only the structures and / or processing steps closely related to the solution according to this application are shown in the accompanying drawings, while other details that are not closely related to this application are omitted.

[0083] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0084] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0085] In the following description, embodiments of the present application will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0086] With the development of digital and internet technologies, license management and identity authentication in the power industry have become increasingly important. Digital identity authentication can verify the identities of power industry personnel, enterprises, and users, ensuring that only authorized personnel can access power business systems. Based on digital identities, granular data access control can also be achieved, ensuring that only authorized personnel can view and modify specific data.

[0087] Traditional identity authentication systems suffer from problems such as centralized management, data breaches, and single points of failure, posing a threat to user privacy and security. To address these challenges, blockchain technology has been introduced into the field of digital identity authentication, leveraging its decentralized, immutable, and secure characteristics to provide users with more secure and reliable digital identity authentication solutions.

[0088] An existing blockchain-based digital identity verification method, system, electronic device, and computer-readable storage medium includes: obtaining a user-submitted identity verification request, digitally signing the request based on a random number generated by the blockchain, and sending it to an identity verification node in the blockchain; retrieving and executing a contract based on the identity verification node, decrypting the digital signature based on the execution contract to obtain an identity verification credential, mapping and comparing the identity verification credential with registered digital identity information in the blockchain to obtain a digital identity verification result; feeding back the digital identity verification result to a transaction terminal, and recording and storing the entire identity verification process parameters in a recording node in the blockchain based on the feedback result. However, this scheme still involves decryption of the digital signature, which may lead to the leakage of decrypted information, and the recorded full-process parameters may also pose a risk of privacy information leakage.

[0089] Another existing digital identity authentication method based on blockchain technology includes: building a blockchain network: a blockchain network is built in the form of a consortium blockchain to store and verify user identity information; identity registration: users provide basic personal information and identity documents, and use cryptographic algorithms to hash the user's basic personal information to generate a unique identity identifier, which is then recorded on the blockchain; identity verification: when identity verification is required, users provide corresponding identity documents, and verification nodes verify the validity and authenticity of the user's identity information through the records on the blockchain; identity authorization: users authorize their identity to specific institutions or individuals, and the authorization information is recorded on the blockchain; identity update: when a user's personal information changes, the personal digital identity information is updated through the identity update mechanism on the blockchain. This application uses a consortium blockchain to build the blockchain network; identity registration generates a unique identity identifier through hash calculation; identity verification uses a two-factor authentication method combined with multiple verification methods; identity authorization and identity update generate a new public-private key pair through smart contracts, verify the ownership of the old public key, bind the new public key with the identity information, and transfer the original assets to the new public key. However, hash calculation to generate a unique identity identifier may have the risk of duplication, and identity authorization and update through smart contracts are prone to vulnerability risks.

[0090] In the existing third authentication method, the steps include: a service node receiving an access request from a client, the access request including an access key AK and a signature, the signature being generated by the client based on a first security key SK corresponding to the AK, and the AK including a verification field; the service node verifying whether the AK was generated by the authentication node based on the verification field, a locally stored version number, and the public key corresponding to the version number; if the AK is determined to be generated by the authentication node, the service node sending the AK to the authentication node to obtain a second SK corresponding to the AK; when the first SK matches the second SK, the service node providing the client with the service requested by the access request. However, this method still relies on a centralized service node, posing a single point of failure risk. Furthermore, the access key verification relies solely on the verification field, version number, and public key, potentially leading to information tampering.

[0091] The above analysis reveals certain shortcomings in existing technical solutions regarding privacy protection, data security, and system reliability. Furthermore, the opacity and complexity of the digital identity authentication process in existing technologies make it difficult to effectively track and audit the identities of power industry personnel, thereby affecting the operational security and reliability of power business systems. Ensuring the authenticity of identity information while protecting user privacy is another technical challenge in existing identity authentication systems.

[0092] Therefore, in order to address the problems of existing digital identity management methods that fail to guarantee the transparency of the digital identity management process while ensuring user privacy, thus making the digital identity authentication process difficult to trace and easily causing chaos in digital identity management, this application provides a blockchain-based digital identity management method, a blockchain-based digital identity management system for executing the blockchain-based digital identity management method, an electronic device, a computer-readable storage medium, and a computer program product. These methods can ensure the authenticity of users' digital identity information while protecting user privacy, and simultaneously enable the tracking and auditing of the digital identity authentication process, thereby effectively improving the convenience and transparency of digital identity management.

[0093] The following examples will provide a detailed description.

[0094] Based on this, embodiments of this application provide a blockchain-based digital identity management method that can be implemented by a blockchain-based digital identity management system. See [link to relevant documentation]. Figure 1 The blockchain-based digital identity management method specifically includes the following:

[0095] Step 100: Execute a preset digital identity management step in the blockchain network, the digital identity management step including at least one of the following: digital identity registration step, digital identity query step, digital identity verification step, and digital identity revocation step.

[0096] Understandably, digital identity management is a crucial means of ensuring information security and preventing identity theft. An effective and secure digital identity management system can reduce security risks such as online fraud and information leaks, protecting the privacy of users' personal information. Furthermore, digital identity management can promote cross-departmental and cross-platform information sharing and interoperability. Through a unified and trustworthy digital identity management system, individuals' identity information can be authorized and shared across different institutions, achieving more efficient data flow and resource integration, and driving the development of the digital economy. Digital identity management plays a vital role in the trusted issuance and secure control of electronic certificates for the power industry.

[0097] The digital identity management method provided in this application is first implemented based on blockchain. The decentralized and tamper-proof characteristics of blockchain are well-suited to the security requirements of the identity authentication field. Building an identity authentication system with the help of blockchain technology can improve the system's security, credibility, and transparency, providing users with more secure and reliable identity recognition and authentication services.

[0098] Specifically, blockchain is a decentralized distributed ledger that is block-based, immutable, secure, and reliable. It cleverly combines distributed storage, peer-to-peer transmission, consensus mechanisms, and cryptography, with each data block linked to the previous one to form a continuous chain. In a blockchain, each block contains the hash value (also called a data digest) of the previous block. Any modification to the data in a block will cause a change in the hash value, and the hash value of the next block depends on the hash value of the previous block. Therefore, once data is modified, it will affect the hash value of subsequent blocks, leading to inconsistencies in the entire blockchain. Thus, once data is recorded on the blockchain, it cannot be modified or deleted, and the continuously growing chain of data blocks ensures the authenticity, security, and integrity of the data.

[0099] A smart contract is an automated contract based on blockchain technology. It is a computer program that runs on the blockchain and can automatically execute its terms. Smart contracts define the terms and execution logic of the contract through programming and can execute automatically when predetermined conditions are met, without human intervention. Smart contracts are typically written in specific programming languages ​​(such as Solidity) provided by smart contract platforms (such as Ethereum). Once coded, the smart contract is uploaded to the blockchain network, meaning all validating nodes on the network receive it. The smart contract periodically checks for triggering conditions; when these conditions are met, the contract is pushed to a verification queue. Validating nodes on the blockchain verify the signature of the event to be verified. Once a majority of validating nodes reach a consensus, the smart contract will execute successfully.

[0100] Ethereum is a smart contract platform based on blockchain technology. It uses a Turing-complete scripting language—Ethereum Virtual Machine code (EVM code)—to create and execute smart contracts. The EVM is the virtual machine on the Ethereum platform; it runs smart contract code and executes programs stored on the blockchain. Ethereum provides a high-level contract language called Solidity. Smart contract code written in Solidity is compiled into EVM bytecode and then deployed to the Ethereum blockchain. Once deployed, the smart contract code executes on the EVM, and its state and results are recorded on the blockchain, ensuring the transparency and immutability of the smart contract. Because Ethereum's scripting language is Turing-complete, it means that any computable problem can be computed. This makes the Ethereum platform highly flexible, supporting various types of smart contracts and decentralized applications (DApps), providing developers with rich functionality and innovative possibilities.

[0101] In the power industry scenario, "user" can refer to a power user. The visitor issuing a digital identity verification request for the target user can be a power user, service provider, or supplier—anyone with verification authority. In one or more embodiments of this application, the target user refers to the user currently being processed by the blockchain-based digital identity management system. Furthermore, both power users and suppliers can interact with the blockchain-based digital identity management system by operating a client terminal.

[0102] In addition, in one or more embodiments of this application, the blockchain-based digital identity management system can be one or more management nodes in a blockchain network, which can also be verification nodes. At the same time, the management nodes and verification nodes in the blockchain network can all be client devices or servers, which can be set according to the actual application needs.

[0103] Step 200: During the execution of the digital identity management steps, based on preset key event types, audit log entries are generated in real time for each key event in the digital identity management steps, and the audit log entries are encrypted and stored in the blockchain. The audit log entries are then sent to authorized users who request audit log access based on preset log access interfaces and access rules.

[0104] As can be seen from the above description, the blockchain-based digital identity management method provided in this application embodiment can ensure the authenticity of users' digital identity information while protecting user privacy, and at the same time realize the tracking and auditing of the digital identity authentication process, thereby effectively improving the convenience and transparency of digital identity management.

[0105] In a blockchain-based digital identity management method provided in this application embodiment, the digital identity registration step is implemented based on CP-ABE encryption, IPFS system and AES encryption, the digital identity query step is implemented based on zero-knowledge proof, and the digital identity verification step is implemented based on multiple distributed verification nodes in the blockchain network.

[0106] In one or more embodiments of this application, IPFS refers to the InterPlanetary File System, which can be abbreviated as IPFS. IPFS is a global, content-addressed, peer-to-peer distributed file system and network hypermedia protocol. IPFS employs a distributed storage approach, where files are divided into multiple blocks and stored across multiple nodes in the network, ensuring data redundancy and reliability. It uses content addressing to locate files, that is, retrieving files based on the hash value of their content, rather than their location or address. IPFS also supports file caching and allows users to manage data updates and historical records through version control. The hypermedia protocol portion of IPFS involves the acquisition and transmission of various types of data on the IPFS network, enabling users to access and share various types of media files, such as images, videos, and audio, through the IPFS protocol. Therefore, IPFS is often used to build decentralized, reliable data storage and transmission networks.

[0107] In one or more embodiments of this application, CP-ABE encryption refers to Ciphertext-Policy Attribute-Based Encryption, which can be abbreviated as CP-ABE. Attribute-based encryption is a modern cryptographic technique that allows data owners to encrypt and decrypt data based on user attributes or sets of attributes, without requiring a specific key. Only users who meet the access policy, i.e., users with specific attributes, can decrypt the data. Attribute-based encryption provides data owners with more granular access control, thereby improving data security and privacy protection. This encryption method is very useful in scenarios requiring personalized or specific access control, such as cloud storage, healthcare, and the Internet of Things. By using attribute-based encryption, users can more easily share data while ensuring that data is only accessed by authorized users.

[0108] In one or more embodiments of this application, AES encryption refers to the Advanced Encryption Standard (AES). AES is a powerful and secure mainstream symmetric encryption algorithm. This standard replaced the original Data Encryption Standard (DES) and is faster and better than DES. The AES algorithm uses a fixed-length key (128 bits, 192 bits, or 256 bits) to encrypt and decrypt data blocks. Both encryption and decryption processes are based on matrix operations and byte substitution. During encryption, plaintext data is grouped into 16-byte (128-bit) blocks. If the blocks are less than 16 bytes, they are padded with specific padding characters (such as PCKS7). Therefore, the last segment of the ciphertext may differ depending on the padding method.

[0109] In other words, this application embodiment uses the Ethereum blockchain platform and smart contract technology to construct a decentralized identity authentication system, enabling distributed storage and high security of user identity information. The CP-ABE attribute encryption algorithm is used to encrypt identity information, combined with IPFS and AES encryption algorithms, to achieve multi-layered encrypted storage, improving the security and trustworthiness of user identity information. The verification process obtains the encrypted ciphertext through the blockchain, decrypts it to obtain the IPFS address, and then uses the user's ciphertext. The service provider (visitor) generates a decryption key using their own attribute set to decrypt the ciphertext and obtain the user's plaintext identity information. This ensures secure and reliable identity verification, promotes cross-organizational and cross-institutional sharing of user identity information, eliminates information silos, and ultimately greatly improves the convenience, efficiency, and security of digital identity authentication.

[0110] Furthermore, in the blockchain-based digital identity management method provided in this application embodiment, user registration and identity verification are two key steps in the digital identity authentication process. Identity registration refers to adding user identity information to the system for subsequent use. Identity verification ensures the authenticity of on-chain information; when a user registers their identity, they specify a blockchain node for subsequent identity verification. The verification node verifies and confirms the integrity and authenticity of the digital identity on the chain, ensuring the authenticity and trustworthiness of the on-chain digital identity. In this model, users can independently register and manage their own on-chain identity, rather than relying on third-party institutions to create and manage it.

[0111] Therefore, in order to further improve the data confidentiality, integrity, availability, and resistance to attacks of blockchain-based digital identity registration, and to simplify the digital identity registration process, a blockchain-based digital identity management method is provided in this application embodiment, see [link to relevant documentation]. Figure 2If the current digital identity management step is the digital identity registration step, then step 100 in the blockchain-based digital identity management method specifically includes the following:

[0112] Step 111: Receive a digital identity registration request from the target user in the blockchain network. The digital identity registration request includes the target user's identity information and multiple verification nodes in the blockchain network specified by the target user.

[0113] Step 112: Encrypt the target user's identity information using CP-ABE to obtain the corresponding identity information hash value, and store the identity information hash value in the IPFS system to obtain the unique IPFS address corresponding to the encrypted data generated and returned by the IPFS system.

[0114] Step 113: Encrypt the IPFS address using AES to obtain an encrypted IPFS address.

[0115] Step 114: Based on the target user's identity information, the verification node addresses corresponding to the multiple verification nodes specified by the target user, and the encrypted IPFS address, generate a unique identity identifier for the target user.

[0116] Step 115: Store the target user's unique identity identifier, the identity information hash value, the verification node addresses corresponding to the multiple verification nodes specified by the target user, the credential expiration time, and the preset supplementary information as the target user's identity credentials in the blockchain; wherein, the identity credentials also include the current credential verification status and the credential expiration time.

[0117] As can be understood, identity credentials refer to encrypted data structures used to verify a user's identity and authorize access to specific resources. Specifically, identity credentials can contain key information such as the user's identity hash value, authentication status, and expiration time, and are securely stored on the blockchain. Their function is to provide necessary identity information and permission verification when a user authenticates or requests access control, ensuring system security and data integrity.

[0118] In one example of this application, see [example]. Figure 3This document describes the content of user digital identity certificate information and the process of storing it in the blockchain. User personal information may include name, qualification level, training records, etc. This personal information is processed using a hash algorithm to form a hash code, which is stored in the identity information data structure defined in the smart contract, and then the certificate is stored in the blockchain. The "User Digital Identity Certificate" refers to the identity credential, and the unique identifier can be abbreviated as "UserID," which is also the user's digital identity certificate identifier. The identity information hash value, also known as the user's identity information hash code, can be written as "userinfoHash"; the verification node address can be written as "verifyNodeAddr"; the encrypted IPFS address is the encrypted IPFS address, which can be written as "encipher(ipfsAddr)"; the credential verification status can also be written as "verificationStatus"; the credential expiration time can be written as "expireTime"; and supplementary information refers to other required supplementary information, which can be abbreviated as "otherinfo." The target user's identity information may include: name, qualification level, and training record. "BlockChain" refers to the blockchain.

[0119] In other words, the digital identity management system designed in this application includes two crucial steps: user registration and user authentication. The registration process involves adding and entering user identity information into the system, allowing for convenient use of this information in subsequent operations. This process not only simplifies user operations but also provides the necessary data for subsequent authentication.

[0120] In other words, when a user registers their identity using the decentralized identity authentication system of this application, the following process is followed:

[0121] (1) Create identity information: The user submits basic identity information to the system and specifies a group of verification nodes. This group of verification nodes will then verify the identity information registered on the blockchain. Compared with specifying only one verification node for verification, this approach implements a distributed identity verification mechanism, which increases the availability and robustness of the module.

[0122] (2) Attribute Encryption and Hash Processing: The system uses the ciphertext-based attribute encryption algorithm CP-ABE to encrypt the user's input identity information. The encrypted identity information is stored in IPFS (InterPlanetary File System) and forms a unique hash code.

[0123] (3) AES encryption of IPFS address (hash code): The generated IPFS hash code is extracted and encrypted using AES encryption.

[0124] (4) Blockchain storage: After obtaining the user's identity information, the verification node address, and the encrypted IPFS hash code, the system generates a unique identifier, UserID. The UserID, the hash code of the identity information, the verification node address, the current identity verification status and identity expiration time, the encrypted IPFS address, and other supplementary information are stored on the blockchain as identity credentials.

[0125] To further improve the convenience and reliability of blockchain-based digital identity management, in an embodiment of this application, a blockchain-based digital identity management method is provided, see [link to relevant documentation]. Figure 4 If the current digital identity management step is the digital identity query step, then step 100 in the blockchain-based digital identity management method specifically includes the following:

[0126] Step 121: Receive a digital identity query request from the target user in the blockchain network. The digital identity query request includes: the target user's unique identity identifier and a zero-knowledge proof generated in advance by the target user for its own identity information.

[0127] Step 122: Verify the zero-knowledge proof; if the verification of the zero-knowledge proof passes, then based on the unique identity of the target user, invoke the smart contract to query the identity credential corresponding to the target user in the blockchain;

[0128] Step 123: Send the identity credentials to the target user.

[0129] In other words, when a user uses the decentralized identity authentication system of this application to query their digital identity, the following process is followed:

[0130] (1) User initiates a query request: When a user needs to query a specific digital identity, such as to verify someone's identity, obtain specific permissions, or view personal information.

[0131] (2) The user provides a digital identity identifier (UserID) and a signature value for the identity information. Verifying the signature is to ensure that the user currently requesting an identity query has ownership of the on-chain identity information.

[0132] (3) Zero-knowledge proof verification: In this step, this module uses zero-knowledge proof technology to verify the user's identity without exposing the user's actual identity information. The specific steps are as follows:

[0133] 1) Generating a Proof: Users first need to generate a zero-knowledge proof demonstrating that they know secret information related to their digital identity without needing to disclose it. This proof can be generated using existing zero-knowledge proof schemes, such as zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) or zk-STARKs (Zero-Knowledge Scalable Transparent Argument of Knowledge).

[0134] 2) Submit Proof: Users submit the generated zero-knowledge proof along with their digital identity, UserID, to the system. This proof contains secret information about their digital identity that the user knows, but does not reveal any actual information.

[0135] 3) Verification of Proof: After receiving the proof submitted by the user, this module will verify it. This verification process only requires the public portion of the proof and does not need to know any of the user's secret information. If the proof is valid, the system can confirm that the user does indeed possess the secret information related to their digital identity.

[0136] (4) Identity Query: Once a user's zero-knowledge proof is verified, the system can invoke the smart contract to query their digital identity. This query process is conducted on-chain, ensuring its transparency and immutability.

[0137] (5) The system returns the query results, including UserID, hash code of identity information, verification node address, verification status and expiration time, encrypted IPFS address, etc.

[0138] Furthermore, during user authentication, it is crucial to ensure the authenticity of on-chain information. To achieve this, this project requires users to designate a set of blockchain nodes for subsequent authentication during identity registration. These verification nodes validate and confirm the integrity and authenticity of the digital identity uploaded to the chain, thereby guaranteeing its trustworthiness. This process fully leverages the decentralized nature of blockchain, enhancing data security and reliability. In the system provided in this application, users can independently register and manage their on-chain identities, eliminating the need for third-party institutions to create and manage them. This breaks through traditional identity authentication models, allowing users to enjoy convenient services while protecting their privacy.

[0139] Based on this, in order to further improve the data confidentiality, integrity, availability, and resistance to attacks of blockchain-based digital identity verification, and to simplify the digital identity verification process, a blockchain-based digital identity management method is provided in this application embodiment, see [link to relevant documentation]. Figure 5 If the current digital identity management step is the digital identity verification step, then step 100 in the blockchain-based digital identity management method specifically includes the following:

[0140] Step 131: Receive a digital identity verification request for the target user in the blockchain network, wherein the digital identity verification request includes: the target user's unique identity identifier and the target user's identity information signature value;

[0141] Step 132: Based on the unique identifier of the target user, find the verification node address corresponding to each of the multiple verification nodes pre-specified by the target user;

[0142] Step 133: Based on the addresses of each verification node, forward the digital identity verification request for the target user to each verification node pre-specified by the target user, so that each verification node calls the smart contract according to the unique identity identifier of the target user, thereby enabling each verification node to verify the target user's identity information signature value and the target user's identity credentials pre-stored in the blockchain, and return the verification result data generated by each node.

[0143] Step 134: Receive the verification result data sent back by each of the verification nodes;

[0144] Step 135: Determine whether the number of verified result data that has passed verification meets the preset threshold. If so, determine that the target user has passed digital authentication and return the corresponding digital authentication pass message to the sending end of the digital authentication request.

[0145] If a verification or judgment process in one or more of this application fails, the system will issue a verification failure message and stop executing subsequent steps of the verification or judgment.

[0146] In other words, when users register their identity information on the blockchain, in order to ensure the authenticity and integrity of the information on the blockchain, the identity information on the blockchain needs to be verified, following the process below:

[0147] (1) Initiating an identity verification request: In order to initiate an identity verification request, the user needs to submit parameters such as the unique identifier UserID of the identity credential and the signature value of the identity information, and submit this information to a set of specified verification nodes to initiate an identity verification request.

[0148] (2) Obtaining on-chain credential information: After receiving the request, in order to obtain the user's registered identity information and credentials on the blockchain network, each verification node calls the smart contract to perform digital identity query.

[0149] (3) Identity verification: The verification node confirms the authenticity and completeness of the registered identity information, and whether the user initiating the digital identity verification request is the true owner of the registered identity. The verification process includes:

[0150] 1) Confirm the format and authenticity of the identity information submitted by the user.

[0151] 2) Check the signature to confirm that the current user does indeed possess the corresponding private key.

[0152] 3) Verify that the user's registered identity information on the blockchain is true and complete by calculating locally on the verification node.

[0153] (4) Modification of credential status: Once more than 2 / 3 (this percentage can be adjusted depending on the chosen consensus mechanism) of nodes have passed the verification, the verification nodes will modify the status of the user's credential and set the expiration time, thereby indicating that the on-chain digital identity being verified has passed the verification.

[0154] To further improve the confidentiality, integrity, availability, and attack resistance of blockchain-based digital identity revocation, and to simplify the digital identity revocation process, this application provides a blockchain-based digital identity management method, see [link to relevant documentation]. Figure 6 If the current digital identity management step is the digital identity revocation step, then a specific implementation of step 100 in the blockchain-based digital identity management method includes the following:

[0155] Step 141: Receive a digital identity revocation request issued by the target user in the blockchain network, wherein the digital identity revocation request includes: the identity information signature value of the target user;

[0156] In one or more embodiments of this application, the different types of requests mentioned may all include the unique identity identifier of the target user, so that the blockchain-based digital identity management system can subsequently determine the target user of the current request based on the unique identity identifier, and can also extract the relevant data corresponding to the target user that is pre-stored based on the unique identity identifier.

[0157] Step 142: Invoke the smart contract to verify the identity information signature value of the target user against the identity credentials of the target user pre-stored in the blockchain. If the verification is successful, change the verification status in the identity credentials of the target user from data indicating successful verification to data indicating identity revocation.

[0158] See Figure 7 If the current digital identity management step is the digital identity revocation step, then another specific implementation of step 100 in the blockchain-based digital identity management method includes the following:

[0159] Step 151: Receive a digital identity revocation request issued by a target verification node in the blockchain network, wherein the digital identity revocation request includes: the signature value of the identity information hash value; the signature value of the identity information hash value is obtained by the target verification node in advance signing the identity information hash value of the target user based on its own private key.

[0160] Step 152: Verify the private key of the target verification node based on the signature value of the identity information hash value.

[0161] Step 153: If the verification of the private key of the target verification node is successful, the smart contract is invoked to verify whether the target verification node is included in the various verification nodes specified in the identity credentials of the target user pre-stored in the blockchain.

[0162] Step 154: If the target verification node is included in each of the verification nodes specified by the target user, then the verification status in the target user's identity credential is modified from data indicating successful verification to data indicating identity revocation.

[0163] In other words, the ability to revoke a digital identity is crucial for ensuring the security, accuracy, and credibility of identity information. When designing a digital identity revocation mechanism, both effectiveness and security must be ensured, following this process:

[0164] (1) Verification node or user initiates revocation request: To ensure security, only verification node or user can initiate identity revocation request, and only for verified credentials. When initiating the request, the unique identifier of the identity credential UserID and the signature value of the verification node's private key against the hash value of the user's identity information userInfoHash are provided.

[0165] (2) System Verification Request. The system first verifies the signature of the initiator of the identity revocation request to confirm that the initiator possesses the private key of the verification node; then, it calls the smart contract to verify whether the node is the same as the verification node specified when the user registered their digital identity. If they are the same, proceed to the next step.

[0166] (3) The system modifies the verification status in the identity credential from "verification passed" to "identity revoked".

[0167] To further improve the real-time performance and reliability of tracking and auditing the digital identity authentication process, thereby effectively enhancing the convenience and transparency of digital identity management, in a blockchain-based digital identity management method provided in this application embodiment, the audit log entries in the blockchain-based digital identity management method are used to store the correspondence between timestamps, key event types, hash digests of identity information, and operator identifiers of key events.

[0168] Specifically, to address the transparency issues in existing identity verification processes and enhance user privacy protection, this application introduces a security audit log system. This system records key events during the identity authentication process but does not involve sensitive personal data, thereby improving the security and transparency of identity authentication.

[0169] 1. Technical Components:

[0170] 1) Event Logger: A lightweight component used to capture and log key events during the authentication process.

[0171] 2) Hash function: Used to generate a hash digest of identity information to ensure privacy protection.

[0172] 3) Timestamp service: Provides accurate event recording for each entry in the log.

[0173] 4) Blockchain storage: Used to securely store log entries and ensure they are not tampered with.

[0174] 5) Access control: Ensure that only authorized users and systems can generate and access logs.

[0175] 2. Implementation steps:

[0176] S1. Define key events: Determine which events need to be logged, such as "authentication request", "authentication successful", "authentication failed", "identity revocation", etc.

[0177] S2. Generate hash digest: When a user submits identity information, the system uses a hash function (such as SHA-256) to generate a hash digest of the identity information. Only this hash digest is stored, not the original identity information.

[0178] S3. Add timestamp and operator identifier: Generate an accurate timestamp for each event and, if applicable, add a unique identifier for the operator or verification node.

[0179] S4: Create log entries: Each log entry contains an event type, hash digest, timestamp, and operator identifier. The entry format is, for example: [timestamp, event type, hash digest, operator identifier].

[0180] S5: Storing Log Entries: Log entries are stored on the blockchain in encrypted form (using AES encryption algorithm, etc.) to ensure security and immutability; existing blockchain platforms such as Ethereum can be used.

[0181] S6: Access Control: Implement access control mechanisms to ensure that only authorized auditors and systems can access log data.

[0182] S7: Log Auditing Interface: Develop a simple user interface or API that allows authorized users to query and audit log entries.

[0183] In summary, the blockchain-based digital identity management method provided in this application effectively solves the security risks, data leakage risks, and information silo effects existing in existing technical solutions by introducing attribute encryption algorithms, multi-layer encrypted storage, and the decentralized nature of blockchain, thereby improving the security and credibility of identity authentication. Addressing problems that existing technical solutions cannot solve, this application effectively enhances the security and reliability of the digital identity authentication system through innovative encrypted storage and verification mechanisms, ensuring that the power business system can verify user identities and issue credible electronic certificates. It plays a crucial role in the credible issuance and secure management of electronic certificates for the power business, ensuring the credibility of user identities, the security of data, and the validity of electronic certificates. It can solve the security risks, data leakage risks, and information silo effects existing in traditional identity authentication systems.

[0184] Specifically, the blockchain-based digital identity management method provided in this application has the following beneficial effects:

[0185] (1) Data confidentiality

[0186] First, data confidentiality is considered. This authentication scheme employs the CP-ABE attribute encryption algorithm and AES encryption technology to ensure that only authorized users can access and decrypt identity information stored in IPFS. Furthermore, by using zero-knowledge proof technology, users can verify their identity without revealing any actual identity information, thereby further enhancing data confidentiality.

[0187] (2) Data integrity

[0188] Secondly, data integrity is another important aspect of the evaluation. The system stores the hash value of user identity information, along with the relevant verification node addresses and status information, on the blockchain through smart contracts. Due to the immutability of the blockchain, once data is written, it cannot be modified or deleted, thus ensuring data integrity.

[0189] (3) Availability

[0190] In terms of availability, the design uses a distributed authentication mechanism, specifying a group of authentication nodes instead of a single node. This not only improves the robustness of the system, but also ensures that the system can continue to run when some nodes are unavailable, thus guaranteeing high availability.

[0191] (4) Resistance to attack

[0192] Finally, the protocol's ability to resist various potential attacks is analyzed. For example, in the case of a man-in-the-middle attack, since all communication is encrypted, even if an attacker intercepts the data, they cannot decrypt it or forge an identity. Furthermore, the digital identity management system involved in this application also needs to resist other common network attacks such as replay attacks and denial-of-service attacks.

[0193] (5) Simplified authentication process: By reducing unnecessary steps, the design of this application improves the efficiency of authentication and reduces authentication time.

[0194] (6) Security Audit Logs: The introduced audit log system records all critical operations, such as verification requests and results, but does not record any sensitive personally identifiable information. The benefits of these measures include improved system efficiency and enhanced transparency and security, while ensuring the protection of user privacy.

[0195] (7) Key Operation Hash Digest: The system generates a hash digest for each step of the authentication process, which enhances the integrity verification of the data.

[0196] (8) Timestamp and operator identifier: Each log entry contains a timestamp and a unique identifier of the operator, ensuring the integrity and non-repudiation of the log.

[0197] This application also provides a blockchain-based digital identity management system for executing all or part of the aforementioned blockchain-based digital identity management method; see [link to relevant documentation]. Figure 8 The blockchain-based digital identity management system specifically includes the following:

[0198] The digital identity management module 10 is used to execute preset digital identity management steps in the blockchain network. The digital identity management steps include at least one of the following: digital identity registration step, digital identity query step, digital identity verification step, and digital identity revocation step.

[0199] The audit log recording and traceability module 20 is used to generate audit log entries in real time for each key event in the digital identity management step based on preset key event types during the execution of the digital identity management step, and to encrypt and store the audit log entries in the blockchain, and to send the audit log entries to the authorized user who issues the audit log access based on the preset log access interface and access rules.

[0200] As described above, the blockchain-based digital identity management system provided in this application uses blockchain to provide a decentralized platform for storing and verifying identity information applications, thereby ensuring the transparency and traceability of transactions. Smart contracts are used to store identity registration, verification processes, and other related operational rules and automate the execution of these operations. This effectively simplifies the processes of digital identity registration, verification, transaction confirmation, and on-chain processing, significantly improving the efficiency of digital identity authentication and transaction execution, while reducing time costs and error rates.

[0201] In a blockchain-based digital identity management system provided in this application embodiment, the digital identity registration step is implemented based on CP-ABE encryption, IPFS system and AES encryption, the digital identity query step is implemented based on zero-knowledge proof, and the digital identity verification step is implemented based on multiple distributed verification nodes in the blockchain network.

[0202] Furthermore, the use of encryption technologies such as CP-ABE (Ciphertext-Policy Attribute-Based Encryption) and AES (Advanced Encryption Standard) ensures the security and privacy of data transmission and storage. CP-ABE allows users to control data access based on attributes, while AES encryption provides strong data encryption capabilities; these technologies protect data from unauthorized access.

[0203] Finally, IPFS (InterPlanetary File System), as a distributed file storage and transmission protocol, can provide more secure, efficient, and low-cost data storage for storing encrypted identity information and other related data, while also supporting fast retrieval of large-scale data.

[0204] To further improve the data confidentiality, integrity, availability, and attack resistance of blockchain-based digital identity registration, and to simplify the digital identity registration process, in a blockchain-based digital identity management method and system provided in this application embodiment, if the current digital identity management step is the digital identity registration step, then the digital identity management module 10 includes: a digital identity registration unit, which is used to perform the following:

[0205] Step 111: Receive a digital identity registration request from the target user in the blockchain network. The digital identity registration request includes the target user's identity information and multiple verification nodes in the blockchain network specified by the target user.

[0206] Step 112: Encrypt the target user's identity information using CP-ABE to obtain the corresponding identity information hash value, and store the identity information hash value in the IPFS system to obtain the unique IPFS address corresponding to the encrypted data generated and returned by the IPFS system.

[0207] Step 113: Encrypt the IPFS address using AES to obtain an encrypted IPFS address.

[0208] Step 114: Based on the target user's identity information, the verification node addresses corresponding to the multiple verification nodes specified by the target user, and the encrypted IPFS address, generate a unique identity identifier for the target user.

[0209] Step 115: Store the target user's unique identity identifier, the identity information hash value, the verification node addresses corresponding to the multiple verification nodes specified by the target user, the credential expiration time, and the preset supplementary information as the target user's identity credentials in the blockchain; wherein, the identity credentials also include the current credential verification status and the credential expiration time.

[0210] To further improve the convenience and reliability of blockchain-based digital identity management, in a blockchain-based digital identity management system provided in this application embodiment, if the current digital identity management step is the digital identity query step, then the digital identity management module 10 includes: a digital identity query unit, which is used to perform the following:

[0211] Step 121: Receive a digital identity query request from the target user in the blockchain network. The digital identity query request includes: the target user's unique identity identifier and a zero-knowledge proof generated in advance by the target user for its own identity information.

[0212] Step 122: Verify the zero-knowledge proof; if the verification of the zero-knowledge proof passes, then based on the unique identity of the target user, invoke the smart contract to query the identity credential corresponding to the target user in the blockchain;

[0213] Step 123: Send the identity credentials to the target user.

[0214] To further improve the data confidentiality, integrity, availability, and attack resistance of blockchain-based digital identity verification, and to simplify the digital identity verification process, in a blockchain-based digital identity management system provided in this application embodiment, if the current digital identity management step is the digital identity verification step, then the digital identity management module 10 includes: a digital identity verification unit, which is used to perform the following:

[0215] Step 131: Receive a digital identity verification request for the target user in the blockchain network, wherein the digital identity verification request includes: the target user's unique identity identifier and the target user's identity information signature value;

[0216] Step 132: Based on the unique identifier of the target user, find the verification node address corresponding to each of the multiple verification nodes pre-specified by the target user;

[0217] Step 133: Based on the addresses of each verification node, forward the digital identity verification request for the target user to each verification node pre-specified by the target user, so that each verification node calls the smart contract according to the unique identity identifier of the target user, thereby enabling each verification node to verify the target user's identity information signature value and the target user's identity credentials pre-stored in the blockchain, and return the verification result data generated by each node.

[0218] Step 134: Receive the verification result data sent back by each of the verification nodes;

[0219] Step 135: Determine whether the number of verified result data that has passed verification meets the preset threshold. If so, determine that the target user has passed digital authentication and return the corresponding digital authentication pass message to the sending end of the digital authentication request.

[0220] To further improve the confidentiality, integrity, availability, and attack resistance of blockchain-based digital identity revocation, and to simplify the digital identity revocation process, in a blockchain-based digital identity management system provided in this application embodiment, if the current digital identity management step is the digital identity revocation step, then the digital identity management module 10 includes: a first digital identity revocation unit, which is used to perform the following:

[0221] Step 141: Receive a digital identity revocation request issued by the target user in the blockchain network, wherein the digital identity revocation request includes: the identity information signature value of the target user;

[0222] Step 142: Invoke the smart contract to verify the identity information signature value of the target user against the identity credentials of the target user pre-stored in the blockchain. If the verification is successful, change the verification status in the identity credentials of the target user from data indicating successful verification to data indicating identity revocation.

[0223] In a blockchain-based digital identity management system provided in this application embodiment, if the current digital identity management step is the digital identity revocation step, then the digital identity management module 10 includes: a second digital identity revocation unit, which is used to perform the following:

[0224] Step 151: Receive a digital identity revocation request issued by a target verification node in the blockchain network, wherein the digital identity revocation request includes: the signature value of the identity information hash value; the signature value of the identity information hash value is obtained by the target verification node in advance signing the identity information hash value of the target user based on its own private key.

[0225] Step 152: Verify the private key of the target verification node based on the signature value of the identity information hash value.

[0226] Step 153: If the verification of the private key of the target verification node is successful, the smart contract is invoked to verify whether the target verification node is included in the various verification nodes specified in the identity credentials of the target user pre-stored in the blockchain.

[0227] Step 154: If the target verification node is included in each of the verification nodes specified by the target user, then the verification status in the target user's identity credential is modified from data indicating successful verification to data indicating identity revocation.

[0228] To further improve the real-time performance and reliability of tracking and auditing the digital identity authentication process, thereby effectively enhancing the convenience and transparency of digital identity management, in a blockchain-based digital identity management system provided in this application embodiment, the audit log entries are used to store the correspondence between timestamps, key event types, hash digests of identity information, and operator identifiers of key events.

[0229] To further illustrate the blockchain-based digital identity management method mentioned in the above embodiments, this application also provides a specific application example of the blockchain-based digital identity management method for the power business, taking the power business scenario as an example. (See [link to relevant documentation]). Figure 9 In the digital identity management system proposed in this application, the power company personnel (users) occupy a central position as the owners of their digital identities. Suppliers refer to entities that have contracts with the power company, providing power equipment, services, or other business transactions. In the scenario of this application, power company personnel need to verify their identity through digital identity authentication to prove their right to access specific power systems or resources, or to obtain services provided by suppliers. Suppliers verify the digital identities and qualifications of power company personnel through this digital identity management system to ensure their legitimacy and credibility before providing them with corresponding services and operations.

[0230] To clearly demonstrate the working principle of the digital identity authentication system of this application, see [link to relevant documentation]. Figure 10 This flowchart not only visually depicts the various components of the system and their interactions, but also clarifies how to use blockchain technology, Ethereum smart contracts, IPFS distributed storage, and CP-ABE and AES encryption technologies to securely store and verify user identity information, thereby improving the security and efficiency of digital identity authentication.

[0231] Specifically, a concrete application example of a blockchain-based digital identity management method for the power industry includes the following steps:

[0232] Phase 1: User Login and Submission of Identity Information: Carbon trading market participants (hereinafter referred to as users) first log in to the system by entering their username and password. After successfully logging in, users need to submit a series of personal identity information, including but not limited to their name, qualification level, training records, address, and other personal identity information.

[0233] The second stage: Encryption and storage of identity information. Next, the system uses the CP-ABE attribute encryption algorithm to encrypt the user's identity information. The advantage of this encryption method is that even if the data is illegally obtained, the actual identity information cannot be deciphered without the correct decryption key. Then, the system stores the encrypted information in IPFS and generates a hash code, which is the unique path to access the encrypted information stored in IPFS. To further protect new identity data messages, the system uses the IPFS hash code, i.e., the address where the identity information is stored, for secondary encryption.

[0234] Phase Three: Identity Information Registration: The system stores the re-encrypted hash code in the blockchain, completing the registration of the user's identity information. In this way, the user's identity information is securely stored in the blockchain network.

[0235] Phase Four: Identity Verification Request and Processing: When a user needs to verify their identity, such as when performing operations requiring authentication, they will send a verification request to the system. Verification nodes are pre-defined nodes in the blockchain network with verification permissions. The identity verification process begins by modifying the user's authentication status in the blockchain. After verifying the user's identity, the verification node marks the user's identity as verified, with two states: verified or not verified.

[0236] Phase 5: Identity Authentication Request and Supplier's Query of Identity Credentials: When users need to use certain services, they send an identity authentication request to the supplier. For example, when purchasing carbon allowances through a carbon allowance trader or engaging in carbon neutrality transactions, market participants need to ensure the security and credibility of the transaction through digital identity authentication. After receiving the user's request, the supplier queries the user's identity credentials in the blockchain. This credential is an encrypted hash code of the user's identity information. The supplier obtains the ciphertext of the IPFS address corresponding to the user's identity information from the blockchain, and then decrypts the ciphertext using a decryption key to obtain the IPFS hash code. The supplier uses the decrypted hash code to obtain the ciphertext of the user's identity information from IPFS, and then uses the CP-ABE decryption key to decrypt the ciphertext of the user's identity information to obtain the user's plaintext identity information for authentication. The specific authentication process may vary depending on the supplier's specific needs and regulations, but it usually includes comparing the information provided by the user with the supplier's existing information to confirm the user's identity.

[0237] The key aspects of the blockchain-based digital identity management method provided in this application mainly include the following:

[0238] 1. A blockchain-based digital identity management method: This application utilizes blockchain technology to construct a decentralized digital identity authentication system, which effectively solves the security risks, data leakage risks, and information silo effects problems in traditional identity authentication systems.

[0239] 2. Utilizing the Ethereum blockchain platform and smart contract technology: By using the Ethereum platform and smart contracts, the application automates and decentralizes the identity authentication process, enhancing the system's security and trustworthiness.

[0240] 3. Multi-layered encrypted storage method: The application adopts the CP-ABE attribute encryption algorithm to encrypt user identity information, combined with IPFS and AES encryption algorithms, to achieve multi-layered encrypted storage of user identity information, ensuring data security and privacy.

[0241] 4. Secure and Reliable Identity Authentication Process: This application implements a secure and reliable identity authentication process. The authentication party (supplier) can obtain encrypted ciphertext through the blockchain, then use the decryption key to decrypt the IPFS address, thereby obtaining the ciphertext in IPFS, and finally use the CP-ABE decryption key to decrypt the user's identity information.

[0242] 5. Cross-organizational and cross-institutional identity information sharing: This application utilizes blockchain technology to achieve effective sharing of user identity information across organizations and institutions, avoiding the information silo effect and improving the convenience and efficiency of digital identity authentication.

[0243] 6. A security audit log system was introduced to record key events during the identity authentication process without involving sensitive personal data, thereby improving the security and transparency of identity authentication. The key technical features of the audit log system are as follows:

[0244] Generate a hash digest of the identity information;

[0245] Log entry creation combined with timestamps;

[0246] Records of operator identification;

[0247] Access control mechanisms that allow access only to authorized users.

[0248] These key elements together constitute an efficient, secure, and user-friendly digital identity management system.

[0249] Therefore, compared with the prior art, the blockchain-based digital identity management method, system, electronic device, and computer-readable storage medium provided in this application have the following beneficial effects:

[0250] 1. Enhanced security and credibility: By employing blockchain technology and multi-layered encryption methods, this application significantly improves the security of user identity information and resolves the security risks and data leakage risks present in traditional identity authentication systems.

[0251] 2. Enhanced Convenience and Efficiency of Identity Verification: The verification process obtains encrypted ciphertext through the blockchain, decrypts it to reveal the IPFS address, and then obtains the user's ciphertext identity. The supplier then generates a decryption key using its own attribute set to decrypt the ciphertext and obtain the user's plaintext identity information, ensuring secure and reliable identity verification. Utilizing blockchain and smart contract technologies, this application simplifies the identity verification process, reduces authentication events, and improves the convenience and efficiency of identity verification.

[0252] 3. Promote information sharing and eliminate information silos: This application supports the sharing of identity information across organizations and institutions. Through authorization mechanisms and the transparency of blockchain, it effectively eliminates information silos and promotes the flow and utilization of information.

[0253] 4. Enhanced system transparency and user privacy protection: Through the security audit log system, this application provides transparency of the authentication process without disclosing sensitive personal information, while enhancing the protection of user privacy.

[0254] In summary, this application provides a secure, efficient, and convenient digital identity authentication solution, suitable for power business and other scenarios requiring high security and high reliability identity authentication.

[0255] This application also provides an electronic device that may include a processor, a memory, a receiver, and a transmitter. The processor is used to execute the blockchain-based digital identity management method mentioned in the above embodiments. The processor and memory can be connected via a bus or other means, taking a bus connection as an example. The receiver can be connected to the processor and memory via wired or wireless means.

[0256] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0257] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the blockchain-based digital identity management method in the embodiments of this application. The processor executes various functional applications and data processing by running the non-transitory software programs, instructions, and modules stored in the memory, thereby implementing the blockchain-based digital identity management method in the above method embodiments.

[0258] The memory may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor, etc. Furthermore, the memory may include high-speed random access memory and non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include memory remotely located relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0259] The one or more modules are stored in the memory, and when executed by the processor, the blockchain-based digital identity management method in the embodiment is executed.

[0260] In some embodiments of this application, the user equipment may include a processor, a memory, and a transceiver unit. The transceiver unit may include a receiver and a transmitter. The processor, memory, receiver, and transmitter may be connected via a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.

[0261] As one implementation method, the functions of the receiver and transmitter in this application can be implemented by transceiver circuits or dedicated transceiver chips, and the processor can be implemented by dedicated processing chips, processing circuits or general-purpose chips.

[0262] As another implementation approach, the server provided in this application embodiment can be implemented using a general-purpose computer. That is, the program code implementing the processor, receiver, and transmitter functions is stored in memory, and the general-purpose processor implements the processor, receiver, and transmitter functions by executing the code in memory.

[0263] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned blockchain-based digital identity management method. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0264] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the blockchain-based digital identity management method.

[0265] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave.

[0266] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0267] In this application, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0268] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to the embodiments of this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A blockchain-based digital identity management method, characterized in that, include: A preset digital identity management process is executed in the blockchain network. The digital identity management process includes at least one of the following: digital identity registration, digital identity query, digital identity verification, and digital identity revocation. The digital identity registration process is implemented based on CP-ABE encryption, IPFS system, and AES encryption. The digital identity query process is implemented based on zero-knowledge proof. The digital identity verification process is implemented based on multiple distributed verification nodes in the blockchain network. If the current digital identity management step is the digital identity registration step, then the execution of the preset digital identity management step in the blockchain network includes: receiving a digital identity registration request from a target user in the blockchain network, the digital identity registration request including: the target user's identity information and multiple verification nodes in the blockchain network specified by the target user; encrypting the target user's identity information using CP-ABE to obtain a corresponding identity information hash value, storing the identity information hash value in the IPFS system to obtain the IPFS address uniquely corresponding to the encrypted data generated and returned by the IPFS system; encrypting the IPFS address using AES to obtain an encrypted IPFS address; generating a unique identity identifier for the target user based on the target user's identity information, the verification node addresses corresponding to the multiple verification nodes specified by the target user, and the encrypted IPFS address; storing the target user's unique identity identifier, the identity information hash value, the verification node addresses corresponding to the multiple verification nodes specified by the target user, the encrypted IPFS address, and preset supplementary information as the target user's identity credential in the blockchain; wherein, the identity credential also includes the current credential verification status and credential expiration time of the identity credential; If the current digital identity management step is the digital identity query step, then the execution of the preset digital identity management step in the blockchain network includes: receiving a digital identity query request from a target user in the blockchain network, the digital identity query request including: the target user's unique identity identifier and a zero-knowledge proof pre-generated by the target user for its own identity information; verifying the zero-knowledge proof; if the verification of the zero-knowledge proof passes, then, based on the target user's unique identity identifier, calling a smart contract to query the identity credential corresponding to the target user in the blockchain; and sending the identity credential to the target user. Furthermore, during the execution of the digital identity management steps, based on preset key event types, audit log entries are generated in real time for each key event in the digital identity management steps, and the audit log entries are encrypted and stored in the blockchain, so as to send the audit log entries to the authorized users who issue audit log access based on preset log access interfaces and access rules.

2. The blockchain-based digital identity management method according to claim 1, characterized in that, If the current digital identity management step is the digital identity verification step, then the execution of the preset digital identity management step in the blockchain network includes: Receive a digital authentication request for the target user in the blockchain network, wherein the digital authentication request includes: the target user's unique identifier and the target user's identity information signature value; Based on the unique identifier of the target user, find the verification node address corresponding to each of the multiple verification nodes pre-specified by the target user; Based on the addresses of each verification node, the digital identity verification request for the target user is forwarded to each verification node pre-specified by the target user, so that each verification node invokes a smart contract according to the unique identity identifier of the target user, thereby enabling each verification node to verify the target user's identity information signature value and the target user's identity credentials pre-stored in the blockchain, and return the verification result data generated by each node. Receive the verification result data sent back by each of the verification nodes; Determine whether the number of verified result data that has passed verification meets a preset threshold. If so, determine that the target user has passed digital authentication and return the corresponding digital authentication pass message to the sender of the digital authentication request.

3. The blockchain-based digital identity management method according to claim 1, characterized in that, If the current digital identity management step is the digital identity revocation step, then the step of executing the preset digital identity management step in the blockchain network includes: Receive a digital identity revocation request issued by the target user in the blockchain network, wherein the digital identity revocation request includes: the identity information signature value of the target user; The smart contract is invoked to verify the identity information signature value of the target user against the identity credentials of the target user pre-stored in the blockchain. If the verification is successful, the verification status in the identity credentials of the target user is modified from data indicating successful verification to data indicating identity revocation.

4. The blockchain-based digital identity management method according to claim 1, characterized in that, If the current digital identity management step is the digital identity revocation step, then the step of executing the preset digital identity management step in the blockchain network includes: In a blockchain network, a digital identity revocation request is received from a target verification node. The digital identity revocation request includes: a signature value of the identity information hash value; the signature value of the identity information hash value is obtained by the target verification node in advance signing the identity information hash value of the target user based on its own private key. The private key of the target verification node is verified based on the signature value of the hash value of the identity information; If the verification of the private key of the target verification node is successful, the smart contract is invoked to verify whether the target verification node is included in the various verification nodes specified in the identity credentials of the target user pre-stored in the blockchain; If the target verification node is included in each of the verification nodes specified by the target user, then the verification status in the target user's identity credential is modified from data indicating successful verification to data indicating identity revocation.

5. The blockchain-based digital identity management method according to any one of claims 1 to 4, characterized in that, The audit log entries are used to store the correspondence between timestamps, key event types, hash digests of identity information, and operator identifiers of key events.

6. A blockchain-based digital identity management system, characterized in that, include: The digital identity management module is used to execute preset digital identity management steps in the blockchain network. The digital identity management steps include at least one of the following: digital identity registration step, digital identity query step, digital identity verification step, and digital identity revocation step. The digital identity registration step is implemented based on CP-ABE encryption, IPFS system, and AES encryption. The digital identity query step is implemented based on zero-knowledge proof. The digital identity verification step is implemented based on multiple distributed verification nodes in the blockchain network. If the current digital identity management step is the digital identity registration step, then the digital identity management module includes: a digital identity registration unit, which performs the following: receiving a digital identity registration request from a target user in a blockchain network, the digital identity registration request including: the target user's identity information and multiple verification nodes in the blockchain network specified by the target user; encrypting the target user's identity information using CP-ABE to obtain a corresponding identity information hash value, storing the identity information hash value in the IPFS system to obtain the IPFS address uniquely corresponding to the encrypted data generated and returned by the IPFS system; encrypting the IPFS address using AES to obtain an encrypted IPFS address; generating a unique identity identifier for the target user based on the target user's identity information, the verification node addresses corresponding to the multiple verification nodes specified by the target user, and the encrypted IPFS address; storing the target user's unique identity identifier, the identity information hash value, the verification node addresses corresponding to the multiple verification nodes specified by the target user, the encrypted IPFS address, and preset supplementary information as the target user's identity credential in the blockchain; wherein, the identity credential also includes the current credential verification status and credential expiration time of the identity credential; If the current digital identity management step is the digital identity query step, then the digital identity management module includes: a digital identity query unit, which performs the following: receiving a digital identity query request from a target user in the blockchain network, the digital identity query request including: the target user's unique identity identifier and a zero-knowledge proof pre-generated by the target user for its own identity information; verifying the zero-knowledge proof; if the verification of the zero-knowledge proof passes, then, based on the target user's unique identity identifier, invoking a smart contract to query the identity credential corresponding to the target user in the blockchain; and sending the identity credential to the target user. The audit log recording and tracing module is used to generate audit log entries in real time for each key event in the digital identity management step based on preset key event types during the execution of the digital identity management step, and to encrypt and store the audit log entries in the blockchain, and to send the audit log entries to the authorized user who issues the audit log access based on the preset log access interface and access rules.

7. The blockchain-based digital identity management system according to claim 6, characterized in that, If the current digital identity management step is the digital authentication step, then the digital identity management module includes: a digital authentication unit, which performs the following: Receive a digital authentication request for the target user in the blockchain network, wherein the digital authentication request includes: the target user's unique identifier and the target user's identity information signature value; Based on the unique identifier of the target user, find the verification node address corresponding to each of the multiple verification nodes pre-specified by the target user; Based on the addresses of each verification node, the digital identity verification request for the target user is forwarded to each verification node pre-specified by the target user, so that each verification node invokes a smart contract according to the unique identity identifier of the target user, thereby enabling each verification node to verify the target user's identity information signature value and the target user's identity credentials pre-stored in the blockchain, and return the verification result data generated by each node. Receive the verification result data sent back by each of the verification nodes; Determine whether the number of verified result data that has passed verification meets a preset threshold. If so, determine that the target user has passed digital authentication and return the corresponding digital authentication pass message to the sender of the digital authentication request.

8. The blockchain-based digital identity management system according to claim 6, characterized in that, If the current digital identity management step is the digital identity revocation step, then the digital identity management module includes: a first digital identity revocation unit, which is used to perform the following: Receive a digital identity revocation request issued by the target user in the blockchain network, wherein the digital identity revocation request includes: the identity information signature value of the target user; The smart contract is invoked to verify the identity information signature value of the target user against the identity credentials of the target user pre-stored in the blockchain. If the verification is successful, the verification status in the identity credentials of the target user is modified from data indicating successful verification to data indicating identity revocation.

9. The blockchain-based digital identity management system according to claim 6, characterized in that, If the current digital identity management step is the digital identity revocation step, then the digital identity management module includes: a second digital identity revocation unit, which is used to perform the following: In a blockchain network, a digital identity revocation request is received from a target verification node. The digital identity revocation request includes: a signature value of the identity information hash value; the signature value of the identity information hash value is obtained by the target verification node in advance signing the identity information hash value of the target user based on its own private key. The private key of the target verification node is verified based on the signature value of the hash value of the identity information; If the verification of the private key of the target verification node is successful, the smart contract is invoked to verify whether the target verification node is included in the various verification nodes specified in the identity credentials of the target user pre-stored in the blockchain. If the target verification node is included in each of the verification nodes specified by the target user, then the verification status in the target user's identity credential is modified from data indicating successful verification to data indicating identity revocation.

10. The blockchain-based digital identity management system according to any one of claims 6 to 9, characterized in that, The audit log entries are used to store the correspondence between timestamps, key event types, hash digests of identity information, and operator identifiers of key events.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the blockchain-based digital identity management method as described in any one of claims 1 to 5.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the blockchain-based digital identity management method as described in any one of claims 1 to 5.

Images