Distributed digital identity document storage method based on block chain and IPFS

Abstract

The invention discloses a distributed digital identity document storage method based on a block chain and an IPFS, and belongs to the technical field of document storage. The method comprises the following steps: registering a distributed digital identity (DID); a verifiable certificate issuing step; a verifiable certificate obtaining step; a verifiable expression VP authorization step; and a verifiable expression VP authorization verification step. According to the method, creation and storage of a distributed digital identity (DID) document, signing and issuing of a verifiable voucher (VC) document and generation and verification of a verifiable expression authorization (VP) document are covered, the verifiable voucher is stored in an encrypted form, a decryption key mechanism is newly added, and a block chain technology and an IPFS decentralized storage system are combined, so that the verification efficiency of the VP document is improved. The invention realizes an efficient and safe document storage and verification method.

Description

Technical Field

[0001] The present invention relates to the field of document storage technology, and more specifically to a distributed digital identity document storage method based on blockchain and IPFS. Background Art

[0002] In the digital age, distributed digital identity (DID) has become a key technology for securely and reliably representing and managing the identity of individuals or entities on the Internet. DID-related documents, such as verifiable credentials (VCs) and verifiable presentations (VPs), contain key identity information of users, so the security, efficiency, and cost of their storage and access are critical considerations.

[0003] Traditional storage methods usually rely on centralized databases or file systems, but these methods are vulnerable to single point failures, data tampering, and privacy leaks. In order to enhance the security and credibility of data, blockchain technology has been introduced into the field of identity management. However, directly storing DID-related documents on the blockchain has the following disadvantages:

[0004] Low storage efficiency: The existing blockchain-based distributed digital identity document storage method requires the entire document content to be stored on the blockchain. Due to the design characteristics of the blockchain itself, such as data redundancy and confirmation mechanism, the storage efficiency is low, especially when dealing with large values ​​or high-frequency transactions in the KV storage structure.

[0005] Long transaction confirmation time: Transactions in the blockchain network require a certain amount of confirmation time before they can be recognized by the network, which usually involves verification and consensus from multiple nodes. This delay may lead to a decline in user experience when processing documents related to distributed digital identities, especially in scenarios where identity verification needs to be done quickly.

[0006] High node maintenance cost: The cost of blockchain storage is usually proportional to the amount of data stored. As the number of distributed digital identity documents increases, the cost of maintaining node storage resources will also increase significantly.

[0007] Poor scalability: With the increase in the number of users and business scale and the increase in document volume (especially VC and VP), the performance of the blockchain network may be seriously affected, resulting in slower transaction speeds and network congestion.

[0008] Low security: In the distributed digital identity documents stored in blockchain, DID is usually stored in plain text, while VC and VP plain text storage is not safe, and cipher text storage is not convenient for conversion and multiple authorizations. Summary of the invention

[0009] In view of this, the present invention provides a distributed digital identity document storage method based on blockchain and IPFS, which is used to at least solve some of the technical problems in the background technology.

[0010] In order to achieve the above object, the present invention adopts the following technical solution:

[0011] A distributed digital identity document storage method based on blockchain and IPFS, comprising the following steps:

[0012] The DID registration and upload step is to register a DID for each entity and upload the DID document corresponding to the DID to the blockchain network;

[0013] Verifiable credential issuance step: the issuer creates and issues verifiable credentials for each user entity, encrypts the verifiable credentials and stores them in the distributed IPFS network, and stores the hash value returned by the distributed IPFS network in the blockchain network;

[0014] Verifiable credential acquisition step: each user entity that receives the verifiable credential obtains the verifiable credential as a holder and obtains the complete plaintext of the verifiable credential document based on its own DID identifier;

[0015] Verifiable Expression VP authorization step: the user entity queries the DID document of the verifier and completes the authorization of the Verifiable Expression VP. The Verifiable Expression VP document is encrypted and stored in the distributed IPFS network. At the same time, the hash value returned by the distributed IPFS network is stored in the blockchain network.

[0016] In the verifiable expression VP authorization verification step, the user entity verifies the verifiable expression VP authorization using the hash value of the verifiable expression VP document.

[0017] Furthermore, the distributed digital identity DID registration steps specifically include:

[0018] A distributed digital identity DID is registered for each entity, and the DID document corresponding to the distributed digital identity is uploaded to the blockchain network for storage. The entities include the user entity, the issuer and the verifier, and the corresponding DID document includes the DID identifier and the user public key.

[0019] Furthermore, the steps for issuing the certificate can be verified, including:

[0020] S201: The Issuer creates a verifiable credential VC Document for each user entity and sends the VCDocument to the corresponding user entity;

[0021] S202: The user entity receives the corresponding verifiable credential VC Document and acts as a holder;

[0022] S203: The holder generates a symmetric password as an encryption and decryption password;

[0023] S204: the holder Holder uses the encryption and decryption password to symmetrically encrypt the received verifiable credential VCDocument;

[0024] S205: The holder sends the encrypted verifiable credential VC Document as a VC encrypted document to the distributed IPFS network;

[0025] S206: The IPFS network stores the VC encrypted document and returns the hash value of the VC encrypted document to the holder;

[0026] S207: The holder sends the hash value of the returned VC encrypted document to the blockchain network;

[0027] S208: The blockchain network stores the hash value of the VC encrypted document and returns the VC encrypted document hash list to the holder;

[0028] S209: The user Holder uses the user public key in his own DID document to asymmetrically encrypt the symmetric password generated in S203 to generate a decrypted password ciphertext;

[0029] S210: The user Holder stores the decrypted password ciphertext generated by S209 to the blockchain network.

[0030] Furthermore, the steps for obtaining the verifiable credentials may include:

[0031] S301: Each holder uses his / her DID to query the blockchain network for the hash list of the VC encrypted documents he / she holds;

[0032] S302: After the query is passed, the holder receives the hash value of the VC encrypted document from the blockchain network according to the VC encrypted document hash list;

[0033] S303: The holder Holder queries the IPFS network for the VC encrypted document according to the hash value of the VC encrypted document;

[0034] S304: After the query is passed, the holder receives the corresponding VC encrypted document from the IPFS network;

[0035] S305: The holder queries the blockchain network for the decrypted password ciphertext based on the hash value of the VC encrypted document and its own DID identifier;

[0036] S306: After the query is passed, the holder receives the decrypted password ciphertext from the blockchain network;

[0037] S307: The holder Holder uses the private key corresponding to the public key of his own DID document to decrypt the received decryption password ciphertext and obtain the decryption password;

[0038] S308: The holder Holder uses the decryption password obtained in S307 to decrypt the VC encrypted document in S304 to obtain the complete VC document plaintext.

[0039] Furthermore, the steps of expressing VP authorization may be verified, including:

[0040] S401: The user entity queries the blockchain for the DID document of the verifier;

[0041] S402: The blockchain returns the DID document of the verifier to the user entity;

[0042] S403: The user entity generates a symmetric password based on the DID document of the Verifier;

[0043] S404: The user entity creates a verifiable expression VP document;

[0044] S405: The user entity uses the symmetric cipher generated in S403 to symmetrically encrypt the verifiable expression VP document generated in S404 to generate an encrypted VP Document;

[0045] S406: The user entity sends the VP Document encrypted document generated in S405 to the IPFS network;

[0046] S407: The IPFS network stores the VP Document encrypted document and returns the hash value of the corresponding VP Document encrypted document to the user entity;

[0047] S408: The user entity sends the hash value of the VP Document encrypted document to the blockchain;

[0048] S409: The blockchain stores the hash value of the VP Document encrypted document;

[0049] S410: The user entity uses the public key in the DID document of the verifier to asymmetrically encrypt the symmetric password generated in S403 to generate a decrypted password ciphertext that can verify the expression VP document;

[0050] S411: The user stores the decrypted ciphertext of the verifiable expression VP document generated in S410 to the blockchain network.

[0051] Further, the verification step of the VP authorization verification may be verified, specifically including:

[0052] S501: The user entity presents the hash value of the VP document that can be verified to the Verifier;

[0053] S502: The Verifier receives the hash value of the verifiable expression VP document and verifies to the blockchain network whether the hash value of the verifiable expression VP document exists;

[0054] S503: The blockchain network returns the verification structure to the Verifier;

[0055] S504: The Verifier obtains the DID document of the user entity mentioned in step S501 from the blockchain network;

[0056] S505: The Verifier queries the distributed storage IPFS network for the VP Document encrypted document;

[0057] S506: The IPFS network returns the VP Document encrypted document to the Verifier according to the hash value of the VP Document encrypted document;

[0058] S507: The Verifier receives the VP Document encrypted document;

[0059] S508: The Verifier queries the blockchain network for the decrypted password ciphertext;

[0060] S509: The blockchain network queries the decrypted password ciphertext based on the hash value of the VP Document encrypted document and the DID identifier of the verifier and returns it to the verifier;

[0061] S510: The Verifier receives the decrypted ciphertext of the VP document that can be verified:

[0062] S511: The Verifier uses the private key corresponding to the public key of its DID to decrypt the decryption password ciphertext obtained in S510:

[0063] S512: The Verifier obtains the decryption password;

[0064] S513: The Verifier uses the decryption password obtained in S512 to decrypt the encrypted VP document obtained in S7;

[0065] S514: The Verifier obtains the plaintext VP document;

[0066] S515: The Verifier performs signature verification using the plaintext VP document.

[0067] Based on the above method, the present invention also discloses a distributed digital identity document storage system based on blockchain and IPFS, including:

[0068] A distributed digital identity DID registration module is used to register a distributed digital identity DID for each entity and upload the DID document corresponding to the distributed digital identity DID to the blockchain network;

[0069] The verifiable credential issuance module is used by the issuer to create and issue verifiable credentials for each user entity, encrypt the verifiable credentials and store them in the distributed IPFS network, and store the hash value returned by the distributed IPFS network in the blockchain network;

[0070] The verifiable credential acquisition module is used to enable users to obtain verifiable credentials and obtain the complete plain text of the verifiable credential document based on their own DID identifier;

[0071] The Verifiable Expression VP Authorization Module is used by the user entity to query the DID document of the verifier and complete the authorization of the Verifiable Expression VP. The Verifiable Expression VP document is encrypted and stored in the distributed IPFS network. At the same time, the hash value returned by the distributed IPFS network is stored in the blockchain network.

[0072] The verifiable expression VP authorization verification module is used for the user entity to verify the verifiable expression VP authorization using the hash value of the verifiable expression VP document.

[0073] Preferably, the distributed digital identity DID registration module specifically performs the following steps: each entity registers a distributed digital identity DID, and uploads the DID document corresponding to the distributed digital identity to the blockchain network for storage, the entities include user entities, issuers and verifiers, and the corresponding DID document includes a DID identifier and a user public key.

[0074] Preferably, the verifiable credential issuing module specifically performs the following steps:

[0075] S201: The Issuer creates a verifiable credential VC Document for each user entity and sends the VCDocument to the corresponding user entity;

[0076] S202: The user entity receives the corresponding verifiable credential VC Document and acts as a holder;

[0077] S203: The holder generates a symmetric password as an encryption and decryption password;

[0078] S204: the holder Holder uses the encryption and decryption password to symmetrically encrypt the received verifiable credential VCDocument;

[0079] S205: The holder sends the encrypted verifiable credential VC Document as a VC encrypted document to the distributed IPFS network;

[0080] S206: The IPFS network stores the VC encrypted document and returns the hash value of the VC encrypted document to the holder;

[0081] S207: The holder sends the hash value of the returned VC encrypted document to the blockchain network;

[0082] S208: The blockchain network stores the hash value of the VC encrypted document and returns the VC encrypted document hash list to the holder;

[0083] S209: The user Holder uses the user public key in his own DID document to asymmetrically encrypt the symmetric password generated in S203 to generate a decrypted password ciphertext;

[0084] S210: The user Holder stores the decrypted password ciphertext generated by S209 to the blockchain network.

[0085] Preferably, the verifiable credential acquisition module specifically performs the following steps:

[0086] S301: Each holder uses his / her DID to query the blockchain network for the hash list of the VC encrypted documents he / she holds;

[0087] S302: After the query is passed, the holder receives the hash value of the VC encrypted document from the blockchain network according to the VC encrypted document hash list;

[0088] S303: The holder Holder queries the IPFS network for the VC encrypted document according to the hash value of the VC encrypted document;

[0089] S304: After the query is passed, the holder receives the corresponding VC encrypted document from the IPFS network;

[0090] S305: The holder queries the blockchain network for the decrypted password ciphertext based on the hash value of the VC encrypted document and its own DID identifier;

[0091] S306: After the query is passed, the holder receives the decrypted password ciphertext from the blockchain network;

[0092] S307: The holder Holder uses the private key corresponding to the public key of his own DID document to decrypt the received decryption password ciphertext and obtain the decryption password;

[0093] S308: The holder Holder uses the decryption password obtained in S307 to decrypt the VC encrypted document in S304 to obtain the complete VC document plaintext.

[0094] It can be seen from the above technical solutions that, compared with the prior art, the present invention discloses a distributed digital identity document storage method based on blockchain and IPFS, which has the following beneficial effects:

[0095] ① This invention combines blockchain technology with IPFS to create a new digital identity document storage architecture. By utilizing the immutability of blockchain, the authenticity and integrity of digital identity documents stored in the system are ensured. At the same time, with the help of IPFS's content addressing mechanism, efficient retrieval and distribution of digital identity documents are achieved.

[0096] ② This invention proposes an optimized distributed digital identity data storage strategy, which classifies and stores digital identity documents according to their importance and access frequency. Important and frequently accessed documents are stored on blockchain nodes, and multi-frequency high-frequency digital identity documents are stored on the IPFS network, thereby reducing the latency of blockchain network transactions and increasing the speed of related document query.

[0097] ③ The present invention innovatively combines symmetric encryption with asymmetric encryption technology and distributed digital identity, providing an efficient and secure encryption and authorization method for distributed digital identity documents. The speed advantage of symmetric encryption is used to encrypt the document body to ensure the efficiency of data processing; at the same time, the public and private key mechanism of asymmetric encryption is used to achieve the security of single authorization. This method reduces the storage resource usage while ensuring the overall security and operational efficiency of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0098] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0099] Figure 1 This is a schematic diagram of the overall business process provided by the present invention.

[0100] Figure 2 Schematic diagram of the distributed digital identity DID registration process provided for the invention

[0101] Figure 3 A schematic diagram of the process of issuing a verifiable credential provided by the present invention.

[0102] Figure 4 A schematic diagram of the process of obtaining a verifiable credential provided by the present invention.

[0103] Figure 5 This is a schematic diagram of the verifiable expression VP authorization process provided by the present invention.

[0104] Figure 6 A schematic diagram of the verifiable expression authorization verification process provided by the present invention. DETAILED DESCRIPTION

[0105] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0106] The embodiment of the present invention discloses a distributed digital identity document storage method based on blockchain and IPFS.

[0107] The business process of the present invention is as follows Figure 1 As shown, it covers the creation and storage of distributed digital identity DID documents, the issuance of verifiable credentials VC documents and the generation and verification of verifiable expression authorization VP documents, wherein the verifiable credentials are stored in encrypted form and a decryption key mechanism is added. By combining blockchain technology with the IPFS decentralized storage system, the present invention realizes an efficient and secure storage and verification method.

[0108] like Figure 2 As shown, the steps of the distributed digital identity DID registration process in the present invention are as follows:

[0109] S101: Each entity generates public and private keys locally and creates its own distributed digital identity DID document (DIDDocument), which includes a DID identifier and a user public key; the entities here include user entities, issuers, and verifiers.

[0110] S102: The entity initiates a blockchain transaction, stores its own DID document on the chain and puts it into the transaction pool to be packaged. After consensus is reached, it is stored on the chain and broadcast to the entire network.

[0111] like Figure 3 As shown, the steps of the process of issuing a verifiable certificate in the present invention are as follows:

[0112] S201: The Issuer creates a verifiable credential VC Document of the user entity and sends the VCDocument to the corresponding user entity;

[0113] S202: The user entity receives the corresponding verifiable credential VC Document and acts as a holder;

[0114] S203: The holder generates a symmetric password as an encryption and decryption password;

[0115] S204: The user Holder uses the password generated in S203 to symmetrically encrypt the verifiable credential VC Document;

[0116] S205: The holder sends the encrypted VC Document to the IPFS network;

[0117] S206: IPFS network stores VC Document ciphertext and returns the storage location (hash);

[0118] S207: The holder sends the hash of the VC Document to the blockchain network;

[0119] S208: The blockchain network stores the hash of the VC Document and returns the transaction address on the chain;

[0120] S209: The user Holder uses the public key in his DID document to asymmetrically encrypt the password generated in S203 to generate a decrypted password ciphertext;

[0121] S210: The user holding the decrypted password ciphertext generated in S209 is stored in the blockchain network.

[0122] Note: The decryption password ciphertext is used to decrypt the VC encrypted documents stored in the IPFS network. When the user initially stores VC, only he can decrypt the VC encrypted document, which can ensure the safe storage of VC documents.

[0123] like Figure 4 As shown, the steps of the process of obtaining verifiable credentials in the present invention are as follows:

[0124] S301: Each holder queries the blockchain network for the VC encrypted document list (hash list) held by him according to the DID document;

[0125] S302: The holder receives the hash list of the VC encrypted document held by the holder;

[0126] S303: The holder queries the IPFS network to obtain the file according to the VC encrypted document hash;

[0127] S304: The holder receives the VC encrypted document;

[0128] S305: The holder Holder queries the decrypted password ciphertext held by the holder based on the hash of the VC encrypted document and his / her own DID;

[0129] S306: The holder receives the decrypted password ciphertext;

[0130] S307: Decrypt using the private key corresponding to the public key of the DID document to obtain the decryption password;

[0131] S308: The user uses the decryption password obtained in S307 to decrypt the VC encrypted document in S304;

[0132] S309: The holder can view the complete VC document in plain text.

[0133] like Figure 5 As shown, the steps of the VP authorization process that can be verified in the present invention are as follows: S401: The user queries the blockchain for the DID document of the verifier;

[0134] S402: The blockchain returns a DID document;

[0135] S403: The user generates a symmetric password as an encryption and decryption password;

[0136] S404: The user creates a verifiable expression VP Document;

[0137] S405: The user symmetrically encrypts the VP Document generated in S404 using the symmetric password generated in S403;

[0138] S406: The user stores the document generated in S405 to the IPFS network;

[0139] S407: IPFS network stores the VP encrypted document and returns the storage location (hash);

[0140] S408: The user stores the VP Document ciphertext hash generated in S405 to the blockchain;

[0141] S409: Blockchain network stores VP Document ciphertext hash;

[0142] S410: The user uses the public key in the DID document of the verifier to asymmetrically encrypt the password generated in S403 to generate a decrypted password ciphertext;

[0143] S411: The user stores the decrypted password ciphertext generated in S410 to the blockchain network;

[0144] S412: End.

[0145] Note: When a user creates a verifiable expression authorization, it is encrypted using the verifier's public key, so only the verifier can decrypt it.

[0146] like Figure 6 As shown, the steps of verifying the authorization of the verifiable expression (obtaining and verifying VP) in the present invention are as follows:

[0147] S501: The user presents the hash of the verifiable expression VP to the verifier;

[0148] S502: The verifier receives the verifiable expression hash and verifies with the blockchain network whether the evidence is stored;

[0149] S503: The blockchain network returns whether the certificate is stored or not;

[0150] S504: The verification direction obtains the DID document of the presenting user from the blockchain network for subsequent signature verification;

[0151] S505: Verify the query of the VP encrypted document on the IPFS network;

[0152] S506: The IPFS network queries and returns the encrypted document of the VP according to the hash of the VP ciphertext document;

[0153] S507: The verifier receives the VP encrypted document;

[0154] S508: Verify the blockchain network and query the decrypted password ciphertext;

[0155] S509: The blockchain network queries and decrypts the ciphertext based on the VP hash and the validator DID and returns it;

[0156] S510: The verifier receives the decrypted password ciphertext:

[0157] S511: The verifier uses the private key corresponding to the public key of its DID to decrypt the ciphertext obtained in S510:

[0158] S512: The verifier obtains the decryption password;

[0159] S513: The verifier uses the decryption password obtained in S512 to decrypt the encrypted VP document obtained in S507;

[0160] S514: The verifier obtains the plaintext VP document;

[0161] S515: The verifier performs signature verification.

[0162] Distributed Digital Identity DID Registration: This is the foundation of the entire storage method. The DID registration step creates a unique and verifiable digital identity for each user or entity. This identity is the cornerstone of all subsequent steps, because without DID, the ownership and relevance of documents, credentials, etc. cannot be clarified. Therefore, DID registration is the starting point of the entire storage method.

[0163] Verifiable Credentials (VC) document issuance: After a user has a DID, they can receive or apply for verifiable credentials. These credentials are associated with the user's DID and prove certain attributes or qualifications of the user. The issuance of VC documents depends on the authenticity of the DID, because only a real DID can receive valid VC. At the same time, VC documents are also important data that needs to be stored and verified in subsequent steps.

[0164] Verifiable Credential VC Document Acquisition: This step is for users or other entities to retrieve and obtain VC documents stored in the system as needed. The acquisition of VC documents is based on DID documents, because the system needs to locate and retrieve the corresponding VC documents based on DID. In addition, the acquired VC will be used in the subsequent Verifiable Expression VP authorization step.

[0165] Verifiable Expression VP Authorization: In this step, users select specific VCs to generate VPs based on their needs and authorize them. VP is a structured representation that contains DID, VC, and other metadata that may be required. This step relies on the DID and VC obtained in the previous step, because without these basic data, a valid VP cannot be generated.

[0166] Verifiable Expression VP Authorization Verification: This is the last step of the entire storage method and a verification of all previous steps. In this step, the verifier receives and verifies the authenticity and validity of the VP. This verification process is based on the storage records of the blockchain and IPFS, so it relies on the correct execution and storage of all previous steps.

[0167] In summary, there is a close relationship between these five parts. DID registration is the starting point of the entire method, providing a basis for the subsequent issuance and acquisition of VC and the generation and verification of VP. The issuance and acquisition of VC is the bridge connecting DID and VP, while the generation and verification of VP is the integration and confirmation of all previous steps. Therefore, these five parts together constitute a complete and efficient distributed digital identity application system for all related document storage methods.

[0168] The present invention relates to blockchain technology, distributed storage system and digital identity management, and specifically uses blockchain and IPFS (InterPlanetary File System) to achieve efficient storage of digital identity documents. At the same time, the present invention adopts a dual encryption method combining symmetric encryption and asymmetric encryption to enhance data security.

[0169] The above method can be implemented through a distributed digital identity document storage system based on blockchain and IPFS, which mainly includes:

[0170] A distributed digital identity DID registration module is used to register a distributed digital identity DID for each entity and upload the DID document corresponding to the distributed digital identity DID to the blockchain network;

[0171] The verifiable credential issuance module is used by the issuer to create and issue verifiable credentials for each user entity, encrypt the verifiable credentials and store them in the distributed IPFS network, and store the hash value returned by the distributed IPFS network in the blockchain network;

[0172] The verifiable credential acquisition module is used to enable users to obtain verifiable credentials and obtain the complete plain text of the verifiable credential document based on their own DID identifier;

[0173] The Verifiable Expression VP Authorization Module is used by the user entity to query the DID document of the verifier and complete the authorization of the Verifiable Expression VP. The Verifiable Expression VP document is encrypted and stored in the distributed IPFS network. At the same time, the hash value returned by the distributed IPFS network is stored in the blockchain network.

[0174] The verifiable expression VP authorization verification module is used for the user entity to verify the verifiable expression VP authorization using the hash value of the verifiable expression VP document.

[0175] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0176] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A distributed digital identity document storage method based on blockchain and IPFS, characterized in that: The following steps are involved: The DID registration and upload step is to register a DID for each entity and upload the DID document corresponding to the DID to the blockchain network; Verifiable credential issuance step: the issuer creates and issues verifiable credentials for each user entity, encrypts the verifiable credentials and stores them in the distributed IPFS network, and stores the hash value returned by the distributed IPFS network in the blockchain network; Verifiable credential acquisition step: each user entity that receives the verifiable credential obtains the verifiable credential as a holder and obtains the complete plaintext of the verifiable credential document based on its own DID identifier; Verifiable Expression VP authorization step: the user entity queries the DID document of the verifier and completes the authorization of the Verifiable Expression VP. The Verifiable Expression VP document is encrypted and stored in the distributed IPFS network. At the same time, the hash value returned by the distributed IPFS network is stored in the blockchain network. In the verifiable expression VP authorization verification step, the user entity verifies the verifiable expression VP authorization using the hash value of the verifiable expression VP document.

2. According to claim 1, a distributed digital identity document storage method based on blockchain and IPFS is characterized in that: The steps for registering and uploading a distributed digital identity DID include: A distributed digital identity DID is registered for each entity, and the DID document corresponding to the distributed digital identity is uploaded to the blockchain network for storage. The entities include user entities, issuers and verifiers, and the corresponding DID document includes a DID identifier and a user public key.

3. According to a distributed digital identity document storage method based on blockchain and IPFS according to claim 1, it is characterized in that: Verifiable credential issuance steps include: S201: The issuing party creates a verifiable credential VC Document for each user entity and sends the VC Document to the corresponding user entity; S202: The user entity receives the corresponding verifiable credential VC Document and acts as the holder; S203: The user generates a symmetric password as an encryption and decryption password; S204: The user holding the password symmetrically encrypts the received verifiable credential VC Document using the encryption and decryption password; S205: The user holding the encrypted verifiable credential VC Document sends it to the distributed IPFS network as a VC encrypted document; S206: The IPFS network stores the VC encrypted document and returns the hash value of the VC encrypted document to the holder; S207: The holder sends the hash value of the returned VC encrypted document to the blockchain network; S208: The blockchain network stores the hash value of the VC encrypted document and returns the VC encrypted document hash list to the holder; S209: The user uses the user public key in his / her DID document to asymmetrically encrypt the symmetric password generated in S203 to generate a decryption password ciphertext; S210: The user holding the decrypted password ciphertext generated in S209 is stored in the blockchain network.

4. According to claim 1, a distributed digital identity document storage method based on blockchain and IPFS is characterized in that: The steps to obtain verifiable credentials include: S301: Each user holding the VC queries the blockchain network for the hash list of the encrypted VC documents held by the user according to his / her DID identifier; S302: After the query is passed, the user holding the VC encrypted document receives the hash value of the VC encrypted document from the blockchain network according to the VC encrypted document hash list; S303: The user holding the VC encrypted document queries the IPFS network for the VC encrypted document according to the hash value of the VC encrypted document; S304: After the query is passed, the user receives the corresponding VC encrypted document from the IPFS network; S305: The user holding the VC encrypted document queries the blockchain network for the decrypted password ciphertext held by the user according to the hash value of the VC encrypted document and its own DID identifier; S306: After the query is passed, the user receives the decrypted password ciphertext from the blockchain network; S307: The user holding the DID document uses the private key corresponding to the public key of the DID document to decrypt the received decryption password ciphertext and obtain the decryption password; S308: The user uses the decryption password obtained in S307 to decrypt the VC encrypted document in S304 to obtain the complete VC document plaintext.

5. According to a distributed digital identity document storage method based on blockchain and IPFS according to claim 1, it is characterized in that: Verifiable expression VP authorization steps, including: S401: The user entity queries the blockchain for the DID document of the verifier; S402: The blockchain returns the DID document of the verifier to the user entity; S403: The user entity generates a symmetric password based on the DID document of the verifier; S404: The user entity creates a verifiable expression VP document; S405: The user entity uses the symmetric cipher generated in S403 to symmetrically encrypt the verifiable expression VP document generated in S404 to generate an encrypted VP Document; S406: The user entity sends the VP Document encrypted document generated in S405 to the IPFS network; S407: The IPFS network stores the VP Document encrypted document and returns the hash value of the corresponding VP Document encrypted document to the user entity; S408: The user entity sends the hash value of the VP Document encrypted document to the blockchain; S409: The blockchain stores the hash value of the VP Document encrypted document; S410: The user entity uses the public key in the DID document of the verifier to asymmetrically encrypt the symmetric password generated in S403 to generate a decrypted password ciphertext that can verify the expression VP document; S411: The user stores the decrypted ciphertext of the verifiable expression VP document generated in S410 to the blockchain network.

6. A distributed digital identity document storage method based on blockchain and IPFS according to claim 1, characterized in that: Verifiable expression VP authorization verification steps, including: S501: The user entity presents the hash value of the VP document that can be verified to the verification party; S502: The verifier receives the hash value of the verifiable expression VP document, and verifies to the blockchain network whether the hash value of the verifiable expression VP document exists; S503: The blockchain network returns the verification structure to the verifier; S504: Verify that the DID document of the user entity in step S501 is obtained from the blockchain network; S505: Verify the distributed storage IPFS network query VP Document encrypted document; S506: The IPFS network returns the VP Document encrypted document to the verifier according to the hash value of the VP Document encrypted document; S507: The verifier receives the VP Document encrypted document; S508: Verify the blockchain network and query the decrypted password ciphertext; S509: The blockchain network queries the decrypted password ciphertext based on the hash value of the VP Document encrypted document and the DID identifier of the verifier and returns it to the verifier; S510: The verifier receives the decrypted ciphertext of the VP document that can be verified: S511: The verifier uses the private key corresponding to the public key of its DID to decrypt the decryption password ciphertext obtained in S510: S512: The verifier obtains the decryption password; S513: The verifier uses the decryption password obtained in S512 to decrypt the encrypted VP document obtained in S7; S514: The verifier obtains the plaintext VP document; S515: The verifier performs signature verification using the plaintext VP document.

7. A distributed digital identity document storage system based on blockchain and IPFS, characterized in that: include: A distributed digital identity DID registration module is used to register a distributed digital identity DID for each entity and upload the DID document corresponding to the distributed digital identity DID to the blockchain network; The verifiable credential issuance module is used by the issuer to create and issue verifiable credentials for each user entity, encrypt the verifiable credentials and store them in the distributed IPFS network, and store the hash value returned by the distributed IPFS network in the blockchain network; The verifiable credential acquisition module is used to enable users to obtain verifiable credentials and obtain the complete plain text of the verifiable credential document based on their own DID identifier; The Verifiable Expression VP Authorization Module is used by the user entity to query the DID document of the verifier and complete the authorization of the Verifiable Expression VP. The Verifiable Expression VP document is encrypted and stored in the distributed IPFS network. At the same time, the hash value returned by the distributed IPFS network is stored in the blockchain network. The verifiable expression VP authorization verification module is used for the user entity to verify the verifiable expression VP authorization using the hash value of the verifiable expression VP document.

8. A distributed digital identity document storage system based on blockchain and IPFS according to claim 7, characterized in that: The distributed digital identity DID registration module specifically performs the following steps: each entity registers a distributed digital identity DID, and uploads the DID document corresponding to the distributed digital identity to the blockchain network for storage. The entities include user entities, issuers and verifiers, and the corresponding DID document includes a DID identifier and a user public key.

9. A distributed digital identity document storage system based on blockchain and IPFS according to claim 7, characterized in that: The verifiable credential issuing module specifically performs the following steps: S201: The issuing party creates a verifiable credential VC Document for each user entity and sends the VC Document to the corresponding user entity; S202: The user entity receives the corresponding verifiable credential VC Document and acts as the holder; S203: The user generates a symmetric password as an encryption and decryption password; S204: The user holding the password symmetrically encrypts the received verifiable credential VC Document using the encryption and decryption password; S205: The user holding the encrypted verifiable credential VC Document sends it to the distributed IPFS network as a VC encrypted document; S206: The IPFS network stores the VC encrypted document and returns the hash value of the VC encrypted document to the holder; S207: The holder sends the hash value of the returned VC encrypted document to the blockchain network; S208: The blockchain network stores the hash value of the VC encrypted document and returns the VC encrypted document hash list to the holder; S209: The user uses the user public key in his / her DID document to asymmetrically encrypt the symmetric password generated in S203 to generate a decryption password ciphertext; S210: The user holding the decrypted password ciphertext generated by S209 is stored in the blockchain network.

10. A distributed digital identity document storage system based on blockchain and IPFS according to claim 7, characterized in that: The verifiable credential acquisition module specifically performs the following steps: S301: Each user holding the VC queries the blockchain network for the hash list of the encrypted VC documents held by the user according to his / her DID identifier; S302: After the query is passed, the user holding the VC encrypted document receives the hash value of the VC encrypted document from the blockchain network according to the VC encrypted document hash list; S303: The user holding the VC encrypted document queries the IPFS network for the VC encrypted document according to the hash value of the VC encrypted document; S304: After the query is passed, the user receives the corresponding VC encrypted document from the IPFS network; S305: The user holding the VC encrypted document queries the blockchain network for the decrypted password ciphertext held by the user according to the hash value of the VC encrypted document and its own DID identifier; S306: After the query is passed, the user receives the decrypted password ciphertext from the blockchain network; S307: The user holding the DID document uses the private key corresponding to the public key of the DID document to decrypt the received decryption password ciphertext and obtain the decryption password; S308: The user uses the decryption password obtained in S307 to decrypt the VC encrypted document in S304 to obtain the complete VC document plaintext.

Images