Block chain self-sovereign identity management method

Abstract

The invention belongs to the technical field of computers, and discloses a block chain self-sovereignty identity management method, which comprises the following steps: a user generates a PGP key pair and constructs a DID identifier, and the PGP key pair comprises a user public key and a user private key; constructing a DID document based on the user public key and the DID identifier; sending the DID document to a block chain; dynamically updating the credibility value of each node in the block chain; and when a node in the block chain needs to access the network resource or service, performing identity verification on the current node based on the creditworthiness value of the current node, when the verification is passed, the current node obtains the access authority to the requested resource or service, and when the verification is not passed, the access request is rejected. According to the technical scheme, honest interaction in the network can be promoted by dynamically adjusting the node reputation value, the security of identity verification is improved, and the overall credibility of the network is increased through a reputation value system.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular to a blockchain self-sovereign identity management method. Background Art

[0002] With the development of the digital age, personal information and data security have become the focus of global attention. Traditional identity management systems often rely on centralized institutions and are usually managed and stored by centralized third-party institutions such as government agencies, banks or other service providers. This not only increases the risk of data tampering or leakage, but also limits users' control over their own identity information. In addition, these systems often lack sufficient transparency and credibility, making the identity management process vulnerable to attacks such as identity theft and fraud. Summary of the invention

[0003] The purpose of the present invention is to provide a blockchain self-sovereign identity management method to solve the problems existing in the above-mentioned prior art.

[0004] To achieve the above objectives, the present invention provides a blockchain self-sovereign identity management method, comprising:

[0005] The user generates a PGP key pair and constructs a DID identifier, wherein the PGP key pair includes a user public key and a user private key;

[0006] Constructing a DID document based on the user public key and the DID identifier;

[0007] Sending the DID document to the blockchain;

[0008] Dynamically updating the reputation value of each node in the blockchain;

[0009] When there is a node in the blockchain that needs to access network resources or services, the current node is authenticated based on the reputation value of the current node. When the verification passes, the current node obtains access rights to the requested resources or services. When the verification fails, the access request is rejected.

[0010] Optionally, the process of generating the PGP key pair specifically includes:

[0011] Determine the key length, generate a number of prime numbers, and construct a key modulus based on each of the prime numbers;

[0012] Calculating the Euler function value of the secret key modulus;

[0013] Select a positive integer that is less than the Euler function value and is coprime to the Euler function value as the public key exponent;

[0014] Calculating a private key exponent based on the public key exponent;

[0015] The PGP key pair is constructed based on the public key exponent, private key exponent and secret key modulus.

[0016] Optionally, the construction process of the DID identifier specifically includes:

[0017] A random number is obtained, a hash operation is performed on the random number to obtain an identification ID, and the DID identifier is constructed based on the identification ID.

[0018] Optionally, the DID document includes a DID identifier, a user public key, an authentication method, and service endpoint information.

[0019] Optionally, dynamically updating the reputation value of each node in the blockchain includes:

[0020] Dynamically calculate and update the reputation value of each node based on its behavior in the network;

[0021] When the reputation value of an existing node reaches the preset trust acceptance threshold of the current node, a trust chain is formed, and indirect trust between nodes is allowed through the trust path;

[0022] The reputation value corresponding to each node on the trust chain constituting indirect trust is calculated and updated based on the attenuation factor. When the reputation value of the intermediate node is greater than or equal to the reputation threshold, the current trust chain is regarded as a valid trust chain;

[0023] Dynamically update the reputation value of each node based on the time decay factor;

[0024] For nodes whose reputation value is lower than the reputation threshold, access rights are restricted.

[0025] Optionally, the reputation value of each node is dynamically calculated and updated based on the behavior of each node in the network. The specific calculation formula is:

[0026] R new =R current +n verify ΔR verify +(n accept k) ΔR accept –n forge ΔR forge

[0027] In the formula, R new and R current are the reputation values ​​of the node before and after the update, n verify 、n accept and n forge are the number of verification, acceptance and forgery behaviors in one update cycle, ΔR verify To verify the reputation value, ΔRaccept To accept the reputation value, ΔR forge is the fake reputation value, and k is the trust breadth coefficient.

[0028] Optionally, the credibility threshold includes several levels, and different levels of credibility values ​​correspond to different levels of network resource access rights.

[0029] Optionally, the reputation value of each node is dynamically updated based on the time decay factor. The specific calculation formula is:

[0030]

[0031] In the formula, R new and R current are the reputation values ​​of the node before and after the update, γ is the time decay factor, and λ i represents the trust chain decay of the reputation value at step i, ΔR i It is the change in reputation value brought about by the trust chain in step i.

[0032] Optionally, when a node with restricted access rights participates in positive behavior, the reputation value is restored and a revocation review is applied for.

[0033] Optionally, authenticate the current node based on its reputation value, including:

[0034] When there is a node in the blockchain that needs to access network resources or services, the public key of the current node and the corresponding DID identifier are legally verified. After the legal verification is passed, the reputation value of the current node is verified. When the reputation value is greater than or equal to the reputation threshold, the identity authentication is passed, and the current node obtains access rights to the requested resources or services. When the reputation value is less than the reputation threshold, the identity authentication fails, and the access request of the current node is rejected.

[0035] The technical effects of the present invention are:

[0036] The present invention promotes honest interaction within the network by dynamically adjusting the node reputation value, which not only improves the security of identity authentication, but also increases the overall trust of the network through the reputation value system. The PGP trust model based on the reputation system can effectively improve the security of identity management and increase the overall trust of the network through the reputation value system. In addition, the method strengthens the user's control over his or her identity information and provides users with a secure and decentralized identity management framework. By combining these technologies with the decentralized nature of blockchain, an identity authentication system that does not rely on any centralized organization can be created, which not only improves the system's anti-attack ability, but also increases the system's transparency and credibility. In addition, the node reputation value system is introduced to establish a dynamic trust mechanism by evaluating and recording the behavior of each node in the network. This mechanism encourages positive behavior and inhibits negative behavior, thereby improving the overall security and efficiency of the network. This is essential for maintaining a healthy and reliable blockchain ecosystem. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0039] Figure 1 This is a management flow chart in an embodiment of the present invention. DETAILED DESCRIPTION

[0040] Various exemplary embodiments of the present invention will now be described in detail. This detailed description should not be considered as limiting the present invention, but should be understood as a more detailed description of certain aspects, features, and embodiments of the present invention.

[0041] It should be understood that the terms described in the present invention are only for describing special embodiments and are not intended to limit the present invention. In addition, for the numerical range in the present invention, it should be understood that each intermediate value between the upper and lower limits of the scope is also specifically disclosed. Each smaller range between the intermediate value in any stated value or stated range and any other stated value or intermediate value in the described range is also included in the present invention. The upper and lower limits of these smaller ranges can be independently included or excluded in the scope.

[0042] Unless otherwise indicated, all technical and scientific terms used herein have the same meanings as those of ordinary skill in the art generally understood by the present invention. Although the present invention describes only preferred methods, any method similar or equivalent to that described herein may also be used in the implementation or testing of the present invention. All documents mentioned in this specification are incorporated by reference to disclose and describe the methods related to the documents. In the event of a conflict with any incorporated document, the content of this specification shall prevail.

[0043] It will be apparent to those skilled in the art that various modifications and variations may be made to the specific embodiments of the present invention description without departing from the scope or spirit of the present invention. Other embodiments derived from the present invention description will be apparent to those skilled in the art. The present application description and examples are exemplary only.

[0044] The words “include,” “including,” “have,” “contain,” etc. used in this article are open-ended terms, meaning including but not limited to.

[0045] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0046] Embodiment 1

[0047] like Figure 1 As shown, a blockchain self-sovereign identity management method is provided in this embodiment, including: a user generates a PGP key pair and constructs a DID identifier, the PGP key pair includes a user public key and a user private key; a DID document is constructed based on the user public key and the DID identifier; the DID document is sent to the blockchain; the reputation value of each node in the blockchain is dynamically updated; when there is a node in the blockchain that needs to access network resources or services, the current node is authenticated based on the reputation value of the current node, when the verification passes, the current node obtains access rights to the requested resources or services, and when the verification fails, the access request is rejected.

[0048] The current identity management mechanisms all rely on third-party management and storage, which has a high centralization risk. By building a PGP trust model and SSI identity management based on reputation, the trust level and security in the network environment are effectively improved, so that users can obtain higher security guarantees when performing identity authentication and data exchange. This method motivates network participants to maintain good network behavior through the calculation and update of dynamic reputation values, thereby improving the overall health and reliability of the network. Finally, this method provides a flexible and reliable trust management and identity authentication method for decentralized networks through a detailed reputation value calculation and update mechanism, which helps to build a more open and secure blockchain network.

[0049] In this method, the user first generates a unique decentralized identifier (DID) and a corresponding PGP key pair for identity authentication and data encryption. The DID document, containing the user's public key and verification information, is published on the decentralized network to ensure its immutability and verifiability. A reputation value calculation mechanism based on user behavior is established in the system to promote honest interactions within the network by dynamically adjusting the node reputation value. This method not only improves the security of identity authentication, but also increases the overall trust of the network through the reputation value system, providing users with a secure and decentralized identity management framework and strengthening users' control over their own identity information.

[0050] The specific scheme of this embodiment is as follows:

[0051] 1. System initialization: First, determine the security parameter l, and then generate two large prime numbers p and q. Subsequently, calculate N = p × q, and the obtained N is the part shared by the public key and the private key, which is used as the modulus for encryption and decryption operations. Then, calculate the Euler function φ(N) = (p-1) × (q-1) to prepare for the generation of the key exponent. The public key exponent e is selected as a positive integer less than φ(N), usually 65537, to ensure that e is less than φ(N) and is coprime with φ(N). Next, calculate the private key exponent d, which satisfies d×e≡1modφ(N), where mod is the modulus operation and d is the modular inverse of e with respect to φ(N). At this point, the public key PK(N,e) and private key SK(N,d) are generated, which together constitute the PGP key pair.

[0052] 2. Create DID: Hash the random number R to generate a unique identification ID. Then use the ID to construct the DID identifier. identifier Is a unique string based on the ID.

[0053] The DID document is further constructed, and its content includes the DID identifier, public key, authentication method, and other optional service endpoint information. Finally, the DID is registered and the DID document is published on the blockchain, ensuring the immutability and global accessibility of the DID document.

[0054] 3. PGP trust model and SSI identity management based on reputation system: The PGP trust model based on reputation system is a dynamic trust management framework designed to establish and maintain trust relationships through quantified node reputation values ​​in decentralized network environments, such as P2P networks, blockchains, and self-sovereign identity (SSI) systems. In this model, the reputation value of each node is a direct indicator of its credibility, while the trust chain allows indirect trust to be formed between nodes that have established trust. In this model, the reputation value of a node directly affects its identity authentication process in the network. Only when the reputation value of a node reaches or exceeds the set threshold can the node successfully authenticate its identity and gain access to network resources.

[0055] The reputation value of a node is a key factor in determining whether to establish a trust relationship with it and complete identity verification. The reputation value of each node is dynamically calculated and updated based on its behavior in the network, reflecting the reliability of its historical behavior and the community's overall evaluation of its behavior. The level of reputation directly affects the possibility of other nodes establishing a trust relationship with it. The calculation and update mechanism of reputation value is a core component, which directly affects the trust relationship of nodes in the network. In order to describe the calculation process of reputation value in detail, including the optimized update mechanism, defining the reputation value threshold, considering factors such as trust depth and trust corrosion, the following are the specific algorithm formulas and steps.

[0056] Assume that the initial reputation value of each node is R0. The update of reputation value follows the following rules:

[0057] When a node successfully verifies the signature of another node, the verification reputation value ΔR is increased verify

[0058] When the node's signature is accepted by other trusted nodes, the acceptance reputation value ΔR is increased accept , where the number of accepted nodes is multiplied by a coefficient k, which represents the breadth of trust.

[0059] If the behavior of the node is considered untrustworthy (such as signature forgery), reduce the forgery reputation value ΔR forge

[0060] The specific reputation value update formula is:

[0061] R new =R current +n verify ΔR verify +(naccept k) ΔR accept –n forge ΔR forge

[0062] In the formula, R new and R current Represents the reputation value of the node before and after the update, n verify 、n accept and n forge Respectively represent the number of verification, acceptance and forgery behaviors in one update cycle.

[0063] When a node needs to access network resources or services, it first initiates an authentication request and attaches its DID. The management system then verifies the DID and public key of the requesting node to ensure that the request comes from a legitimate identity. The system determines whether it meets the reputation threshold requirements for the access request by querying and evaluating the node's current reputation value. If the node's reputation value reaches or exceeds the required threshold, the authentication is successful and the node gains access to the requested resource or service. If the reputation value does not reach the threshold, the authentication fails, the node's access request is rejected, and the node may be prompted to increase its reputation value.

[0064] Once a direct trust relationship is established between nodes, that is, one node believes that the reputation value of another node has reached its acceptance threshold, a trust chain can be formed between them. The trust chain allows nodes to indirectly trust other nodes that do not interact directly but are connected through a trust path. The formation of this indirect trust is based on the transitivity principle: if node A trusts node B, and node B trusts node C, then under certain conditions, node A can indirectly trust node C, but this trust will gradually decay as the trust chain deepens. In this embodiment, by introducing a decay factor λ, for each step in the trust chain, the contribution of the reputation value is reduced by λ. n , where n is the length of the trust chain.

[0065] Reputation threshold: The establishment of indirect trust depends on whether the node reputation reaches the set threshold. Only when the reputation of all intermediate nodes meets the minimum standard, the trust chain is considered valid. threshold , only when the node's reputation value R ≥ R threshold, the node is considered trustworthy, thus completing the identity verification process. This threshold can be set based on the network's security requirements and historical data. This reputation value threshold can be designed into multiple levels. When the node's reputation value reaches or exceeds a higher threshold R1, the node can not only successfully verify its identity, but also obtain different levels of network resource access rights based on its reputation level. This mechanism is implemented by dynamically generating and updating whitelists and blacklists, where the whitelist includes nodes with higher reputation values, which enjoy more permissions and services; while nodes with lower reputation values ​​are blacklisted, restricting their access to certain network resources or services, thereby incentivizing nodes to maintain good network behavior.

[0066] On the other hand, over time, if there is no new positive behavior, the reputation value should gradually decrease, simulating the natural erosion of trust. A time decay factor γ can be set, and the reputation value decays γ·R in each cycle current .

[0067] Taking trust depth and trust erosion into consideration, the update formula is adjusted to:

[0068]

[0069] Among them, λ i represents the trust chain decay of the reputation value at step i, ΔR i It is the change in reputation value brought about by the trust chain in step i.

[0070] In this case, for nodes whose reputation values ​​are lower than certain standards, the reputation revocation mechanism may be triggered to temporarily or permanently revoke their identity verification status and network access rights, including removal from the whitelist or addition to the blacklist. Nodes can restore their reputation values, apply for a review of the revocation, and restore their identity verification status and access rights through positive behaviors, such as participating in network governance and providing high-quality services.

[0071] Through this detailed calculation and update mechanism, the PGP trust model based on the reputation system can more accurately and dynamically reflect the trust status of each node in the network, providing a flexible and reliable trust management and identity authentication method for decentralized networks.

[0072] This embodiment proposes an identity management method that integrates the PGP trust model and the concept of self-sovereign identity (SSI). By dynamically adjusting the node reputation value to promote honest interaction within the network, it not only improves the security of identity authentication, but also increases the overall trust of the network through the reputation value system. The PGP trust model based on the reputation system can effectively improve the security of identity management and increase the overall trust of the network through the reputation value system. In addition, the method strengthens the user's control over his or her identity information and provides users with a secure and decentralized identity management framework. By combining these technologies with the decentralized nature of blockchain, an identity authentication system that does not rely on any centralized organization can be created, which not only improves the system's anti-attack ability, but also increases the transparency and credibility of the system. In addition, the node reputation value system is introduced to establish a dynamic trust mechanism by evaluating and recording the behavior of each node in the network. This mechanism encourages positive behavior and inhibits negative behavior, thereby improving the overall security and efficiency of the network. This is essential for maintaining a healthy and reliable blockchain ecosystem.

[0073] The above is only a preferred specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A blockchain self-sovereign identity management method, characterized in that: include: The user generates a PGP key pair and constructs a DID identifier, wherein the PGP key pair includes a user public key and a user private key; Constructing a DID document based on the user public key and the DID identifier; Sending the DID document to the blockchain; Dynamically updating the reputation value of each node in the blockchain; When there is a node in the blockchain that needs to access network resources or services, the current node is authenticated based on the reputation value of the current node. When the verification passes, the current node obtains access rights to the requested resources or services. When the verification fails, the access request is rejected.

2. A blockchain self-sovereign identity management method according to claim 1, characterized in that: The generation process of the PGP key pair specifically includes: Determine the key length, generate a number of prime numbers, and construct a key modulus based on each of the prime numbers; Calculating the Euler function value of the secret key modulus; Select a positive integer that is less than the Euler function value and is coprime to the Euler function value as the public key exponent; Calculating a private key exponent based on the public key exponent; The PGP key pair is constructed based on the public key exponent, private key exponent and secret key modulus.

3. A blockchain self-sovereign identity management method according to claim 1, characterized in that: The construction process of the DID identifier specifically includes: A random number is obtained, a hash operation is performed on the random number to obtain an identification ID, and the DID identifier is constructed based on the identification ID.

4. A blockchain self-sovereign identity management method according to claim 1, characterized in that: The DID document includes a DID identifier, a user public key, an authentication method, and service endpoint information.

5. A blockchain self-sovereign identity management method according to claim 1, characterized in that: Dynamically updating the reputation value of each node in the blockchain includes: Dynamically calculate and update the reputation value of each node based on its behavior in the network; When the reputation value of an existing node reaches the preset trust acceptance threshold of the current node, a trust chain is formed, and indirect trust between nodes is allowed through the trust path; The reputation value corresponding to each node on the trust chain constituting indirect trust is calculated and updated based on the attenuation factor. When the reputation value of the intermediate node is greater than or equal to the reputation threshold, the current trust chain is regarded as a valid trust chain; Dynamically update the reputation value of each node based on the time decay factor; For nodes whose reputation value is lower than the reputation threshold, access rights are restricted.

6. A blockchain self-sovereign identity management method according to claim 5, characterized in that: The reputation value of each node is dynamically calculated and updated based on the behavior of each node in the network. The specific calculation formula is: R new =R current +n verify ·ΔR verify +(n accept ·k)·ΔR accept -n forge ·ΔR forge In the formula, R new and R current are the reputation values ​​of the node before and after the update, n verify 、n accept and n forge are the number of verification, acceptance and forgery behaviors in one update cycle, ΔR verify To verify the reputation value, ΔR accept To accept the reputation value, ΔR forge is the fake reputation value, and k is the trust breadth coefficient.

7. A blockchain self-sovereign identity management method according to claim 5, characterized in that: The reputation threshold includes several levels, and different levels of reputation values ​​correspond to different levels of network resource access rights.

8. A blockchain self-sovereign identity management method according to claim 5, characterized in that: The reputation value of each node is dynamically updated based on the time decay factor. The specific calculation formula is: In the formula, R new and R current are the reputation values ​​of the node before and after the update, γ is the time decay factor, and λ i represents the trust chain decay of the reputation value at step i, ΔR i It is the change in reputation value brought about by the trust chain in step i.

9. A blockchain self-sovereign identity management method according to claim 5, characterized in that: It also includes restoring the reputation value and applying for revocation review when a node with restricted access rights engages in positive behavior.

10. A blockchain self-sovereign identity management method according to claim 1, characterized in that: Authentication of the current node is performed based on the reputation value of the current node, including: When there is a node in the blockchain that needs to access network resources or services, the public key of the current node and the corresponding DID identifier are legally verified. After the legal verification is passed, the reputation value of the current node is verified. When the reputation value is greater than or equal to the reputation threshold, the identity authentication is passed, and the current node obtains access rights to the requested resources or services. When the reputation value is less than the reputation threshold, the identity authentication fails, and the access request of the current node is rejected.

Images