Digital identity anonymous login method and system based on real name authentication and storage medium

Abstract

The invention discloses a digital identity anonymous login method and system based on real name authentication and a storage medium. According to the anonymous login scheme of the digital identity based on the real-name authentication disclosed by the embodiment of the invention, the user can use the user public key stored in the identity information of the real-name authentication of the real-name digital identity block chain and the login requirement of the target service system to generate the login information; the target business system can obtain the real-name identity information corresponding to the user from the real-name digital identity block chain according to the real-name DID identifier in the login information after receiving the login information, and verifies the login information according to the identity information; therefore, the user can directly use the digital identity subjected to real-name authentication to log in the desired target service system, the universality of the real-name DID identity is greatly improved, and the application range of the real-name DID identity is expanded.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to an anonymous login method and system and a storage medium for a digital identity based on real-name authentication. Background Art

[0002] With the continuous advancement of trusted technologies, especially blockchain technology, distributed digital identity (DID) application solutions have emerged, which has brought revolutionary changes to more and more traditional IT systems. These systems can now use distributed digital identities to enable users to independently control their personal data and assets, and realize decentralized data sharing across departments, industries, and regions. In addition, as the most authoritative and influential standardization organization in the field of Web technology, the World Wide Web Consortium (W3C) launched the first DID standard specification in 2019, which marks an important step forward in the normalization and standardization of DID technology.

[0003] Although DID identities have been widely used, they are usually issued by different blockchains or operators and can only be used on the corresponding blockchains, which greatly limits the application scope of DID identities. In particular, real-name authenticated DID identities need to be uniformly authenticated by an authoritative organization and cannot be issued by each platform. Therefore, although users have obtained real-name authenticated DID identities, they cannot log in and use them on different platforms. Therefore, a technical solution is needed that allows users to use real-name authenticated DID identities when logging in to the blockchain. Summary of the invention

[0004] The embodiments of the present application provide an anonymous login method and system based on a real-name authenticated digital identity and a storage medium to solve the defect in the prior art that users cannot use a real-name authenticated digital identity to log in to different blockchains.

[0005] To achieve the above-mentioned purpose, the embodiment of the present application provides an anonymous login method based on a real-name authenticated digital identity, for a user to log in to a target business system, wherein the target business system includes a login server and is connected to a real-name digital identity blockchain, and the method includes:

[0006] The user's client obtains login requirement information from the login server, wherein the login requirement information includes the business system identifier, login access address and business data of the target business system.

[0007] The client obtains user real-name information, wherein the user real-name information includes the user's real-name DID identifier and at least one user public key;

[0008] The client generates login information based on the user public key and the login requirement information, and sends the login information to the login server;

[0009] The login server generates a user identity verification request according to the login information, and sends it to the real-name digital identity blockchain, wherein the user identity verification request includes the user's real-name DID identifier;

[0010] The access node of the real-name digital identity blockchain obtains the identity authentication information of the user according to the real-name DID identifier of the user included in the user identity authentication request;

[0011] The login server verifies the login information using the identity verification information and the business data;

[0012] When the verification result is verification passed, the login server allows the user to log in to the login server using the real-name DID identifier.

[0013] The embodiment of the present application also provides an anonymous login system for a digital identity based on real-name authentication, comprising: a target business system, a real-name digital identity blockchain, wherein the target business system comprises a login server, and the real-name digital identity blockchain comprises an access node,

[0014] The target business system is used to: send login request information to the user's client, wherein the login request information includes the business system identifier, login access address and business data of the target business system, receive login information generated by the client based on the user public key and the login request information, wherein the user public key includes the user real-name information obtained by the client, and the user real-name information also includes the user's real-name DID identifier; generate a user identity authentication request according to the login information, and send it to the real-name digital identity blockchain, wherein the user identity authentication request includes the user's real-name DID identifier;

[0015] The real-name digital identity blockchain is used to: obtain the user's identity authentication information through an access node according to the user's real-name DID identifier contained in the user identity authentication request, and send it to the login server of the target business system;

[0016] Among them, the target business system is further used to verify the login information using the identity authentication information and the business data; and when the verification result is passed, the user is allowed to log in to the login server using the real-name DID identifier.

[0017] The present application also provides an electronic device, including:

[0018] Memory, used to store programs;

[0019] The processor is used to run the program stored in the memory, and when the program is run, the anonymous login method for digital identity based on real-name authentication provided in the embodiment of the present application is executed.

[0020] An embodiment of the present application also provides a computer-readable storage medium on which a computer program executable by a processor is stored, wherein when the program is executed by the processor, an anonymous login method for a digital identity based on real-name authentication as provided in an embodiment of the present application is implemented.

[0021] The anonymous login method and system and storage medium based on real-name authentication of digital identity provided in the embodiments of the present application obtain login requirement information from the login server by the user's client, obtain the user's real-name information including the user's real-name DID identifier and at least one user public key, generate login information based on the user's public key and the login requirement information, and send it to the login server; therefore, the login server generates a user identity verification request according to the login information, and sends it to the real-name digital identity blockchain; the real-name digital identity blockchain obtains the user's identity verification information according to the user's real-name DID identifier contained in the user identity verification request, so that the login server can use the identity verification information and business data to verify the user's login information, and when the verification result is verification passed , allowing users to log in using real-name DID identification. Therefore, in the anonymous login scheme based on real-name authenticated digital identity disclosed in the embodiment of the present application, users can use the user public key in the real-name authenticated identity information stored or obtained at the client and the login requirements of the target business system to generate login information. After receiving the login information, the target business system can obtain the real-name identity information corresponding to the user from the real-name digital identity blockchain according to the real-name DID identification in the login information, and verify the login information according to the identity information, so that the user can directly use the digital identity that has been real-name authenticated to log in at the desired target business system, which greatly improves the versatility of the real-name DID identity and expands the application scope of the real-name DID identity.

[0022] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0024] Figure 1 is a schematic diagram showing an application scenario of an anonymous login solution for a digital identity based on real-name authentication according to an embodiment of the present application;

[0025] Figure 2 A flowchart of an embodiment of an anonymous login method for a digital identity based on real-name authentication provided by the present application;

[0026] Figure 3 A schematic diagram of the structure of the anonymous login system based on real-name authentication of digital identity provided for this application;

[0027] Figure 4 A schematic diagram of the structure of an electronic device embodiment provided in this application. DETAILED DESCRIPTION

[0028] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0029] Embodiment 1

[0030] The solution provided in the embodiments of the present application can be applied to any data system or server with encryption and decryption functions.

[0031] With the continuous advancement of trusted technologies, especially blockchain technology, distributed digital identity (DID) application solutions have emerged, which has brought revolutionary changes to more and more traditional IT systems. These systems can now use distributed digital identities to enable users to independently control their personal data and assets, and realize decentralized data sharing across departments, industries, and regions. In addition, as the most authoritative and influential standardization organization in the field of Web technology, the World Wide Web Consortium (W3C) launched the first DID standard specification in 2019, which marks an important step forward in the normalization and standardization of DID technology.

[0032] In this regard, a DID (decentralized identity) system has been proposed in the prior art. This system is mainly proposed for the above-mentioned existing centralized identity system in which each website manages the identity information of users, and has also been widely used. However, at present, DID identities are usually issued by different blockchains or operators and can only be used on the corresponding blockchain, which greatly limits the application scope of DID identities. In particular, real-name authenticated DID identities need to be uniformly authenticated by an authoritative organization and cannot be issued by each platform on its own. Therefore, although users have obtained real-name authenticated DID identities, they cannot log in and use them on different platforms.

[0033] In the current DID system, users can request identity authentication from the operator of the DID platform, and the operator can generate a request based on the user's DID identity to verify the identity information requested by the user and issue a DID identity to the user after the verification is passed, so that the user can use the DID identity to log in and use it on the platform or the corresponding blockchain. For example, Figure 1 Schematic diagram showing an application scenario of an anonymous login solution based on a digital identity with real-name authentication according to an embodiment of the present application. Figure 1 In the scenario shown in , users can use the DID identity pre-registered on the business system (e.g., blockchain platform) to log in to the business system they want to use, for example, by logging in to the business node of the business system to use the business in the system. When the system supports or requires users to use real-name DID identities, users can also request real-name DID identities through various platforms that issue DID identities. However, such real-name DID identities are still issued by each platform after authentication through their own identity authentication methods or means, and cannot be used universally on different blockchains or business platforms. In actual use, users still need to pre-register multiple DID identities or real-name DID identities and use them on different platforms.

[0034] Therefore, in the current situation where there are multiple DID identity operating platforms, the real-name DID identities generated by different operating platforms are not universal, or even if users obtain real-name DID identities from authoritative agencies, they cannot use them on different platforms or blockchains, but can only use them in the business systems connected to the operating platform. Therefore, the scope of use of the user's real-name DID identity is greatly limited, and it also brings inconvenience to users using real-name DID identities on different business platforms.

[0035] To this end, according to an embodiment of the present application, an anonymous login method based on a real-name authenticated digital identity is provided, which is used by a user to log in to any target business system using a real-name authenticated digital identity. Figure 1 As shown in Figure 1is a schematic diagram showing an application scenario of an anonymous login solution based on a DID identity with real-name authentication according to an embodiment of the present application. Figure 1 In the scenario shown in , in the prior art, when a user wants to use multiple blockchains, he needs to request a DID identity in advance on each blockchain or its corresponding operator, and the blockchain or its operator can issue a DID identity to the user after authenticating the user's identity based on the user's request, and store it in the corresponding blockchain, so that the user can use the DID identity issued in advance by the target business system to log in to the blockchain, and when the user wants to use multiple blockchains, the user needs to request the issuance of a DID identity on the corresponding blockchain respectively, and then use the corresponding DID identity to log in. Even in situations where a real-name DID is required, in the prior art, users often authenticate and issue real-name DIDs through various blockchain platforms. Therefore, users still need to store multiple real-name DID identities for use when logging in to different blockchains. For example, Figure 1 In the scenario shown in , the user wants to log in to one of the target business systems 1-3. In the prior art, each of the target business systems 1-3 is built by a different operator, and therefore the DID identifiers used are also different. Therefore, in the prior art, the user needs to initiate a DID identifier issuance request on each of the target business systems 1-3, so that each target business system can issue a DID identifier to the user according to its respective DID identifier issuance rules according to the DID identifier request submitted by the user, so that the user can use the corresponding DID identifier to log in when he needs to log in to one or more target business systems. Of course, as mentioned above, more and more blockchains currently require users to log in with real-name authentication, and therefore, in the prior art, the user requests real-name authentication from the corresponding target business system, and then the corresponding target business system issues the corresponding real-name authentication DID identifier for it after real-name authentication. This also means that when users log in to multiple blockchains, they still need to use different real-name authentication DID identifiers to log in. Even if the user applies for real-name authentication from an authority and obtains a real-name authentication DID issued by the authority, since the real-name authentication DID is not issued by the blockchain operator, it is still difficult for the user to use the real-name authentication DID when logging into each blockchain.

[0036] In the solution of the embodiment of the present application, for example, in Figure 1In the scenario shown in , a user can initiate a request to the target business system that he wants to log in through his client to obtain login requirement information. For example, the user can obtain the login requirement information from the login server of the target business system through his client. In an embodiment of the present application, the login requirement information may include the business system identifier of the target business system, the login access address, such as the address of the login server, and business data, that is, the business information that the user wants to use when logging in to the target business system. In an embodiment of the present application, the target business system can generate the above login requirement information into a QR code, and can display the QR code on its login page, so that the user who needs to log in to the target business system can scan the QR code by using the corresponding application installed on his client, thereby obtaining the login requirement information. In addition, in an embodiment of the present application, the user can also send a request to the login server of the target business system, and include the address of his client in the request, so that the login server of the target business system can respond to the request sent by the user through the client and send the login requirement information to the user's client.

[0037] After obtaining the login requirement information, the user can obtain the user's real-name information through its client, such as the real-name DID identity issued to the user by an authority, for example, in the embodiment of the present application, the user's real-name information may include the user's real-name DID and at least one user public key. Specifically, in the embodiment of the present application, the user can store the real-name DID obtained from the authority and the corresponding real-name DID document on the client, so that the real-name DID stored locally can be directly obtained through the client, and a user public key can be determined from the corresponding real-name DID document as the public key used by the user to log in to the target business system, and the corresponding first private key can also be obtained according to the first public key determined in the DID document.

[0038] Then the user can generate login information on his client using the user public key thus obtained and the login requirement information obtained from the target business system. For example, in an embodiment of the present application, the user can use the application in the client to use the first algorithm to calculate the first summary information of the business data contained in the login requirement information according to the business system identifier of the target business system. For example, after the user obtains the login requirement information from the target business system, the user can parse it to obtain the business system identifier of the target business system, and then the user can use the preset first algorithm, such as a hash algorithm, to calculate the business data extracted from the login requirement information to obtain the first summary information. Then the user can use the first private key obtained as above to encrypt and calculate the first summary information, and use the encryption result as the first signature data. Finally, the user can generate login information based on the first signature data, the real-name DID identifier, and the public key information of the first public key, and send it to the login server of the target business system. For example, in an embodiment of the present application, the user can encapsulate the first signature data, the real-name DID identifier, and the public key information of the first public key into a data packet, and can further use the public key of the target business system to encrypt the data packet to generate login information. Of course, in an embodiment of the present application, the user can also directly put the first signature data, the real-name DID identifier, and the public key information of the first public key into a certain data, and then send the data to the login server of the target business system. This application has no restrictions on this.

[0039] After the target business system receives the login information sent by the user through the client through the login server, it can, for example, first use its private key, that is, its own public key sent in advance by, for example, broadcasting, to decrypt the login information, and then generate the user's identity authentication request based on the decrypted login information. For example, in an embodiment of the present application, the target business system can parse the login information sent by the client to extract the user's real-name DID identifier from it, and then the target business system can package the real-name DID identifier and its own business system identifier to generate a user identity authentication request for sending to the real-name digital identity blockchain. Since in an embodiment of the present application, the user does not use the real-name DID identifier generated by the target business system or its operator, but can use the real-name DID identifier issued by a professional or authoritative identity authentication agency, therefore, the target business system can send the real-name DID identifier contained therein to the real-name digital identity blockchain together with its own business system identifier after receiving the login information sent by the user.

[0040] The real-name digital identity blockchain can be any blockchain with real-name identity authentication and verification capabilities, on which the real-name DID identity data of each user can be stored. For example, after receiving a user identity authentication request sent by a target business system, the access node of the real-name digital identity blockchain can first use the business system identifier of the target business system contained in the identity authentication request to obtain the public key of the target business system, and then use the public key to verify the request to determine that the request is sent by the target business system, and then the real-name digital identity blockchain can parse the request to obtain the user's real-name DID identifier. Then, the access node of the real-name digital identity blockchain can use the real-name DID document of the real-name DID identifier stored therein as the identity authentication information based on the real-name DID identifier extracted in this way, and can also send the identity authentication information obtained in this way to the target business system, so that the login server of the target business system, for example, can obtain the first public key from the real-name DID document obtained from the real-name digital identity blockchain according to the public key information of the first public key obtained as above. For example, in an embodiment of the present application, the public key information may be the public key index of the first public key in the user's real-name DID document.

[0041] The login server uses the first public key obtained in this way to verify the first signature data in the login information to confirm the signature data. For example, the login server can use a second algorithm that is pre-synchronized with the client or specified by the user to perform a similar calculation on the business data to obtain the second summary information (e.g., hash value) of the business data. The login server can then compare the second summary information obtained in this way with the decrypted signature data. When the second summary information is consistent with the user's decrypted signature data, it is determined that the verification result is verified. Therefore, in an embodiment of the present application, the user can use a real-name DID identifier that is not issued by the target business system to log in to the target business system, and the target business system does not need to preset a verification node or server, but can only obtain the corresponding user's real-name DID document from the real-name digital identity blockchain based on the real-name DID identifier sent by the user, so that the user's public key can be obtained therefrom and the user's real-name DID identity can be verified.

[0042] In addition, in an embodiment of the present application, when the user receives the login request information of the target business system, it can check whether the real-name DID identity information has been stored. For example, when the user checks and confirms that he has not yet applied for a real-name DID identity, the user can send a real-name DID identification application request to the access node of the real-name digital identity blockchain through the client. In an embodiment of the present application, the real-name DID identification application request may include at least the user's identity information and the business system identifier of the target business system; the real-name digital identity blockchain generates a real-name DID identification and a real-name DID document for the user according to the real-name DID identification application request, and stores the real-name DID document in the real-name digital identity blockchain, wherein the real-name DID document contains at least a first public key, and then the access node can send the real-name DID identification and the real-name DID document to the client.

[0043] In addition, in the embodiment of the present application, when the login server confirms that the real-name DID identity authentication of the user is passed, the user's login identifier can be generated based on the real-name DID identifier and the business data of the business to be used by the user, so as to allow the user to log in to the login server using the login identifier. Alternatively, after generating a login identifier for the user, the login server can directly use the login identifier to log the user into the login server, thereby greatly saving the user's login time.

[0044] The anonymous login scheme based on real-name authenticated digital identity provided by the embodiment of the present application is achieved by the user's client obtaining login requirement information from the login server, obtaining the user's real-name information including the user's real-name DID identifier and at least one user public key, and generating login information based on the user's public key and the login requirement information to send to the login server; therefore, the login server generates a user identity verification request based on the login information to send to the real-name digital identity blockchain; the real-name digital identity blockchain obtains the user's identity verification information based on the user's real-name DID identifier contained in the user identity verification request, so that the login server can use the identity verification information and business data to verify the user's login information, and when the verification result is verification passed, the user is allowed to log in. The user logs in using the real-name DID identifier. Therefore, in the anonymous login scheme based on real-name authenticated digital identity disclosed in the embodiment of the present application, the user can use the user public key in the real-name authenticated identity information stored or obtained at the client and the login requirements of the target business system to generate login information. After receiving the login information, the target business system can obtain the real-name identity information corresponding to the user from the real-name digital identity blockchain according to the real-name DID identifier in the login information, and verify the login information according to the identity information. Thus, the user can directly use the digital identity that has been real-name authenticated to log in at the desired target business system, which greatly improves the versatility of the real-name DID identity and expands the application scope of the real-name DID identity.

[0045] The above embodiments are illustrations of the technical principles and exemplary application frameworks of the embodiments of the present application. The specific technical solutions of the embodiments of the present application are further described in detail below through multiple embodiments.

[0046] Embodiment 2

[0047] Figure 2 The flowchart of the embodiment of the anonymous login method based on real-name authentication of digital identity provided by the present application, the execution subject of the method can be various terminals or server devices with data encryption and decryption capabilities deployed on the blockchain, or it can be a device or chip integrated on these devices. In particular, in the embodiment of the present application, at least one access node and at least one verification node can be deployed on the blockchain, and the verification node can be set by an authority. Figure 2 As shown, the anonymous login method based on real-name authentication digital identity includes the following steps:

[0048] S201, the user's client obtains login requirement information from the login server.

[0049] In step S201, the user's client may obtain login requirement information from the login server of the target business system. In the embodiment of the present application, the login requirement information may include the business system identifier, login access address and business data of the target business system. In step S201, the login requirement information may also be generated into a QR code by the target business system, and the QR code may be displayed on its login page, so that the user who needs to log in to the target business system can obtain the login requirement information by scanning the QR code using the corresponding application installed on its client in step S201. In addition, in the embodiment of the present application, the user may also send a request to the login server of the target business system in step S201, and include the address of its client in the request, so that the login server of the target business system can send the login requirement information to the user's client in response to the request sent by the user through the client.

[0050] S202, the client obtains the user's real-name information.

[0051] In step S202, the client may obtain the user's real-name information, such as the real-name DID identity issued to the user by an authority. In the embodiment of the present application, the user's real-name information may include the user's real-name DID and at least one user public key. Specifically, in the embodiment of the present application, the user may store the real-name DID obtained from the authority and the corresponding real-name DID document on the client, so that the client may directly obtain the locally stored real-name DID, and determine a user public key from the corresponding real-name DID document as the public key used by the user to log in to the target business system, and may also obtain the corresponding first private key based on the first public key determined in the DID document.

[0052] S203, the client generates login information based on the user public key and login requirement information, and sends it to the login server.

[0053] In step S203, the user can generate login information on the client using the user public key obtained in step S202 and the login requirement information obtained from the target business system in step S201. For example, in an embodiment of the present application, the user can use an application in the client to calculate the first summary information of the business data included in the login requirement information using a first algorithm according to the business system identifier of the target business system in step S203.

[0054] For example, the user can use a preset first algorithm, such as a hash algorithm, to calculate the business data extracted from the login requirement information to obtain the first summary information. Then the user can use the first private key obtained as above to encrypt the first summary information, and use the encryption result as the first signature data. Finally, the user can generate login information based on the first signature data, the real-name DID identifier, and the public key information of the first public key, and send it to the login server of the target business system. For example, in an embodiment of the present application, the user can encapsulate the first signature data, the real-name DID identifier, and the public key information of the first public key into a data packet, and can further use the public key of the target business system to encrypt the data packet to generate login information. Of course, in an embodiment of the present application, the user can also directly put the first signature data, the real-name DID identifier, and the public key information of the first public key into a certain data, and then send the data to the login server of the target business system. This application has no restrictions on this.

[0055] S204, the login server generates a user identity authentication request based on the login information and sends it to the real-name digital identity blockchain.

[0056] In step S204, the login server can parse the login information sent by the user's client and send the generated result as a user identity verification request to the real-name digital identity blockchain. After the target business system receives the login information sent by the user through the client through the login server, it can, for example, first use its private key, that is, its own public key sent in advance by means such as broadcasting, to decrypt the login information, and then generate the user's identity verification request based on the decrypted login information.

[0057] For example, in an embodiment of the present application, the target business system can parse the login information sent by the client in step S202 to extract the user's real-name DID identifier therefrom, and then, in step S204, the target business system can package the real-name DID identifier and its own business system identifier to generate a user identity authentication request for sending to the real-name digital identity blockchain.

[0058] Since in the embodiment of the present application, the user does not use the real-name DID identifier generated by the target business system or its operator, but can use the real-name DID identifier issued by a professional or authoritative identity certification agency, the target business system can send the real-name DID identifier contained in the login information sent by the user together with its own business system identifier to the real-name digital identity blockchain after receiving the login information sent by the user.

[0059] S205, the access node of the real-name digital identity blockchain obtains the user's identity authentication information based on the user's real-name DID identifier contained in the user identity authentication request.

[0060] S206: The login server verifies the login information using the identity authentication information and the business data.

[0061] S207, when the verification result is verification passed, the login server allows the user to log in to the login server using the real-name DID identifier.

[0062] In addition, in an embodiment of the present application, the real-name digital identity blockchain can be any blockchain with real-name identity authentication and verification capabilities, on which the real-name DID identity data of each user can be stored. For example, after the access node of the real-name digital identity blockchain receives the user identity authentication request sent by the target business system in step S204, it can first use the business system identifier of the target business system contained in the identity authentication request to obtain the public key of the target business system, and then use the public key to verify the request to determine that the request is sent by the target business system. In step S205, the login server verifies the login information using the identity authentication information and business data. For example, the real-name digital identity blockchain can parse the request to obtain the user's real-name DID identifier. Then, the access node of the real-name digital identity blockchain can use the real-name DID document of the real-name DID identifier stored therein as identity authentication information based on the real-name DID identifier extracted in this way, and can also send the identity authentication information obtained in this way to the target business system, so that the target business system, such as a login server, can obtain the first public key from the real-name DID document obtained from the real-name digital identity blockchain based on the public key information of the first public key obtained as above. For example, in an embodiment of the present application, the public key information can be the public key index of the first public key in the user's real-name DID document.

[0063] The login server uses the first public key obtained in this way to verify the first signature data in the login information to verify the signature data. For example, the login server can use a second algorithm that is pre-synchronized with the client or specified by the user to perform a similar calculation on the business data to obtain the second summary information of the business data. The login server can then compare the second summary information obtained in this way with the signature data. When the second summary information is consistent with the user's signature data, the verification result is determined to be a passed verification. Therefore, in an embodiment of the present application, a user can use a real-name DID identifier that is not issued by the target business system to log in to the target business system, and the target business system does not need to preset a verification node or server, but can only obtain the corresponding user's real-name DID document from the real-name digital identity blockchain based on the real-name DID identifier sent by the user, so that the user's public key can be obtained therefrom and the user's real-name DID identity can be verified.

[0064] In addition, in an embodiment of the present application, when the user receives the login request information of the target business system, it can check whether the real-name DID identity information has been stored. For example, when the user checks and confirms that he has not yet applied for a real-name DID identity, the user can send a real-name DID identification application request to the access node of the real-name digital identity blockchain through the client. In an embodiment of the present application, the real-name DID identification application request may include at least the user's identity information and the business system identifier of the target business system; the real-name digital identity blockchain generates a real-name DID identification and a real-name DID document for the user according to the real-name DID identification application request, and stores the real-name DID document in the real-name digital identity blockchain, wherein the real-name DID document contains at least a first public key, and then the access node can send the real-name DID identification and the real-name DID document to the client.

[0065] In addition, in the embodiment of the present application, when the login server confirms that the real-name DID identity authentication of the user is passed, the user's login identifier can be generated based on the real-name DID identifier and the business data of the business to be used by the user, so as to allow the user to log in to the login server using the login identifier. Alternatively, after generating a login identifier for the user, the login server can directly use the login identifier to log the user into the login server, thereby greatly saving the user's login time.

[0066] The anonymous login method based on digital identity with real-name authentication provided in the embodiment of the present application is achieved by the user's client obtaining login requirement information from the login server, obtaining the user's real-name information including the user's real-name DID identifier and at least one user public key, and generating login information based on the user's public key and the login requirement information to send to the login server; therefore, the login server generates a user identity verification request according to the login information to send to the real-name digital identity blockchain; the real-name digital identity blockchain obtains the user's identity verification information according to the user's real-name DID identifier contained in the user identity verification request, so that the login server can use the identity verification information and business data to verify the user's login information, and when the verification result is verification passed, the user is allowed to log in. The user logs in using the real-name DID identifier. Therefore, in the anonymous login method based on real-name authenticated digital identity disclosed in the embodiment of the present application, the user can use the user public key in the real-name authenticated identity information stored or obtained at the client and the login requirements of the target business system to generate login information. After receiving the login information, the target business system can obtain the real-name identity information corresponding to the user from the real-name digital identity blockchain according to the real-name DID identifier in the login information, and verify the login information according to the identity information. Thus, the user can directly use the digital identity that has been real-name authenticated to log in at the desired target business system, which greatly improves the versatility of the real-name DID identity and expands the application scope of the real-name DID identity.

[0067] Embodiment 3

[0068] Figure 3 This is a schematic diagram of the structure of the anonymous login system based on the real-name authentication digital identity provided by the present application. The anonymous login system based on the real-name authentication digital identity can be used to implement, for example, Figure 2 The described embodiment of the present application provides an anonymous login method for a digital identity based on real-name authentication.

[0069] In an embodiment of the present application, an anonymous login system based on a real-name authenticated digital identity may include: a target business system 31, a real-name digital identity blockchain 32, and a client 33 used by a user. The target business system includes a login server, and the real-name digital identity blockchain includes an access node.

[0070] The target business system 31 can be used to: send login request information to the user's client 33. The login request information may include the business system identifier, login access address and business data of the target business system, receive the login information generated by the client based on the user public key and the login request information. The user public key includes the user real-name information obtained by the client, and the user real-name information also includes the user's real-name DID identifier; generate a user identity authentication request based on the login information, and send it to the real-name digital identity blockchain. The user identity authentication request includes the user's real-name DID identifier.

[0071] For example, the user's client 33 wants to obtain login requirement information from the login server of the target business system 31. In the embodiment of the present application, the login requirement information may include the business system identifier, login access address and business data of the target business system 31. And the login requirement information may also be generated by the target business system 31 into a QR code, and the QR code may be displayed on its login page, so that the user who needs to log in to the target business system can obtain the login requirement information by scanning the QR code using the corresponding application installed on his client. In addition, in the embodiment of the present application, the user can also send a request to the login server of the target business system, and include the address of his client in the request, so that the login server of the target business system can respond to the request sent by the user through the client and send the login requirement information to the user's client.

[0072] The client 33 can obtain the user's real-name information, such as the real-name DID identity issued to the user by an authority. In the embodiment of the present application, the user's real-name information can include the user's real-name DID and at least one user public key. Specifically, in the embodiment of the present application, the user can store the real-name DID obtained from the authority and the corresponding real-name DID document on the client 33, so that the real-name DID stored locally can be directly obtained through the client 33, and a user public key can be determined from the corresponding real-name DID document as the public key used by the user to log in to the target business system, and the corresponding first private key can also be obtained according to the first public key determined in the DID document.

[0073] The client generates login information by using the client 33 to obtain the user public key and the login requirement information obtained from the target business system 31. For example, in an embodiment of the present application, the user can use the application in the client 33 to calculate the first summary information of the business data included in the login requirement information using the first algorithm according to the business system identifier of the target business system 31.

[0074] For example, the user can use a preset first algorithm, such as a hash algorithm, to calculate the business data extracted from the login requirement information to obtain the first summary information. Then the user can use the first private key obtained as above to encrypt the first summary information, and use the encryption result as the first signature data. Finally, the user can generate login information based on the first signature data, the real-name DID identifier, and the public key information of the first public key, and send it to the login server of the target business system 31. For example, in an embodiment of the present application, the user can encapsulate the first signature data, the real-name DID identifier, and the public key information of the first public key into a data packet, and can further use the public key of the target business system to encrypt the data packet to generate login information. Of course, in an embodiment of the present application, the user can also directly put the first signature data, the real-name DID identifier, and the public key information of the first public key into a certain data, and then send the data to the login server of the target business system. This application has no restrictions on this.

[0075] The real-name digital identity blockchain 32 can be used to obtain the user's identity authentication information through the user's real-name DID identifier contained in the access node user identity authentication request, and send it to the login server of the target business system 31. The target business system is further used to verify the login information using the identity authentication information and the business data; and when the verification result is verification passed, the user is allowed to use the real-name DID identifier to log in to the login server, and the user's client obtains the login requirement information from the login server.

[0076] The login server can parse the login information sent by the user's client 33 and send the generated result as a user identity verification request to the real-name digital identity blockchain. After receiving the login information sent by the user through the client 33 through the login server, the target business system 31 can, for example, first use its private key, that is, its own public key sent in advance by, for example, broadcasting, to decrypt the login information, and then generate the user's identity verification request based on the decrypted login information.

[0077] For example, in an embodiment of the present application, the target business system 31 can parse the login information sent by the client 33 to extract the user's real-name DID identifier therefrom. Then, the target business system can package the real-name DID identifier and its own business system identifier to generate a user identity authentication request for sending to the real-name digital identity blockchain.

[0078] Since in the embodiment of the present application, the user does not use the real-name DID identifier generated by the target business system or its operator, but can use the real-name DID identifier issued by a professional or authoritative identity certification agency, the target business system can send the real-name DID identifier contained in the login information sent by the user together with its own business system identifier to the real-name digital identity blockchain after receiving the login information sent by the user.

[0079] The real-name digital identity blockchain 32 can be any blockchain with real-name identity authentication and verification capabilities, on which the real-name DID identity data of each user can be stored. For example, after the access node of the real-name digital identity blockchain receives the user identity authentication request sent by the target business system, it can first use the business system identifier of the target business system contained in the identity authentication request to obtain the public key of the target business system, and then use the public key to verify the request to determine that the request is sent by the target business system. The login server verifies the login information using the identity authentication information and business data. For example, the real-name digital identity blockchain can parse the request to obtain the user's real-name DID identifier. Then, the access node of the real-name digital identity blockchain can use the real-name DID document of the real-name DID identifier stored therein as the identity authentication information based on the real-name DID identifier extracted in this way, and can also send the identity authentication information obtained in this way to the target business system 31, so that the login server of the target business system 31, for example, can obtain the first public key from the real-name DID document obtained by the real-name digital identity blockchain 32 according to the public key information of the first public key obtained as above. For example, in an embodiment of the present application, the public key information may be the public key index of the first public key in the user's real-name DID document.

[0080] The target business system 31 can use the first public key obtained in this way to verify the first signature data in the login information to verify the signature data. For example, the login server of the target business system 31 can use a second algorithm that is pre-synchronized with the client or specified by the user to perform a similar calculation on the business data to obtain the second summary information of the business data. The login server can then compare the second summary information obtained in this way with the signature data. When the second summary information is consistent with the user's signature data, the verification result is determined to be a passed verification. Therefore, in an embodiment of the present application, the user can use a real-name DID identifier that is not issued by the target business system to log in to the target business system, and the target business system 31 does not need to preset a verification node or server, but can only obtain the corresponding user's real-name DID document from the real-name digital identity blockchain based on the real-name DID identifier sent by the user, so that the user's public key can be obtained therefrom and the user's real-name DID identity can be verified.

[0081] In addition, in an embodiment of the present application, when the user receives the login request information of the target business system, it can check whether the real-name DID identity information has been stored. For example, when the user checks and confirms that he has not yet applied for a real-name DID identity, the user can send a real-name DID identification application request to the access node of the real-name digital identity blockchain through the client. In an embodiment of the present application, the real-name DID identification application request may include at least the user's identity information and the business system identifier of the target business system; the real-name digital identity blockchain generates a real-name DID identification and a real-name DID document for the user according to the real-name DID identification application request, and stores the real-name DID document in the real-name digital identity blockchain, wherein the real-name DID document contains at least a first public key, and then the access node can send the real-name DID identification and the real-name DID document to the client.

[0082] The anonymous login system based on digital identity with real-name authentication provided by the embodiment of the present application obtains login requirement information from the login server by the user's client, obtains the user's real-name information including the user's real-name DID identifier and at least one user public key, generates login information based on the user's public key and the login requirement information, and sends it to the login server; therefore, the login server generates a user identity verification request according to the login information, and sends it to the real-name digital identity blockchain; the real-name digital identity blockchain obtains the user's identity verification information according to the user's real-name DID identifier contained in the user identity verification request, so that the login server can use the identity verification information and business data to verify the user's login information, and when the verification result is verification passed, the user is allowed to log in. The user logs in using the real-name DID identifier. Therefore, in the anonymous login system based on real-name authenticated digital identity disclosed in the embodiment of the present application, the user can use the user public key in the real-name authenticated identity information stored or obtained at the client and the login requirements of the target business system to generate login information. After receiving the login information, the target business system can obtain the real-name identity information corresponding to the user from the real-name digital identity blockchain according to the real-name DID identifier in the login information, and verify the login information according to the identity information. Thus, the user can directly use the digital identity that has been real-name authenticated to log in at the desired target business system, which greatly improves the versatility of the real-name DID identity and expands the application scope of the real-name DID identity.

[0083] Embodiment 4

[0084] The above describes the internal functions and structure of the anonymous login system based on real-name authentication of digital identity, which can be implemented as an electronic device. Figure 4 This is a schematic diagram of the structure of an electronic device embodiment provided by this application. Figure 4As shown, the electronic device includes a memory 41 and a processor 42 .

[0085] The memory 41 is used to store programs. In addition to the above programs, the memory 41 can also be configured to store various other data to support operations on the electronic device. Examples of such data include instructions for any application or method operating on the electronic device, contact data, phone book data, messages, pictures, videos, etc.

[0086] The memory 41 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0087] The processor 42 is not limited to a processor (CPU), but may also be a processing chip such as a graphics processing unit (GPU), a field programmable gate array (FPGA), an embedded neural network processor (NPU) or an artificial intelligence (AI) chip. The processor 42 is coupled to the memory 41 and executes the program stored in the memory 41 to execute the anonymous login method of the digital identity based on real-name authentication of the above-mentioned embodiment 2.

[0088] Further, if Figure 4 As shown, the electronic device may also include: a communication component 43, a power component 44, an audio component 45, a display 46 and other components. Figure 4 Only some components are shown schematically, which does not mean that the electronic device only includes Figure 4 Components shown.

[0089] The communication component 43 is configured to facilitate wired or wireless communication between the electronic device and other devices. The electronic device can access a wireless network based on a communication standard, such as WiFi, 3G, 4G or 5G, or a combination thereof. In an exemplary embodiment, the communication component 43 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 43 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0090] The power supply assembly 44 provides power to various components of the electronic device. The power supply assembly 44 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device.

[0091] The audio component 45 is configured to output and / or input audio signals. For example, the audio component 45 includes a microphone (MIC), and when the electronic device is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 41 or sent via the communication component 43. In some embodiments, the audio component 45 also includes a speaker for outputting audio signals.

[0092] The display 46 includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0093] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0094] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An anonymous login method based on real-name authentication of digital identity, used for a user to log in to a target business system, characterized in that: The target business system includes a login server and is connected to a real-name digital identity blockchain, and the method includes: The user's client obtains login requirement information from the login server, wherein the login requirement information includes the business system identifier, login access address and business data of the target business system. The client obtains user real-name information, wherein the user real-name information includes the user's real-name DID identifier and at least one user public key; The client generates login information based on the user public key and the login requirement information, and sends the login information to the login server; The login server generates a user identity verification request according to the login information, and sends it to the real-name digital identity blockchain, wherein the user identity verification request includes the user's real-name DID identifier; The access node of the real-name digital identity blockchain retrieves the identity authentication information (DID document) of the user stored therein according to the real-name DID identifier of the user contained in the user identity authentication request; The login server verifies the login information using the identity verification information and the business data; When the verification result is verification passed, the login server allows the user to log in to the login server using the real-name DID identifier.

2. The anonymous login method based on real-name authentication of digital identity according to claim 1, characterized in that: The acquiring of user real-name information by the client includes: The client obtains a first real-name DID document of the user based on the identity identifier of the user; The client obtains a first public key from at least one public key in the first real-name DID document; The client obtains a first private key according to the first public key.

3. The anonymous login method based on real-name authentication of digital identity according to claim 2, characterized in that: The generating of login information by the client based on the user public key and the login requirement information comprises: The client uses a first algorithm to calculate first summary information of the business data contained in the login requirement information according to the business system identifier of the target business system; The client encrypts the summary information using the first private key to generate first signature data; The client generates the login information using the first signature data, the real-name DID identifier, and the public key information of the first public key.

4. The anonymous login method based on real-name authentication of digital identity according to claim 3, characterized in that: The generating of the user identity authentication request by the login server according to the login information comprises: The login server obtains the real-name DID identifier from the login information; The login server uses the real-name DID identifier and the business system identifier of the target business system as the user identity authentication request.

5. The anonymous login method based on real-name authentication of digital identity according to claim 4, characterized in that: The access node of the real-name digital identity blockchain obtains the identity authentication information of the user according to the real-name DID identifier of the user included in the user identity authentication request, including: The access node of the real-name digital identity blockchain obtains the real-name DID document corresponding to the real-name DID identifier from the real-name digital identity blockchain as the identity authentication information according to the real-name DID identifier.

6. The anonymous login method based on real-name authentication of digital identity according to claim 5, characterized in that: The verification of the login information by the login server using the identity authentication information and the business data includes: The login server obtains the first public key from the real-name DID document according to the public key information of the first public key; The login server uses the first public key to decrypt the first signature data in the login information to obtain decrypted signature data; The login server performs calculation processing on the business data according to a second algorithm corresponding to the business data to obtain second summary information of the business data; The login server compares the second summary information with the decrypted signature data, and when the second summary information is consistent with the decrypted signature data, determines that the verification result is verification passed.

7. The anonymous login method based on real-name authentication of digital identity according to claim 1, characterized in that: Before the client obtains the user real-name information corresponding to the target business system according to the login requirement information of the target business system, the method further includes: The client sends a real-name DID identification application request to an access node of the real-name digital identity blockchain, wherein the real-name DID identification application request at least includes the identity information of the user; The real-name digital identity blockchain generates a real-name DID identifier and a real-name DID document for the user according to the real-name DID identifier application request, and stores the real-name DID document in the real-name digital identity blockchain, wherein the real-name DID document contains at least a first public key; The access node sends the real-name DID identifier and the real-name DID document to the client.

8. The anonymous login method based on real-name authentication of digital identity according to claim 1, characterized in that: The login server allowing the user to log in to the login server using the real-name DID identifier includes: The login server generates a login identifier for the user based on the real-name DID identifier and the business data to allow the user to log in to the login server using the login identifier.

9. An anonymous login system based on real-name authentication digital identity, comprising: A target business system and a real-name digital identity blockchain, wherein the target business system includes a login server, and the real-name digital identity blockchain includes an access node, characterized in that: The target business system is used to: send login request information to the user's client, wherein the login request information includes the business system identifier, login access address and business data of the target business system, receive login information generated by the client based on the user public key and the login request information, wherein the user public key includes the user real-name information obtained by the client, and the user real-name information also includes the user's real-name DID identifier; generate a user identity authentication request according to the login information, and send it to the real-name digital identity blockchain, wherein the user identity authentication request includes the user's real-name DID identifier; The real-name digital identity blockchain is used to: obtain the user's identity authentication information through an access node according to the user's real-name DID identifier contained in the user identity authentication request, and send it to the login server of the target business system; Among them, the target business system is further used to verify the login information using the identity authentication information and the business data; and when the verification result is passed, the user is allowed to log in to the login server using the real-name DID identifier.

10. A computer-readable storage medium having a computer program executable by a processor stored thereon, characterized in that: When the program is executed by a processor, the anonymous login method for a digital identity based on real-name authentication as described in any one of claims 1 to 8 is implemented.

Images