Identity verification method, middleware, storage medium and computer program product

Abstract

The invention provides an identity verification method, middleware, a storage medium and a computer program product. The method comprises the following steps: acquiring code number information from first equipment; generating first identity identification information based on the code number information; and based on the first identity identification information, obtaining first identity credential information corresponding to the first identity identification information from the storage system, and sending the first identity credential information to the first application server, so that the first application server obtains an identity credential based on the first identity credential information and performs identity verification.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an identity authentication method, middleware, storage medium and computer program product. Background Art

[0002] In the digital age, distributed digital identity technology uses public key cryptography. The security of private keys is the security foundation of distributed digital identities. If private keys are leaked, identity theft will occur. The Subscriber Identity Module (SIM) card has a high security level and can be used as a physical digital wallet, but due to the limited storage space of the SIM card, it cannot store too much data. In addition to public and private keys, distributed identity technology also involves various credentials, such as academic degree certificates, award certificates, qualification certificates, etc., which have certain requirements for storage space. Using a SIM card alone cannot meet all storage needs, which results in low user identity security. Summary of the invention

[0003] In view of this, the present application hopes to provide an identity authentication method, middleware, storage medium and computer program product, which can ensure the identity security of the user when the SIM card cannot meet the storage requirements.

[0004] The technical solution of this application is implemented as follows:

[0005] In a first aspect, the present application provides an identity authentication method, which is applied to identity management middleware, and the method comprises:

[0006] Acquire code number information from the first device;

[0007] Based on the code number information, generate first identity identification information;

[0008] Based on the first identity identification information, first identity credential information corresponding to the first identity identification information is obtained from the storage system, and the first identity credential information is sent to the first application server, so that the first application server obtains the identity credential based on the first identity credential information and performs identity authentication.

[0009] In a second aspect, the present application provides a middleware, the middleware comprising:

[0010] An acquiring unit, configured to acquire code number information from the first device;

[0011] A generating unit, configured to generate first identity information based on the code number information;

[0012] The acquisition unit is further used to acquire first identity credential information corresponding to the first identity identification information from the storage system based on the first identity identification information, and send the first identity credential information to the first application server, so that the first application server can acquire the identity credential based on the first identity credential information and perform identity authentication.

[0013] In a third aspect, the present application provides a middleware, which includes: a processor and a memory; when the processor executes a running program stored in the memory, the above-mentioned identity authentication method is implemented.

[0014] In a fourth aspect, the present application provides a storage medium having a computer program stored thereon, which implements the above-mentioned identity authentication method when executed by a processor.

[0015] In a fifth aspect, the present application provides a computer program product, including a computer program, which implements the above-mentioned identity authentication method when executed by a processor.

[0016] The present application provides an identity authentication method, middleware, storage medium and computer program product, the method comprising: obtaining code number information from a first device; generating first identity identification information based on the code number information; obtaining first identity credential information corresponding to the first identity identification information from a storage system based on the first identity identification information, and sending the first identity credential information to a first application server, so that the first application server can obtain identity credentials based on the first identity credential information and perform identity authentication. The above implementation scheme is adopted, and an identity management middleware is introduced. The code number information is obtained from the first device through the identity management middleware, and the first identity identification information is generated. The first identity identification information is used to obtain the corresponding first identity credential information from the storage system for use by the first application server. In this way, there is no need to store a large number of credentials in the SIM card, reducing the use of SIM card storage space. At the same time, when the SIM card space cannot meet the storage requirements, the first identity credential information can be obtained through the identity management middleware, and the identity credential is provided to the first application server for identity authentication, thereby ensuring the security of user identity. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of an identity verification method provided in an embodiment of the present application;

[0018] Figure 2 A schematic diagram of a process for applying for an identity credential corresponding to first identity identification information provided in an embodiment of the present application;

[0019] Figure 3 A schematic diagram of the composition structure of an identity credential provided in an embodiment of the present application;

[0020] Figure 4A schematic diagram of a process for applying for and publishing primary identity information provided in an embodiment of the present application;

[0021] Figure 5 A schematic diagram of a process for obtaining identity credentials provided in an embodiment of the present application;

[0022] Figure 6 A schematic diagram of a process for generating second identity identification information provided in an embodiment of the present application;

[0023] Figure 7 A schematic diagram of a process for obtaining second identity information provided in an embodiment of the present application;

[0024] Figure 8 A schematic diagram of the structure of a middleware provided in the embodiment of the present application Figure 1 ;

[0025] Fig. 9 A schematic diagram of the structure of a middleware provided in the embodiment of the present application Figure 2 . DETAILED DESCRIPTION

[0026] In order to enable a more detailed understanding of the features and technical contents of the embodiments of the present application, the technical solution of the present application is further elaborated in detail below in combination with the drawings and specific embodiments of the specification. The attached drawings are for reference only and are not used to limit the embodiments of the present application.

[0027] Unless otherwise defined, all technical and scientific terms used in the embodiments of the present application have the same meaning as those commonly understood by those skilled in the art to which the present application belongs. The terms used in the embodiments of the present application are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0028] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict. It should also be noted that the terms "first / second / third" involved in the embodiments of the present application are only used to distinguish similar objects and do not represent a specific ordering of the objects. It is understandable that "first / second / third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0029] In the digital age, users increasingly rely on the Internet and digital technologies to process personal information, conduct transactions, and communicate with others. However, the ever-expanding digital footprint makes it increasingly important to protect digital identities and personal information. Identity authentication is a key security measure that ensures that only authorized users can access sensitive information and online services.

[0030] Distributed digital identity is an identity management model based on blockchain technology, with technical characteristics such as decentralization and verifiability. In this model, each entity can have a globally unique and tamper-proof digital identifier, as well as a series of verifiable digital credentials corresponding to it. These identifiers and digital credentials are stored on the blockchain, and an entity can provide its digital identifier or digital credentials to other entities on demand, and the other party can verify the digital identifier and digital credentials with the help of the blockchain.

[0031] Distributed digital identity technology uses public key cryptography, and usually uses digital wallets to store the private keys of user entities, and uses private keys for encryption, decryption, digital signatures and other operations. The security of private keys is the security foundation of distributed digital identities. If private keys are leaked, identity theft will occur. Therefore, physical digital wallets are more secure than software digital wallets.

[0032] Operators have SIM cards and mobile phone number resources, which can be used in a distributed digital identity system. Among them, SIM cards (taking China Mobile's Super SIM card as an example) have large storage capacity, support public and private key cryptographic algorithms, and have a very high security level, and can be used in physical digital wallets. Mobile phone numbers are used as an identity identifier. Through mobile authentication technology, such as the one-click login function of mobile phones, the application end obtains the corresponding mobile phone number from the operator's authentication service end to achieve user authentication, reducing the security risks caused by password leakage.

[0033] SIM cards can be used as physical digital wallets because of their high security level, but they cannot store too much data due to their limited storage space. In addition to public and private keys, distributed identity technology also involves a variety of credentials, such as academic degree certificates, award certificates, qualification certificates, etc., which have certain requirements for storage space. Using SIM alone cannot meet all storage needs, so SIM cards are mainly used to store keys and use keys for cryptographic operations.

[0034] Digital wallets need to provide universal identity services for other applications. As an independent digital wallet, it needs to use universal interfaces to provide services. This model usually faces customer development issues rather than technical issues. Currently, there are many digital wallets launched by manufacturers, and how to increase the share of digital wallets will face huge challenges.

[0035] Based on this, for operators, in addition to SIM cards, mobile authentication technology (such as one-click login function with mobile phone number) has been widely promoted and applied. This function provides access authentication services for various applications through software development kits (SDK). In the embodiment of the present application, a distributed digital identity authentication method is proposed, which provides identity services for various applications through middleware. The middleware itself does not need to store any identity information. All information can be obtained through SIM cards and storage systems (such as blockchain), which can be used as a functional extension of mobile authentication technology.

[0036] The technical solutions provided by the embodiments of this application are as follows:

[0037] The present application embodiment provides an identity authentication method, such as Figure 1 As shown, applied to identity management middleware, the method may include:

[0038] S101. Obtain code number information from a first device.

[0039] In the embodiment of the present application, the specific form of the identity management middleware may be an SDK applied to a mobile terminal.

[0040] In the embodiment of the present application, the first device is an operator gateway device.

[0041] In the embodiment of the present application, the code number information is the user's mobile phone number.

[0042] In an embodiment of the present application, the identity management middleware obtains the user's mobile phone number from the operator's gateway device, for example, through the client's mobile phone number one-click login function, or through a certification authority and an operator-specific interface.

[0043] S102: Generate first identity identification information based on the code number information.

[0044] In this embodiment of the present application, the first identity information may be referred to as a primary identity ID.

[0045] In the embodiment of the present application, based on the code number information, generating the first identity identification information can be achieved in the following manner:

[0046] The first auxiliary information is obtained from the first device, and the first identity information is generated based on the code number information and the first auxiliary information; or the second auxiliary information is obtained from the SIM card, and the first identity information is generated based on the code number information and the second auxiliary information.

[0047] In this embodiment of the present application, the first auxiliary information is the user's name.

[0048] In this embodiment of the present application, the second auxiliary information is IMSI information.

[0049] In an embodiment of the present application, the first auxiliary information may be that when obtaining the mobile phone number from the operator gateway device, the operator gateway device may also simultaneously send the user name corresponding to the mobile phone number to the identity management middleware.

[0050] In an embodiment of the present application, the identity management middleware uses the mobile phone number and the first auxiliary information to calculate the user's primary identity ID. The specific calculation method is: primary identity ID = f1 (mobile phone number, (first auxiliary information)), where f1 is a cryptographic algorithm, such as a one-way function, and the first auxiliary information is the user's name.

[0051] In an embodiment of the present application, the second auxiliary information can be obtained from the SIM card. The identity management middleware uses the mobile phone number and the second auxiliary information to obtain the user's primary identity ID. The specific calculation method is: primary identity ID = f1 (mobile phone number, (second auxiliary information)), where f1 is a cryptographic algorithm, such as a one-way function, and the second auxiliary information is IMSI information.

[0052] In the embodiment of the present application, when calculating the primary identity ID, the first auxiliary information and the second auxiliary information are optional, that is, the mobile phone number can be directly used to calculate the primary identity ID.

[0053] S103: Based on the first identity identification information, obtain first identity credential information corresponding to the first identity identification information from the storage system, and send the first identity credential information to the first application server, so that the first application server obtains the identity credential based on the first identity credential information and performs identity authentication.

[0054] In the embodiment of the present application, the storage system may be a blockchain or other storage system. Specifically, the storage system may be selected according to the actual situation and is not specifically limited in the embodiment of the present application.

[0055] In the embodiment of the present application, the first identity credential information may be an identity credential or a credential token.

[0056] In the embodiment of the present application, the first application server may be a server for a specific application, such as a server corresponding to a shopping software.

[0057] In an embodiment of the present application, after generating the first identity identification information based on the code number information, and before obtaining the first identity credential information corresponding to the first identity identification from the storage system based on the first identity identification information, the identity management middleware sends a first request to the credential issuing device, wherein the first request carries the first identity identification information and the code number information, so that the credential issuing device can generate an identity credential based on the first identity identification information and the code number information, and send the identity credential to the storage system.

[0058] In an embodiment of the present application, after generating the primary identity information, the identity management middleware sends a first request to the credential issuing device. The first request may be sent by the identity management middleware to the operator gateway to apply for an identity credential (such as a mobile phone number credential). The first request carries the primary identity ID, and the first request for applying for an identity credential is sent to the credential issuing module of the credential issuing device through the operator gateway. The first request adds the mobile phone number to the original primary identity ID, that is, the first request received by the credential issuing module carries the primary identity ID and the mobile phone number.

[0059] In an embodiment of the present application, the credential issuance module further generates an identity credential corresponding to the primary identity information based on the primary identity ID and the mobile phone number, and sends the identity credential to a storage system such as a blockchain.

[0060] Based on this, in the embodiment of the present application, the detailed process of applying for the identity certificate corresponding to the first identity identification information can be as follows: Figure 2 As shown, the specific process includes the following:

[0061] 0. The identity management middleware generates the primary identity ID.

[0062] 1. The identity management middleware sends a first request for applying for identity credentials to the operator gateway, and the first request carries the primary identity ID.

[0063] 2. Then send a first request for applying for identity credentials to the credential issuance module through the operator gateway, the first request carrying the primary identity ID and mobile phone number. When the first request is forwarded by the operator gateway, the operator gateway adds the user's mobile phone number to the first request.

[0064] It should be noted that the operator gateway can obtain the mobile phone number through mobile phone traffic.

[0065] 3. The credential issuance module generates an identity credential corresponding to the primary identity information. The generated identity credential is as follows: Figure 3 As shown, the identity certificate includes the primary identity ID, mobile phone number, issuer, issue date, and the issuer's private key signature for the identity certificate.

[0066] 4. The credential issuance module sends the generated identity credentials to the storage system for storage.

[0067] 5. Optionally, the credential issuance module returns the generated identity credential to the identity management middleware, and the identity management middleware stores the identity credential, which may be stored locally or in other storage systems.

[0068] In the embodiment of the present application, the storage system pre-stores the identity credential corresponding to the primary identity ID generated by the identity management middleware. Because the storage system needs to further perform identity authentication to send the identity credential to the identity management middleware, in the embodiment of the present application, the storage system also pre-stores some other information corresponding to the primary identity ID. Before the identity management middleware obtains the first identity credential information corresponding to the primary identity ID from the storage system, it is also necessary to execute the application and release process of the primary identity ID. The specific process is as follows: Figure 4 As shown, in Figure 4 The identity management middleware uses the mobile phone number and auxiliary information to generate a unique identity, namely the primary identity ID, and publishes the primary identity ID and the generated public key in a storage system such as the blockchain. The detailed process is as follows:

[0069] 1. The identity management middleware obtains the user's mobile phone number from the operator gateway. For example, through the client's mobile phone number one-click login function, or the authentication agency and the operator's dedicated interface. Optionally, the operator gateway can also send the user name corresponding to the mobile phone number to the identity management middleware.

[0070] 2. The identity management middleware sends a request to the SIM card to generate a public-private key pair, which carries the mobile phone number and the initial KeyID. The initial KeyID is used to identify the key, and the KeyID is unique in the same SIM card. For example, the hash value of the mobile phone number can be used as the initial KeyID.

[0071] It should be noted that one main identity ID may correspond to multiple manageable identity IDs, and each identity ID has a unique corresponding key, but the SIM card's own password module cannot store keys for each identity ID. Therefore, a root key is stored in the SIM card, that is, the key corresponding to the main identity ID. The root key can be generated using the initial keyID (that is, the hash value of the mobile phone number). When there are many identities, the root key and KeyID can be used to calculate the key corresponding to the KeyID.

[0072] 3. The SIM card uses the mobile phone number and the initial KeyID as parameters to generate a public-private key pair in its own cryptographic module and sends the user's public key to the identity management middleware. Optionally, the SIM card can also send the IMSI information to the identity management middleware, which can solve the problem of secondary resale of mobile phone numbers.

[0073] 4. The identity management middleware uses the mobile phone number and auxiliary information (auxiliary information is optional, such as IMSI information, user name, etc.) to calculate the user's primary identity ID: ID = f1 (mobile phone number, (IMSI information or user name)), where f1 is a cryptographic algorithm, such as a one-way function.

[0074] 5. The identity management middleware publishes the document consisting of the user's primary identity ID, user public key and initial KeyID to the storage system (such as blockchain) for third-party query.

[0075] In the embodiment of the present application, since the storage system pre-stores the identity credential corresponding to the primary identity ID and the primary identity ID, the user public key, the initial keyID and other information, when the identity management middleware obtains the first identity credential information corresponding to the first identity information from the storage system based on the first identity information, it can be implemented in the following manner:

[0076] Obtain a signature value from the SIM card; send a third request to the storage system, the third request carrying the first identity identification information and the signature value; when the storage system successfully verifies the signature value, receive the identity credential corresponding to the first identity identification information sent by the storage system or the identity token generated by the storage system, wherein the identity credential and the identity token are the first identity credential information.

[0077] In the embodiment of the present application, the specific method of obtaining the signature value from the SIM card is as follows:

[0078] A fourth request is sent to the storage system, wherein the fourth request carries the first identity identification information; a random number sent by the storage system and the first key identification information found based on the first identity identification information are received; a fifth request is sent to the SIM card, wherein the fifth request carries the first key identification information and the random number; and a signature value is received from the SIM card, wherein the signature value is generated by the SIM card based on the first key identification information and the random number.

[0079] In this embodiment of the present application, the first key identification information is an initial keyID.

[0080] In an embodiment of the present application, after generating the primary identity information, the identity management middleware sends a fourth request to the storage system to obtain the identity credential (such as a mobile phone number credential), and the fourth request carries the primary identity ID. The storage system sends a response message to the identity management middleware to obtain the identity credential, which carries a random number and an initial keyID found based on the primary identity. After receiving the random number and initial keyID sent by the storage system, the identity management middleware sends a fifth request to the SIM card requesting a signature, and the fifth request carries the random number and the initial keyID of the signature key of the primary identity. The SIM card further generates a corresponding private key using the initial keyID, signs the random number, and returns the signature value to the identity management middleware.

[0081] In the embodiment of the present application, the identity management middleware receives the signature value sent by the SIM card. After obtaining the signature value, the identity management middleware sends a third request to the storage system to obtain the identity credential. The third request carries the primary identity ID and the signature value. After receiving the third request, the storage system can perform the following two implementation processes:

[0082] 1) The storage system searches for the corresponding public key in the storage system according to the primary identity ID, and uses the public key to verify the signature value. If the verification is successful, the storage system searches (or retrieves) the identity credential corresponding to the primary identity ID and sends the identity credential to the identity management middleware.

[0083] 2) The storage system searches for the corresponding public key in the storage system according to the primary identity ID, and uses the public key to verify the signature value. If the verification is successful, a credential token is generated and sent to the identity management middleware.

[0084] In the embodiment of the present application, the identity management middleware receives the identity credential or identity token sent by the storage system, and then sends the identity credential or identity token to the first application server. In this way, there are two ways for the first application server to obtain the identity credential:

[0085] 1) The identity management middleware directly submits the acquired identity credentials to the first application server for mobile phone number authentication.

[0086] 2) The identity management middleware submits the credential token obtained from the storage system to the first application server. The first application server sends a request to the storage system to obtain the identity credential, which carries the credential token. The storage system further verifies the credential token. After the credential token is successfully verified, the corresponding identity credential is retrieved and sent to the first application server.

[0087] Based on the above embodiments, the process of obtaining the identity credentials can be summarized as follows: Figure 5 As shown, the specific steps include:

[0088] 0. The identity management middleware generates the primary identity ID.

[0089] 1. The identity management middleware sends a request to the storage system to obtain identity credentials (such as mobile phone number credentials), which includes the user's primary identity ID.

[0090] 2. The storage system sends a response to the identity credential request to the identity management middleware, which carries a random number.

[0091] 3. The identity management middleware requests a signature from the SIM card, which carries the random number and the initial KeyID of the signing key of the primary identity ID.

[0092] 4. The SIM card uses the initial KeyID to generate the corresponding private key and uses the private key to sign the random number.

[0093] 5. The SIM card returns the signature value to the identity management middleware.

[0094] 6. The identity management middleware sends a request to obtain identity credentials to the storage system, and the request carries the primary identity ID and signature value.

[0095] 7. Method 1: The first application server obtains identity credentials indirectly from the storage system:

[0096] a. The storage system searches for the corresponding public key verification signature value according to the primary identity ID. When the verification succeeds, the storage system retrieves the identity credential corresponding to the request for obtaining the identity credential.

[0097] b. The storage system sends the obtained identity credentials to the identity management middleware.

[0098] c. The identity management middleware submits the identity credential to the first application server for the first application server to authenticate the mobile phone number.

[0099] 8. Method 2: The first application server obtains identity credentials directly from the storage system:

[0100] a. The storage system searches for the corresponding public key based on the primary identity ID to verify the signature. If the verification is successful, a credential token is generated.

[0101] b. The storage system sends the obtained credential token to the identity management middleware.

[0102] c. The identity management middleware submits the credential token to the first application server.

[0103] d. The first application server sends a request to the storage system to obtain identity credentials, which carries a credential token.

[0104] e. The storage system verifies the credential token, retrieves the corresponding identity credential when the verification is successful, and sends the identity credential to the first application server.

[0105] In summary, after the identity management middleware obtains the primary identity identification ID, it can search for the identity credential or credential token corresponding to the primary identity identification ID from the storage system, and send the obtained identity credential or credential token to the application server corresponding to the application that requires identity authentication. The application server then performs identity authentication based on the obtained identity credential, or further obtains the identity credential from the storage system based on the obtained credential token, and then executes the identity authentication process.

[0106] It can be understood that an identity authentication method provided in an embodiment of the present application introduces an identity management middleware, obtains code number information from the first device through the identity management middleware, and generates first identity identification information, and uses the first identity identification information to obtain corresponding first identity credential information from the storage system for use by the first application server. In this way, there is no need to store a large number of credentials in the SIM card, reducing the use of SIM card storage space. At the same time, when the SIM card space cannot meet the storage requirements, the first identity credential information can be obtained through the identity management middleware, and the identity credential is provided to the first application server for identity authentication, thereby ensuring user identity security.

[0107] In one embodiment of the present application, the storage system also stores one or more second identity identification information corresponding to the first identity identification. After generating the first identity identification information based on the code number information, the corresponding one or more second identity identification information is searched from the storage system based on the first identity identification information; based on the one or more second identity identification information, one or more second identity credential information corresponding to the one or more second identity identification information is obtained from the storage system, and the one or more second identity credential information is sent to the first application server.

[0108] In the embodiment of the present application, the specific method of generating one or more second identity identification information stored in the storage system is as follows:

[0109] Receive the sixth request sent by the first application server; based on the sixth request, obtain one or more keys from the SIM card; based on the first identity information, the code number information and the one or more keys, generate one or more second identity information; send the one or more second identity information to the storage system.

[0110] In an embodiment of the present application, the first application server sends a sixth request to the identity management middleware, where the sixth request is used to request generation of new identity identification information (ie, second identity identification information), where the second identity identification information can be referred to as a new identity identification document.

[0111] In the embodiment of the present application, when the identity management middleware receives the sixth request sent by the first application server, the identity management middleware first generates a new keyID, which can be randomly derived from the initial keyID, and the keyID is used to identify the key, and sends a request to the SIM card for a public-private key pair, which carries the obtained mobile phone number and the generated new keyID. The identity management middleware receives the new public key calculated by the SIM card based on the mobile phone number and the new keyID.

[0112] It should be noted that if the number of new keyIDs is one or more, the number of private keys calculated by the SIM card is one or more, and the number of private keys obtained by the identity management middleware is one or more.

[0113] In the embodiment of the present application, the identity management middleware will further regenerate a new identity ID based on the mobile phone number.

[0114] In an embodiment of the present application, the identity management middleware sets the manager of the new identity ID as the primary identity ID, and publishes the new identity document consisting of the new identity ID, the manager of the new identity (i.e., the primary identity ID), the user's new public key and the corresponding new KeyID in a storage system (such as a blockchain) for third-party query.

[0115] Based on this, the specific implementation of this process can be summarized as follows: Figure 6 As shown, the specific steps include:

[0116] 1. The first application server requests the identity management middleware to generate new identity information.

[0117] 2. The identity management middleware generates a new KeyID, which is used to identify the key. The new keyID can be randomly derived from the initial keyID.

[0118] 3. The identity management middleware sends a request to the SIM card to generate a new public-private key pair. The request carries the mobile phone number and the new KeyID.

[0119] 4. The SIM card uses the new KeyID and mobile phone number to calculate a new public-private key pair and returns the new public key to the identity management middleware.

[0120] 5. The identity management middleware regenerates a new identity ID and generates a new identity document based on it. The calculation of the new identity ID can refer to the calculation process of the primary identity ID, which will not be repeated here.

[0121] 6. The identity management middleware sets the manager of the new identity ID as the primary identity ID, and publishes the new identity document consisting of the new identity ID, the manager of the new identity (i.e. the primary identity ID), the user's public key and the corresponding new KeyID to the storage system (such as blockchain) for third-party query.

[0122] In an embodiment of the present application, one or more second identity identification information corresponding to the main identity identification information is stored in the storage system. In this way, after obtaining the main identity identification information, the identity management middleware can find one or more second identity identification information based on the main identity identification information.

[0123] It should be noted that searching for one or more second identity information can be performed when the software system is started. When the software system is started, the main identity information corresponding to the terminal and all the second identity information that can be managed by the main identity as a controller are obtained. The acquisition process can be summarized as follows: Figure 7 As shown, the specific steps include:

[0124] 1. The identity management middleware obtains the user's mobile phone number from the operator gateway. For example, it can obtain the user's mobile phone number through the client's mobile phone number one-click login function, or through the authentication agency and the operator's dedicated interface. Optionally, the operator gateway can also send the user name corresponding to the mobile phone number to the identity management middleware.

[0125] 2. The identity management middleware requests the SIM card to generate a public and private key pair. The key pair carries the mobile phone number and the initial KeyID, where the KeyID is used to identify the key and is unique in the same SIM card. For example, the hash value of the mobile phone number can be used as the initial KeyID.

[0126] 3. The SIM card calculates the corresponding public key using the mobile phone number and the initial KeyID, and returns the public key to the identity management middleware. Optionally, the SIM card can also send the IMSI information to the identity management middleware.

[0127] 4. The identity management middleware uses the mobile phone number and auxiliary information (auxiliary information is optional, such as IMSI information, user name, etc.) to calculate the user's primary identity ID:

[0128] The primary identity ID=f1(mobile phone number, (auxiliary information)), wherein f1 is a cryptographic algorithm, such as a one-way function, and the auxiliary information is the first auxiliary information or the second auxiliary information.

[0129] 5. Obtain the main identity ID and the IDs that the administrator can manage and the corresponding KeyID. The acquisition process can be specifically carried out in the following ways:

[0130] The identity management middleware sends a request to the storage system to obtain a manageable identity, and the request includes the primary identity ID of the user.

[0131] Based on the request, the storage system feeds back to the identity management middleware the user's primary identity ID (optional) and other identities (ie, second identity information) that use the user's primary identity ID as the administrator, as well as the KeyID corresponding to the other identities.

[0132] In an embodiment of the present application, after obtaining one or more second identity identification information from the storage system, the identity management middleware can obtain one or more corresponding second identity credential information from the storage system based on the one or more second identity identification information.

[0133] It should be noted that, to obtain one or more corresponding second identity credential information from the storage system, it is necessary to apply for the identity credential corresponding to the second identity information in advance and store it in the storage system. Specifically, you can refer to the process of generating the identity credential corresponding to the first identity information, the difference is that the main identity ID is changed to a manageable identity ID, which will not be repeated here.

[0134] It should be noted that the process of obtaining the second identity credential information from the storage system can refer to the process of obtaining the first identity credential information, and the only difference is the parameters such as the public key and primary identity ID used, which will not be repeated here.

[0135] In an embodiment of the present application, after obtaining one or more second identity credential information, the one or more second identity credential information is sent to the first application server, so that the first application server can obtain the corresponding identity credential according to the second identity credential information and perform verification.

[0136] Based on the above embodiments, the digital identity authentication method targeted in the embodiments of the present application provides identity services for various applications through middleware. The implementation of the entire process involves a SIM card, identity management middleware, operator gateway, application APP and storage system (such as blockchain).

[0137] With the help of identity management middleware, users obtain mobile phone numbers through the operator gateway, and generate a primary identity ID based on auxiliary information, and use the primary identity ID to apply for a new identity; apply for the user's identity credentials from the credential issuance module and store the identity credentials; the identity management middleware generates a primary identity, uses the primary identity to obtain the user's identity credentials from storage systems such as blockchain, and provides the identity credentials to the application APP on demand for use by the application APP on demand, and the identity management middleware does not need to store any data.

[0138] Based on the above embodiments, distributed digital identity is one of the key technologies of Web 3.0 and the basis of trust and value transfer. Digital wallets are the key entry point for implementing distributed digital identity, providing functions such as the generation, storage, and cryptographic calculation of digital identity. They are usually divided into hardware digital wallets and software digital wallets, and have become a hot spot for competition among many manufacturers. The identity management middleware proposed in the embodiment of this application can be used as a functional extension of the mobile authentication middleware, using SIM cards and mobile phone numbers to provide users with convenient identity services, giving full play to the resource advantages of operators, and is of great significance for seizing the entry point of Web 3.0.

[0139] It should be noted that the principle of distributed digital identity is:

[0140] Distributed digital identity consists of two parts: distributed digital identity identifier and digital identity certificate.

[0141] A distributed digital identity identifier (DID) is an identifier consisting of a string of characters that represents a digital identity and can achieve global uniqueness without the need for a central registration agency. DID documents are mainly used to record information such as user public keys, including DID identifiers, DID controllers, public keys, and other content.

[0142] Compared with the related art, the embodiments of the present application have the following technical advantages:

[0143] 1. Use identity management middleware to manage digital identity without computing and storage space: Digital wallets are the entry point for managing digital identities. They are divided into hardware wallets and software wallets, both of which require secure computing and storage resources. The embodiment of the present application uses SIM cards to provide a hardware security foundation, provides a security technology environment involving cryptographic operations, generates user identification with the help of mobile phone numbers, and stores identity credentials in a public storage environment. The middleware is simple to implement and can give full play to the role of SIM cards and mobile phone numbers as a functional extension of mobile authentication.

[0144] 2. Give full play to the role of SIM cards and mobile phone numbers: Currently, mobile phone numbers are only used for simple login and registration operations as a way of user identity authentication. This proposal combines mobile phone numbers with digital identities, uses the one-click login function of mobile phone numbers, and combines user public keys and identity attributes to generate identity credentials that can be used for user real-name authentication, thereby improving the usability of mobile phone numbers and making the user real-name process simpler and safer.

[0145] 3. This function can be used as an extension of the operator's mobile authentication (one-click login), providing identity attribute information in addition to the mobile phone number. In addition to generating identity credentials, the authentication process of the identity credentials does not require the operator's participation. This not only ensures the authority of the operator as the issuer of the identity credentials, but also reduces the construction and maintenance costs of the operator's application system through distributed authentication.

[0146] Based on the above embodiment, in another embodiment of the present application, a middleware 1 is provided, such as Figure 8 As shown, the middleware 1 includes:

[0147] The acquiring unit 10 is configured to acquire code number information from the first device.

[0148] The generating unit 11 is used to generate first identity identification information based on the code number information.

[0149] The acquisition unit 10 is also used to acquire first identity credential information corresponding to the first identity identification information from the storage system based on the first identity identification information, and send the first identity credential information to the first application server so that the first application server can acquire the identity credential and perform identity authentication based on the first identity credential information.

[0150] In one embodiment, the middleware 1 may further include: a sending unit.

[0151] The sending unit is used to send a first request to the credential issuing device, wherein the first request carries first identity identification information and code number information, so that the credential issuing device can generate an identity credential based on the first identity identification information and code number information, and send the identity credential to the storage system.

[0152] In one embodiment, the acquisition unit 10 is further configured to acquire first auxiliary information from the first device, and generate first identity information based on the code number information and the first auxiliary information.

[0153] Alternatively, the acquiring unit 10 is further configured to acquire the second auxiliary information from the SIM card, and generate the first identity information based on the code information and the second auxiliary information.

[0154] In one embodiment, the first identity credential information includes an identity credential or an identity token.

[0155] In one embodiment, the middleware 1 may further include: a receiving unit.

[0156] The acquiring unit 10 is further configured to acquire a signature value from the SIM card.

[0157] The sending unit is further used to send a third request to the storage system, where the third request carries the first identity information and the signature value.

[0158] The receiving unit is used to receive the identity credential corresponding to the first identity identification information sent by the storage system or the identity token generated by the storage system when the storage system successfully verifies the signature value.

[0159] In one embodiment, the sending unit is further configured to send a fourth request to the storage system, where the fourth request carries the first identity information.

[0160] The receiving unit is further used to receive the random number sent by the storage system and the first key identification information found based on the first identity identification information.

[0161] The sending unit is further used to send a fifth request to the SIM card, where the fifth request carries the first key identification information and a random number.

[0162] The receiving unit is further used to receive a signature value sent by the SIM card, wherein the signature value is generated by the SIM card based on the first key identification information and a random number.

[0163] In one embodiment, the storage system stores one or more second identity identification information corresponding to the first identity identification.

[0164] In one embodiment, the acquisition unit 10 is further configured to search the storage system for one or more corresponding second identity information based on the first identity information.

[0165] The acquisition unit 10 is further configured to acquire one or more second identity credential information corresponding to the one or more second identity identification information from the storage system based on the one or more second identity identification information, and send the one or more second identity credential information to the first application server.

[0166] In one embodiment, the receiving unit is further configured to receive a sixth request sent by the first application server.

[0167] The obtaining unit 10 is further configured to obtain one or more keys from the SIM card based on the sixth request.

[0168] The generating unit 11 is further configured to generate one or more second identity identification information based on the first identity identification information, the code number information and the one or more keys.

[0169] The sending unit is further used to send one or more second identity identification information to the storage system.

[0170] The embodiment of the present application provides a middleware, which obtains code number information from a first device; generates first identity identification information based on the code number information; obtains first identity credential information corresponding to the first identity identification information from a storage system based on the first identity identification information, and sends the first identity credential information to a first application server, so that the first application server can obtain the identity credential and perform identity authentication based on the first identity credential information. It can be seen that the embodiment of the present application proposes a middleware, that is, for a distributed digital identity authentication device, the middleware obtains the user's mobile phone number through an operator gateway, calculates the user's primary identity identification ID based on the mobile phone number and auxiliary information, applies for the user's identity credential from a credential issuance module, and obtains the user's primary identity identification ID from a storage system such as a blockchain. The storage system obtains the user's identity credentials and provides the identity credentials to the first application server on demand. The identity management middleware itself does not need to store any data. In this way, the identity management middleware is introduced, and the code number information is obtained from the first device through the identity management middleware, and the first identity identification information is generated. The first identity identification information is used to obtain the corresponding first identity credential information from the storage system for use by the first application server. In this way, there is no need to store a large number of credentials in the SIM card, reducing the use of SIM card storage space. At the same time, when the SIM card space cannot meet the storage requirements, the first identity credential information can be obtained through the identity management middleware, and the identity credentials are provided to the first application server for identity authentication, thereby ensuring the security of the user's identity.

[0171] Fig. 9 A schematic diagram of the composition structure of a middleware 1 provided in an embodiment of the present application. In practical applications, based on the same disclosure concept of the above embodiments, Fig. 9 As shown, the middleware 1 of the embodiment of the present application includes a processor 12 , a memory 13 and a communication bus 14 .

[0172] In the specific implementation process, the acquisition unit 10, the generation unit 11, the sending unit, and the receiving unit can be implemented by a processor 12 located on the middleware 1, and the processor 12 can be at least one of an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing image processing device (DSPD), a programmable logic image processing device (PLD), a field programmable gate array (FPGA), a CPU, a controller, a microcontroller, and a microprocessor. It can be understood that for different devices, the electronic device used to implement the above-mentioned processor function can also be other, and the embodiments of the present application do not make specific limitations.

[0173] In the embodiment of the present application, the communication bus 14 is used to realize the connection and communication between the processor 12 and the memory 13; when the processor 12 executes the running program stored in the memory 13, the following identity authentication method is implemented:

[0174] Obtain code number information from the first device; generate first identity identification information based on the code number information; obtain first identity credential information corresponding to the first identity identification information from the storage system based on the first identity identification information, and send the first identity credential information to the first application server, so that the first application server obtains the identity credential based on the first identity credential information and performs identity authentication.

[0175] In one embodiment, the processor 12 is further used to send a first request to a credential issuing device, wherein the first request carries first identity identification information and code number information, so that the credential issuing device generates an identity credential based on the first identity identification information and code number information, and sends the identity credential to a storage system.

[0176] In one embodiment, the processor 12 is further used to obtain first auxiliary information from the first device, and generate first identity information based on the code number information and the first auxiliary information; or, obtain second auxiliary information from the SIM card, and generate first identity information based on the code number information and the second auxiliary information.

[0177] In one embodiment, the first identity credential information includes an identity credential or an identity token.

[0178] In one embodiment, the processor 12 is further used to obtain a signature value from a SIM card; send a third request to the storage system, the third request carrying the first identity information and the signature value; and when the storage system successfully verifies the signature value, receive an identity credential corresponding to the first identity information sent by the storage system or an identity token generated by the storage system.

[0179] In one embodiment, the processor 12 is further used to send a fourth request to the storage system, the fourth request carrying the first identity identification information; receive a random number sent by the storage system and the first key identification information found based on the first identity identification information; send a fifth request to the SIM card, the fifth request carrying the first key identification information and the random number; receive a signature value sent by the SIM card, wherein the signature value is generated by the SIM card based on the first key identification information and the random number.

[0180] In one embodiment, the storage system stores one or more second identity identification information corresponding to the first identity identification.

[0181] In one embodiment, the above-mentioned processor 12 is also used to search for one or more corresponding second identity identification information from the storage system based on the first identity identification information; based on the one or more second identity identification information, obtain one or more second identity credential information corresponding to the one or more second identity identification information from the storage system, and send the one or more second identity credential information to the first application server.

[0182] In one embodiment, the above-mentioned processor 12 is also used to receive a sixth request sent by the first application server; based on the sixth request, obtain one or more keys from the SIM card; based on the first identity information, code number information and one or more keys, generate one or more second identity information; and send one or more second identity information to the storage system.

[0183] Based on the above embodiments, an embodiment of the present application provides a storage medium on which a computer program is stored. The above computer-readable storage medium stores one or more programs. The above one or more programs can be executed by one or more processors and applied to the middleware. The computer program implements the identity authentication method as described above.

[0184] Based on the above embodiments, an embodiment of the present application provides a computer program product, including a computer program, which can be executed by one or more processors and applied to a middleware. The computer program implements the identity authentication method as described above.

[0185] It should be noted that in the embodiments of the present application, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0186] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment method can be implemented by means of software plus a necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD), including a number of instructions for an image display device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the method described in each embodiment of the embodiment of the present application.

[0187] The above is only a specific implementation of the embodiment of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An identity authentication method, characterized in that: Applied to identity management middleware, the method comprises: Acquire code number information from the first device; Based on the code number information, generate first identity identification information; Based on the first identity identification information, first identity credential information corresponding to the first identity identification information is obtained from a storage system, and the first identity credential information is sent to a first application server, so that the first application server obtains an identity credential based on the first identity credential information and performs identity authentication.

2. The method according to claim 1, characterized in that After generating the first identity identification information based on the code number information, and before acquiring the first identity credential information corresponding to the first identity identification from the storage system based on the first identity identification information, the method further includes: A first request is sent to a credential issuing device, wherein the first request carries the first identity identification information and the code number information, so that the credential issuing device generates an identity credential based on the first identity identification information and the code number information, and sends the identity credential to the storage system.

3. The method according to claim 1, characterized in that The generating first identity information based on the code number information includes: Acquire first auxiliary information from the first device, and generate the first identity information based on the code number information and the first auxiliary information; Alternatively, the second auxiliary information is obtained from a subscriber identity module SIM card, and the first identity identification information is generated based on the code number information and the second auxiliary information.

4. The method according to claim 1, characterized in that The first identity credential information includes an identity credential or an identity token, and the acquiring, based on the first identity identification information, the first identity credential information corresponding to the first identity identification information from the storage system includes: Get the signature value from the SIM card; Sending a third request to the storage system, where the third request carries the first identity information and the signature value; When the storage system successfully verifies the signature value, an identity credential corresponding to the first identity identification information sent by the storage system or an identity token generated by the storage system is received.

5. The method according to claim 4, characterized in that The step of obtaining a signature value from a SIM card includes: Sending a fourth request to the storage system, where the fourth request carries the first identity identification information; Receiving a random number sent by the storage system and first key identification information found based on the first identity identification information; Sending a fifth request to the SIM card, where the fifth request carries the first key identification information and the random number; The signature value sent by the SIM card is received, wherein the signature value is generated by the SIM card based on the first key identification information and the random number.

6. The method according to claim 1, characterized in that The storage system stores one or more second identity identification information corresponding to the first identity identification information. After the first identity identification information is generated based on the code number information, the method further includes: Based on the first identity information, searching the storage system for one or more corresponding second identity information; Based on the one or more second identity identification information, one or more second identity credential information corresponding to the one or more second identity identification information is acquired from the storage system, and the one or more second identity credential information is sent to the first application server.

7. The method according to claim 6, characterized in that Before searching the storage system for one or more corresponding second identity information based on the first identity information, the method further includes: receiving a sixth request sent by the first application server; Based on the sixth request, obtaining one or more keys from the SIM card; Generate the one or more second identity information based on the first identity information, the code number information and the one or more keys; The one or more second identity identification information are sent to the storage system.

8. A middleware, characterized in that: The middleware includes: An acquiring unit, configured to acquire code number information from the first device; A generating unit, configured to generate first identity identification information based on the code number information; The acquisition unit is also used to acquire first identity credential information corresponding to the first identity identification information from the storage system based on the first identity identification information, and send the first identity credential information to the first application server, so that the first application server can acquire the identity credential and perform identity authentication based on the first identity credential information.

9. A middleware, characterized in that: The middleware comprises: a processor and a memory; when the processor executes the running program stored in the memory, the method according to any one of claims 1 to 7 is implemented.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the method according to any one of claims 1 to 7.

Images