Access control method, device and equipment and storage medium

Abstract

The invention discloses an access control method, device and equipment and a storage medium, and relates to the technical field of block chains, the access control method is applied to an access controller, the access controller is a controller set based on a distributed digital identity system and a block chain network, and the access control method comprises the following steps: obtaining an access verification request initiated by a digital identity client; the data identity client is a client containing a digital identity generated by a digital identity management contract of the block chain network, and the access control verification request comprises a verifiable credential issued by a credential management contract of the block chain network; and initiating a verification request to a credential verification contract of the block chain network based on the access control verification request, and determining whether to execute a door opening operation according to a corresponding verification result. In this way, the block chain and the distributed digital identity are combined, the autonomous and controllable digital identity can be provided for each user corresponding to the access controller, and the controllability and safety of the identity information are improved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to an access control method, device, equipment and storage medium. Background Art

[0002] Traditional access control systems mostly use centralized identity management methods, which have problems such as identity data being controlled by a single authority, low security, and privacy leakage. Blockchain technology, with its decentralized, tamper-proof, and full-process traceability characteristics, provides a safe and reliable guarantee for the storage and verification of identity data; however, the user's identity data is managed by the blockchain, and the user passively accepts his or her own identity, which leads to a single identity, easy association of information, and the risk of information leakage.

[0003] It can be seen that how to further improve the security of identity information on the basis of decentralization is a problem to be solved in this field. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide an access control method, device, equipment and storage medium, which combines blockchain and distributed digital identity to provide each user corresponding to the access controller with an autonomous and controllable digital identity, thereby improving the controllability and security of identity information. The specific scheme is as follows:

[0005] In a first aspect, the present application provides an access control method, which is applied to an access controller, wherein the access controller is a controller based on a distributed digital identity system and a blockchain network, comprising:

[0006] Obtaining a door access verification request initiated by a digital identity client; the digital identity client is a client including a digital identity generated by a digital identity management contract of the blockchain network, and the door access verification request includes a verifiable credential issued by a credential management contract of the blockchain network;

[0007] Based on the access control verification request, a verification request is initiated to the credential verification contract of the blockchain network, and whether to perform the door opening operation is determined according to the corresponding verification result.

[0008] Optionally, before obtaining the access control verification request initiated by the digital identity client, the process further includes:

[0009] The locally stored digital identity document specification data is sent to the digital identity management contract of the blockchain network, so that the digital identity management contract generates a digital identity for the identity generation request received by the distributed digital identity system according to the digital identity document specification data, so as to integrate the digital identity into the corresponding client to obtain a digital identity client; the digital identity document specification data is the document specification data constructed by the user's client and the access control entity.

[0010] Optionally, the digital identity management contract generates a corresponding digital identity according to the identity generation request received by the distributed digital identity system, so as to integrate the digital identity into a corresponding client to obtain a digital identity client, including:

[0011] The digital identity management contract generates a corresponding digital identity according to the identity generation request received by the distributed digital identity system, and generates a verifiable credential for the target user through the credential management contract, so as to integrate the digital identity and the verifiable credential into the client and obtain the digital identity client corresponding to the target user; the identity generation request is a request for the target user initiated by the access control entity or the client to the distributed digital identity system.

[0012] Optionally, the digital identity management contract generates a corresponding digital identity according to the identity generation request received by the distributed digital identity system, including:

[0013] The digital identity management contract obtains the signed request sent by the distributed digital identity system, and registers and generates a corresponding digital identity according to the signed request; the signed request is a request obtained by the distributed digital identity system after receiving the identity generation request sent by the client, using the key corresponding to the client in the digital identity document specification data to sign the identity generation request.

[0014] Optionally, generating a verifiable credential for a target user through the credential management contract includes:

[0015] The credential template corresponding to the access controller is determined through the credential management contract, and the user information of the target user that matches the credential template is obtained through the credential management contract to generate a verifiable credential for the target user based on the user information and the corresponding digital identity.

[0016] Optionally, the method further includes:

[0017] Obtaining a key update request initiated by each digital identity client through the digital identity management contract;

[0018] The digital identity of each digital identity client is verified through the credential verification contract, and the key corresponding to each digital identity client is updated after the verification is passed, so as to manage the digital identity of each digital identity client based on the updated key.

[0019] Optionally, initiating a verification request to a credential verification contract of the blockchain network based on the access control verification request, and determining whether to perform a door opening operation according to a corresponding verification result, includes:

[0020] Initiating a verification request to the credential verification contract of the blockchain network based on the access control verification request, so that the credential verification contract verifies the format and attributes of the verifiable credential and obtains a corresponding verification result;

[0021] If the verification result indicates that the verification is passed, the door opening operation is allowed;

[0022] If the verification result indicates that the verification has failed, the door opening operation is not allowed, and a prompt message indicating that the verification has failed is triggered.

[0023] In a second aspect, the present application provides an access control device, which is applied to an access controller, wherein the access controller is a controller based on a distributed digital identity system and a blockchain network, including:

[0024] An access control verification request acquisition module is used to obtain an access control verification request initiated by a digital identity client; the digital identity client is a client including a digital identity generated by a digital identity management contract of the blockchain network, and the access control verification request includes a verifiable credential issued by a credential management contract of the blockchain network;

[0025] A verification module is used to initiate a verification request to the credential verification contract of the blockchain network based on the access control verification request, and determine whether to perform a door opening operation according to a corresponding verification result.

[0026] In a third aspect, the present application provides an electronic device, including:

[0027] Memory, used to store computer programs;

[0028] A processor is used to execute the computer program to implement the access control method as described above.

[0029] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the access control method as described above when executed by a processor.

[0030] It can be seen that the present application is applied to an access control controller, which is a controller set up based on a distributed digital identity system and a blockchain network, specifically including: first obtaining an access control verification request initiated by a digital identity client; the digital identity client is a client of a digital identity generated by a digital identity management contract of the blockchain network, and the access control verification request includes a verifiable credential issued by a credential management contract of the blockchain network; then, based on the access control verification request, a verification request is initiated to the credential verification contract of the blockchain network, and whether to perform a door opening operation is determined based on the corresponding verification result. In this way, the present application, in combination with blockchain and distributed digital identity, can provide an autonomous and controllable digital identity for each user corresponding to the access control controller, thereby improving the controllability and security of identity information. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0032] Figure 1 A flow chart of a door access control method disclosed in this application;

[0033] Figure 2 A flow chart of a specific access control method disclosed in this application;

[0034] Figure 3 Another specific access control method flow chart disclosed in this application;

[0035] Figure 4 A schematic diagram of the structure of an access control device disclosed in this application;

[0036] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] See also Figure 1As shown, an embodiment of the present invention discloses a door access control method, which is applied to a door access controller, wherein the door access controller is a controller based on a distributed digital identity system and a blockchain network, including:

[0039] Step S11, obtaining an access control verification request initiated by a digital identity client; the digital identity client is a client of a digital identity generated by a digital identity management contract of the blockchain network, and the access control verification request includes a verifiable credential issued by a credential management contract of the blockchain network.

[0040] In the embodiment of the present application, the access control controller is a controller set up based on a distributed digital identity system and a blockchain network. It can read the verifiable credentials presented by the user through the client to verify the validity through the blockchain network, and control the access control switch according to the verification result; specifically, the digital identity client used by the user integrates the digital identity generated by the digital identity association contract of the blockchain network and the verifiable credentials issued by the credential management contract, and can initiate an access control verification request to the access control controller at the access control entity.

[0041] In a specific embodiment, before obtaining the access control verification request initiated by the digital identity client, it may also include: sending the locally stored digital identity document specification data to the digital identity management contract of the blockchain network, so that the digital identity management contract generates a digital identity for the identity generation request received by the distributed digital identity system based on the digital identity document specification data, so as to integrate the digital identity into the corresponding client to obtain a digital identity client; the digital identity document specification data is the document specification data constructed by the user's client and the access control entity. Specifically, the access control controller can send the locally stored document specification data constructed by the user's client and the relevant information of the access control subject to the digital identity management contract of the blockchain network in advance. After receiving the identity generation request initiated by the distributed digital identity system, the data identity management contract can generate a corresponding digital identity according to the digital identity document specification data, and return the generated digital identity to the distributed digital identity system, so that the distributed digital identity system can integrate the digital identity into the user's client to obtain the digital identity client; it can be understood that the distributed digital identity system forwards the request to the blockchain network after receiving the identity generation request initiated by the user or staff through the user's client or through the access control subject, so that the digital identity management contract on the blockchain network generates a digital identity for the identity generation request based on the relevant digital identity document specification data, and then the distributed digital identity system can integrate the digital identity returned by the blockchain network into the user's client to obtain the user's digital identity client.

[0042] In a specific embodiment, the digital identity management contract generates a corresponding digital identity according to the identity generation request received by the distributed digital identity system, so as to integrate the digital identity into the corresponding client to obtain a digital identity client, which may include: the digital identity management contract generates a corresponding digital identity according to the identity generation request received by the distributed digital identity system, and generates a verifiable credential for the target user through the credential management contract, so as to integrate the digital identity and the verifiable credential into the client, and obtain the digital identity client corresponding to the target user; the identity generation request is a request for the target user initiated by the access control subject or the client to the distributed digital identity system. Specifically, in the process of generating a corresponding digital identity according to the identity generation request received by the distributed digital identity system, the digital identity management contract in the blockchain network also generates a verifiable credential for the target user corresponding to the identity generation request through the credential management contract; in this way, the distributed digital identity system can integrate the digital identity and the corresponding verifiable credential returned by the blockchain network based on the identity generation request into the client of the target user to obtain the corresponding digital identity client.

[0043] In a specific embodiment, the digital identity management contract generates a corresponding digital identity according to the identity generation request received by the distributed digital identity system, which may include: the digital identity management contract obtains the signed request sent by the distributed digital identity system, and registers and generates a corresponding digital identity according to the signed request; the signed request is a request obtained by the distributed digital identity system after receiving the identity generation request sent by the client, using the key corresponding to the client in the digital identity document specification data to sign the identity generation request. Specifically, in the process of generating a digital identity by the digital identity management contract, first, the user or staff initiates an identity generation request to the distributed digital identity system through the client or the access control subject, and the distributed digital identity system can use the key corresponding to the client in the previously saved relevant digital identity document specification data to sign the identity generation request to obtain the signed request; then the distributed digital identity system sends the signed request to the digital identity management contract of the blockchain network, and the digital identity management contract registers and generates the corresponding digital identity based on the signed request.

[0044] Furthermore, the generation of verifiable credentials for the target user through the credential management contract may include: determining the credential template corresponding to the access control controller through the credential management contract, and obtaining the user information of the target user that matches the credential template through the credential management contract, so as to generate verifiable credentials for the target user based on the user information and the corresponding digital identity. Specifically, in the process of generating verifiable credentials through the credential management contract, the access control subject corresponds to the access control credential template, and the target user can apply for verifiable credentials from the distributed digital identity system through the client; further, after the user enters his own user information, the distributed digital identity system can initiate a verifiable credential generation request to the credential management contract of the blockchain network based on the user information, so that the credential management contract generates verifiable credentials for the user. In a specific embodiment, the verifiable credentials generated by the credential management contract will be issued to the user's client so that the user can pass the access control with the help of the client.

[0045] In a specific embodiment, it may also include: obtaining a key update request initiated by each digital identity client through the digital identity management contract; verifying the digital identity of each digital identity client through the credential verification contract, and updating the key corresponding to each digital identity client after the verification is passed, so as to manage the digital identity of each digital identity client based on the updated key. Specifically, in order to ensure the security of user information, the digital identity management contract in the blockchain network can regularly update the key of the digital identity of the relevant user, and can receive a digital identity key update request initiated by the user's digital identity client or the distributed digital identity system; the digital identity of the relevant user needs to be verified through the credential verification contract, and only after the verification is passed, the key corresponding to each digital identity client is updated, and the registration information of each digital identity is updated, so as to facilitate the management of the digital identity of each digital identity client.

[0046] Step S12: Initiate a verification request to the credential verification contract of the blockchain network based on the access control verification request, and determine whether to perform a door opening operation based on the corresponding verification result.

[0047] In an embodiment of the present application, when a user passes through a door access control, a door access control verification request needs to be initiated through a digital identity client, and the door access control controller forwards the door access control verification request to the credential verification contract of the blockchain network, and the credential verification contract verifies the verifiable credential of the digital identity client to obtain a corresponding verification result; the subsequent door access control controller can determine whether to perform the door opening operation based on the verification result returned by the blockchain network. In a specific embodiment, the initiation of a verification request to the credential verification contract of the blockchain network based on the door access control verification request, and determining whether to perform the door opening operation based on the corresponding verification result, may include: initiating a verification request to the credential verification contract of the blockchain network based on the door access control verification request, so that the credential verification contract verifies the format and attributes of the verifiable credential and obtains a corresponding verification result; if the verification result indicates that the verification is passed, the door opening operation is allowed; if the verification result indicates that the verification is not passed, the door opening operation is not allowed, and a prompt message indicating the verification failure is triggered. Specifically, the process of verifying the verifiable credentials of the digital identity client through the credential verification contract of the blockchain network is to verify the format and attributes of the verifiable credentials, perform format verification, timeliness verification, access control subject information verification and signature information verification, etc., and finally obtain the verification result; further, if the verification result indicates that it passes, the door opening operation can be allowed; the door opening instruction can also be directly issued; correspondingly, if the verification result indicates that it fails, the door opening operation will not be allowed, and the corresponding prompt information can be triggered to remind the relevant user that he does not have the authority to pass the access control.

[0048] It can be seen that the distributed digital identity system in this application is connected to the smart contract of the blockchain network, which can realize the management of digital identity, credential templates and credentials; it can provide digital identity management services for users or access control entities; when users want to pass the access control, they need to present verifiable credentials, and the access control controller calls the credential verification contract of the blockchain network to verify the validity of the verifiable credentials presented by the user, so as to determine whether the user has the right to pass the access control. In this way, the combination of the blockchain network and the distributed digital identity system realizes the decentralized management of the access control system and improves the security and reliability of identity data.

[0049] like Figure 2 As shown, the embodiment of the present application discloses a door access control method, which specifically includes:

[0050] In the embodiment of the present application, the access control subject first customizes and publishes the credential template, and the user can enter the relevant user information according to the specified credential template to apply for a verifiable credential; the access control subject can issue the corresponding verifiable credential after reviewing the verifiable credential application; further, the user can use the verifiable credential to pass the access control. It should be pointed out that the access control subject is a credential template customized and published by the distributed digital identity management system and the blockchain network, and the verifiable credential applied by the user is generated through the credential management contract in the blockchain network. Specifically, the blockchain network can be used to store and manage all data and transaction records of the access control system to ensure the security and immutability of the data; the distributed digital identity system (Decentralized Identifier System, distributed digital identity system, DID System) is responsible for generating, managing and verifying distributed digital identities (DID) to achieve decentralized management of user identities; the access control controller (DController) is responsible for reading the user's verifiable credentials (Verifiable Credential, VC), verifying the user's identity and authority, and controlling the access control switch; the digital identity client (VClient) is used for the management of DID identity, the preservation of keys, the application and display of VC, and when passing through the access control, the VC is presented to the access control system. Furthermore, when a user requests to enter the access control area, a request is sent to the access control controller through the digital identity client, and the client stores the verifiable credential VC issued by the access control entity. After receiving the user's request, the access control controller initiates a VC verification request to the credential verification contract of the blockchain network, and determines whether the VC is valid based on the returned verification result: if the VC verification is valid, the access control controller performs the door opening operation; if the verification VC is invalid, the door is refused to be opened.

[0051] In a specific embodiment, Figure 3 As shown, users can apply for digital identities directly from the distributed digital identity system through the client or the access control entity, and the access control entity should customize and publish its own credential template and send it to the distributed digital identity system; and the distributed digital identity system can provide visual digital identity management, credential template management and verifiable credential management for users and access control entities by integrating the digital identity contract, credential management contract and credential verification contract of the blockchain network. Furthermore, after the digital identity and the corresponding verifiable credentials are generated by the digital identity contract and credential management contract in the blockchain network, the corresponding verifiable credentials can be issued to the user's client through the distributed digital identity system.

[0052] Furthermore, the digital identity management contract in the blockchain network can receive requests from the distributed digital identity system, receive the digital identity document specification data of the applicant (user or access control subject), and generate the corresponding DID identity for the applicant. Each DID identity will have a DID identifier, which consists of a prefix (did:cid:) and a globally unique code. The calculation formula for the DID identifier is as follows: did_id="did:cid:"+base58_encode(ripemd160_encode({context, publicKey, authentication, recovery})); Specifically, the DID document specification data structure is as follows:

[0053] {

[0054] "version": "1",

[0055] "@context": "https: / / w3id.org / did / v1",

[0056] "id": "did:cid:3VibZhuzB8iDBNgUdwKieEh5zxNTxevnEUJPiNXWHxdHVNG5smSK816",

[0057] "keyPairs": [

[0058] {

[0059] "id": "did:cid:3VibZhuzB8iDBNgUdwKieEh5zxNTxevnEUJPiNXWHxdHVNG5smSK816#keys-1",

[0060] "publicKeyHex": "01340da8e86e41761f0fd2c5958f9a96a4ed146184708da14d81771fb5285f5a78",

[0061] "type": "Sm2p256v1"

[0062] }

[0063] ],

[0064] "authentication": [

[0065] "did:cid:3VibZhuzB8iDBNgUdwKieEh5zxNTxevnEUJPiNXWHxdHVNG5smSK816#keys-1"

[0066] ],

[0067] "proof": {

[0068] "creator": "did:cid:3VibZhuzB8iDBNgUdwKieEh5zxNTxevnEUJPiNXWHxdHVNG5smSK816#keys-1",

[0069] "signatureValue": "3046022100c6eb0b934549ee073aa698520ada1d5aaa0289f5bb38d",

[0070] "type": "Sm2p256v1"

[0071] },

[0072] "service": [

[0073] {

[0074] "id": "did:cid:3VibZhuzB8iDBNgUdwKieEh5zxNTxevnEUJPiNXWHxdHVNG5smSK816#resolver",

[0075] "serviceEndpoint": "http: / / localhost:8080 / v1 / did / resolve",

[0076] "type": "DIDResolve"

[0077] }

[0078] ],

[0079] "created": "2024-04-11 09:59:02",

[0080] "updated": "2024-04-11 09:59:02"

[0081] }

[0082] Among them, id: DID identity unique identifier; keyPairs: maintain the key list of DID, including: key ID, public key, key algorithm; authentication: authentication method, maintain the key ID maintained in keyPairs; service: maintain the distributed digital identity system service terminal; proof: DID digital signature, use the user's private key to sign the other parts of the DID document to get the digital signature string (signatureValue = sm2.Sign(privateKey, did_document)), type indicates the signature algorithm, creator specifies the key ID used for the signature. In addition, the digital identity management contract can also be used for DID cancellation and DID key update. Specifically, the process of canceling a digital identity first receives the DID cancellation request from the DID System, verifies whether the request signature is valid, and determines the DID holder's authority, and then deletes the relevant DID from the DID registry; accordingly, the DID key update is mainly to ensure security, and users should regularly update the key of the DID identity; it also receives the DID key update request from the DID System, verifies the request signature, determines the DID holder's authority, and updates the DID registry.

[0083] Correspondingly, the credential management contract in the blockchain network can be used to manage the credential templates of the access control subject and generate verifiable credentials; template management is specifically used to identify and manage the types of different credential templates. According to the defined templates, verifiable credentials VC of various specific formats and data structures can be issued. It can be understood that the verifiable credential VC is the proof of the user's access to the access control. Each access control subject can customize the credential template for multiple access control and specify the user information that the user needs to provide (such as name, address, etc.) in order to generate multiple digital identity certificates (i.e., verifiable credentials VC) for the user for different access control; the VC data structure is as follows:

[0084] {

[0085] "@context": [

[0086] "https: / / www.w3.org / 2018 / credentials / v1"

[0087] ],

[0088] "id": "c2dfc7fc-dc54-4dde-bec4-e2f398d4d70e",

[0089] "cptId": "85b072f5-e7b6-40f2-adaa-8c21cda9f5f1",

[0090] "type": "lite",

[0091] "issuer": "did:cid:3bTV1HzGCjzMGzFnwVnqsRSfQpFedzty6qehYtd4ZMKByWFHvCZvvCB",

[0092] "proof": {

[0093] "creator": "did:cid:3bTV1HzGCjzMGzFnwVnqsRSfQpFedzty6qehYtd4ZMKByWFHvCZvvCB / 1",

[0094] "signatureValue": "3045022002b3138bbac4f1d77692acd5d5cb63fa8cf117e96ac64dd71f25f914b91e7c35022100e18f89beb38cb0f77a3a4c262f59cbd9d72b20eaab91561369a1ddf49c4cdba6",

[0095] "type": "Sm2p256v1"

[0096] },

[0097] "revocation": {

[0098] "id": "http: / / localhost:8080 / v1 / credential / revocation",

[0099] "type": "SimpleRevocationListV1"

[0100] },

[0101] "credentialSubject": {

[0102] "claims": "{\"name\":\"Zhang San\",\"address\":\"Unit 1, Building 2, Room 201\",\"area\":\"XXX Community\"}",

[0103] "id": "did:cid:5zJ7kjhmyJXFtFQ7Y7LA1SyvVrdsH3VEk2tTUi5X6oi5obYzwm71F71"

[0104] },

[0105] "expirationDate": "2024-05-29T10:27:15Z",

[0106] "issuanceDate": "2024-04-29T10:27:15Z",

[0107] }

[0108] Among them, claims: credential declaration, maintain user attributes. Each enterprise organization can define a credential template that meets its own business and write it into the blockchain. When a user applies for a credential, he fills in the user information according to the user attribute fields defined in the credential template; id: credential unique ID; cptId: credential template ID; expirationDate: credential expiration timestamp; issueDate: issuance timestamp; issuer: issuing authority (access control entity) DID; proof: proof information, signature information for verifiable credential declaration. It can be understood that the credential verification contract in the blockchain network can realize the validity verification of the verifiable credential VC. The specific verification process may include VC verifiable credential format verification. VC should comply with the format of the w3c (World Wide Web Consortium) did verifiable credential, whether it contains @context, id, type, issuer and other attributes; expire_check: check the expirationDate attribute to verify whether the VC has expired; issuer_check: according to the issuer attribute, obtain the information of the issuer (access control subject) and verify the validity of VC with it; signature_check: obtain the signatureValue (signature) attribute and type (signature algorithm, this embodiment can use the SM2 national secret signature algorithm) in the proof information, and verify the validity of the signature according to the signature algorithm through the issuer public key obtained by the issuer; the final verification result can be obtained through verification of these steps.

[0109] In a specific embodiment, the user's digital identity client can implement digital identity management, credential template management, VC management, and storage of personal private keys by calling the distributed digital identity service interface. Specifically, the user and the access control subject register their respective DID identities. The user is the end user, and the access control subject is responsible for defining the credential template and issuing verifiable credentials VC to the user based on the credential template; the user or the access control subject generates an asymmetric key pair of the SM2 national secret algorithm offline, calls the DID System interface to generate a DID document, and then uses the private key saved by the client to sign the DID document, and merges the signature into the DID document; finally, the DID System interface is called, and the signed DID document is passed in as a parameter to register and generate a DID identity. Furthermore, each access control can customize different access control credential templates, so that different verifiable credentials VC can be issued to users for each access control, realizing more fine-grained access control authority control; the credential template defines the user's personal declaration information (such as name, address, community address, etc.) that the user needs to provide. Correspondingly, users can call the DID System interface through the access control entity or through the client, fill in personal information according to the credential template requirements, and apply for verifiable credentials VC. After the access control entity reviews and approves it, the DID System will issue VC to the user.

[0110] It is understandable that when a user requests to enter the access control area, a request can be sent to the access control controller through the digital identity client, and the client stores the verifiable credentials VC issued by the access control entity. After receiving the user request, the access control controller initiates a VC verification request to the credential verification contract of the blockchain network, and determines whether the VC is valid based on the returned verification result: if the VC verification is valid, the access control controller performs the door opening operation; if the verification VC is invalid, the door is refused to be opened. Among them, the access control controller is an access control system based on blockchain and distributed digital identity system, which controls the access control switch by reading the validity of the verifiable credentials (VC) presented by the user.

[0111] In this way, this application combines blockchain and distributed digital identity to provide each user corresponding to the access control controller with an autonomous and controllable digital identity, avoiding the identity data being controlled by a single centralized authority, and improving the security and credibility of the access control; and users can manage their own identities independently through the client, increasing the flexibility and controllability of the identity. Furthermore, the openness and transparency of the blockchain network allows anyone to view and verify identity information, improving the credibility of identity information. At the same time, due to the full traceability of the blockchain, violations can be traced and held accountable. In addition, this application can protect the user's personal privacy information through encryption and key control, avoid information leakage and unauthorized use, and improve the controllability and security of identity information.

[0112] like Figure 4 As shown, the embodiment of the present application discloses an access control device, which is applied to an access controller. The access controller is a controller based on a distributed digital identity system and a blockchain network, including:

[0113] The access control verification request acquisition module 11 is used to obtain the access control verification request initiated by the digital identity client; the digital identity client is a client including a digital identity generated by the digital identity management contract of the blockchain network, and the access control verification request includes a verifiable credential issued by the credential management contract of the blockchain network;

[0114] The verification module 12 is used to initiate a verification request to the credential verification contract of the blockchain network based on the access control verification request, and determine whether to perform a door opening operation according to a corresponding verification result.

[0115] It can be seen that this application combines blockchain and distributed digital identity to provide each user corresponding to the access control controller with an autonomous and controllable digital identity, thereby improving the controllability and security of identity information.

[0116] In a specific embodiment, the device may include:

[0117] An identity integration module is used to send the locally stored digital identity document specification data to the digital identity management contract of the blockchain network, so that the digital identity management contract generates a digital identity for the identity generation request received by the distributed digital identity system according to the digital identity document specification data, so as to integrate the digital identity into the corresponding client to obtain a digital identity client; the digital identity document specification data is the document specification data constructed by the user's client and the access control subject.

[0118] In a specific embodiment, the identity integration module may include:

[0119] The identity integration submodule is used for the digital identity management contract to generate a corresponding digital identity according to the identity generation request received by the distributed digital identity system, and to generate a verifiable credential for the target user through the credential management contract, so as to integrate the digital identity and the verifiable credential into the client and obtain the digital identity client corresponding to the target user; the identity generation request is a request for the target user initiated by the access control subject or the client to the distributed digital identity system.

[0120] In a specific embodiment, the identity integration submodule may include:

[0121] A digital identity generation unit is used for the digital identity management contract to obtain the signed request sent by the distributed digital identity system, and to register and generate a corresponding digital identity according to the signed request; the signed request is a request obtained by the distributed digital identity system after receiving the identity generation request sent by the client, using the key corresponding to the client in the digital identity document specification data to sign the identity generation request.

[0122] In a specific embodiment, the identity integration submodule may include:

[0123] A credential generation unit is used to determine the credential template corresponding to the access control controller through the credential management contract, and obtain user information of the target user that matches the credential template through the credential management contract, so as to generate a verifiable credential for the target user based on the user information and the corresponding digital identity.

[0124] In a specific embodiment, the device may further include:

[0125] A key update request acquisition module, used to obtain key update requests initiated by each digital identity client through the digital identity management contract;

[0126] The key update module is used to verify the digital identity of each digital identity client through the credential verification contract, and update the key corresponding to each digital identity client after the verification is passed, so as to manage the digital identity of each digital identity client based on the updated key.

[0127] In a specific embodiment, the verification module 12 may include:

[0128] A verification unit, configured to initiate a verification request to a credential verification contract of the blockchain network based on the access control verification request, so that the credential verification contract verifies the format and attributes of the verifiable credential and obtains a corresponding verification result;

[0129] A first determination unit, configured to allow a door opening operation to be performed when the verification result indicates that the verification is passed;

[0130] The second determination unit is configured to, when the verification result indicates that the verification has failed, not allow the door opening operation to be performed and trigger a prompt message indicating that the verification has failed.

[0131] Furthermore, the present application also discloses an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0132] Figure 5A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the access control method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0133] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0134] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0135] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the access control method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0136] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed access control method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0137] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0138] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0139] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0140] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0141] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A door access control method, characterized in that: Applied to an access controller, which is a controller based on a distributed digital identity system and a blockchain network, including: Obtaining a door access verification request initiated by a digital identity client; the digital identity client is a client including a digital identity generated by a digital identity management contract of the blockchain network, and the door access verification request includes a verifiable credential issued by a credential management contract of the blockchain network; Based on the access control verification request, a verification request is initiated to the credential verification contract of the blockchain network, and whether to perform the door opening operation is determined according to the corresponding verification result.

2. The access control method according to claim 1, characterized in that: Before obtaining the access control verification request initiated by the digital identity client, the method further includes: The locally stored digital identity document specification data is sent to the digital identity management contract of the blockchain network, so that the digital identity management contract generates a digital identity for the identity generation request received by the distributed digital identity system according to the digital identity document specification data, so as to integrate the digital identity into the corresponding client to obtain a digital identity client; the digital identity document specification data is the document specification data constructed by the user's client and the access control entity.

3. The access control method according to claim 2, characterized in that: The digital identity management contract generates a corresponding digital identity according to the identity generation request received by the distributed digital identity system, so as to integrate the digital identity into the corresponding client to obtain a digital identity client, including: The digital identity management contract generates a corresponding digital identity according to the identity generation request received by the distributed digital identity system, and generates a verifiable credential for the target user through the credential management contract, so as to integrate the digital identity and the verifiable credential into the client and obtain the digital identity client corresponding to the target user; the identity generation request is a request for the target user initiated by the access control entity or the client to the distributed digital identity system.

4. The access control method according to claim 2, characterized in that: The digital identity management contract generates a corresponding digital identity according to the identity generation request received by the distributed digital identity system, including: The digital identity management contract obtains the signed request sent by the distributed digital identity system, and registers and generates a corresponding digital identity according to the signed request; the signed request is a request obtained by the distributed digital identity system after receiving the identity generation request sent by the client, using the key corresponding to the client in the digital identity document specification data to sign the identity generation request.

5. The access control method according to claim 3, characterized in that: Generating a verifiable credential for a target user through the credential management contract includes: The credential template corresponding to the access controller is determined through the credential management contract, and the user information of the target user that matches the credential template is obtained through the credential management contract to generate a verifiable credential for the target user based on the user information and the corresponding digital identity.

6. The access control method according to claim 4, characterized in that: Also includes: Obtaining a key update request initiated by each digital identity client through the digital identity management contract; The digital identity of each digital identity client is verified through the credential verification contract, and the key corresponding to each digital identity client is updated after the verification is passed, so as to manage the digital identity of each digital identity client based on the updated key.

7. The access control method according to any one of claims 1 to 6, characterized in that: The method of initiating a verification request to the credential verification contract of the blockchain network based on the access control verification request, and determining whether to perform a door opening operation according to a corresponding verification result, includes: Initiating a verification request to the credential verification contract of the blockchain network based on the access control verification request, so that the credential verification contract verifies the format and attributes of the verifiable credential and obtains a corresponding verification result; If the verification result indicates that the verification is passed, the door opening operation is allowed; If the verification result indicates that the verification has failed, the door opening operation is not allowed, and a prompt message indicating that the verification has failed is triggered.

8. An access control device, characterized in that: Applied to an access controller, which is a controller based on a distributed digital identity system and a blockchain network, including: An access control verification request acquisition module is used to obtain an access control verification request initiated by a digital identity client; the digital identity client is a client including a digital identity generated by a digital identity management contract of the blockchain network, and the access control verification request includes a verifiable credential issued by a credential management contract of the blockchain network; A verification module is used to initiate a verification request to the credential verification contract of the blockchain network based on the access control verification request, and determine whether to perform a door opening operation according to a corresponding verification result.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the access control method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, implements the access control method according to any one of claims 1 to 7.

Images