Electronic license data protection method and device, storage medium and electronic equipment

Abstract

The invention relates to the technical field of data security, and particularly provides an electronic license data protection method and device, a storage medium and electronic device.The method can comprise the steps that a corresponding Merkel tree is generated based on user attribute data in an electronic license to be signed and issued, the user attribute data comprises user privacy data and user right data, and the Merkel tree comprises a root hash value of a root node related to the user attribute data and hash values of a plurality of child nodes; content in the electronic certificate to be signed and issued is signed, a signature value is obtained, and the content comprises a user identity label and all nodes in the Merkel tree; and generating a user electronic certificate at least containing the user identity identifier, the root hash value and the signature value. Some embodiments of the application can ensure the data security of the electronic license.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and more specifically, to a method, device, storage medium and electronic device for protecting electronic certificate data. Background Art

[0002] Electronic certificates refer to various electronic certification documents issued by authoritative institutions in accordance with the law that have the same legal effect as paper certificates, such as identity cards, household registers, driver's licenses, business licenses, etc. Electronic certificates clearly represent the identity information, rights and interests enjoyed by the owner of the electronic certificate, and other private data such as preferential policies. Currently, electronic certificates are publicly released and can be obtained by other entities through public means. At the same time, electronic certificates are transmitted in plain text on the Internet. Based on this, the user's private data is at risk of being spread or even maliciously collected and used.

[0003] At present, the data privacy protection of electronic certificates is mainly achieved through technologies such as digital signatures and data watermarks. However, due to the lack of reasonable access control rules for electronic certificates, any user can use the issuer's electronic certificate to easily obtain the original data, resulting in the leakage of user privacy data.

[0004] Therefore, how to provide a more secure technical solution for the method of protecting electronic certificate data has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The purpose of some embodiments of the present application is to provide a method, device, storage medium and electronic device for protecting electronic certificate data. The technical solutions of the embodiments of the present application can improve the security of electronic certificate data and reduce the risks of leakage and theft.

[0006] In a first aspect, some embodiments of the present application provide a method for protecting electronic certificate data, comprising: generating a corresponding Merkle tree based on user attribute data in the electronic certificate to be issued, wherein the user attribute data includes: user privacy data and user rights and interests data, and the Merkle tree includes a root hash value of a root node and hash values ​​of multiple child nodes related to the user attribute data; signing the content in the electronic certificate to be issued to obtain a signature value, wherein the content includes: a user identity and all nodes in the Merkle tree; generating a user electronic certificate containing at least the user identity, the root hash value and the signature value.

[0007] Some embodiments of the present application calculate the user attribute data in the electronic certificate to be issued step by step, generate a Merkle tree on the electronic certificate to be issued, then sign the content in the electronic certificate to be issued to obtain a signature value, and finally generate the corresponding user electronic certificate through the signature value, the root hash value in the Merkle tree and the user identity. Some embodiments of the present application process user attribute data and generate user electronic certificates based on the Merkle tree method, which can improve the security of electronic certificate data, effectively prevent data from being tampered with and lost, and reduce the risk of leakage and theft during transmission.

[0008] In some embodiments, the generating of the corresponding Merkle tree based on the user attribute data in the electronic certificate to be issued includes: calculating each user attribute data in the user attribute data to obtain hash values ​​of multiple first-level child nodes, wherein the one user attribute data corresponds to one child node; based on the multiple first-level child nodes, calculating adjacent child nodes step by step until the root hash value is obtained, thereby generating the Merkle tree.

[0009] Some embodiments of the present application achieve secure data processing by calculating user attribute data level by level to generate a Merkle tree.

[0010] In some embodiments, the user electronic certificate also includes: hash values ​​of the multiple child nodes in the Merkle tree.

[0011] Some embodiments of the present application provide data support for subsequent third-party verification of the user's electronic certificate by storing hash values ​​of all child nodes of the Merkle tree in the user's electronic certificate.

[0012] In some embodiments, before signing the content of the electronic certificate to be issued to obtain the signature value, the method further includes: sending hash values ​​of the multiple child nodes in the Merkle tree to the user end, wherein the hash values ​​of the multiple child nodes are used to assist a third party in verifying the user's electronic certificate.

[0013] Some embodiments of the present application can improve data security by storing hash values ​​of all child nodes of the Merkle tree on the user side, and provide data support for subsequent third-party verification of user electronic certificates.

[0014] In the second aspect, some embodiments of the present application provide a method for protecting electronic certificate data, including: calculating the collected characteristic information of the user to obtain a characteristic hash value; calculating the characteristic hash value and the hash values ​​of some sub-nodes on the user's electronic certificate to obtain a hash value to be verified, wherein the hash value to be verified includes: a root hash value to be verified and a hash value of an intermediate node to be verified; the user's electronic certificate is obtained by an electronic certificate issuing system executing any method embodiment in the first aspect; sending the hash value to be verified to the electronic certificate issuing system, so that the electronic certificate issuing system can confirm the verification result of the user by verifying the hash value to be verified.

[0015] Some embodiments of the present application obtain the hash value to be verified through the user's characteristic information and the hash value of some sub-nodes, so that the electronic certificate issuance system can verify the hash value to be verified and determine whether the user's verification result is passed. Some embodiments of the present application can achieve the purpose of protecting the privacy of the user's personal information in the electronic certificate by verifying the identity through the hash calculation of the private information without affecting the normal use of the electronic certificate.

[0016] In some embodiments, the hash values ​​of some sub-nodes on the user's electronic certificate are obtained by: after identifying the user's electronic certificate, reading the hash values ​​of some sub-nodes from the user's electronic certificate; or, receiving the hash values ​​of some sub-nodes sent by the user terminal.

[0017] Some embodiments of the present application are flexible in implementation by reading hash values ​​of some sub-nodes from the user's electronic certificate or obtaining them from the user end.

[0018] In some embodiments, the step of calculating the characteristic hash value and the hash values ​​of some sub-nodes on the user's electronic certificate to obtain the hash value to be verified includes: performing hash calculation on the characteristic hash value and the hash values ​​of some sub-nodes according to preset authentication rules to obtain the hash value to be verified.

[0019] Some embodiments of the present application calculate through preset authentication rule related data to obtain the hash value to be verified, which can achieve accurate and secure verification of the user's electronic certificate.

[0020] In a third aspect, some embodiments of the present application provide a device for protecting electronic certificate data, comprising: a generation module for generating a corresponding Merkle tree based on user attribute data in the electronic certificate to be issued, wherein the user attribute data includes: user privacy data and user rights and interests data, and the Merkle tree includes a root hash value of a root node related to the user attribute data and hash values ​​of multiple child nodes; a digital signature module for signing the content in the electronic certificate to be issued to obtain a signature value, wherein the content includes: a user identity and all nodes in the Merkle tree; a certificate generation module for generating a user electronic certificate containing at least the user identity, the root hash value and the signature value.

[0021] In a fourth aspect, some embodiments of the present application provide a device for protecting electronic certificate data, comprising: a feature processing module, used to calculate the collected feature information of the user to obtain a feature hash value; a calculation module, used to calculate the feature hash value and the hash values ​​of some sub-nodes on the user's electronic certificate to obtain a hash value to be verified, wherein the hash value to be verified includes: a root hash value to be verified and a hash value of an intermediate node to be verified; the user's electronic certificate is obtained by an electronic certificate issuing system executing a method as described in any method embodiment of the first aspect; a verification module, used to send the hash value to be verified to the electronic certificate issuing system, so that the electronic certificate issuing system can confirm the verification result of the user by verifying the hash value to be verified.

[0022] In a fifth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0023] In a sixth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement a method as described in any embodiment of the first aspect.

[0024] In a seventh aspect, some embodiments of the present application provide a computer program product, wherein the computer program product comprises a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0026] Figure 1 A system diagram for protecting electronic certificate data provided by some embodiments of the present application;

[0027] Figure 2 One of the flow charts of the method for protecting electronic certificate data provided in some embodiments of the present application;

[0028] Figure 3 A schematic diagram of a Merkle tree structure provided for some embodiments of the present application;

[0029] Figure 4 One of the schematic diagrams of user electronic certificates provided in some embodiments of the present application;

[0030] Figure 5 A second schematic diagram of a user electronic certificate provided for some embodiments of the present application;

[0031] Figure 6 A second flow chart of a method for protecting electronic certificate data provided in some embodiments of the present application;

[0032] Figure 7 A flowchart of a method for issuing user electronic certificates provided in some embodiments of the present application;

[0033] Figure 8 A flow chart of a method for using a user's electronic certificate provided in some embodiments of the present application;

[0034] Fig. 9 One of the block diagrams of the device for protecting electronic certificate data provided in some embodiments of the present application;

[0035] Fig.10 The second block diagram of the device for protecting electronic certificate data provided in some embodiments of the present application;

[0036] Fig.11 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0037] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0038] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0039] Electronic certificates refer to various electronic certification documents issued by authoritative institutions in accordance with the law and with the same legal effect as paper certificates. Electronic certificates can not only effectively reduce the use of paper materials, but also effectively break through the limitations of time and space, making it convenient for enterprises and individuals to review and use them multiple times, and reducing the burden of storage and carrying for certificate holders. At the same time, electronic certificates can also provide accurate and comprehensive information for certificate users. Nowadays, electronic certificates have increasingly become the main electronic credentials for market entities and citizen activities, and are also important basic data to support social service operations.

[0040] Traditional methods of protecting electronic certificate information often rely on centralized servers for data storage and management, which leads to serious challenges to the reliability and accessibility of data. Since data is stored in a single node, once a single point of failure or malicious attack occurs, it may lead to data loss or tampering, thereby threatening the integrity and security of electronic certificate information. Moreover, existing electronic certificate information encryption methods often use a single encryption algorithm. Although the confidentiality of data is guaranteed to a certain extent, there is still a risk of being cracked. Especially during data transmission and storage, the security of data cannot be fully guaranteed and is prone to malicious attacks and theft.

[0041] It can be seen from the above-mentioned related technologies that the security protection of electronic certificate information in the existing technology needs to be improved.

[0042] In view of this, some embodiments of the present application provide a method for protecting electronic certificate data, which is based on the Merkle tree to protect the privacy of personal information in electronic certificates. The method calculates each user attribute data in the electronic certificate issued on behalf of the user, obtains the hash values ​​of multiple first-level child nodes, and then calculates the adjacent child nodes again to obtain the hash values ​​of the intermediate child nodes, and so on until the root hash value is obtained to form a Merkle tree. Then the Merkle tree is signed to obtain the signature value. Finally, a user electronic certificate containing at least the signature value, the root hash value and the user identity is generated. When the user subsequently uses the user's electronic certificate, the disclosure of unnecessary privacy information on the electronic certificate can be reduced by proving the privacy information, thereby achieving the purpose of protecting the privacy of the user's electronic certificate personal information. Some embodiments of the present application can realize the safe issuance and use of user electronic certificates, reducing the risk of malicious attacks and theft.

[0043] The following is combined with Figure 1The overall composition structure of the system for protecting electronic certificate data provided by some embodiments of the present application is exemplified.

[0044] like Figure 1 As shown, some embodiments of the present application provide a system for protecting electronic certificate data, and the system for protecting electronic certificate data includes: a user terminal 100, an electronic certificate issuing system 200, and a third party 300. Among them, the user of the user terminal 100 can send an electronic certificate application to the electronic certificate issuing system 200. After the electronic certificate issuing system 200 verifies the user's identity, it can generate a corresponding user electronic certificate for it and complete the issuance of the electronic certificate. When the user needs to use the user's electronic certificate on the third party 300, the third party 300 can collect the user's feature information, and then generate a hash value to be verified in combination with the relevant verification information on the electronic certificate, and send it to the electronic certificate issuing system 200. The electronic certificate issuing system 200 can verify the hash value to be verified, obtain the verification result and feedback it to the third party 300. The third party 300 determines whether the user's electronic certificate is successfully authenticated based on the verification result.

[0045] In some embodiments of the present application, the electronic certificate issuance system 200 can be deployed on a terminal, and the type of the terminal is not specifically limited here. The third party 300 can be a relying party that needs to use an electronic certificate, and the specific business type that it can handle can be determined by the actual scenario, and the embodiments of the present application are not specifically limited here.

[0046] The following is combined with Figure 2 The implementation process of the electronic certificate data protection performed by the electronic certificate issuance system 200 provided by some embodiments of the present application is exemplified. Before executing the following method, the user terminal 100 first sends a request for the issuance of an electronic certificate to the electronic certificate issuance system 200. After receiving the request, the electronic certificate issuance system 200 verifies the identity of the user and confirms that the user identity verification has passed. Among them, the method for verifying the user identity can be user information upload, face recognition, SMS verification code, etc., which is not specifically limited in the embodiments of the present application.

[0047] Please see attached Figure 2 , Figure 2 A flow chart of a method for protecting electronic certificate data is provided for some embodiments of the present application. The method for protecting electronic certificate data may include:

[0048] S210, generating a corresponding Merkle tree based on the user attribute data in the electronic certificate to be issued, wherein the user attribute data includes: user privacy data and user rights data, and the Merkle tree includes a root hash value of a root node related to the user attribute data and hash values ​​of multiple child nodes.

[0049] For example, in some embodiments of the present application, the electronic certificate issuance system 200 calculates each user sensitive attribute (as a specific example of user privacy data) and the preferential rights enjoyed (as a specific example of user rights data) contained in the main data packet extension field of the electronic certificate to be issued by calling the internal Merkle tree generation module, and generates a corresponding Merkle tree. User sensitive attributes may include: user's name, certificate number, address, age, facial information, etc. Preferential rights may include a variety of rights that users can enjoy. For example, a fixed group of people can visit for free with their identity documents.

[0050] In some embodiments of the present application, S210 may include: calculating each piece of user attribute data in the user attribute data to obtain hash values ​​of multiple first-level child nodes, wherein the piece of user attribute data corresponds to one child node; based on the multiple first-level child nodes, calculating adjacent child nodes step by step until the root hash value is obtained, thereby generating the Merkle tree.

[0051] For example, in some embodiments of the present application, Figure 3 The Merkle tree generation process shown in the figure. First, each user sensitive attribute (i.e. Figure 3 The attribute information in the hash function) and the preferential rights 1 and preferential rights 2 enjoyed are hashed to obtain the first-level hash leaf (as a specific example of the hash values ​​of multiple first-level child nodes) Hi = hash (AttrValue i) (i = 1, 2, 3, 4 ...), that is, Figure 3 Then, the adjacent nodes in the first-level hash leaf are hashed to obtain the second-level hash leaf (i.e. Figure 3 The second-level nodes in the table are H8~H11, and so on, the third-level nodes H12 and H13 are obtained, until the root hash value H of the root node H14 is obtained. Through the above step-by-step calculation, Figure 3 The Merkle tree shown in Figure 1. All nodes of the Merkle tree are on the content of the electronic certificate to be issued.

[0052] S220, signing the content of the electronic certificate to be issued to obtain a signature value, wherein the content includes: a user identity and all nodes in the Merkle tree.

[0053] For example, in some embodiments of the present application, after the data in the main data packet extension field of the electronic certificate to be issued is subjected to the above-mentioned hash processing, the user's personal identification ID (as a specific example of the user identification) and Figure 3 The hash values ​​of all nodes in the Merkle tree are digitally signed to obtain a signature value. The algorithm of the digital signature can be flexibly selected according to the needs, and the embodiment of the present application is not limited here.

[0054] S230, generating a user electronic certificate containing at least the user identity, the root hash value and the signature value.

[0055] For example, in some embodiments of the present application, a final user electronic certificate is generated after completing the digital signature. Figure 4 The user electronic certificate shown in the figure includes: personal identity ID, root hash value H (i.e. Figure 4 The root hash H in the electronic certificate issuance system (i.e. Figure 4 in ).

[0056] In some embodiments of the present application, before executing S220, the method for protecting electronic certificate data also includes: sending hash values ​​of the multiple child nodes in the Merkle tree to the user terminal, wherein the hash values ​​of the multiple child nodes are used to assist a third party in verifying the user's electronic certificate.

[0057] For example, in some embodiments of the present application, since the final generated electronic certificate only has a root hash value, but the hash values ​​of some of the user's child nodes are required when the user's electronic certificate is used subsequently, the electronic certificate issuance system 200 can send the hash values ​​of several child nodes for subsequent verification to the user terminal 100 (as a specific example of the hash values ​​of multiple child nodes). The user terminal 100 stores the hash values ​​of the several child nodes through its own digital identity wallet. When using the electronic certificate, the user terminal 100 can decide which nodes' hash values ​​to send to the third party 300 for verification.

[0058] In some other embodiments of the present application, the user electronic certificate also includes: hash values ​​of multiple child nodes in the Merkle tree.

[0059] For example, in other embodiments of the present application, Figure 5 In the user electronic certificate shown, the certificate content of the user electronic certificate also includes: name, certificate number, address, age, facial information, hash values ​​H1~H7 corresponding to preferential rights 1 and preferential rights 2, as well as intermediate nodes H8~H13 and root node H14.

[0060] After completing the issuance of the above-mentioned user electronic certificate, Figure 6 The implementation process of electronic certificate data protection performed by the third party 300 provided in some embodiments of the present application is exemplified. The following exemplification is made with the third party 300 as the relying party.

[0061] Please see attached Figure 6 , Figure 6A flow chart of a method for protecting electronic certificate data provided in some embodiments of the present application, the method for protecting electronic certificate data includes:

[0062] S610, calculating the collected user feature information to obtain a feature hash value.

[0063] For example, in some embodiments of the present application, when a user uses an electronic certificate, it is necessary to obtain the user's facial information (as a specific example of feature information) through the relying party's biometric recognition device or by scanning a code. The relying party calculates the feature hash value HM=hash(M) of the collected facial information.

[0064] S620, calculating the characteristic hash value and the hash values ​​of some subnodes on the user's electronic certificate to obtain a hash value to be verified, wherein the hash value to be verified includes: a root hash value to be verified and a hash value of an intermediate node to be verified.

[0065] For example, in some embodiments of the present application, Figure 3 Taking the Merkle tree shown as an example, HM and the known H6, H11 and H12 on the user's electronic certificate (as a specific example of the hash value of some child nodes) are calculated to obtain H10', H13' (as a specific example of the hash value of the intermediate node to be verified) and H' (as a specific example of the root hash value to be verified).

[0066] In some embodiments of the present application, S620 may include: performing hash calculation on the characteristic hash value and the hash values ​​of the part of the sub-nodes according to a preset authentication rule to obtain the hash value to be verified.

[0067] For example, in some embodiments of the present application, based on the preset authentication rules of the relying party, the hash values ​​of other hash sub-leaves required for authentication are calculated step by step until the root hash H' is obtained. For example, one calculation method is as follows:

[0068] H10'=hash(HM+H6);

[0069] H13'=hash(H10'+H11);

[0070] H'=hash(H13'+H12).

[0071] Among them, the preset authentication rules can be based on Figure 2 The hash algorithm used in the method embodiment shown is adaptively set and is not specifically limited in the embodiment of the present application.

[0072] In some embodiments of the present application, the hash values ​​of some sub-nodes on the user's electronic certificate are obtained by the following method: after identifying the user's electronic certificate, the hash values ​​of some sub-nodes are read from the user's electronic certificate; or, the hash values ​​of some sub-nodes are received from the user terminal.

[0073] For example, in some embodiments of the present application, Figure 4 In the case of the user's electronic certificate shown in the figure, the hash values ​​of several child nodes in the Merkle tree that can be used for verification (that is, the hash values ​​of some child nodes) are stored in the user terminal 100. At this time, the user terminal 100 can send the hash values ​​of several child nodes to the relying party for subsequent calculation and verification. Figure 5 Taking the user's electronic certificate as an example, the hash values ​​of several child nodes in the Merkle tree that can be used for verification are in the certificate content of the user's electronic certificate. At this time, the hash values ​​of the corresponding part of the child nodes can be read after the user's electronic certificate is identified. In actual application scenarios, which method to use can be selected according to specific circumstances, and the embodiments of this application are not specifically limited here.

[0074] S630: Send the hash value to be verified to the electronic certificate issuing system, so that the electronic certificate issuing system can confirm the verification result of the user by verifying the hash value to be verified.

[0075] For example, in some embodiments of the present application, the relying party sends the hash values ​​H10', H13' and H' to be verified to the electronic certificate issuing system 200. The electronic certificate issuing system 200 calls the authentication module and verifies step by step to the root node according to the established preset authentication rules. If H' and H are known, the verification result is authentication passed, otherwise the authentication fails. Finally, the relying party receives the verification result fed back by the electronic certificate issuing system 200 and displays or informs the user. If the user passes the authentication, the authenticity of the entity identity of the user's electronic certificate and the preferential rights enjoyed are proved.

[0076] It should be noted that the algorithm used in the hash calculation involved in the above embodiments of the present application can be flexibly selected, and the embodiments of the present application are not specifically limited here.

[0077] It should be understood that the method for protecting electronic certificate data provided in this application can be applied to different electronic certificate application scenarios (for example, face recognition, card swiping, scanning code to fill in information, etc.). There is no need to issue multiple electronic certificates to different relying parties. One electronic certificate can bind identity information and multiple preferential rights. Without affecting the normal use of electronic certificates, it can effectively protect the user's personal attribute information in the electronic certificate from being leaked, and support users to use personal attribute information in different ways according to the usage scenario requirements of different relying parties. Avoid unnecessary privacy leaks. The relying party of the electronic certificate application (such as an information system) can only obtain the personal attribute information required for the current business interaction, and can verify the authenticity of the obtained information to prevent the information from being tampered with or forged.

[0078] The following is combined with Figure 7 The specific process of issuing a user electronic certificate through interaction between the user terminal 100 and the electronic certificate issuing system 200 provided in some embodiments of the present application is exemplified.

[0079] Please see attached Figure 7 , Figure 7 A flow chart of a method for issuing a user electronic certificate is provided for some embodiments of the present application.

[0080] The above process is explained below as an example.

[0081] S710, the client 100 sends a certificate application for an electronic certificate to the electronic certificate issuing system 200;

[0082] S720, the electronic certificate issuing system 200 confirms that the identity verification of the user terminal 100 is successful;

[0083] S730, the electronic certificate issuing system 200 generates a corresponding Merkle tree based on the user attribute data in the electronic certificate to be issued.

[0084] S740, the electronic certificate issuing system 200 signs the content of the electronic certificate to be issued to obtain a signature value.

[0085] S750, the electronic certificate issuing system 200 generates a user electronic certificate containing a user identity, a root hash value and a signature value.

[0086] S760, the electronic certificate issuing system 200 sends the user electronic certificate to the user terminal 100.

[0087] It is understandable that the specific implementation process of S710 to S760 can refer to the method embodiment provided above, and the detailed description is appropriately omitted here to avoid repetition. In the process of issuing electronic certificates, the hash algorithm and Merkle tree are used to hide the plaintext attribute information on the electronic certificate to be issued, so as to improve data security. Figure 7 In the embodiment shown, the user's electronic certificate only contains the root node of the Merkle tree. In another embodiment, the user's electronic certificate may also contain all the nodes of the entire Merkle tree, and the details may refer to the method embodiment provided above.

[0088] The following is combined with Figure 8 The specific process of using a user's electronic certificate in interaction between a user terminal 100, an electronic certificate issuing system 200 and a third party 300 provided in some embodiments of the present application is exemplified.

[0089] Please see attached Figure 8 , Figure 8 A flow chart of a method for using a user's electronic certificate is provided for some embodiments of the present application.

[0090] The above process is explained below using the preferential rights and interests of users using their electronic certificates as an example.

[0091] S810, the user terminal 100 sends a request to the third party 300 to enjoy preferential rights.

[0092] S820, the third party 300 collects the user's biometric information, and calculates the biometric information to obtain a feature hash value.

[0093] For example, the biometric information may be face information. The third party 300 collects the corresponding biometric information through a biometric recognition device on the local side or by scanning a code.

[0094] S830, the third party 300 obtains hash values ​​of some sub-nodes on the user's electronic certificate.

[0095] S840, the third party 300 calculates the characteristic hash value and the hash values ​​of some child nodes according to the preset authentication rules to obtain the hash value to be verified.

[0096] S850, the third party 300 sends the hash value to be verified to the electronic certificate issuing system 200.

[0097] S860, the electronic certificate issuing system 200 compares the hash value to be verified with the hash value in the Merkle tree to obtain a verification result.

[0098] S870, the electronic certificate issuing system 200 sends the verification result to the third party 300.

[0099] If the verification result is authentication passed, it indicates that the future identity authentication of the user terminal 100 is passed and the user has this preferential right, otherwise, the preferential right is refused to be provided in the future.

[0100] It can be understood that the specific implementation process of S810 to S870 can refer to the method embodiment provided above, and in order to avoid repetition, the detailed description is appropriately omitted here.

[0101] It can be seen from the above embodiments that in the process of using electronic certificates, the relying party only collects one type of personal attribute information required for interaction in the current scenario (that is, the facial information in the above example), and the relying party and the electronic certificate issuance system only need to transmit the hash value of the personal attribute information. The relying party verifies the authenticity of the current user identity and the rights and interests enjoyed by the electronic certificate issuance system based on the verification results. According to the two electronic certificate issuance methods involved in the above embodiments, there are two corresponding verification methods.

[0102] Specifically, the first verification method is: the relying party obtains the user's electronic certificate containing all the nodes of the Merkle tree. Based on the preset authentication rules, the relying party calculates the root hash value H' of the root node according to the attribute plaintext information (i.e., the collected personal attribute information) and the hash value of the node read for verification. The electronic certificate issuance system compares whether H and H' are equal. If they are equal, the authentication is successful, otherwise it fails. The second verification method is: the relying party obtains the user's electronic certificate containing only the root node of the Merkle tree, and obtains the hash values ​​of several nodes for verification from the user end (in this method, the "digital identity wallet" preset by the user end stores the hash values, and the user end decides which hash values ​​to send for verification each time). After receiving the hash values ​​of several nodes, the relying party calculates the root node hash value H' according to the attribute plaintext information and the hash values ​​of several nodes, and compares whether the root node hash values ​​H and H' on the user's electronic certificate are equal. If they are equal, the authentication is successful. Through the above two verification methods, without affecting the normal use of electronic certificates, the purpose of protecting the privacy of user certificate personal information is achieved through the method of privacy information certification.

[0103] Please refer to Fig. 9 , Fig. 9 The block diagram of the electronic certificate data protection device provided by some embodiments of the present application is shown. It should be understood that the electronic certificate data protection device corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the electronic certificate data protection device can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0104] Fig. 9The device for protecting electronic certificate data includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the device for protecting electronic certificate data. The device for protecting electronic certificate data includes: a generation module 910, which is used to generate a corresponding Merkle tree based on user attribute data in the electronic certificate to be issued, wherein the user attribute data includes: user privacy data and user rights and interests data, and the Merkle tree includes a root hash value of a root node related to the user attribute data and hash values ​​of multiple child nodes; a digital signature module 920, which is used to sign the content in the electronic certificate to be issued to obtain a signature value, wherein the content includes: a user identity and all nodes in the Merkle tree; a certificate generation module 930, which is used to generate a user electronic certificate containing at least the user identity, the root hash value and the signature value.

[0105] Please refer to Fig.10 , Fig.10 The block diagram of the electronic certificate data protection device provided by some embodiments of the present application is shown. It should be understood that the electronic certificate data protection device corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the electronic certificate data protection device can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0106] Fig.10 The device for protecting electronic certificate data includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the device for protecting electronic certificate data. The device for protecting electronic certificate data includes: a feature processing module 1010, used to calculate the collected feature information of the user to obtain a feature hash value; a calculation module 1020, used to calculate the feature hash value and the hash values ​​of some sub-nodes on the user's electronic certificate to obtain a hash value to be verified, wherein the hash value to be verified includes: a root hash value to be verified and a hash value of an intermediate node to be verified; a verification module 1030, used to send the hash value to be verified to an electronic certificate issuing system, so that the electronic certificate issuing system can confirm the verification result of the user by verifying the hash value to be verified.

[0107] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0108] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations of the method corresponding to any of the above methods provided in the above embodiments.

[0109] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0110] like Fig.11 As shown, some embodiments of the present application provide an electronic device 1100, which includes: a memory 1110, a processor 1120, and a computer program stored in the memory 1110 and executable on the processor 1120, wherein the processor 1120 can implement a method as described in any of the above embodiments when reading the program from the memory 1110 through a bus 1130 and executing the program.

[0111] Processor 1120 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 1120 can be a microprocessor.

[0112] The memory 1110 may be used to store instructions executed by the processor 1120 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 1120 of the disclosed embodiment may be used to execute instructions in the memory 1110 to implement the method shown above. The memory 1110 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0113] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0114] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0115] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for protecting electronic certificate data, characterized in that: include: Generate a corresponding Merkle tree based on user attribute data in the electronic certificate to be issued, wherein the user attribute data includes: user privacy data and user rights and interests data, and the Merkle tree includes a root hash value of a root node related to the user attribute data and hash values ​​of multiple child nodes; Signing the content of the electronic certificate to be issued to obtain a signature value, wherein the content includes: a user identity and all nodes in the Merkle tree; Generate a user electronic certificate containing at least the user identity, the root hash value and the signature value.

2. The method according to claim 1, characterized in that The generating of the corresponding Merkle tree based on the user attribute data in the electronic certificate to be issued includes: Calculate each piece of user attribute data in the user attribute data to obtain hash values ​​of multiple first-level child nodes, wherein one piece of user attribute data corresponds to one child node; Based on the multiple first-level child nodes, adjacent child nodes are calculated step by step until the root hash value is obtained, and the Merkle tree is generated.

3. The method according to claim 1, characterized in that The user electronic certificate also includes: hash values ​​of the multiple child nodes in the Merkle tree.

4. The method according to claim 1, characterized in that Before signing the content of the electronic certificate to be issued to obtain the signature value, the method further includes: The hash values ​​of the multiple child nodes in the Merkle tree are sent to the user terminal, wherein the hash values ​​of the multiple child nodes are used to assist a third party in verifying the user's electronic certificate.

5. A method for protecting electronic certificate data, characterized in that: include: Calculate the collected user feature information to obtain a feature hash value; Calculate the characteristic hash value and the hash values ​​of some subnodes on the user's electronic certificate to obtain a hash value to be verified, wherein the hash value to be verified includes: a root hash value to be verified and a hash value of an intermediate node to be verified; the user's electronic certificate is obtained by an electronic certificate issuing system executing the method described in any one of claims 1 to 4; The hash value to be verified is sent to the electronic certificate issuing system, so that the electronic certificate issuing system confirms the verification result of the user by verifying the hash value to be verified.

6. The method according to claim 5, characterized in that The hash values ​​of some sub-nodes on the user's electronic certificate are obtained by the following method: After identifying the user's electronic certificate, read the hash value of the part of the sub-nodes from the user's electronic certificate; or, Receive the hash value of the part of the child nodes sent by the user terminal.

7. The method according to claim 5 or 6, characterized in that The step of calculating the characteristic hash value and the hash values ​​of some sub-nodes on the user's electronic certificate to obtain the hash value to be verified includes: According to the preset authentication rules, the characteristic hash value and the hash values ​​of the part of the child nodes are hashed to obtain the hash value to be verified.

8. A device for protecting electronic certificate data, characterized in that: include: A generating module, configured to generate a corresponding Merkle tree based on user attribute data in the electronic certificate to be issued, wherein the user attribute data includes: user privacy data and user rights and interests data, and the Merkle tree includes a root hash value of a root node and hash values ​​of multiple child nodes related to the user attribute data; A digital signature module, used to sign the content of the electronic certificate to be issued to obtain a signature value, wherein the content includes: a user identity and all nodes in the Merkle tree; The certificate generation module is used to generate a user electronic certificate containing at least the user identity, the root hash value and the signature value.

9. A device for protecting electronic certificate data, characterized in that: include: The feature processing module is used to calculate the collected user feature information to obtain a feature hash value; A calculation module, used to calculate the characteristic hash value and the hash values ​​of some subnodes on the user's electronic certificate to obtain a hash value to be verified, wherein the hash value to be verified includes: a root hash value to be verified and a hash value of an intermediate node to be verified; the user's electronic certificate is obtained by an electronic certificate issuing system executing the method described in any one of claims 1 to 4; The verification module is used to send the hash value to be verified to the electronic certificate issuing system, so that the electronic certificate issuing system can confirm the verification result of the user by verifying the hash value to be verified.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program executes the method according to any one of claims 1 to 7 when executed by a processor.

11. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program executes the method according to any one of claims 1 to 7 when being run by the processor.

12. A computer program product, characterized in that The computer program product comprises a computer program, wherein the computer program executes the method according to any one of claims 1 to 7 when executed by a processor.

Images