Distributed digital identity management system and method

Abstract

The invention provides a distributed digital identity management system and method, and relates to the field of block chains. The system comprises a service chain registration module, a user registration module, an information acquisition module, a judgment module and a verification module. A service chain registration module respectively registers a plurality of service chains to a service chain; the user registration module registers the service chain and the plurality of service chains according to the registration information of the user; the information acquisition module acquires to-be-verified information of a user; the judgment module analyzes and judges whether the to-be-verified information needs to be verified by the service chain to obtain a judgment result; and the verification module selects verification between the service chains or verification between the service chains according to the judgment result. According to the method and the device, the service chain and the service chain are independently registered, the verification path is flexibly selected according to different verification requirements, the efficiency and the adaptability of the system are improved, the safety of the management and verification process of the user identity in the distributed environment is ensured, and the verification efficiency is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of blockchain, and in particular to a distributed digital identity management system and method. Background Art

[0002] The distributed digital identity management system is an identity management solution built on blockchain and distributed accounting technology, which aims to solve the problems of data leakage and insufficient privacy protection in the traditional centralized identity management model. The distributed digital identity management system realizes the decentralized storage of data through blockchain technology, and can realize the circulation and sharing of identity information between different systems and applications.

[0003] However, the existing mutual recognition of distributed digital identities is mainly based on the identifier itself and the chain to which the identifier belongs. A lot of information can only be queried on the chain, and mutual recognition of identity cannot be achieved off the chain. At the same time, the information carried by the identifier is limited, and direct information interaction is not possible. At present, the management of multiple chains and multiple identities is due to the issuance and management of public and private keys by a certain chain, and independent issuance of identification mutual recognition cannot be performed. Users cannot fully control their own identities, and cannot meet the needs of high concurrency of actual identity authentication, and the efficiency is low. Summary of the invention

[0004] The present application provides a distributed digital identity management system to solve the technical problems that the existing technology cannot meet the high concurrency requirements of actual identity authentication and has low authentication efficiency.

[0005] In a first aspect, the present application provides a distributed digital identity management device, including: a service chain registration module, a user registration module, an information acquisition module, a judgment module and a verification module, wherein:

[0006] The business chain registration module is used to register multiple business chains with the service chain respectively;

[0007] The user registration module is used to register with the service chain and multiple business chains respectively according to the user's registration information, obtain the service identifier and multiple business identifiers and send them to the user end;

[0008] The information acquisition module is used to acquire the user's information to be verified, where the information to be verified is the information to be verified signed by the user with the user's private key;

[0009] The judgment module is used to analyze the information to be verified and determine whether the service chain needs to be verified to obtain a judgment result;

[0010] The verification module is used to select verification between business chains or verification between business chains and service chains according to the judgment result, obtain a verification result, and send the verification result to the user end.

[0011] In a possible design, the business chain registration module is specifically used to:

[0012] Each of the service chains sends service registration information to the service chain for registration;

[0013] The service chain issues a corresponding identity certificate according to the service registration information and sends the identity certificate to the corresponding service chain to complete the registration.

[0014] In a possible design, the user registration module is specifically used to:

[0015] The service chain obtains user registration information of the user;

[0016] Sending the user registration information to the service chain for registration, and obtaining a service identifier issued by the service chain;

[0017] Sending the user registration information to multiple service chains for independent registration respectively, and obtaining multiple service identifiers issued by the service chains;

[0018] The service identifier and the business identifier are sent to the user end.

[0019] In a possible design, the user registration module is also used to:

[0020] Get user information from the preset database;

[0021] Comparing the user information with the registration information to obtain a comparison result;

[0022] If there is information inconsistency in the comparison result, an error feature corresponding to the inconsistent information is returned;

[0023] If the comparison result shows that the information is consistent, determining whether there is a service identifier corresponding to the user in the service chain;

[0024] When the service identifier corresponding to the user exists in the service chain, the registered information is returned;

[0025] When the service identifier corresponding to the user does not exist in the service chain, the service chain issues a corresponding service identifier for the user.

[0026] In a possible design, the user registration module is also used to:

[0027] Filtering the service chains according to whether there is a service identifier corresponding to the user in each service chain;

[0028] Returning registered information of multiple service chains in the service chain that exist in the service identifier corresponding to the user;

[0029] The user registration information is sent to the remaining service chains respectively for user registration to obtain corresponding multiple service identifiers.

[0030] In one possible design, the judgment model is specifically used to:

[0031] Determine whether the information to be verified has global information that needs to be verified;

[0032] When the information to be verified contains global information that needs to be verified, the service chain needs to participate in the verification;

[0033] When the information to be verified does not contain any global information that needs to be verified, the service chain does not need to participate in the verification.

[0034] In a possible design, the verification module is specifically used to:

[0035] When the judgment result is that the service chain does not need to be verified, extracting a corresponding target service chain and a random verification service chain from the multiple service chains according to the service identifier;

[0036] Verifying the information to be verified through the target service chain and the verification service chain to obtain a verification result;

[0037] When the judgment result is that the service chain needs to be verified, extracting a corresponding target service chain from multiple service chains according to the service identifier;

[0038] The information to be verified is verified through the target business chain and the service chain to obtain a verification result.

[0039] In a possible design, the verification module is also used to:

[0040] The target service chain extracts a user public key corresponding to the user from the historical registration information;

[0041] Generate a public key ring according to the user public key, the public key of the target service chain and the public key of the verification service chain;

[0042] Generate a ring signature according to the information to be verified and the public key ring;

[0043] Sending the information to be verified and the ring signature to the verification service chain;

[0044] The verification service chain verifies the validity of the user private key signature in the information to be verified according to the ring signature;

[0045] When the user private key signature is valid, the information to be verified is checked and a verification result is returned.

[0046] In a possible design, the verification module is also used to:

[0047] The target service chain extracts a user public key corresponding to the user from the historical registration information;

[0048] Generate a public key ring according to the user public key, the public key of the target business chain and the public key of the service chain;

[0049] Generate a ring signature according to the information to be verified and the public key ring;

[0050] Sending the information to be verified and the ring signature to the service chain;

[0051] The service chain verifies the validity of the user private key signature in the information to be verified according to the ring signature;

[0052] When the user private key signature is valid, the information to be verified is checked and a verification result is returned.

[0053] In a possible design, a storage module is also included, and the storage module is used to store the verification result on the chain.

[0054] In a second aspect, the present application provides a distributed digital identity management method, comprising:

[0055] Register multiple business chains to the service chain respectively;

[0056] Register with the service chain and multiple business chains respectively according to the user's registration information, obtain a service identifier and multiple business identifiers and send them to the user end;

[0057] Obtain the user's information to be verified, where the information to be verified is the information to be verified signed by the user with the user's private key;

[0058] Analyze the information to be verified to determine whether a service chain is required to verify and obtain a determination result;

[0059] According to the judgment result, verification between business chains or verification between business chains and service chains is selected to obtain a verification result, and the verification result is sent to the user end.

[0060] In a third aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the implementation of the second aspect as described above.

[0061] In a fourth aspect, the present application provides a computer program product, including a computer program, which implements the implementation of the second aspect as described above when executed by a processor.

[0062] The distributed digital identity management system and method provided by the present application include: a business chain registration module, a user registration module, an information acquisition module, a judgment module and a verification module, wherein the business chain registration module is used to register multiple business chains with the service chain respectively; the user registration module is used to register with the service chain and multiple business chains respectively according to the user's registration information, and obtain the service identification and multiple business identifications and send them to the user end; the information acquisition module is used to obtain the user's to-be-verified information, and the to-be-verified information is the information to be verified after the user signs with the user's private key; the judgment module is used to analyze the information to be verified and determine whether the service chain needs to be verified to obtain the judgment result; the verification module is used to select the verification between business chains or the verification between business chains and service chains according to the judgment result to obtain the verification result. By utilizing blockchain technology, the decentralization and transparency of identity management are ensured. At the same time, by registering separately in the business chain and the service chain, the verification path can be flexibly selected according to different verification requirements, the efficiency and adaptability of the system are improved, and the security of the management and verification process of user identity in a distributed environment is ensured, and the verification efficiency is effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0064] Figure 1 This is a schematic diagram of the structure of the distributed digital identity management system provided in the embodiment of the present application. Figure 1 ;

[0065] Figure 2 This is a flowchart of a distributed digital identity management system provided by an embodiment of the present application. Figure 1 ;

[0066] Figure 3 This is a flowchart of a distributed digital identity management system provided by an embodiment of the present application. Figure 2 ;

[0067] Figure 4 This is a flowchart of a distributed digital identity management system provided by an embodiment of the present application. Figure 3 ;

[0068] Figure 5 This is a schematic diagram of the structure of the distributed digital identity management system provided in the embodiment of the present application. Figure 2 ;

[0069] Figure 6 It is a flowchart diagram of the distributed digital identity management method provided in an embodiment of the present application.

[0070] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0071] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0072] The essence of blockchain is to store data in a block-chain data structure in chronological order, and to use cryptography to ensure that it cannot be tampered with. Its biggest feature is that it is composed of a distributed network, and uses cryptographic technologies such as asymmetric encryption to ensure the security of on-chain data. At the same time, through consensus mechanisms, smart contracts, etc., the reliability of on-chain data is guaranteed among multiple untrusted distributed participants.

[0073] Blockchain integrates distributed ledgers, encryption technology, consensus algorithms, smart contracts and other technologies. It has the characteristics of decentralization and tamper-proofing. It has technical advantages in promoting data sharing, optimizing business processes, reducing operating costs, improving collaborative efficiency, and building a trusted system.

[0074] The blockchain network is jointly maintained by nodes, and information is stored and updated through a consensus mechanism to achieve open, transparent and decentralized operations. The nodes on the blockchain network have equal power, and each full node in the system has a complete copy of the data. The failure or exit of any node does not affect the normal operation of the system. The smart contract code is deployed to each node and automatically executed according to the pre-agreed business logic and terms and conditions to establish a decentralized autonomous model. Blockchain integrates distributed storage, encryption technology, consensus algorithm, smart contract and other technologies, and has the characteristics of decentralization and tamper-proof. It has technical advantages in promoting data sharing, optimizing business processes, reducing operating costs, improving collaborative efficiency, and building a trusted system.

[0075] Distributed digital identity is a technology-based identity authentication and management system that achieves higher security and scalability by distributing the storage, verification and management of user identity information across multiple nodes.

[0076] In a distributed digital identity system, the user's identity information is stored in multiple nodes instead of being stored in a single centralized institution. Each node has its own authentication and management functions, and can independently authenticate users and control access to identity data. This means that the user's identity information will not be stored in one place, thereby increasing the security of centralized storage.

[0077] Distributed digital identity systems usually use cryptography to protect user identity information. User identity information is encrypted and verified and tamper-proofed using digital signatures. When a user needs to authenticate their identity, the system uses a distributed algorithm to verify the identity information provided by the user and compares it with multiple nodes to ensure the accuracy and integrity of the identity.

[0078] The distributed digital identity system can also be integrated with other systems to provide a wider range of authentication and authorization functions. For example, it can be combined with blockchain technology to achieve decentralized authentication and access control. Users can seamlessly authenticate and access control between different networks and applications by using their digital identities.

[0079] The distributed digital identity management system is an identity management solution built on blockchain and distributed accounting technology, which aims to solve the problems of data leakage and insufficient privacy protection in the traditional centralized identity management model. The distributed digital identity management system realizes the decentralized storage of data through blockchain technology, uses technical means to store the user's identity information in multiple nodes, and verifies and manages the identity authentication system through cryptographic technology. It provides higher security and scalability, and can be integrated with other systems to provide users with a convenient identity authentication and authorization experience.

[0080] However, the existing mutual recognition of distributed digital identities is mainly based on the identifier itself and the chain to which the identifier belongs. A lot of information can only be queried on the chain, and mutual recognition of identity cannot be achieved off the chain. At the same time, the information carried by the identifier is limited, and direct information interaction is not possible. At present, the management of multiple chains and multiple identities is due to the issuance and management of public and private keys by a certain chain, and independent issuance of identification mutual recognition cannot be performed. Users cannot fully control their own identities, and cannot meet the needs of high concurrency of actual identity authentication, and the efficiency is low.

[0081] This application can be specifically applied to scenarios where distributed digital identities are recognized across chains.

[0082] The distributed digital identity management system and method provided in this application are intended to solve the above technical problems of the prior art.

[0083] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0084] Figure 1 FIG. 1 is a schematic diagram of the structure of a distributed digital identity management system according to an embodiment of the present invention. Figure 1 As shown, this embodiment provides a distributed digital identity management system, including: a service chain registration module 101, a user registration module 102, an information acquisition module 103, a judgment module 104 and a verification module 105, wherein:

[0085] The service chain registration module 101 is used to register multiple service chains with the service chain respectively.

[0086] Specifically, the business chain registration module is responsible for registering multiple business chains into the service chain, ensuring that each business chain has a unique identifier (DID, Decentralized Identity) in the system, and its identity and function are recognized and recorded by the service chain.

[0087] The user registration module 102 is used to register with the service chain and multiple business chains according to the user's registration information, obtain the service identifier and multiple business identifiers and send them to the user end.

[0088] Specifically, the user registration module performs registration according to the user's registration information, generates and allocates a service identifier and multiple service identifiers for the user, so as to perform identity authentication and operation in the system.

[0089] The information acquisition module 103 is used to acquire the user's information to be verified, where the information to be verified is the information to be verified signed by the user with the user's private key.

[0090] Specifically, the information acquisition module acquires the user information required for verification and provides necessary data for the subsequent verification process.

[0091] The judgment module 104 is used to analyze the information to be verified and determine whether the service chain needs to be verified to obtain a judgment result.

[0092] Specifically, the judgment module analyzes the information to be verified to determine the verification path and whether the service chain needs to participate in the verification, so as to optimize the verification process and improve the verification efficiency.

[0093] The verification module 105 is used to select verification between business chains or verification between a business chain and a service chain according to the judgment result, obtain the verification result, and send the verification result to the user end.

[0094] Specifically, the verification module selects an appropriate verification path based on the judgment result. Business chain verification is usually faster than service chain verification, and service chain verification information is more comprehensive. Therefore, the verification path is determined according to the information to be verified. If it can be verified between business chains, it does not need to be sent to the service chain for verification, which effectively improves the verification speed and efficiency. In the case where the service chain needs to perform global verification, it can also be verified through the service chain to ensure the authenticity and integrity of the information.

[0095] The distributed digital identity management system provided by the embodiment of the present invention ensures the decentralization and transparency of identity management by utilizing blockchain technology. At the same time, according to different verification requirements, it flexibly selects verification paths to improve the efficiency and adaptability of the system, ensures the security of user identity management and verification process in a distributed environment, and effectively improves the verification efficiency. Through public key encryption and signature verification, the security and non-tamperability of information are ensured; support collaboration between multiple business chains and service chains to ensure the interoperability and scalability of the system.

[0096] Figure 2 Schematic diagram of the distributed digital identity management system provided in the embodiment of the present application Figure 1 .like Figure 2 As shown, this embodiment describes in detail the process of registering multiple business chains with the service chain in the above embodiment. The specific implementation method of the process includes the following steps:

[0097] Step S201: Each business chain sends business registration information to the service chain for registration.

[0098] Specifically, each business chain prepares its registration information, which usually includes the name of the business chain, node information, function description, public key, etc. The data transmission process in which the business chain sends its registration information to the service chain for registration is sent through an encrypted channel to ensure the integrity and security of the data.

[0099] Step S202: the service chain issues a corresponding identity certificate according to the service registration information and sends the identity certificate to the corresponding service chain to complete the registration.

[0100] Specifically, the service chain checks whether the received registration information is complete and contains all required fields; verifies the identity information of the service chain to ensure its authenticity and accuracy; and checks whether the same registration information already exists to prevent duplicate registration.

[0101] After the check is passed, the service chain generates a corresponding identity credential (usually a decentralized identifier, DID) for the business chain. At the same time, the service chain will create a corresponding DID document containing the business chain's public key, service endpoint, verification method and other information. The generated identity credential and related DID document are sent back to the corresponding business chain, and then the business chain's registration information and the generated identity credential are stored in a decentralized storage system for subsequent query and verification.

[0102] After Business Link receives the identity credentials, the registration process is completed.

[0103] The embodiment of the present invention registers multiple business chains with the service chain respectively, so that the service chain can effectively manage and verify the registration information of the business chains, thereby ensuring the security of the system and the coordination and cooperation between the chains.

[0104] Figure 3 Schematic diagram of the distributed digital identity management system provided in the embodiment of the present application Figure 2 .like Figure 3 As shown, this embodiment describes in detail the process of registering with the service chain and multiple service chains according to the user's registration information in the above embodiment, obtaining the service identifier and multiple service identifiers and sending them to the user end. The specific implementation method of the process includes the following steps:

[0105] Step S301: Obtain user registration information of the user.

[0106] Specifically, the registration information provided by the user usually includes basic identity information, user public key, and other possible verification information. The user registration information obtained is information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation portals for users to choose to authorize or refuse.

[0107] Step S302: Send the user registration information to the service chain for registration, and obtain a service identifier issued by the service chain.

[0108] Specifically, the user's registration information is sent to the service chain for registration. The service chain verifies the integrity and authenticity of the information and checks whether there is duplicate registration. After the review is passed, the service chain generates and issues a unique service identifier for the user (usually a decentralized identifier, DID); the service chain stores the service identifier in a decentralized storage system and returns it to the registration process.

[0109] Step S303: Send the user registration information to multiple service chains for independent registration, and obtain multiple service identifiers issued by the service chains.

[0110] Specifically, the user's registration information is sent to multiple business chains for independent registration; each business chain independently verifies the user information to ensure that it meets its own registration standards and requirements; each business chain generates and issues a business identifier for the user, and stores the business identifier and returns it to the registration process.

[0111] Step S304: Send the service identifier and business identifier to the user terminal.

[0112] Specifically, collect the service identifiers issued by the service chain and multiple business identifiers issued by the business chain. - Send these identifiers to the user to ensure that the user has all the identifiers in the system.

[0113] In some optional implementations, the above step S302 includes:

[0114] Step a1: The service chain obtains user information from a preset database.

[0115] Specifically, the service chain obtains user-related storage information from the preset database. This information may include the user's historical registration data, identity verification records, etc. The user information obtained is all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0116] Step a2, comparing the user information with the registration information to obtain a comparison result.

[0117] Specifically, the user information obtained from the database is compared with the registration information submitted by the user, and the comparison results are analyzed to determine the consistency of the information.

[0118] Step a3: If there is information inconsistency in the comparison result, an error feature corresponding to the inconsistent information is returned.

[0119] Specifically, if the comparison result shows inconsistent information, the service chain returns error features corresponding to the inconsistent information, including specific error fields and suggested corrections.

[0120] Step a4: If the comparison result shows that the information is consistent, determine whether there is a service identifier corresponding to the user in the service chain.

[0121] Step a5: When the service identifier corresponding to the user exists in the service chain, the registered information is returned.

[0122] Specifically, it is determined whether a service identifier corresponding to the user already exists in the service chain. If the service identifier already exists, the registered information is returned to inform the user that his identity has been registered in the service chain to avoid duplicate registration and identifier conflicts.

[0123] Step a6: When the service identifier corresponding to the user does not exist in the service chain, a corresponding service identifier is issued to the user.

[0124] Specifically, if the service ID does not exist, a new service ID is generated and issued for the user. The process of issuing a service ID: Create a unique decentralized identifier (DID) as the user's service ID; generate a DID document containing information such as the user's public key and verification method; store the service ID and DID document in a decentralized storage system, and return the service ID to the user.

[0125] In some optional implementations, the above step S303 includes:

[0126] Step b1, screening the service chains according to whether there is a service identifier corresponding to the user in each service chain.

[0127] Specifically, for each service chain, it is checked whether a service identifier corresponding to the user already exists.

[0128] Step b2: Return the registered information of multiple service chains in the service chain that exist in the service identifier corresponding to the user.

[0129] Specifically, for service chains with user service identifiers, it indicates that the user has completed registration on these service chains and does not need to register again, thus avoiding repeated registration and identifier conflicts.

[0130] Step b3: Send the user registration information to the remaining service chains for user registration to obtain corresponding multiple service identifiers.

[0131] Specifically, the registration process includes: the business chain obtains user information from a preset database; compares the user information with the registration information to obtain a comparison result; if there is information inconsistency in the comparison result, returns an error feature corresponding to the inconsistent information; if there is information consistency in the comparison result, determines whether there is a business identifier corresponding to the user in the business chain; when the business identifier corresponding to the user exists in the business chain, returns the registered information; when the business identifier corresponding to the user does not exist in the business chain, issues the corresponding business identifier to the user.

[0132] The embodiment of the present invention ensures the decentralization and transparency of identity management by registering users separately in multiple business chains and service chains, using blockchain technology, and can effectively manage user registration information and ensure the uniqueness and traceability of user identity identifiers on different chains. The multi-chain independent registration method enhances the flexibility and security of the system.

[0133] Figure 4 Schematic diagram of the distributed digital identity management system provided in the embodiment of the present application Figure 3 .like Figure 4 As shown, this embodiment describes in detail the process of analyzing the information to be verified in the above embodiment to determine whether the service chain needs to be verified. The specific implementation method of the process includes the following steps:

[0134] Step S401: Determine whether the information to be verified contains global information that needs to be verified.

[0135] Specifically, the content of the information to be verified is analyzed to determine whether it involves elements that require a global view or global consistency verification. For example, cross-chain transactions, global identity status checks, system-level permission verification, etc., usually require global information.

[0136] Step S402: When the information to be verified contains global information that needs to be verified, the service chain needs to participate in the verification.

[0137] Specifically, if there is global information that needs to be verified in the information to be verified, it is marked as requiring the service chain to participate in the verification. The service chain can provide the necessary global view and consistency check to ensure the consistency and integrity of the information in the entire system.

[0138] Step S403: When the information to be verified does not contain any global information that needs to be verified, the service chain does not need to participate in the verification.

[0139] Specifically, if there is no global information that needs to be verified in the information to be verified, it is marked as not requiring the service chain to participate in the verification. The mutual verification between service chains can effectively shorten the verification time and improve the verification efficiency.

[0140] The above judgment is used to select the appropriate verification path to ensure the efficiency and reliability of the verification process. This mechanism not only improves the performance of the system, but also ensures the correctness and security in complex scenarios.

[0141] Step S404: when the judgment result is that the service chain does not need to be verified, a corresponding target service chain and a random verification service chain are extracted from the multiple service chains according to the service identifier.

[0142] Specifically, according to the service identifier, a target service chain related to the information to be verified is extracted from multiple service chains, and a verification service chain is randomly selected from the remaining service chains to increase the reliability of verification and prevent single point failures.

[0143] Step S405: Verify the information to be verified through the target service chain and the verification service chain to obtain a verification result.

[0144] Specifically, by verifying information between business chains and effectively utilizing the collaboration between business chains, the participation of service chains is reduced, the complexity and time consumption of cross-chain communication are reduced, and the verification efficiency is improved while maintaining a high level of security and reliability. The verification business chain can also be dynamically selected according to demand to adapt to different business scenario requirements.

[0145] Step S406: When the judgment result is that the service chain needs to be verified, the corresponding target service chain is extracted from the multiple service chains according to the service identifier.

[0146] Specifically, according to the service identifier, a target service chain related to the information to be verified is extracted from multiple service chains.

[0147] Step S407: Verify the information to be verified through the target business chain and the service chain to obtain a verification result.

[0148] Specifically, the service chain can provide a global view and perform verification through the business chain and service chain to ensure the consistency and integrity of cross-chain data. When verification between business chains cannot meet the verification requirements, information verification is performed by utilizing the collaboration of the target business chain and service chain to ensure the efficiency, security and integrity of the verification process.

[0149] In some optional implementations, the above step S405 includes:

[0150] Step c1: The target service chain extracts the user public key corresponding to the user from the historical registration information.

[0151] Specifically, extracting the user public key corresponding to the user from its historical registration information can ensure the accuracy of the public key used in the verification process.

[0152] Step c2: Generate a public key ring based on the user public key, the public key of the target service chain and the public key of the verification service chain.

[0153] Specifically, the user public key is the user public key extracted from the target business chain. The public key of the target business chain is used as a participant in the verification and signing process, and the public key of the verification business chain is used as another participant in the verification process. The generation of the public key ring ensures that the participants in the verification process are clear and can provide sufficient security.

[0154] Step c3: Generate a ring signature based on the information to be verified and the public key ring.

[0155] Specifically, a ring signature is generated based on the information to be verified and the generated public key ring. The generation of the ring signature ensures that the information to be verified can be verified by the verification business chain without revealing the specific signer.

[0156] Step c4: Send the information to be verified and the ring signature to the verification service chain.

[0157] Specifically, the information to be verified and the generated ring signature are sent to the verification business chain, and the verification business chain is responsible for verifying the received information.

[0158] Step c5, the verification service chain verifies the validity of the user private key signature in the verification information based on the ring signature.

[0159] Specifically, the verification business chain is verified through ring signature verification to ensure that the information to be verified is indeed signed by a member of the public key ring.

[0160] Step c6: When the user's private key signature is valid, the information to be verified is checked and the verification result is returned.

[0161] Specifically, if the user's private key signature is verified to be valid, the verification business chain further verifies the content of the information to be verified, and the verification process may include checking the integrity, consistency and compliance of the information with business rules. The verification business chain returns the verification result to the requester, and the verification result will confirm the authenticity and integrity of the information to be verified.

[0162] In some optional implementations, the above step S407 includes:

[0163] Step d1: The target service chain extracts the user public key corresponding to the user from the historical registration information.

[0164] Specifically, extracting the user public key corresponding to the user from its historical registration information can ensure the accuracy of the public key used in the verification process.

[0165] Step d2, generating a public key ring according to the user public key, the public key of the target business chain and the public key of the service chain.

[0166] Specifically, the user public key is the user public key extracted from the target service chain. The public key of the target service chain is used as one participant in the verification and signing process, and the public key of the service chain is used as another participant in the verification process. The generation of the public key ring ensures that the participants in the verification process are clear and can provide sufficient security.

[0167] Step d3: Generate a ring signature based on the information to be verified and the public key ring.

[0168] Specifically, a ring signature is generated based on the information to be verified and the generated public key ring. The generation of the ring signature ensures that the information to be verified can be verified by the verification business chain without revealing the specific signer.

[0169] Step d4: Send the information to be verified and the ring signature to the service chain.

[0170] Specifically, the information to be verified and the generated ring signature are sent to the service chain. The service chain is responsible for verifying the received information.

[0171] Step d5: The service chain verifies the validity of the user private key signature in the verification information based on the ring signature.

[0172] Specifically, the service chain uses a ring signature to verify the validity of the user's private key signature in the information to be verified. Through ring signature verification, it ensures that the information to be verified is indeed signed by a member of the public key ring.

[0173] Step d6, when the user's private key signature is valid, the information to be verified is checked and the verification result is returned.

[0174] Specifically, if the user's private key signature is verified to be valid, the service chain further verifies the content of the information to be verified. The verification process may include checking the integrity, consistency and compliance of the information with business rules. The service chain returns the verification result to the requester, and the verification result indicates whether the authenticity and integrity of the information to be verified are confirmed.

[0175] By selecting a suitable verification path, the embodiment of the present invention enables the system to maximize the use of resources and improve verification efficiency; by introducing a random verification business chain or service chain, the security and reliability of verification are increased; it supports dynamic adjustment of the verification path according to different judgment results to adapt to different verification requirements and scenarios; it ensures the transparency and traceability of the verification process and supports subsequent auditing and analysis.

[0176] Through ring signatures, the verification process protects the privacy of the signer and does not reveal the specific identity of the signer; ring signatures provide strong security to ensure the authenticity and integrity of information; ring signatures involve multiple public keys, which can ensure the efficiency of the verification process; they support different verification scenarios and requirements, and can adapt to different security requirements by adjusting the composition of the public key ring. By effectively using ring signature technology for verification, the security and privacy of user identity and information are ensured.

[0177] Figure 5 This is a schematic diagram of the structure of the distributed digital identity management system provided in the embodiment of the present application. Figure 2 ,like Figure 5 As shown, the distributed digital identity management device provided in the embodiment of the present invention further includes a storage module 106, and the storage module 106 is used to store the verification result on the chain.

[0178] Specifically, on-chain storage is highly secure, transparent, and tamper-proof. When the on-chain storage exceeds the preset threshold, the amount of data can be managed through off-chain storage. For example, infrequently used data is regularly transferred to off-chain storage, such as IPFS (InterPlanetary File System), and its hash value is retained on the chain to verify data integrity. Combining on-chain and off-chain storage, the security of blockchain and the scalability of distributed storage are utilized; at the same time, data classification strategies can be dynamically adjusted according to business needs and data characteristics to adapt to changing storage needs; storage effectiveness is regularly tested, data storage and access performance are optimized, and storage and access efficiency is improved while ensuring data security.

[0179] Figure 6 A flow chart of the distributed digital identity management method provided for this application, such as Figure 6 As shown, the method includes:

[0180] Step S601: register multiple business chains with the service chain respectively.

[0181] Step S602: register with the service chain and multiple business chains respectively according to the user's registration information, obtain a service identifier and multiple business identifiers and send them to the user end.

[0182] Step S603: Obtain the user's information to be verified, where the information to be verified is the information to be verified signed by the user with the user's private key.

[0183] Step S604: Analyze the information to be verified to determine whether a service chain needs to be verified to obtain a determination result.

[0184] Step S605: select verification between business chains or verification between business chains and service chains according to the judgment result, obtain the verification result, and send the verification result to the user end.

[0185] The distributed digital identity management method provided by the embodiment of the present invention ensures the decentralization and transparency of identity management by utilizing blockchain technology. At the same time, according to different verification requirements, it flexibly selects verification paths to improve the efficiency and adaptability of the system, ensures the security of user identity management and verification process in a distributed environment, and effectively improves the verification efficiency. Through public key encryption and signature verification, the security and non-tamperability of information are ensured; support collaboration between multiple business chains and service chains to ensure the interoperability and scalability of the system.

[0186] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0187] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0188] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0189] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0190] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0191] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0192] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0193] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0194] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0195] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and corresponding operation entrances shall be provided for users to choose to authorize or refuse.

[0196] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A distributed digital identity management system, characterized in that: include: Business chain registration module, user registration module, information acquisition module, judgment module and verification module, among which, The business chain registration module is used to register multiple business chains with the service chain respectively; The user registration module is used to register with the service chain and multiple business chains respectively according to the user's registration information, obtain the service identifier and multiple business identifiers and send them to the user end; The information acquisition module is used to acquire the user's information to be verified, where the information to be verified is the information to be verified signed by the user with the user's private key; The judgment module is used to analyze the information to be verified and determine whether the service chain needs to be verified to obtain a judgment result; The verification module is used to select verification between business chains or verification between business chains and service chains according to the judgment result, obtain a verification result, and send the verification result to the user end.

2. The system according to claim 1, characterized in that Register multiple business chains with the service chain separately, including: Each of the service chains sends service registration information to the service chain for registration; The service chain issues a corresponding identity certificate according to the service registration information and sends the identity certificate to the corresponding service chain to complete the registration.

3. The system according to claim 1, characterized in that Registering with the service chain and multiple business chains respectively according to the user's registration information, obtaining a service identifier and multiple business identifiers and sending them to the user end, including: Get the user's user registration information; Sending the user registration information to the service chain for registration, and obtaining a service identifier issued by the service chain; Sending the user registration information to multiple service chains for independent registration respectively, and obtaining multiple service identifiers issued by the service chains; The service identifier and the business identifier are sent to the user end.

4. The system according to claim 3, characterized in that Sending the user registration information to the service chain for registration includes: The service chain obtains user information from a preset database; Comparing the user information with the registration information to obtain a comparison result; If there is information inconsistency in the comparison result, an error feature corresponding to the inconsistent information is returned; If the comparison result shows that the information is consistent, determining whether there is a service identifier corresponding to the user in the service chain; When the service identifier corresponding to the user exists in the service chain, the registered information is returned; When the service identifier corresponding to the user does not exist in the service chain, a corresponding service identifier is issued to the user.

5. The system according to claim 3, characterized in that Sending the user registration information to multiple service chains for independent registration includes: Filtering the service chains according to whether there is a service identifier corresponding to the user in each service chain; Returning registered information of multiple service chains in the service chain that exist in the service identifier corresponding to the user; The user registration information is sent to the remaining service chains respectively for user registration to obtain corresponding multiple service identifiers.

6. The system according to claim 1, characterized in that Analyze the information to be verified to determine whether the service chain needs to be verified, including: Determine whether the information to be verified has global information that needs to be verified; When the information to be verified contains global information that needs to be verified, the service chain needs to participate in the verification; When the information to be verified does not contain any global information that needs to be verified, the service chain does not need to participate in the verification.

7. The system according to claim 1, characterized in that According to the judgment result, verification between business chains or verification between business chains and service chains is selected to obtain verification results, including: When the judgment result is that the service chain does not need to be verified, extracting a corresponding target service chain and a random verification service chain from the multiple service chains according to the service identifier; Verifying the information to be verified through the target service chain and the verification service chain to obtain a verification result; When the judgment result is that the service chain needs to be verified, extracting a corresponding target service chain from multiple service chains according to the service identifier; The information to be verified is verified through the target business chain and the service chain to obtain a verification result.

8. The system according to claim 7, characterized in that Verifying the information to be verified through the target service chain and the verification service chain includes: The target service chain extracts a user public key corresponding to the user from the historical registration information; Generate a public key ring according to the user public key, the public key of the target service chain and the public key of the verification service chain; Generate a ring signature according to the information to be verified and the public key ring; Sending the information to be verified and the ring signature to the verification service chain; The verification service chain verifies the validity of the user private key signature in the information to be verified according to the ring signature; When the user private key signature is valid, the information to be verified is checked and a verification result is returned.

9. The system according to claim 7, characterized in that Verifying the information to be verified through the target business chain and the service chain includes: The target service chain extracts a user public key corresponding to the user from the historical registration information; Generate a public key ring according to the user public key, the public key of the target business chain and the public key of the service chain; Generate a ring signature according to the information to be verified and the public key ring; Sending the information to be verified and the ring signature to the service chain; The service chain verifies the validity of the user private key signature in the information to be verified according to the ring signature; When the user private key signature is valid, the information to be verified is checked and a verification result is returned.

10. The system according to claim 1, characterized in that It also includes a storage module, which is used to store the verification result on the chain.

11. A distributed digital identity management method, characterized in that: include: Register multiple business chains to the service chain respectively; Register with the service chain and multiple business chains respectively according to the user's registration information, obtain a service identifier and multiple business identifiers and send them to the user end; Obtain the user's information to be verified, where the information to be verified is the information to be verified signed by the user with the user's private key; Analyze the information to be verified to determine whether a service chain is required to verify and obtain a determination result; According to the judgment result, verification between business chains or verification between business chains and service chains is selected to obtain a verification result, and the verification result is sent to the user end.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to claim 11 when executed by a processor.

13. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the method as claimed in claim 11.

Images