Distributed digital identity certificate generation method and device, and electronic equipment

Abstract

The invention discloses a distributed digital identity certificate generation method and device and electronic equipment, and relates to the technical field of blockchains, and the generation method comprises the steps: controlling a preset proxy server to receive a proxy certificate issuing request, determining an aggregation signature based on an encrypted digital signature sent by each preset certificate issuing server, and generating a distributed digital identity certificate based on the aggregation signature; and generating the digital identity certificate. According to the method and the device, the technical problems that a unique digital identity certificate cannot be effectively generated in a many-to-one authorization or multi-level authorization scene in the prior art, so that the process of identity verification is tedious and the efficiency is relatively low are solved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a method for generating a distributed digital identity certificate, a device thereof, and an electronic device. Background Art

[0002] With the development of the Internet, more and more personal and organizational information is available on the Internet, leading to increasingly prominent identity and data security issues. As an authoritative electronic certificate in a network environment, digital certificates (EC) play an important role in ensuring information security in a network environment. They can ensure the confidentiality, integrity and authenticity of network communications, and provide a trust basis for online transactions, data sharing and identity authentication. In the mechanism of digital certificate application, the certificate holder applies for a digital certificate from an authority as an individual or organization. The authority issues a digital certificate to the certificate holder based on the application information to indicate the uniqueness of the certificate holder's identity. The certificate holder only allows his or her own certificate to be used, and refuses to use the certificate by any other individual or organization. Therefore, digital certificates are non-replicable, non-forgeable and non-changeable on the Internet.

[0003] In the related art, the authorization method of digital certificates uses a pair of public and private keys to generate a digital signature, that is, each issuer has its own independent pair of public and private keys. The issuer uses its own private key to sign the digital certificate, and the verifier uses the issuer's public key to verify the signature.

[0004] However, in scenarios of many-to-one authorization or multi-level authorization, there will be performance and operational issues. For example, the certificate holder needs to obtain digital certificates from multiple issuers. Each digital certificate has an independent digital signature. When the verifier needs to verify the user's identity, the digital signature of each certificate needs to be verified. Especially in high-traffic applications that require frequent digital signature verification, this will increase the complexity and time overhead of verification.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present invention provide a method for generating a distributed digital identity certificate and its device and electronic device, so as to at least solve the technical problem in the related art that a unique digital identity certificate cannot be effectively generated in a many-to-one authorization or multi-level authorization scenario, resulting in a cumbersome and inefficient process for identity authentication.

[0007] According to one aspect of an embodiment of the present invention, a method for generating a distributed digital identity certificate is provided, comprising: controlling a preset proxy server to receive a proxy issuance request, wherein the proxy issuance request comes from at least one preset issuance server, and the proxy issuance request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset issuance server; determining an aggregate signature based on the encrypted digital signature sent by each of the preset issuance servers, and generating a digital identity certificate based on the aggregate signature.

[0008] Furthermore, before controlling the preset proxy server to receive the proxy certification request, it includes: controlling each of the preset certification server to send a key generation request to the preset proxy server; based on the key generation request, controlling the preset proxy server to generate a preset public key and a private key set, wherein the private key set includes at least: a private key generated for each of the preset certification server.

[0009] Furthermore, based on the key generation request, the step of controlling the preset proxy server to generate a preset public key and a private key set includes: determining a modulus based on a first preset prime number and a second preset prime number, and determining a preset function value based on the modulus; determining the preset public key based on the preset value and the preset function value; determining the private key of each of the preset certification servers based on the preset public key and the preset function value; and adding the private key of each of the preset certification servers to the private key set.

[0010] Furthermore, before controlling the preset proxy server to receive the proxy certification request, it also includes: controlling the preset proxy server to make the preset public key public, and sending each private key in the private key set to the corresponding preset certification server; controlling each of the preset certification server to use the private key to encrypt the certificate data to obtain the encrypted digital signature, wherein the certificate data is determined by the preset certification server based on the application data sent by the target terminal, and the application data is the data sent by the target terminal to the preset certification server when applying for the digital identity certificate.

[0011] Furthermore, the step of controlling each of the preset issuing servers to use the private key to encrypt the certificate data to obtain the encrypted digital signature includes: determining the hash summary value of the certificate data; based on the modulus, using the private key to sign the hash summary value of the certificate data to obtain the encrypted digital signature.

[0012] Furthermore, based on the encrypted digital signature sent by each of the preset issuing servers, the step of determining the aggregate signature includes: based on the modulus, aggregating the encrypted digital signature sent by each of the preset issuing servers to obtain the aggregate signature.

[0013] Furthermore, after generating a digital identity certificate based on the aggregate signature, the method includes: when detecting that the digital identity certificate is used on the target terminal, controlling the preset verification server to decrypt the aggregate signature based on the publicly disclosed preset public key and the modulus to obtain the decrypted digital identity certificate; determining whether the decrypted digital identity certificate is the same as the certificate data on each of the preset issuing servers, and when the decrypted digital identity certificate is the same as the certificate data on each of the preset issuing servers, determining that the verification of the generated digital identity certificate is passed, wherein the certificate data on each of the preset issuing servers is the same.

[0014] According to another aspect of an embodiment of the present invention, a distributed digital identity generation device is also provided, including: a control unit, used to control a preset proxy server to receive a proxy certification request, wherein the proxy certification request comes from at least one preset certification server, and the proxy certification request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset certification server; a processing unit, used to determine an aggregate signature based on the encrypted digital signature sent by each of the preset certification servers, and generate a digital identity certificate based on the aggregate signature.

[0015] Furthermore, the generating device includes: a first control module, used to control each of the preset certification server ends to send a key generation request to the preset proxy server end before controlling the preset proxy server end to receive the proxy certification request; a second control module, used to control the preset proxy server end to generate a preset public key and a private key set based on the key generation request, wherein the private key set includes at least: a private key generated for each of the preset certification server ends.

[0016] Furthermore, the second control module includes: a first determination submodule, used to determine the modulus based on the first preset prime number and the second preset prime number, and determine the preset function value based on the modulus; a second determination submodule, used to determine the preset public key based on the preset value and the preset function value; a third determination submodule, used to determine the private key of each of the preset certification server ends based on the preset public key and the preset function value; and a first adding submodule, used to add the private key of each of the preset certification server ends to the private key set.

[0017] Furthermore, the generating device also includes: a first processing module, used to control the preset proxy server to make the preset public key public before controlling the preset proxy server to receive the proxy certification request, and send each private key in the private key set to the corresponding preset certification server; a first encryption module, used to control each of the preset certification servers to use the private key to encrypt the certificate data to obtain the encrypted digital signature, wherein the certificate data is determined by the preset certification server based on the application data sent by the target terminal, and the application data is the data sent by the target terminal to the preset certification server when applying for the digital identity certificate.

[0018] Furthermore, the first encryption module includes: a fourth determination submodule, used to determine the hash summary value of the certificate data; and a first signature module, used to sign the hash summary value of the certificate data based on the modulus using the private key to obtain the encrypted digital signature.

[0019] Furthermore, the generating device also includes: a first aggregation module, which is used to aggregate the encrypted digital signatures sent by each of the preset issuing service ends based on the modulus to obtain the aggregate signature.

[0020] Furthermore, the processing unit includes: a first decryption module, which is used to control the preset verification server to decrypt the aggregate signature based on the public preset public key and the modulus to obtain the decrypted digital identity certificate when it is detected that the digital identity certificate is used on the target terminal; a first determination module, which is used to determine whether the decrypted digital identity certificate is the same as the certificate data on each of the preset issuing servers, and when the decrypted digital identity certificate is the same as the certificate data on each of the preset issuing servers, determine that the verification of the generated digital identity certificate is passed, wherein the certificate data on each of the preset issuing servers is the same.

[0021] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for generating a distributed digital identity certificate as described above is implemented.

[0022] According to another aspect of an embodiment of the present invention, an electronic device is also provided, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned methods for generating a distributed digital identity certificate.

[0023] In the present invention, the preset proxy server can be controlled to receive the proxy certification request, and the aggregate signature can be determined based on the encrypted digital signature sent by each preset certification server. Based on the aggregate signature, a digital identity certificate can be generated, thereby solving the technical problem in the related technology that a unique digital identity certificate cannot be effectively generated in the scenario of many-to-one authorization or multi-level authorization, resulting in a cumbersome and inefficient process for identity authentication.

[0024] In the present invention, the preset proxy server is controlled to receive the proxy issuance request of each preset issuance server, and the encrypted digital signature carried by the proxy issuance request sent by each preset issuance server is aggregated to obtain an aggregate signature. The aggregate signature can then be attached to the digital certificate to generate a digital identity certificate. This can effectively integrate multiple signatures to generate a more efficient and secure unique digital identity certificate. In addition, when the digital identity certificate needs to be verified, multiple digital signatures can be verified at one time, which improves the verification efficiency, thereby achieving the technical effect of efficiently verifying user identity and improving system performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0026] Figure 1 is a flow chart of an optional method for generating a distributed digital identity certificate according to an embodiment of the present invention;

[0027] Figure 2 is a schematic diagram of an optional distributed digital identity authorization system structure based on multiple private keys and a single public key according to an embodiment of the present invention;

[0028] Figure 3 is a schematic diagram of an optional distributed digital identity generation device according to an embodiment of the present invention;

[0029] Figure 4 The present invention is a hardware structure block diagram of an electronic device (or mobile device) for a method for generating a distributed digital identity certificate according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) collected and involved in the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for users to choose to authorize or refuse. For example, an interface is set between the system and the relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0033] In order to solve the problem that when there are multiple authorization requirements, multiple issuers (i.e., preset issuing servers) are required to issue multiple certificates, and the digital signatures on each certificate need to be repeatedly verified each time the digital certificate is verified, the present invention can generate multiple private keys and a single public key corresponding to multiple issuers through a key generation module of an agent (i.e., the preset agent server), and each issuer encrypts the certificate data according to the corresponding private key to obtain an encrypted digital signature. The agent can receive the encrypted digital signatures sent by multiple issuers, and aggregate the encrypted digital signatures to obtain an aggregated signature. A digital identity certificate can be generated based on the aggregated signature, and the digital signature of the digital certificate can be verified by the verifier (i.e., the preset verification server). The verification of multiple digital signatures can be completed at one time, thereby improving the verification efficiency.

[0034] The present invention is described in detail below in conjunction with various embodiments.

[0035] Embodiment 1

[0036] According to an embodiment of the present invention, an embodiment of a method for generating a distributed digital identity certificate is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0037] Figure 1 is a flow chart of an optional method for generating a distributed digital identity certificate according to an embodiment of the present invention, such as Figure 1 As shown, the method comprises the following steps:

[0038] Step S101, controlling the preset proxy server to receive a proxy certification request, wherein the proxy certification request comes from at least one preset certification server, and the proxy certification request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset certification server.

[0039] Optionally, the verification platform system can be used to transmit and process data of the target terminal and each server. The preset issuing server (i.e., the entity responsible for issuing digital certificates (Verifiable Credentials, VC)) can verify the identity on the verification platform system (i.e., verify whether the preset issuing server has the issuing authority), and the preset proxy server (i.e., the entity that accepts proxy authorization from one or more issuers) can also verify the identity on the verification platform system (i.e., verify whether the preset proxy server can issue digital certificates on behalf of the server).

[0040] In this embodiment, multiple preset certificate issuing servers (i.e., issuers) can authorize a preset proxy server (i.e., agent) to issue digital certificates on their behalf. The preset proxy server can receive proxy issuance requests from any number of preset certificate issuing servers. The proxy issuance request carries at least proxy data, and the proxy data includes at least: the encrypted digital signature of the preset certificate issuing server.

[0041] For example, in a financial transaction system, a preset issuing service end (such as a financial institution) can authorize a preset proxy service end (such as a third-party payment platform) to process loan authentication transactions, and can send a proxy issuing request to the preset proxy service end.

[0042] Step S102: determine the aggregate signature based on the encrypted digital signature sent by each preset certificate issuing server, and generate a digital identity certificate based on the aggregate signature.

[0043] Optionally, each preset issuing server can use a private key to sign data (such as certificate application information) to generate an encrypted digital signature, which proves the source and integrity of the data. Only the preset issuing server holding the corresponding private key can generate a valid encrypted digital signature.

[0044] In this embodiment, the digital signatures of multiple preset issuing servers can be aggregated into a single signature. Multiple signatures can be combined to represent the common authentication of all preset issuing servers. The generation of an aggregate signature can enhance trust and represents a collection of multiple independent authentications. The aggregate signature is attached to a digital certificate to generate a digital identity certificate.

[0045] In summary, by controlling the preset proxy server to receive the proxy certification request, and based on the encrypted digital signature sent by each preset certification server, the aggregate signature can be determined, and a digital identity certificate can be generated based on the aggregate signature, thereby solving the technical problem in the related technology that a unique digital identity certificate cannot be effectively generated in the scenario of many-to-one authorization or multi-level authorization, resulting in a cumbersome and inefficient process for identity authentication.

[0046] In order to accurately generate a preset public key and a private key set, in the distributed digital identity certificate generation method provided in Example 1 of the present application, each preset issuing server is controlled to send a key generation request to the preset proxy server; based on the key generation request, the preset proxy server is controlled to generate a preset public key and a private key set, wherein the private key set includes at least: a private key generated for each preset issuing server.

[0047] Optionally, the preset proxy server can generate a private key for each preset certification server and a preset public key (ie, a single public key) for all preset certification servers, and can distribute the private key to each corresponding preset certification server and publish the generated preset public key.

[0048] In this embodiment, each preset certification server can be controlled to send a key generation request to the preset proxy server. According to the key generation request, a preset public key and a private key set (i.e., multiple private keys) can be generated in the key generation module of the preset proxy server (i.e., the agent), and the private key can be distributed to the corresponding preset certification server. The preset public key can then be made public by the preset proxy server.

[0049] In order to improve the accuracy of determining the preset public key and the private key of each preset issuing server, in the method for generating a distributed digital identity certificate provided in Example 1 of the present application, the modulus is determined based on the first preset prime number and the second preset prime number, and the preset function value is determined based on the modulus; the preset public key is determined based on the preset value and the preset function value; the private key of each preset issuing server is determined based on the preset public key and the preset function value; and the private key of each preset issuing server is added to the private key set.

[0050] Optionally, the modulus (such as n=p×q) can be calculated based on a first preset prime number (such as a larger prime number p) and a second preset prime number (such as a larger prime number q), and the preset function value (such as φ(n)=(p-1)×(q-1)) can be determined based on the modulus, and the preset public key (such as e) can be determined based on the preset value (such as 1) and the preset function value φ(n).

[0051] Exemplarily, an integer e (ie, a preset public key) may be selected between (1, φ(n)), and the preset convention needs to satisfy (e, φ(n)) = 1 (ie, e and φ(n) are mutually prime).

[0052] In this embodiment, the private key of each preset issuing server (such as d x ), where the private key of each preset issuing server needs to meet (e·d x )modφ(n)=1. Afterwards, the private key of each preset issuing server can be added to the private key set.

[0053] In order to accurately obtain an encrypted digital signature, in the method for generating a distributed digital identity certificate provided in Example 1 of the present application, the preset proxy server is controlled to make the preset public key public, and each private key in the private key set is sent to the corresponding preset issuing server; each preset issuing server is controlled to use the private key to encrypt the certificate data to obtain an encrypted digital signature, wherein the certificate data is determined by the preset issuing server based on the application data sent by the target terminal, and the application data is the data sent by the target terminal to the preset issuing server when applying for a digital identity certificate.

[0054] Optionally, the certificate holder can send application data including the certificate holder's identity information to each preset issuing server through a target terminal (such as a mobile phone, computer, etc.) based on the digital signatures of different preset issuing servers required for applying for the certificate. The preset issuing server can obtain the certificate data based on the application data.

[0055] In this embodiment, after the key generation module of the preset proxy server generates a preset public key and a private key set, the preset public key can be made public, and each private key in the private key set can be sent to the corresponding preset certificate issuing server. Each preset certificate issuing server can use the private key sent by the preset proxy server to encrypt the certificate data to obtain an encrypted digital signature.

[0056] In order to improve the accuracy of determining the encrypted digital signature, in the method for generating a distributed digital identity certificate provided in Example 1 of the present application, the hash summary value of the certificate data is determined; based on the modulus, the hash summary value of the certificate data is signed using a private key to obtain an encrypted digital signature.

[0057] Optionally, the certificate data can be hashed to convert certificate data of any length into a hash summary value of fixed length. The issuing server is preset to sign the hash summary value of the certificate data using its private key to generate an encrypted digital signature.

[0058] In this embodiment, according to the modulus (such as n), the private key (such as d x ) signs the message m (i.e. the certificate data) to generate an encrypted digital signature s x (like ).

[0059] In order to accurately obtain the aggregate signature, in the method for generating a distributed digital identity certificate provided in the first embodiment of the present application, the encrypted digital signature sent by each preset issuing server is aggregated based on the modulus to obtain the aggregate signature.

[0060] In this embodiment, it is assumed that there are k preset certificate issuing service terminals, each of which uses a private key (such as d 1 ,……,d k ) Generate an encrypted digital signature (such as s 1 ,s 2 ,...,s k ), all encrypted digital signatures can be sent to the aggregation node of the preset proxy server, and the aggregation node aggregates all signatures to generate an aggregate signature S (such as S = (s 1 ×s 2 ×…×s k )mod n).

[0061] In order to accurately verify the generated digital identity certificate, in the distributed digital identity certificate generation method provided in Example 1 of the present application, when it is detected that the digital identity certificate is used on the target terminal, the preset verification server is controlled to decrypt the aggregate signature based on the public preset public key and modulus to obtain the decrypted digital identity certificate; it is determined whether the decrypted digital identity certificate is the same as the certificate data on each preset issuing server, and when the decrypted digital identity certificate is the same as the certificate data on each preset issuing server, it is determined that the verification of the generated digital identity certificate is passed, wherein the certificate data on each preset issuing server is the same.

[0062] Optionally, the certificate holder (such as a user) can register an identity on the verification platform system through the target terminal (i.e., it can be used to distinguish different users), and the preset verification server (i.e., the entity that accepts and verifies digital credentials, such as a business organization, school, etc.) can also verify the identity on the verification platform system (i.e., verify whether the preset verification server has verification authority).

[0063] In this embodiment, when it is detected that the certificate holder uses the digital identity certificate on the target terminal (for example, when the certificate holder performs an operation on the target terminal (such as employment authentication, loan authentication, etc.), the preset verification server can decrypt the aggregate signature (ie, S) according to the preset public key (ie, e) and modulus (ie, n) disclosed by the preset proxy server (such as m′=S e modn), and obtain the decrypted digital identity certificate (i.e., the decrypted certificate data m′). It can be determined whether the decrypted digital identity certificate is identical to the certificate data on each preset issuing server (i.e., m). If the decrypted digital identity certificate is identical to the certificate data on each preset issuing server (i.e., m′=m), it is determined that the verification of the generated digital identity certificate is passed.

[0064] Figure 2 is a schematic diagram of an optional distributed digital identity authorization system structure based on multiple private keys and a single public key according to an embodiment of the present invention, such as Figure 2As shown, a distributed digital identity authorization system based on multiple private keys and a single public key may include different issuers (i.e., preset issuing servers, such as issuer 1, ..., issuer n), agents (i.e., preset agent servers), verifiers (i.e., preset verification servers), and verification platforms. The issuer, agent, and verifier need to verify their identities on the verification platform to indicate that they have corresponding authority. The user initiates a certificate application request to the issuer on the verification platform through the target terminal. The issuer initiates a key generation request to the agent (i.e., the agent authorized by the issuer) based on the certificate application request. The key generation module of the agent can generate multiple private keys (i.e., a private key set) and a single public key (i.e., a preset public key), and send the private keys to the corresponding issuers respectively. The issuer uses the private key to sign the certificate data and initiates an agent issuance request to the agent. After generating the digital identity certificate, the agent can issue a verifiable credential (i.e., a digital identity certificate) on the verification platform. When it is detected that the user needs to use the verifiable credential, the verifier verifies the digital identity certificate based on the preset public key.

[0065] In an embodiment of the present invention, through the verification platform system, a user can use a target terminal to send a certificate application request to multiple preset certificate issuing servers. For each preset certificate issuing server, certificate data can be generated according to the certificate application request, and a key generation request can be initiated to the preset proxy server. The key generation module of the preset proxy server can generate a preset public key and a private key set, and distribute the private key to the corresponding preset certificate issuing server. The preset public key can be made public, and then the preset certificate issuing server signs the certificate data according to the private key to generate an encrypted digital signature, which can be sent to the preset proxy server. The preset proxy server aggregates the encrypted digital signatures sent by each preset certificate issuing server to obtain an aggregated signature and attach it to the digital identity certificate. After that, the generated digital identity certificate can be uploaded to the verification platform system. The user can obtain the digital identity certificate through the verification platform system. When it is detected that the digital identity certificate is used on the target terminal, the preset verification server can be controlled to verify the digital identity certificate according to the preset public key, which can realize the verification of multiple digital signatures at one time, thereby improving the verification speed, thereby achieving the technical effect of accurately and efficiently verifying multiple digital signatures and improving system performance.

[0066] The following is a detailed description in conjunction with another embodiment.

[0067] Embodiment 2

[0068] A distributed digital identity generation device provided in this embodiment includes multiple implementation units, each implementation unit corresponds to each implementation step in the above-mentioned embodiment 1.

[0069] Figure 3is a schematic diagram of an optional distributed digital identity generation device according to an embodiment of the present invention, such as Figure 3 As shown, the distributed digital identity generation device may include: a control unit 30 and a processing unit 31.

[0070] The control unit 30 is used to control the preset proxy server to receive a proxy certification request, wherein the proxy certification request comes from at least one preset certification server, and the proxy certification request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset certification server;

[0071] The processing unit 31 is used to determine the aggregate signature based on the encrypted digital signature sent by each preset certificate issuing server, and generate a digital identity certificate based on the aggregate signature.

[0072] The above-mentioned distributed digital identity generation device can control the preset proxy server to receive the proxy issuance request through the control unit 30, determine the aggregate signature based on the encrypted digital signature sent by each preset issuance server through the processing unit 31, and generate a digital identity certificate based on the aggregate signature.

[0073] Optionally, the generating device includes: a first control module, used to control each preset certification server to send a key generation request to the preset proxy server before controlling the preset proxy server to receive the proxy certification request; a second control module, used to control the preset proxy server to generate a preset public key and a private key set based on the key generation request, wherein the private key set includes at least: a private key generated for each preset certification server.

[0074] Optionally, the second control module includes: a first determination submodule, used to determine the modulus based on the first preset prime number and the second preset prime number, and determine the preset function value based on the modulus; a second determination submodule, used to determine the preset public key based on the preset value and the preset function value; a third determination submodule, used to determine the private key of each preset issuing server based on the preset public key and the preset function value; a first adding submodule, used to add the private key of each preset issuing server to the private key set.

[0075] Optionally, the generating device also includes: a first processing module, used to control the preset proxy server to make the preset public key public before controlling the preset proxy server to receive the proxy certification request, and send each private key in the private key set to the corresponding preset certification server; a first encryption module, used to control each preset certification server to use the private key to encrypt the certificate data to obtain an encrypted digital signature, wherein the certificate data is determined by the preset certification server based on the application data sent by the target terminal, and the application data is the data sent by the target terminal to the preset certification server when applying for a digital identity certificate.

[0076] Optionally, the first encryption module includes: a fourth determination submodule, used to determine the hash summary value of the certificate data; and a first signature module, used to sign the hash summary value of the certificate data based on the modulus using a private key to obtain an encrypted digital signature.

[0077] Optionally, the generating device further includes: a first aggregation module, configured to aggregate the encrypted digital signatures sent by each preset issuing server based on a modulus to obtain an aggregated signature.

[0078] Optionally, the processing unit includes: a first decryption module, which is used to control the preset verification server to decrypt the aggregate signature based on the public preset public key and modulus to obtain a decrypted digital identity certificate when it is detected that the digital identity certificate is used on the target terminal; a first determination module, which is used to determine whether the decrypted digital identity certificate is the same as the certificate data on each preset issuing server, and when the decrypted digital identity certificate is the same as the certificate data on each preset issuing server, determine that the verification of the generated digital identity certificate is passed, wherein the certificate data on each preset issuing server is the same.

[0079] The above-mentioned distributed digital identity generation device may also include a processor and a memory. The above-mentioned control unit 30, processing unit 31, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0080] The processor includes a kernel, and the kernel retrieves the corresponding program unit from the memory. One or more kernels may be set, and a digital identity certificate may be generated based on the aggregate signature by adjusting kernel parameters.

[0081] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0082] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including a non-volatile computer-readable storage medium, the non-volatile computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the method for generating a distributed digital identity certificate of any one of the above items is implemented.

[0083] When the computer program product is executed on a data processing device, it is suitable for executing an initialization program having the following method steps: controlling the preset proxy server to receive a proxy certification request, determining an aggregate signature based on the encrypted digital signature sent by each preset certification server, and generating a digital identity certificate based on the aggregate signature.

[0084] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement the above-mentioned method for generating a distributed digital identity certificate.

[0085] Figure 4 1 is a hardware structure block diagram of an electronic device (or mobile device) for generating a distributed digital identity certificate according to an embodiment of the present invention. Figure 4 As shown, the electronic device may include one or more processors (e.g., Figure 4 The processor 402a, processor 402b, ..., processor 402n, etc., which may include but are not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 404 for storing data. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 4 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 4 More or fewer components as shown, or with Figure 4 Different configurations are shown.

[0086] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0087] The embodiments or examples of the present disclosure are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection of the present disclosure. In the absence of contradiction, each step in a certain embodiment or example can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0088] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0089] In the several embodiments provided by the present invention, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0090] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0091] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0092] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0093] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for generating a distributed digital identity certificate, characterized in that: include: Controlling the preset proxy server to receive a proxy certification request, wherein the proxy certification request comes from at least one preset certification server, and the proxy certification request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset certification server; Based on the encrypted digital signature sent by each of the preset certificate issuing servers, an aggregate signature is determined, and based on the aggregate signature, a digital identity certificate is generated.

2. The method for generating a distributed digital identity certificate according to claim 1, characterized in that: Before the preset proxy server is controlled to receive the proxy certification request, it includes: Control each of the preset certificate issuing servers to send a key generation request to the preset proxy server; Based on the key generation request, the preset proxy server is controlled to generate a preset public key and a private key set, wherein the private key set at least includes: a private key generated for each of the preset certification servers.

3. The method for generating a distributed digital identity certificate according to claim 2, characterized in that: Based on the key generation request, the step of controlling the preset proxy server to generate a preset public key and a set of private keys includes: Determine a modulus based on a first preset prime number and a second preset prime number, and determine a preset function value based on the modulus; Determining the preset public key based on a preset value and the preset function value; Determine the private key of each of the preset certification service ends based on the preset public key and the preset function value; The private key of each of the preset certification servers is added to the private key set.

4. The method for generating a distributed digital identity certificate according to claim 1, characterized in that: Before controlling the preset proxy server to receive the proxy certification request, it also includes: Control the preset proxy server to make the preset public key public, and send each private key in the private key set to the corresponding preset certification server; Control each of the preset issuing servers to use the private key to encrypt the certificate data to obtain the encrypted digital signature, wherein the certificate data is determined by the preset issuing server based on the application data sent by the target terminal, and the application data is the data sent by the target terminal to the preset issuing server when applying for the digital identity certificate.

5. The method for generating a distributed digital identity certificate according to claim 4, characterized in that: The step of controlling each of the preset certificate issuing servers to use the private key to encrypt the certificate data to obtain the encrypted digital signature comprises: Determining a hash digest value of the certificate data; Based on the modulus, the hash summary value of the certificate data is signed using the private key to obtain the encrypted digital signature.

6. The method for generating a distributed digital identity certificate according to claim 1, characterized in that: The step of determining the aggregate signature based on the encrypted digital signature sent by each of the preset issuing servers comprises: Based on the modulus, the encrypted digital signature sent by each of the preset issuing servers is aggregated to obtain the aggregate signature.

7. The method for generating a distributed digital identity certificate according to claim 6, characterized in that: After generating a digital identity certificate based on the aggregate signature, the following steps are included: When it is detected that the digital identity certificate is used on the target terminal, controlling the preset verification server to decrypt the aggregate signature based on the public preset public key and the modulus to obtain the decrypted digital identity certificate; Determine whether the decrypted digital identity certificate is identical to the certificate data on each of the preset issuing servers, and if the decrypted digital identity certificate is identical to the certificate data on each of the preset issuing servers, determine that the verification of the generated digital identity certificate is passed, wherein the certificate data on each of the preset issuing servers is identical.

8. A distributed digital identity generation device, characterized in that: include: A control unit, used to control a preset proxy server to receive a proxy certification request, wherein the proxy certification request comes from at least one preset certification server, and the proxy certification request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset certification server; The processing unit is used to determine the aggregate signature based on the encrypted digital signature sent by each of the preset certificate issuing servers, and generate a digital identity certificate based on the aggregate signature.

9. A computer program product, characterized in that It comprises a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for generating a distributed digital identity certificate as described in any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for generating a distributed digital identity certificate as described in any one of claims 1 to 7.

Images