Distributed digital identity verification method, device, and electronic device

Abstract

The present invention discloses a distributed digital identity verification method, device, and electronic device, relating to the field of blockchain technology. The verification method comprises: controlling a registration module of a preset proxy server to receive a proxy request; determining a preset tag based on an encrypted digital signature sent by each preset issuing server; generating a digital identity certificate based on the preset tag; and, upon detecting that a digital identity certificate is being used on a client, controlling a verification module of a preset verification server to verify the digital identity certificate based on the public certificate data on each preset issuing server. The present invention solves the technical problem of low efficiency in simultaneously verifying multiple digital identities in related technologies.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a distributed digital identity verification method, device, and electronic device. Background Art

[0002] Distributed digital identity is a new identity authentication system built on blockchain technology. It uses distributed ledger technologies such as blockchain to give each user a unique and tamper-proof identifier, allowing users to independently control and manage their own identity information, and achieve autonomous verification, secure storage and privacy protection of identity data.

[0003] The current distributed digital identity system, based on the specifications developed by the W3C (World Wide Web Consortium), is mainly operated collaboratively by issuers, holders, and verifiers to complete the digital identity credential issuance, registration, and verification processes, realizing distributed management of identity information and enhancing the security and privacy protection of identity authentication.

[0004] However, when encountering complex scenarios with multi-level authorization or one-to-many authorization, the current distributed digital identity system needs to verify the signatures of multiple issuers one by one for each verification. This linear verification method slows down the overall process and reduces system performance. This problem becomes particularly prominent when a large number of issuers are involved, which has an adverse impact on user experience and system throughput.

[0005] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0006] The embodiments of the present invention provide a distributed digital identity verification method, apparatus, and electronic device thereof, to at least solve the technical problem of low efficiency in simultaneously verifying multiple digital identities in the related art.

[0007] According to one aspect of an embodiment of the present invention, a method for verifying a distributed digital identity is provided, comprising: controlling a registration module of a preset proxy server to receive a proxy request, wherein the proxy request comes from at least one preset certificate issuing server, and the proxy request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset certificate issuing server; determining a preset tag based on the encrypted digital signature sent by each of the preset certificate issuing servers; generating a digital identity certificate based on the preset tag; and, upon detecting that the digital identity certificate is used on a client, controlling a verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each of the preset certificate issuing servers.

[0008] Furthermore, before controlling the registration module of the preset proxy server to receive the proxy request, it includes: controlling each of the preset certificate issuance servers to receive the application issuance request sent by the client, wherein the application issuance request carries at least application data, and the application data includes at least: the certificate type data of the client; based on the application data, using the preset private key to encrypt the certificate data of the preset certificate issuance server indicated by the certificate type data to obtain the encrypted digital signature.

[0009] Furthermore, the step of determining the preset tag based on the encrypted digital signature sent by each of the preset certification server ends includes: controlling the signature module of the preset proxy server end to receive the encrypted digital signature sent by the registration module; adding the encrypted digital signature of each of the preset certification server ends to the digital signature set; and determining the preset tag based on the digital signature set.

[0010] Furthermore, the step of determining the preset label based on the digital signature set includes: representing each of the encrypted digital signatures in the digital signature set as a leaf node, and calculating the hash value of each leaf node; constructing Merkle tree data based on the hash value of each leaf node; and determining the preset label based on the Merkle tree data, wherein the preset label includes: all hash values on the path from the leaf node to the root node.

[0011] Furthermore, the step of constructing Merkle tree data based on the hash value of each leaf node includes: merging every two leaf nodes to obtain multiple merged leaf nodes, and calculating the merged hash value of the merged leaf nodes; merging every two merged leaf nodes until one merged leaf node remains, and representing the remaining merged leaf node as the root node; calculating the root node hash value of the root node; and constructing the Merkle tree data based on the hash value of each leaf node, the merged hash value of the merged leaf node after merger, and the root node hash value of the root node.

[0012] Furthermore, the verification module of the preset verification server is controlled to verify the digital identity certificate based on the public certificate data on each of the preset issuing servers, including: decrypting each of the encrypted digital signatures in the digital signature set based on the preset public key on each of the preset issuing servers to obtain the decrypted certificate data; for each of the decrypted certificate data, determining whether the certificate data is the same as the public certificate data on the preset issuing server corresponding to the certificate data; and verifying the digital identity certificate based on the digital signature set when all of the certificate data are the same as the public certificate data on the preset issuing server corresponding to the certificate data.

[0013] Furthermore, the step of verifying the digital identity certificate based on the digital signature set includes: recalculating the hash value of the root node based on the digital signature set to obtain the verification hash value of the root node; judging whether the verification hash value of the root node is the same as the root node hash value of the root node, and if the verification hash value is the same as the root node hash value, determining that the digital identity certificate verification is passed.

[0014] According to another aspect of an embodiment of the present invention, a distributed digital identity verification device is also provided, including: a control unit, used to control the registration module of a preset proxy server to receive a proxy request, wherein the proxy request comes from at least one preset issuing server, and the proxy request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset issuing server; a determination unit, used to determine a preset tag based on the encrypted digital signature sent by each of the preset issuing servers; a generation unit, used to generate a digital identity certificate based on the preset tag; and a verification unit, used to control the verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each of the preset issuing servers when it is detected that the digital identity certificate is used on the client.

[0015] Furthermore, the verification device includes: a first control module, used to control each of the preset certification server to receive the application certification request sent by the client before controlling the registration module of the preset proxy server to receive the proxy request, wherein the application certification request carries at least application data, and the application data includes at least: the certificate type data of the client; a first encryption module, used to encrypt the certificate data of the preset certification server indicated by the certificate type data based on the application data using a preset private key to obtain the encrypted digital signature.

[0016] Furthermore, the determination unit includes: a second control module, used to control the signature module of the preset proxy server to receive the encrypted digital signature sent by the registration module; a first processing module, used to add the encrypted digital signature of each of the preset issuing server to the digital signature set; and a first determination module, used to determine the preset label based on the digital signature set.

[0017] Furthermore, the first determination module includes: a first processing sub-module, used to represent each of the encrypted digital signatures in the digital signature set as a leaf node, and calculate the hash value of each leaf node; a first construction sub-module, used to construct Merkle tree data based on the hash value of each leaf node; a first determination sub-module, used to determine the preset label based on the Merkle tree data, wherein the preset label includes: all hash values on the path from the leaf node to the root node.

[0018] Furthermore, the first construction submodule includes: a second processing submodule, used to merge every two leaf nodes to obtain multiple merged leaf nodes, and calculate the merged hash value of the merged leaf nodes; a third processing submodule, used to merge every two merged leaf nodes until one merged leaf node remains, and represent the remaining merged leaf node as the root node; a first calculation submodule, used to calculate the root node hash value of the root node; and a second construction submodule, used to construct the Merkle tree data based on the hash value of each leaf node, the merged hash value of the merged leaf node after merger, and the root node hash value of the root node.

[0019] Furthermore, the verification unit includes: a first decryption module, used to decrypt each of the encrypted digital signatures in the digital signature set based on a preset public key on each of the preset issuing server ends to obtain the decrypted certificate data; a first judgment module, used to judge, for each decrypted certificate data, whether the certificate data is the same as the public certificate data on the preset issuing server end corresponding to the certificate data; a first verification module, used to verify the digital identity certificate based on the digital signature set when all the certificate data are the same as the public certificate data on the preset issuing server end corresponding to the certificate data.

[0020] Furthermore, the first verification module includes: a second calculation submodule, used to recalculate the hash value of the root node based on the digital signature set to obtain the verification hash value of the root node; a fourth processing submodule, used to determine whether the verification hash value of the root node is the same as the root node hash value of the root node, and if the verification hash value is the same as the root node hash value, determine that the verification of the digital identity certificate is passed.

[0021] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements any one of the above-mentioned methods for verifying a distributed digital identity.

[0022] According to another aspect of an embodiment of the present invention, an electronic device is also provided, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned distributed digital identity verification methods.

[0023] In the present invention, a registration module of a preset proxy server is controlled to receive a proxy request, a preset tag is determined based on the encrypted digital signature sent by each preset issuing server, and a digital identity certificate is generated based on the preset tag. When it is detected that the digital identity certificate is used on the client, the verification module of the preset verification server is controlled to verify the digital identity certificate based on the public certificate data on each preset issuing server, thereby solving the technical problem of low efficiency in verifying multiple digital identities at the same time in the related art.

[0024] In the present invention, the registration module of the preset proxy server can be controlled to receive the proxy request, and the preset label can be determined according to the encrypted digital signature sent by each preset issuing server. Then, a digital identity certificate can be generated according to the preset label, and the generated digital identity certificate can be uploaded to the verification platform system. The client can obtain the digital identity certificate through the verification platform system. When it is detected that the digital identity certificate is used on the client, the verification module of the preset verification server can be controlled to verify the digital identity certificate based on the public certificate data on each preset issuing server. It is possible to verify multiple digital identity certificates at one time, thereby achieving the technical effect of accurately and efficiently verifying multiple digital identity certificates and improving system performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0026] Figure 1 is a flow chart of an optional distributed digital identity verification method according to an embodiment of the present invention;

[0027] Figure 2 is a schematic diagram of an optional Merkle tree-based distributed digital identity authorization system structure according to an embodiment of the present invention;

[0028] Figure 3 is a schematic diagram of an optional distributed digital identity verification device according to an embodiment of the present invention;

[0029] Figure 4 The present invention is a block diagram of the hardware structure of an electronic device (or mobile device) for a distributed digital identity verification method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected and involved in the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse. For example, an interface is set up between this system and the relevant users or institutions. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or institution through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or institution.

[0033] In the present invention, by adding a proxy server and aggregating the digital signatures of multiple issuers on the proxy server, authorization management is made clearer and easier to handle. The Merkle tree technology can reduce the exposure of identity information during frequent signature verification processes, while keeping the complexity of the verification process at a low level. Even when the number of issuers increases dramatically, the verification process can still be carried out quickly, thereby shortening the user's waiting time, increasing the verification speed, and further improving the scalability of the system.

[0034] The present invention will be described in detail below with reference to various embodiments.

[0035] Example 1

[0036] According to an embodiment of the present invention, an embodiment of a method for verifying a distributed digital identity is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0037] Figure 1 is a flow chart of an optional distributed digital identity verification method according to an embodiment of the present invention, such as Figure 1 As shown, the method includes the following steps:

[0038] Step S101: Control the registration module of the preset proxy server to receive a proxy request, wherein the proxy request comes from at least one preset certification server, and the proxy request carries at least proxy data, which includes at least an encrypted digital signature of the preset certification server.

[0039] Optionally, the verification platform system can be used to transmit and process data from the client and each server. The preset issuing server (i.e., the entity responsible for issuing digital certificates (Verifiable Credentials, VC)) can verify the identity on the verification platform system (i.e., verify whether the preset issuing server has the authority to issue certificates), and the preset proxy server (i.e., the entity that accepts proxy authorization from one or more issuers) can also verify the identity on the verification platform system (i.e., verify whether the preset proxy server can issue digital certificates on behalf of the server).

[0040] In this embodiment, the preset certificate issuing server can authorize the preset proxy server to issue digital certificates on its behalf, and the proxy registration module of the preset proxy server can receive proxy requests from any number of preset certificate issuing servers. The proxy request carries at least the encrypted digital signature of each preset certificate issuing server, and the encrypted digital signature can be made public through the registration module of the preset proxy server.

[0041] Step S102: Determine a preset tag based on the encrypted digital signature sent by each preset certification server.

[0042] Optionally, a preset label (ie, a hash tree structure, such as a Merkle tree) may be determined based on the encrypted digital signature sent by each preset certification server.

[0043] In this embodiment, a hash algorithm may be used to calculate each encrypted digital signature to generate a Merkle tree label (ie, a preset label).

[0044] Step S103: Generate a digital identity certificate based on the preset tag.

[0045] Optionally, when the preset issuing server issues a digital certificate, a Merkle tree tag (i.e., a preset tag) is generated through a hash algorithm based on the digital signatures of one or more issuers. The determined preset tag can be attached to the digital certificate to generate a digital identity certificate, and the digital identity certificate can be uploaded to the verification platform system. The client can obtain the digital identity certificate in the verification platform system.

[0046] Step S104 : when it is detected that the digital identity certificate is used on the client, the verification module of the preset verification server is controlled to verify the digital identity certificate based on the public certificate data on each preset issuing server.

[0047] Optionally, users can register their identities on the verification platform system through a client (such as a computer or mobile phone) (i.e., they can be used to distinguish different users), and the preset verification server (i.e., an entity that accepts and verifies digital credentials, such as a business organization, school, etc.) can also verify the identities on the verification platform system (i.e., verify whether the preset verification server has verification authority).

[0048] In this embodiment, after the client obtains the digital identity certificate, when it detects that the digital identity certificate is used on the client, it controls the verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each preset issuing server (that is, the content data on the certificate applied for by the client).

[0049] In this embodiment, when a user performs an operation on the client (such as employment authentication, loan authentication, etc.), the verification module of the preset verification server can verify the user's identity and qualifications. By verifying the Merkle tree label on the digital identity certificate and the digital signature of the issuer, the signature verification of multiple issuers' authorizations can be completed at one time.

[0050] In summary, by controlling the registration module of the preset proxy server to receive proxy requests, the preset tag can be determined based on the encrypted digital signature sent by each preset issuing server, and then a digital identity certificate is generated based on the preset tag, and the digital certificate is uploaded to the verification platform system. After that, the client can obtain the digital identity certificate in the verification platform system. When it is detected that the digital identity certificate is used on the client, the verification module of the preset verification server is controlled to verify the digital identity certificate according to the public certificate data on each preset issuing server, thereby solving the technical problem of low efficiency in verifying multiple digital identities at the same time in the related technology.

[0051] In order to accurately determine the encrypted digital signature, in the distributed digital identity verification method provided in Example 1 of the present application, each preset issuing server is controlled to receive the application issuance request sent by the client, wherein the application issuance request carries at least application data, and the application data includes at least: the certificate type data of the client; based on the application data, the certificate data of the preset issuing server indicated by the certificate type data is encrypted using a preset private key to obtain an encrypted digital signature.

[0052] Optionally, when a user needs to apply for a digital certificate from multiple preset issuing servers, the client can initiate an application request to multiple preset issuing servers. Each preset issuing server receives the application request sent by the client. The application request carries at least the client's user information data and certificate type data (used to indicate the preset issuing server).

[0053] In this embodiment, the preset private key may be used to encrypt the certificate data of the preset issuing server indicated by the certificate type data (including the user information data of the client and the certificate content) to obtain an encrypted digital signature.

[0054] In order to accurately determine the preset tag, in the distributed digital identity verification method provided in Example 1 of the present application, the signature module of the preset proxy server is controlled to receive the encrypted digital signature sent by the registration module; the encrypted digital signature of each preset issuing server is added to the digital signature set; and the preset tag is determined based on the digital signature set.

[0055] Optionally, after generating the encrypted digital signature, the registration module of the preset proxy server can send the encrypted digital signature to the signature module of the preset proxy server, control the signature module of the preset proxy server to receive the sent encrypted digital signature, and add the encrypted digital signature of each preset issuing server to the digital signature set.

[0056] In this embodiment, in the signature module of the preset proxy server, a hash value of each digital signature in the digital signature set may be calculated according to the digital signature set, and a preset tag may be determined according to each hash value.

[0057] In order to improve the accuracy of determining the preset label, it is necessary to first construct Merkle tree data. In the distributed digital identity verification method provided in Example 1 of the present application, each encrypted digital signature in the digital signature set is represented as a leaf node, and the hash value of each leaf node is calculated; based on the hash value of each leaf node, Merkle tree data is constructed; based on the Merkle tree data, the preset label is determined, wherein the preset label includes: all hash values on the path from the leaf node to the root node.

[0058] Optionally, the Merkle tree data of the encrypted digital signature can be calculated and used as the encrypted digital signature aggregation (ie, the preset label) of the preset certification server.

[0059] In this embodiment, each encrypted digital signature in the digital signature set can be represented as a leaf node, and the hash value of each leaf node can be calculated. Based on the hash value of each leaf node, Merkle tree data can be constructed, and based on the Merkle tree data, the preset label (including all hash values on the path from the leaf node to the root node) can be determined.

[0060] In order to deterministically construct Merkle tree data, in the distributed digital identity verification method provided in Example 1 of the present application, every two leaf nodes are merged to obtain multiple merged leaf nodes, and the merged hash value of the merged leaf nodes is calculated; every two merged leaf nodes are merged until one merged leaf node remains, and the remaining merged leaf nodes are represented as root nodes; the root node hash value of the root node is calculated; and based on the hash value of each leaf node, the merged hash value of the merged leaf node after the merger, and the root node hash value of the root node, Merkle tree data is constructed.

[0061] Optionally, every two leaf nodes are merged to obtain multiple merged leaf nodes. If the number of leaf nodes is odd, the last leaf node can be paired with itself and the merged hash value of the merged leaf nodes can be calculated.

[0062] In this embodiment, every two merged leaf nodes are merged until one merged leaf node remains, and the merged leaf node is represented as a root node, and the root node hash value of the root node can be calculated. According to the hash value of each leaf node, the merged hash value of the merged leaf node after the merger, and the root node hash value of the root node, Merkle tree data can be constructed.

[0063] In order to verify the digital identity certificate, in the distributed digital identity verification method provided in Example 1 of the present application, each encrypted digital signature in the digital signature set is decrypted based on the preset public key on each preset issuing server to obtain the decrypted certificate data; for each decrypted certificate data, it is determined whether the certificate data is the same as the public certificate data on the preset issuing server corresponding to the certificate data; when all certificate data are the same as the public certificate data on the preset issuing server corresponding to the certificate data, the digital identity certificate is verified based on the digital signature set.

[0064] Optionally, each encrypted digital signature in the digital signature set can be verified by the public key disclosed by the issuer (i.e., the preset issuing server), proving that the encrypted digital signature can only be issued by the issuer. Each encrypted digital signature in the digital signature set can be decrypted according to the preset public key on each preset issuing server to obtain the decrypted certificate data. For each decrypted certificate data, it is determined whether the certificate data is the same as the public certificate data on the preset issuing server corresponding to the certificate data. If they are the same, the consistency of the digital signature is proved.

[0065] In this embodiment, when all certificate data are identical to the public certificate data on the preset issuing server corresponding to the certificate data, the digital identity certificate can be verified based on the digital signature set.

[0066] In order to improve the accuracy of verifying digital identity certificates, in the distributed digital identity verification method provided in Example 1 of the present application, the hash value of the root node is recalculated based on the digital signature set to obtain the verification hash value of the root node; it is determined whether the verification hash value of the root node is the same as the root node hash value of the root node; if the verification hash value is the same as the root node hash value, it is determined that the digital identity certificate verification has passed.

[0067] Optionally, the Merkle tree root node can be generated according to the encrypted digital signatures of all participating preset issuing servers (i.e., the digital signature set) in accordance with the same process as when generating the preset label (i.e., recalculating the hash value of the root node) to obtain the verification hash value of the root node.

[0068] In this embodiment, it is possible to determine whether the verification hash value of the root node is the same as the root node hash value of the root node, and if the verification hash value is the same as the root node hash value, determine that the verification of the digital identity certificate is passed. In this way, the verification of multiple encrypted digital signatures can be completed at one time.

[0069] Figure 2 : is a schematic diagram of an optional Merkle tree-based distributed digital identity authorization system structure according to an embodiment of the present invention, such as Figure 2 As shown, a distributed digital identity authorization system based on a Merkle tree can include different issuers (i.e., preset issuing servers, such as issuer 1, ..., issuer n), agents (i.e., preset agent servers), holders (i.e., the client where the user is located), verifiers (i.e., preset verification servers), and a verification platform. The holder needs to register his / her identity on the verification platform, and the issuer, agent, and verifier need to verify their identities on the verification platform to demonstrate their corresponding authority. The holder can initiate a certificate request to the issuer on the verification platform to obtain a digital credential, thereby proving the user's identity and qualifications in the digital world. Based on the certificate request, the issuer initiates an agent request to the agent (i.e., the agent authorized by the issuer). After generating a digital identity certificate, the agent can publish a verifiable credential (i.e., a digital identity certificate) on the verification platform so that the holder can obtain the verifiable credential. If it is detected that the holder needs to use the verifiable credential, the holder can submit the verifiable credential on the verification platform, and the verifier verifies the verifiable credential based on the preset tag and digital signature set.

[0070] In an embodiment of the present invention, through the verification platform system, the client can send certificate application requests to multiple preset certificate issuing servers. For each preset certificate issuing server, an encrypted digital signature can be generated according to the certificate application request, and a proxy request can be initiated to the preset proxy server. Then, the registration module of the preset proxy server receives the proxy request of each preset certificate issuing server, and can determine the preset tag based on the encrypted digital signature carried by the proxy request. According to the preset tag, a digital identity certificate can be generated, and then the generated digital identity certificate can be uploaded to the verification platform system. The client can obtain the digital identity certificate through the verification platform system. When it is detected that the digital identity certificate is used on the client, the verification module of the preset verification server can be controlled to verify the digital identity certificate based on the public certificate data on each preset certificate issuing server. It can realize verification of multiple digital identity certificates at one time, thereby improving the verification speed, thereby achieving the technical effect of accurately and efficiently verifying multiple digital identity certificates and improving system performance.

[0071] The following describes it in detail with reference to another embodiment.

[0072] Example 2

[0073] A distributed digital identity verification device provided in this embodiment includes multiple implementation units, each implementation unit corresponding to each implementation step in the above-mentioned embodiment 1.

[0074] Figure 3 is a schematic diagram of an optional distributed digital identity verification device according to an embodiment of the present invention, such as Figure 3 As shown, the distributed digital identity verification device may include: a control unit 30, a determination unit 31, a generation unit 32, and a verification unit 33.

[0075] The control unit 30 is configured to control the registration module of the preset proxy server to receive a proxy request, wherein the proxy request comes from at least one preset issuing server, and the proxy request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset issuing server;

[0076] A determination unit 31, configured to determine a preset tag based on the encrypted digital signature sent by each preset issuing server;

[0077] A generating unit 32, configured to generate a digital identity certificate based on a preset tag;

[0078] The verification unit 33 is configured to control the verification module of the preset verification server to verify the digital identity certificate based on the public certificate data of each preset issuing server when detecting that the digital identity certificate is used on the client.

[0079] The above-mentioned distributed digital identity verification device can control the registration module of the preset proxy server to receive a proxy request through the control unit 30, determine the preset tag based on the encrypted digital signature sent by each preset issuing server through the determination unit 31, generate a digital identity certificate based on the preset tag through the generation unit 32, and control the verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each preset issuing server through the verification unit 33 when it is detected that the digital identity certificate is used on the client. In an embodiment of the present invention, the registration module of the preset proxy server can be controlled to receive a proxy request, and the preset tag can be determined based on the encrypted digital signature sent by each preset issuing server. Based on the preset tag, a digital identity certificate can be generated. When it is detected that the digital identity certificate is used on the client, the verification module of the preset verification server is controlled to verify the digital identity certificate based on the public certificate data on each preset issuing server.

[0080] Optionally, the verification device includes: a first control module, used to control each preset certification server to receive an application certification request sent by the client before controlling the registration module of the preset proxy server to receive the proxy request, wherein the application certification request carries at least application data, and the application data includes at least: the certificate type data of the client; a first encryption module, used to encrypt the certificate data of the preset certification server indicated by the certificate type data using a preset private key based on the application data to obtain an encrypted digital signature.

[0081] Optionally, the determination unit includes: a second control module, used to control the signature module of the preset proxy server to receive the encrypted digital signature sent by the registration module; a first processing module, used to add the encrypted digital signature of each preset issuing server to the digital signature set; and a first determination module, used to determine the preset label based on the digital signature set.

[0082] Optionally, the first determination module includes: a first processing sub-module, used to represent each encrypted digital signature in the digital signature set as a leaf node, and calculate the hash value of each leaf node; a first construction sub-module, used to construct Merkle tree data based on the hash value of each leaf node; a first determination sub-module, used to determine a preset label based on the Merkle tree data, wherein the preset label includes: all hash values on the path from the leaf node to the root node.

[0083] Optionally, the first construction submodule includes: a second processing submodule, used to merge every two leaf nodes to obtain multiple merged leaf nodes, and calculate the merged hash value of the merged leaf nodes; a third processing submodule, used to merge every two merged leaf nodes until one merged leaf node remains, and represent the remaining merged leaf nodes as root nodes; a first calculation submodule, used to calculate the root node hash value of the root node; and a second construction submodule, used to construct Merkle tree data based on the hash value of each leaf node, the merged hash value of the merged leaf node after merger, and the root node hash value of the root node.

[0084] Optionally, the verification unit includes: a first decryption module, used to decrypt each encrypted digital signature in the digital signature set based on a preset public key on each preset issuing server to obtain decrypted certificate data; a first judgment module, used to judge, for each decrypted certificate data, whether the certificate data is the same as the public certificate data on the preset issuing server corresponding to the certificate data; a first verification module, used to verify the digital identity certificate based on the digital signature set when all certificate data are the same as the public certificate data on the preset issuing server corresponding to the certificate data.

[0085] Optionally, the first verification module includes: a second calculation submodule, used to recalculate the hash value of the root node based on the digital signature set to obtain the verification hash value of the root node; a fourth processing submodule, used to determine whether the verification hash value of the root node is the same as the root node hash value of the root node, and if the verification hash value is the same as the root node hash value, determine that the digital identity certificate verification is passed.

[0086] The above-mentioned distributed digital identity verification device may also include a processor and a memory. The above-mentioned control unit 30, determination unit 31, generation unit 32, verification unit 33, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0087] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the digital identity certificate can be verified by adjusting kernel parameters.

[0088] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0089] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements any of the above-mentioned distributed digital identity verification methods.

[0090] When the computer program product is executed on a data processing device, it is suitable for executing an initialization program having the following method steps: controlling a registration module of a preset proxy server to receive a proxy request, determining a preset tag based on the encrypted digital signature sent by each preset certification server, generating a digital identity certificate based on the preset tag, and, upon detecting that the digital identity certificate is used on the client, controlling a verification module of a preset verification server to verify the digital identity certificate based on the public certificate data on each preset certification server.

[0091] According to another aspect of an embodiment of the present invention, an electronic device is also provided, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement the above-mentioned distributed digital identity verification method.

[0092] Figure 4 FIG. 1 is a hardware structure block diagram of an electronic device (or mobile device) for a distributed digital identity verification method according to an embodiment of the present invention. Figure 4 As shown, the electronic device may include one or more processors (e.g., Figure 4 The processors 402a, 402b, ..., 402n, etc., which may include but are not limited to processing devices such as microprocessors (MCUs) or programmable logic devices (FPGAs), and a memory 404 for storing data. In addition, the processors 402a, 402b, ..., 402n, etc., may also include: a display, an input / output interface (I / 0 interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / 0 interface), a network interface, a keyboard, a power supply, and / or a camera. It will be understood by those skilled in the art that Figure 4 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 4 More or fewer components than shown, or with Figure 4 Different configurations shown.

[0093] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0094] The embodiments or examples of the present disclosure are not exhaustive, but are merely illustrations of some embodiments or examples, and are not intended to be specific limitations on the scope of protection of the present disclosure. In the absence of contradiction, each step in a certain embodiment or example can be implemented as an independent example, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be arbitrarily combined; in addition, the various embodiments or examples can be arbitrarily combined. For example, some or all steps of different embodiments or examples can be arbitrarily combined, and a certain embodiment or example can be arbitrarily combined with the optional methods or optional examples of other embodiments or examples.

[0095] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0096] In the several embodiments provided by the present invention, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are merely illustrative. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, and can be electrical or other forms.

[0097] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0098] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0099] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

[0100] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A distributed digital identity verification method, characterized in that: include: When a user applies for a digital certificate from multiple preset issuing servers, the client initiates an application request to the multiple preset issuing servers; Controlling a registration module of a preset proxy server to receive a proxy request, wherein the proxy request comes from at least one preset certification server, the proxy request carries at least proxy data, and the proxy data includes at least: an encrypted digital signature of the preset certification server; Based on the encrypted digital signature sent by each of the preset certification servers, a preset tag is determined, wherein the signature module of the preset proxy server is controlled to receive the encrypted digital signature sent by the registration module; the encrypted digital signature of each of the preset certification servers is added to a digital signature set; based on the digital signature set, the preset tag is determined, each of the encrypted digital signatures in the digital signature set is represented as a leaf node, and a hash value of each leaf node is calculated; based on the hash value of each leaf node, Merkle tree data is constructed; based on the Merkle tree data, the preset tag is determined, wherein the preset tag includes: all hash values on the path from the leaf node to the root node; Generate a digital identity certificate based on the preset tag; When it is detected that the digital identity certificate is used on the client, the verification module of the preset verification server is controlled to verify the digital identity certificate based on the public certificate data on each of the preset issuing servers, wherein the signature verification authorized by multiple preset issuing servers is completed by verifying the preset label on the digital identity certificate and the encrypted digital signature of the preset issuing server.

2. The distributed digital identity verification method according to claim 1, characterized in that: Before the registration module of the preset proxy server receives the proxy request, it includes: Controlling each of the preset certificate issuance servers to receive a certificate issuance request sent by the client, wherein the certificate issuance request carries at least application data, and the application data includes at least: certificate type data of the client; Based on the application data, the certificate data of the preset issuing server indicated by the certificate type data is encrypted using a preset private key to obtain the encrypted digital signature.

3. The distributed digital identity verification method according to claim 1, characterized in that: The step of constructing Merkle tree data based on the hash value of each leaf node includes: Merge every two leaf nodes to obtain multiple merged leaf nodes, and calculate the merged hash value of the merged leaf nodes; Merging every two of the merged leaf nodes until one merged leaf node remains, and characterizing the remaining merged leaf node as the root node; Calculating a root node hash value of the root node; The Merkle tree data is constructed based on the hash value of each leaf node, the merged hash value of the merged leaf node, and the root node hash value of the root node.

4. The distributed digital identity verification method according to claim 3, characterized in that: The step of controlling the verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each of the preset issuing servers includes: Decrypting each of the encrypted digital signatures in the digital signature set based on a preset public key on each of the preset certificate issuing servers to obtain the decrypted certificate data; For each decrypted certificate data, determining whether the certificate data is identical to the public certificate data on the preset issuing server corresponding to the certificate data; In the case that all the certificate data are identical to the public certificate data on the preset issuing server corresponding to the certificate data, the digital identity certificate is verified based on the digital signature set.

5. The distributed digital identity verification method according to claim 4, characterized in that: The step of verifying the digital identity certificate based on the digital signature set includes: Recalculating the hash value of the root node based on the digital signature set to obtain a verification hash value of the root node; Determine whether the verification hash value of the root node is the same as the root node hash value of the root node; if the verification hash value is the same as the root node hash value, determine that the digital identity certificate is verified successfully.

6. A distributed digital identity verification device, characterized in that: include: When a user applies for a digital certificate from multiple preset issuing servers, the client initiates an application request to the multiple preset issuing servers; A control unit, configured to control a registration module of a preset proxy server to receive a proxy request, wherein the proxy request comes from at least one preset certification server, the proxy request carries at least proxy data, and the proxy data includes at least an encrypted digital signature of the preset certification server; A determination unit is configured to determine a preset tag based on the encrypted digital signature sent by each of the preset certification servers, wherein the signature module of the preset proxy server is controlled to receive the encrypted digital signature sent by the registration module; the encrypted digital signature of each of the preset certification servers is added to a digital signature set; based on the digital signature set, the preset tag is determined, each of the encrypted digital signatures in the digital signature set is represented as a leaf node, and a hash value of each leaf node is calculated; based on the hash value of each leaf node, Merkle tree data is constructed; based on the Merkle tree data, the preset tag is determined, wherein the preset tag includes: all hash values on the path from the leaf node to the root node; A generating unit, configured to generate a digital identity certificate based on the preset tag; A verification unit is used to control the verification module of the preset verification server to verify the digital identity certificate based on the public certificate data on each of the preset issuing servers when detecting that the digital identity certificate is used on the client, wherein the signature verification of the authorization of multiple preset issuing servers is completed by verifying the preset label on the digital identity certificate and the encrypted digital signature of the preset issuing server.

7. A computer program product, characterized in that The invention comprises a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the distributed digital identity verification method according to any one of claims 1 to 5 is implemented.

8. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the distributed digital identity verification method described in any one of claims 1 to 5.

Images