Distributed identity management system and method based on block chain

Abstract

According to the distributed identity management system and method based on the block chain, the identity information of the user is stored on the distributed nodes by using the characteristics of the block chain, and the security of the information is protected by using an encryption algorithm. Each user has a unique identity label, and the identity label is written into a block of the block chain and is managed and verified through an intelligent contract. The user can control the access and management of the identity information of the user through the private key without depending on a centralized identity authentication mechanism. In addition, the VC template providing the VC service is subjected to uplink processing, and the consistency and compliance of the VC certificate are ensured from the source. According to the invention, the problem of verification information forgery of the distributed identity management system can be solved, and the security and credibility of identity verification are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of identity management, and specifically relates to a distributed identity management system and method based on blockchain. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the rapid development of information technology, traditional identity management systems are facing increasing challenges in terms of usability, security, credibility, and privacy protection. Current identity authentication methods mostly rely on centralized identity management agencies, such as government departments or large enterprises, which usually centrally store and manage the identity information of a large number of users. However, this centralized management method has the risk of single point failure. Once attacked or data leaked, it may lead to user privacy leakage and identity theft.

[0004] In general distributed identity management systems, the decentralized and tamper-proof characteristics of blockchain are utilized to improve the security and reliability of identity management based on the correspondence between DID and on-chain identity. However, the problem of forgery of proof information in distributed identity management systems cannot be solved. Summary of the invention

[0005] In order to solve the above problems, the present invention proposes a distributed identity management system and method based on blockchain. The present invention can solve the problem of forgery of certification information in the distributed identity management system and improve the security and credibility of identity authentication.

[0006] According to some embodiments, the present invention adopts the following technical solutions:

[0007] A distributed identity management system based on blockchain, comprising:

[0008] User management module, used to receive user chain D ID identity application requests;

[0009] The identity center is used to connect to different VC services and D ID services according to the application request;

[0010] VC template management module, used to receive VC templates uploaded by the issuer, manage the VC templates, approve and issue certificates to the application party, and manage the issued VC certificates;

[0011] The application management module is used to receive the application party's D ID and registration information for applying for a VC certificate, manage the applied DID identity, and issue a VP certificate for the applied VC certificate;

[0012] The data hosting module is used to receive the user's hosting request, host the key, VP certificate, VC certificate and D ID identity according to the hosting request, and encrypt and store them;

[0013] The access control module is used to receive the presentation result of the VC certificate or the VP certificate, as well as the access control settings, and perform access rights management on the user;

[0014] The behavior audit module is used to record the audit logs of the operations of each module in the system in order to query the corresponding audit logs.

[0015] As an optional implementation, the VC template management module is configured to receive the VC template defined by the issuer through a graphical interface, and support dynamic updating of the VC template; store the VC template and its metadata in encrypted form on the blockchain to form a traceable and tamper-proof template registry version; introduce a template approval and authorization process to ensure that only authorized issuers can create or modify templates.

[0016] As a further implementation method, any modification or addition of a template must be reviewed by the smart contract and confirmed by multi-node consensus on the chain.

[0017] As an optional implementation, the metadata version number, release date and applicable scenario.

[0018] As an optional implementation, the data hosting module is configured to use an encryption algorithm to encrypt and store the hosted data, support users to set data access permissions according to their own needs, realize automated execution of permission control through smart contracts, ensure that only users with corresponding permissions can access or modify data, manage data recovery and backup, and use encrypted storage for backup data.

[0019] As a further implementation method, the data hosting module also provides private key management services, allowing users to keep their own private keys or choose to have the system manage them. The management requires prior authorization by the user.

[0020] As an optional implementation, the access control module is configured to introduce an ABAC model, combine access control policies with dynamic factors, automatically evaluate user access requests through smart contracts, and decide whether to authorize based on preset policies; and deploy access control logic on the blockchain in the form of smart contracts to achieve automation and decentralization of access control.

[0021] As a further implementation, the access control module performs identity authentication according to the VP or VC certificate presented by the user.

[0022] As a further implementation, the access control module is also configured to monitor the user's access behavior and immediately issue a warning message when an abnormality is found.

[0023] Based on the above-mentioned distributed identity management system based on blockchain, the working method includes the following steps:

[0024] The user management module receives the user's on-chain D ID identity application request;

[0025] The identity center connects to different VC services and D ID services according to the application request;

[0026] The VC template management module receives the VC template uploaded by the issuer, manages the VC template, approves and issues the application certificate, and manages the issued VC certificates;

[0027] The application management module receives the application D ID and the registration information of the VC certificate application, manages the identity of the applied D ID, and issues a VP certificate for the applied VC certificate;

[0028] The data hosting module receives the user's hosting request, and according to the hosting request, hosts the key, VP certificate, VC certificate and D ID identity, and stores them in encrypted form;

[0029] The access control module receives the presentation result of the VC certificate or the VP certificate and the access control settings, and manages the access rights of the user;

[0030] The behavior audit module records audit logs for all operations within the system to query the corresponding audit logs.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] The high security of the present invention effectively alleviates the security risks faced by traditional identity management systems due to centralized storage and management. The present invention utilizes the distributed storage and encryption characteristics of blockchain technology to effectively protect the security of user identity information and prevent the risk of data leakage and identity theft.

[0033] The present invention effectively protects privacy. Users have their own private keys to control access and management of identity information without exposing the information to third parties. Blockchain encryption technology and smart contracts ensure the privacy of user identity information and effectively protect the user's personal privacy.

[0034] The present invention is transparent and traceable in the management of identity information. The present invention utilizes the immutability and transparency of blockchain technology to ensure that all identity authentication and identity information changes can be recorded and traced, thereby enhancing the transparency and credibility of system operations.

[0035] The present invention can realize efficient and convenient identity verification, and users can verify their identity in a fast and secure manner without having to frequently submit identity information to multiple institutions. This not only saves time and cost, but also improves user experience and service efficiency.

[0036] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0038] Figure 1 This is an architecture diagram of a distributed identity management system based on blockchain in one embodiment;

[0039] Figure 2 is a schematic diagram of a VC template management process of an embodiment;

[0040] Figure 3 is a schematic diagram of a data hosting module of an embodiment;

[0041] Figure 4 This is a schematic diagram of an access control module of an embodiment. DETAILED DESCRIPTION

[0042] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0043] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0044] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0045] In the absence of conflict, the embodiments in this application and the features in the embodiments may be combined with each other.

[0046] First of all, some necessary explanations of terms:

[0047] DID (Decentralized Identifier): DID (decentralized identifier) ​​is a self-controlled, decentralized identifier, usually used to identify an entity (such as an individual, organization, device, etc.) in a blockchain network. Unlike traditional identifiers (such as email addresses, usernames), DID does not rely on centralized identity providers (such as governments, social platforms, etc.), but is created and controlled by users themselves.

[0048] VC (Verifiable Credential): VC (Verifiable Credential) is a digital certificate issued by an identity issuer (such as a government agency, school, company, etc.) to prove that an entity (such as an individual or organization) has certain attributes or qualifications. VC is usually used in conjunction with DID to provide a trusted, decentralized identity authentication method.

[0049] VP (Verifiable Presentation): VP (Verifiable Presentation) is an extension of VC. It means that the credential holder combines multiple VCs together to form a certificate set that can be presented to a third party. VP not only contains VC information, but also can contain the digital signature of the prover to ensure the authenticity of the displayed information.

[0050] Embodiment 1

[0051] A distributed identity management system based on blockchain, such as Figure 1 As shown, including:

[0052] Used in the management module, used for: users apply for on-chain D ID identity through the distributed identity management system. The D ID identity corresponds to the on-chain user and is generated through a smart contract. The Document attributes of the D ID identity include information such as the D ID identifier and public key.

[0053] The identity center can connect to different VC services and D ID services. Users can add different services through the identity center, and administrators can manage users and added chain services.

[0054] The VC template management module is used to achieve: the issuer can upload and manage the VC template, approve and issue the certificate of the application party, and manage the issued VC certificates. The chain management of VC templates ensures the transparency and security of template information.

[0055] The application management module is used to implement: as a user of DID service and VC service, the application party can register DID and apply for VC certificate, manage the applied DID, and issue VP certificate for the applied VC certificate.

[0056] The data hosting module is used to realize: users can host keys, VP certificates, VC certificates, and D IDs to this system. The data hosting module uses encrypted storage to ensure the security of user information.

[0057] The access control module is used to achieve: users can present VC or VP certificates and set attributes through access control. Users can customize access rights settings to protect personal information from being accessed at will.

[0058] The behavior audit module is used to achieve: all operations within the system are recorded in audit logs, and administrators can query all records through the audit module to promptly discover and handle abnormal situations.

[0059] The following is a detailed introduction:

[0060] like Figure 2 As shown, the VC template management module performs the following steps:

[0061] 1) Template creation and definition: The issuer defines the VC template through a graphical interface and designs a standardized VC template framework, which includes basic attribute fields (such as name, age, education, etc.) and optional fields, and supports customizing templates according to different application scenarios. At the same time, the template supports dynamic updates to ensure synchronization with the latest laws and industry regulations.

[0062] 2) Blockchain template registry: VC templates and their metadata (such as version number, release date, applicable scenarios, etc.) are stored in encrypted form on the blockchain to form a traceable and tamper-proof template registry. Any modification or addition of a template must pass the smart contract review process and be confirmed by multi-node consensus on the chain.

[0063] 3) Version control: A new version is generated each time a template is modified, and historical records are retained for easy tracing and rollback, enhancing the transparency of the system.

[0064] 4) Version approval and authorization mechanism: Introduce template approval and authorization mechanism to ensure that only authorized issuers can create or modify templates. Automatically execute approval logic through smart contracts, combined with the openness and transparency of blockchain, to enhance the credibility and trustworthiness of template management.

[0065] The template approval and authorization mechanism of this embodiment includes:

[0066] (1) Multi-level authority management

[0067] Issuer identity authentication: The issuer ensures its legitimacy through an identity authentication mechanism. The identity information of all issuers and their authority levels will be stored on the blockchain for subsequent traceability and verification.

[0068] Permission classification: Multi-level permission management system, assigning different permissions to different roles:

[0069] Administrator: The ultimate controller of the system, responsible for setting basic rules, approval processes, and permission levels.

[0070] Template administrator: has the authority to design and define VC templates, but any modification must be approved by the administrator or specific authorized personnel.

[0071] Auditor: For each template modification, the reviewer verifies it according to the audit rules and makes a decision to approve or reject it.

[0072] Tiered authorization: Different template administrators can be granted different permissions. For example, only certain expert groups can modify templates involving high-risk areas (such as finance or health), while templates in other low-risk areas can be modified through a more streamlined process.

[0073] (2) Automated approval of smart contracts

[0074] The template approval process is automatically executed through smart contracts. All template creation or modification requests are first submitted by the issuer, and the approval process is automatically triggered through smart contracts. Smart contracts will review the request according to preset rules (such as role permissions, version requirements, timestamps, etc.) and automatically send notifications to relevant roles for further review or approval.

[0075] Multi-node consensus: The creation and modification of templates not only requires approval from a single reviewer, but also multiple review nodes. Based on the smart contract, a consensus mechanism is set up, requiring multiple independent nodes (for example, representatives of different institutions or roles) to agree to modify or publish. After each node independently reviews the request, it will reach a consensus through the consensus algorithm of the blockchain.

[0076] Timeliness and automation: Smart contracts automatically perform approvals based on defined time windows. If a request is not approved within 24 hours, the smart contract will automatically notify the relevant personnel and handle it according to the rules (such as delayed approval, automatic rejection, etc.).

[0077] (3) Dynamic compliance verification

[0078] Automatic compliance check: As industry standards and laws and regulations change, VC templates may need to be adjusted to maintain compliance. Smart contracts can integrate external compliance verification tools. When new laws or industry standards are released, the compliance check mechanism is automatically triggered to detect whether the existing template complies with the new regulations. If not, the smart contract will remind the issuer and temporarily freeze the use of the template until the issuer updates the template.

[0079] Dynamic compliance monitoring: Integrate dynamic compliance monitoring tools through third-party services to monitor industry regulations or policy changes in real time, and promptly prompt the issuer to update the VC template. This "compliance-driven" mechanism ensures that the template remains effective in an ever-changing legal environment.

[0080] 5) Dynamic update: Supports real-time update of template information to ensure that the application party always uses the latest template and improves flexibility.

[0081] Data hosting modules such as Figure 3 As shown, the management is as follows:

[0082] Encrypted storage and private key management: Encrypted data is stored using encryption algorithms to ensure data security during transmission and storage. At the same time, secure private key management services are provided, allowing users to keep their own private keys or choose to have the system manage them (user authorization required) to achieve fine-grained control over data access rights.

[0083] The encryption storage and private key management of this embodiment specifically include:

[0084] (1) Data preprocessing and data segmentation

[0085] Data segmentation: Before data is encrypted, the system segments it according to the encryption block size. Using the Shamir secret sharing algorithm, the data is segmented into multiple fragments, and each fragment is encrypted and stored separately in the distributed storage network. Even if some storage nodes are attacked, the attacker cannot access the complete data, which enhances the fault tolerance of the data.

[0086] Metadata storage: Metadata about data segmentation, encryption algorithms, encryption keys, etc. is stored on the blockchain to ensure the correct reconstruction of data after segmentation and support data traceability and verification.

[0087] (2) Data encryption

[0088] Encryption algorithm selection: The system uses a combination of symmetric encryption and asymmetric encryption to encrypt data:

[0089] Symmetric encryption: Encrypt each data shard and use a symmetric key to encrypt the data. This can effectively protect the confidentiality and integrity of the data.

[0090] Asymmetric encryption: Encrypting symmetric keys. When symmetric keys are exchanged between users and systems, they need to be encrypted using asymmetric encryption. Users encrypt symmetric keys with their public keys, and the system decrypts them with their private keys. Using asymmetric encryption ensures that only users can decrypt their own data.

[0091] Multiple encryption: To enhance security, multiple encryption schemes are used to protect data by combining symmetric encryption, asymmetric encryption and hash algorithms. Even if the encryption key is leaked, the original data content cannot be restored.

[0092] (3) Data storage

[0093] Encrypted storage: Each encrypted data shard is stored in a distributed storage system. The storage node of each data shard is dynamically selected according to the smart contract rules of the blockchain. To ensure the reliability and persistence of data, redundant storage technology is used, that is, each data shard is redundantly stored on multiple nodes to prevent single point failure or data loss.

[0094] Decentralized storage: The blockchain records the storage address or hash value of the data shard, but does not store the original data. That is, the blockchain only records the identifier or storage location of the data, but does not store the actual sensitive data, thereby achieving decentralized data protection.

[0095] (4) Private key management

[0096] Self-management: Users store private keys on local devices and protect them using password authentication.

[0097] Private key custody: Users authorize the system to keep private keys on their behalf. The system uses encrypted container technology to store private keys, ensuring that access to private keys is limited to authorized users. In order to avoid centralization risks, distributed key management technology can be used to cut private keys into multiple shares, which can be stored and restored through distributed nodes. No single node can obtain the complete private key.

[0098] (5) Fine-grained access control

[0099] Use role-based access control (RBAC) and attribute-based access control (ABAC) to provide fine-grained control over data access. Each data item can be set with different access permissions, allowing different roles to have different levels of access. Access control rules and encryption key lifecycle management are verified and executed through blockchain smart contracts.

[0100] Flexible data access permission settings: users can set data access permissions according to their needs, including data visibility, editing permissions, etc. Automated execution of permission control is achieved through smart contracts to ensure that only users with corresponding permissions can access or modify data.

[0101] Data recovery and backup management: Establish a complete data recovery and backup mechanism to prevent data loss or damage. Backup data is also encrypted for storage to ensure data security.

[0102] The data recovery and backup mechanism of this embodiment includes:

[0103] (1) Data backup mechanism

[0104] Multi-point redundant backup storage: To prevent single point failure, backup data will be stored in multiple distributed storage nodes, which may be distributed in different geographical locations. Distributed file system and blockchain are used to store encrypted backup data.

[0105] Automated regular backup: The system automatically backs up the user's sensitive information every 24 hours. The backup operation is controlled by a smart contract to ensure that a new hash value is generated after each backup and recorded on the blockchain. The history of each backup can be traced back.

[0106] (2) Data recovery mechanism

[0107] Data loss or damage detection: When the system detects data loss or damage, it will first trigger the data recovery process. The system automatically verifies the user's identity and determines their permissions through smart contracts.

[0108] Backup selection and recovery request: The system searches the backup history on the blockchain to find the latest available backup copy. Users can select a backup at a specific point in time, and the system retrieves the backup data from the distributed storage system based on the hash value and storage location of the backup data.

[0109] Decryption and recovery: The data extracted from the backup will be decrypted by the encryption and decryption module. Since the backup data has been encrypted, only users with the corresponding decryption key can restore the data. The user requests the system to restore the operation through his public and private keys, and the system performs the decryption operation according to the authorization management.

[0110] Fast recovery mechanism: Since the backup data is distributed across multiple storage nodes, the system can select multiple copies for recovery, ensuring that when a node fails, data can be quickly recovered from other copies. By recording the storage location of each backup copy through smart contracts, the system can automatically select the best copy for recovery.

[0111] like Figure 4 As shown, the access control module performs the following controls:

[0112] Attribute-based access control: Introducing the ABAC model, the access control policy is combined with dynamic factors such as user attributes, resource attributes, and environmental attributes to achieve more flexible and fine-grained access control. The user's access request is automatically evaluated through smart contracts, and the authorization is determined based on the preset policy. Users can customize access policies and set different access rights (such as read-only, editable) according to different application scenarios, which is highly flexible.

[0113] Smart contract-driven automated access control: Deploy access control logic on the blockchain in the form of smart contracts, and automate and decentralize access control through automatic execution of on-chain code, reducing human intervention and improving the efficiency and credibility of access control.

[0114] Credential verification control: Users authenticate their identities by presenting VP or VC, and the system instantly verifies their legitimacy to ensure access security.

[0115] Behavior monitoring and alarm management: Monitor user access behavior, issue an alarm immediately when an anomaly is found, and handle potential security threats in a timely manner.

[0116] Specifically, in this embodiment, attribute-based access control includes:

[0117] (1) Dynamic Generation and Evaluation of Access Control Policies

[0118] 1) User attributes and identity authentication

[0119] DID authentication and verification: Each user is identified in the system by a decentralized identity (DID) and is bound to a VC certificate or VP certificate related to his or her identity. These certificates are issued by a trusted certification authority and guarantee the authenticity of the user's identity through the immutability and transparency of the blockchain.

[0120] Custom permissions and policies: Users can set their own access policies based on their personal needs, clearly indicating which information or resources can be accessed by others and which cannot. Users register their own access rules on the blockchain network and bind them to smart contracts.

[0121] 2) Definition of resource attributes

[0122] Resource identification and classification: Each resource, such as data, files, service interfaces, etc., will be registered with a unique identifier in the blockchain. When registering, the system will set corresponding attributes for the resource, such as access permission level, confidentiality requirements, etc. A file may have a sensitivity mark and only authorized users can access it. For resources with high security levels, "multi-factor authentication" can also be set as an access condition.

[0123] Resource authorization mechanism: Resource owners or administrators can manage access rights to resources, formulate different resource access policies, and publish them through smart contracts. These policies will be dynamically matched with user attributes to ensure that only qualified users can access the corresponding resources.

[0124] 3) Dynamic evaluation of environmental attributes

[0125] Environmental assessment rules: Access control policies are not only based on the attributes of users and resources, but also on the attributes of the current environment. For example, the time and location of user access, the security of the device, etc. The system stipulates that if a user attempts to access sensitive resources from an unauthorized device (such as an insecure network environment), access will be denied.

[0126] (2) Dynamic access control based on smart contracts

[0127] 1) Smart contract strategy execution

[0128] Smart contract evaluation of access requests: Every time a user initiates an access request, the system automatically calls a smart contract for dynamic evaluation. The smart contract obtains relevant information from the attributes of the user, resources, and environment, and makes judgments based on predefined access control policies. The smart contract considers:

[0129] User roles and permissions: Based on the user’s DID and the role field in the VC certificate, the smart contract evaluates whether the user has permission to access the resource.

[0130] Resource access policy: The smart contract checks the resource's permission tag and whether it complies with the resource's access rules.

[0131] Environmental matching: The smart contract evaluates the environmental conditions of the current access request, such as time, location, device status, etc., and determines whether access is allowed based on pre-set conditions.

[0132] 2) Flexible customization and adjustment of strategies

[0133] Policy customization interface: The system provides users with a policy customization interface, where users can freely set rules according to different scenarios and needs. Users can stipulate: only allow access to resources during a specific time, only allow access at a specific location, only allow access to users with a specific role or who meet multiple identity authentication requirements.

[0134] Flexible adjustment of smart contracts: When users want to adjust their strategies, they can directly publish new smart contracts on the blockchain, and the old contracts will be replaced by the new ones. The automated execution and update of smart contracts ensures the immediacy and transparency of strategy adjustments.

[0135] In summary, the present invention uses blockchain as the basic technology, constructs the anchoring relationship between D ID identity and on-chain account, proposes VC template on-chain, data security trusteeship and attribute-based access control, solves the centralized problems such as untrusted storage, single point failure, user identity theft and privacy leakage in data centers, solves the problem of general distributed identity management system that proves information forgery, and builds a safer and more reliable distributed identity management system based on blockchain.

[0136] The distributed identity management system based on blockchain uses the characteristics of blockchain to store the user's identity information on distributed nodes and use encryption algorithms to protect the security of information. Each user has a unique identity (ID), which is written into the block of the blockchain and managed and verified through smart contracts. Users can control access and management of their identity information through private keys without relying on centralized identity authentication agencies. In addition, the VC template that provides VC services is processed on the chain to ensure the consistency and compliance of VC certificates from the source. Users can customize the access rights of VC or VP certificates to achieve fine-grained access control.

[0137] Therefore, the distributed identity management system based on blockchain not only improves the security and credibility of identity authentication, but also effectively protects users' privacy information, providing users and organizations with a more secure, efficient and convenient identity management solution.

[0138] Embodiment 2

[0139] Based on the above-mentioned distributed identity management system based on blockchain, the working method includes the following steps:

[0140] The user management module receives the user's on-chain D ID identity application request;

[0141] The identity center connects to different VC services and D ID services according to the application request;

[0142] The VC template management module receives the VC template uploaded by the issuer, manages the VC template, approves and issues the application certificate, and manages the issued VC certificates;

[0143] The application management module receives the application D ID and the registration information of the VC certificate application, manages the identity of the applied D ID, and issues a VP certificate for the applied VC certificate;

[0144] The data hosting module receives the user's hosting request, and according to the hosting request, hosts the key, VP certificate, VC certificate and D ID identity, and stores them in encrypted form;

[0145] The access control module receives the presentation result of the VC certificate or the VP certificate and the access control settings, and manages the access rights of the user;

[0146] The behavior audit module records audit logs for all operations within the system to query the corresponding audit logs.

[0147] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0148] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0149] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0150] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0151] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made by those skilled in the art within the spirit and principle of the present invention without creative labor shall be included in the protection scope of the present invention.

Claims

1. A distributed identity management system based on blockchain, characterized in that: include: User management module, used to receive user chain DID identity application requests; The identity center is used to connect to different VC services and DID services according to the application request; VC template management module, used to receive VC templates uploaded by the issuer, manage the VC templates, approve and issue certificates to the application party, and manage the issued VC certificates; The application management module is used to receive the application DID and the registration information of the VC certificate application, manage the applied DID identity, and issue a VP certificate for the applied VC certificate; The data hosting module is used to receive the user's hosting request, host the key, VP certificate, VC certificate and DID identity according to the hosting request, and store them in encrypted form; The access control module is used to receive the presentation result of the VC certificate or the VP certificate, as well as the access control settings, and perform access rights management on the user; The behavior audit module is used to record the audit logs of the operations of each module in the system in order to query the corresponding audit logs.

2. A distributed identity management system based on blockchain as claimed in claim 1, characterized in that: The VC template management module is configured to receive the VC template defined by the issuer through a graphical interface, and support dynamic update of the VC template; The VC template and its metadata are stored in encrypted form on the blockchain to form a traceable and tamper-proof template registry version; the template approval and authorization process is introduced to ensure that only authorized issuers can create or modify the template.

3. A distributed identity management system based on blockchain as claimed in claim 2, characterized in that: Any modification or addition of a template must be reviewed by the smart contract and confirmed by the consensus of multiple nodes on the chain; Alternatively, a consensus mechanism is set up based on the smart contract, which requires multiple independent nodes to agree to modify or publish. After each node independently reviews the request, it will reach a consensus through the consensus algorithm of the blockchain; Alternatively, the smart contract performs the approval within a predetermined time window.

4. A distributed identity management system based on blockchain as claimed in claim 2, characterized in that: The metadata version number, release date, and applicable scenarios.

5. A distributed identity management system based on blockchain as claimed in claim 1, characterized in that: The data hosting module is configured to use an encryption algorithm to encrypt and store the hosted data, supports users to set data access permissions according to their own needs, realizes the automated execution of permission control through smart contracts, ensures that only users with corresponding permissions can access or modify data, manages data recovery and backup, and uses encrypted storage for backup data.

6. A distributed identity management system based on blockchain as claimed in claim 5, characterized in that: Data backup management includes the backup data being stored in multiple distributed storage nodes, which are distributed in different geographical locations. Distributed file systems and blockchains are used to store encrypted backup data, and users’ designated information is automatically backed up regularly. The backup operation is controlled by smart contracts to ensure that a new hash value is generated after each backup and recorded on the blockchain. Or data recovery management includes looking up the backup history on the blockchain, finding the latest available backup copy, retrieving the backup data from the distributed storage system based on the hash value and storage location of the backup data according to the user's backup selection at a predetermined time point, and decrypting the extracted data; If multiple copies are selected for recovery, the storage location of each backup copy is recorded through a smart contract, and the best copy is selected for recovery first.

7. A distributed identity management system based on blockchain as claimed in claim 5, characterized in that: The data hosting module also provides private key management services, allowing users to keep their own private keys or choose to have the system manage them. The management requires prior authorization by the user.

8. A distributed identity management system based on blockchain as claimed in claim 1, characterized in that: Before encrypting and storing the hosted data, the data is segmented according to the encryption block size, and the secret sharing algorithm is used to segment the data into multiple fragments. Each fragment is encrypted and stored separately in the distributed storage network. Each encrypted data fragment is stored in the distributed storage system, and the storage node of each data fragment is dynamically selected according to the smart contract rules of the blockchain. Alternatively, symmetric keys are used to encrypt data when encrypting each data shard; asymmetric keys are used to encrypt data when exchanging data between users and the system.

9. A distributed identity management system based on blockchain as claimed in claim 1, characterized in that: The access control module is configured to introduce an ABAC model, combine access control policies with dynamic factors, automatically evaluate user access requests through smart contracts, and decide whether to authorize based on preset policies; and deploy access control logic on the blockchain in the form of smart contracts to achieve automation and decentralization of access control; Or the access control module performs identity authentication based on the VP or VC certificate presented by the user; Alternatively, the access control module is further configured to monitor the user's access behavior and immediately issue a warning message when an abnormality is found.

10. A working method of a distributed identity management system based on blockchain according to any one of claims 1 to 9, characterized in that: The following steps are involved: The user management module receives the user's on-chain DID identity application request; The identity center connects to different VC services and DID services based on the application request; The VC template management module receives the VC template uploaded by the issuer, manages the VC template, approves and issues the application certificate, and manages the issued VC certificates; The application management module receives the application DID and the registration information of the VC certificate application, manages the applied DID identity, and issues a VP certificate for the applied VC certificate; The data hosting module receives the user's hosting request, and according to the hosting request, hosts the key, VP certificate, VC certificate and DID identity, and stores them in encrypted form; The access control module receives the presentation result of the VC certificate or the VP certificate and the access control settings, and manages the access rights of the user; The behavior audit module records audit logs for all operations within the system to query the corresponding audit logs.

Images