Resource access method and device, equipment, storage medium and computer program product

Abstract

The invention discloses a resource access method and device, electronic equipment, a computer readable medium and a computer program product, simple, convenient, safe and efficient identifier analysis system management can be realized, the method is applied to an authentication management mechanism, and the method comprises the following steps: receiving an identifier application generated by a user management system based on user identity information, sending the information to an identifier analysis system for qualification verification; when the qualification verification is passed, distributing a distributed identifier and a user private key to the target user, and uploading the distributed identifier and a user public key to the block chain; receiving a permission application generated by the user management system based on user private key encryption permission application information, acquiring a user public key from the block chain by using a distributed identifier in the permission application to verify the user public key, and sending the permission application information to an identifier analysis system to perform permission verification when the verification is passed; and when the permission verification is passed, distributing an access credential encrypted based on an institution private key to the target user, so that the target user accesses the identifier analysis system by using the access credential.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a resource access method, and also to a resource access device, an electronic device, a computer-readable storage medium, and a computer program product. Background Art

[0002] The Industrial Internet Identity Resolution System (abbreviated as: Identity Resolution System) is an important part of the Industrial Internet. There are many types of users accessing its internal nodes, and different types of users have different access rights to the nodes of the Identity Resolution System. Therefore, the Identity Resolution System authorizes different users to have access rights to identity resources through access control policies.

[0003] Traditional identity resolution systems mainly use role-based access control strategies and identity-based access control strategies to implement user access management. However, as the number of users in the identity resolution system continues to increase, the types of users accessing the identity resolution nodes become increasingly complex, and these traditional strategies have exposed some defects. The first is the problem of poor scalability: As the number of users accessing the identity resolution nodes increases, traditional strategies need to manage complex "user-node-access rights" mapping relationships, resulting in a large mapping table and increased query time; in addition, a user may have multiple access rights in an identity resolution node. Once the user's access rights change, multiple mapping tables need to be updated, resulting in maintenance difficulties and poor scalability. The second is the problem of difficulty in centralized management: The access rights of all users in the traditional identity resolution system are centrally managed. Once the server storing the user's access rights is out of power, downtime, etc., it will not be able to continue to provide services to users; in addition, the user access rights of the traditional identity resolution system are usually centrally managed by the administrator, and there is a possibility of human tampering with the data.

[0004] Therefore, how to achieve simple and convenient identification resolution system management, and then achieve more secure and efficient identification resolution system access is a problem that needs to be solved urgently by those skilled in the art. Summary of the invention

[0005] The purpose of this application is to provide a resource access method, which can realize simple and convenient identification resolution system management, thereby realizing more secure and efficient identification resolution system access; another purpose of this application is to provide a resource access device, electronic device, computer-readable storage medium and computer program product, all of which have the above-mentioned beneficial effects.

[0006] In a first aspect, the present application discloses a resource access method, which is applied to an authentication management agency, wherein the authentication management agency is in communication connection with both a user management system and an identity resolution system, and the method comprises:

[0007] Receiving an identification application generated by the user management system based on user identity information, and sending the identification application to the identification resolution system for qualification verification;

[0008] When the qualification verification is passed, a distributed identifier, a user public key, and a user private key of the target user are generated, and the distributed identifier and the user private key are distributed to the target user, and the distributed identifier and the user public key are uploaded to the blockchain;

[0009] Receive a permission application generated by the user management system based on the permission application information, where the permission application is generated based on encryption of the user private key;

[0010] Using the distributed identifier in the permission application, the user public key is obtained from the blockchain to verify the permission application, and when the verification passes, the permission application information is sent to the identity resolution system for permission verification;

[0011] When the authority verification is passed, the access credential encrypted based on the institution's private key is distributed to the target user, so that the target user can use the access credential to initiate an access request to the identity resolution system, and the identity resolution system can respond to the access request using the institution's public key in the blockchain.

[0012] Optionally, sending the identification application to the identification resolution system for qualification verification includes:

[0013] The identification application is sent to the identification resolution system, so that the identification resolution system determines whether the target user belongs to a preset applicable object according to the user identity information, so as to realize the qualification verification.

[0014] Optionally, sending the permission application information to the identity resolution system for permission verification includes:

[0015] The permission application information is sent to the identity resolution system, so that the identity resolution system determines whether the application permission of the target user meets the user type of the target user according to the permission application information, so as to realize the permission verification.

[0016] Optionally, generating a distributed identifier of a target user includes:

[0017] A distributed identifier of the target user is generated according to the user type of the target user.

[0018] Optionally, uploading the distributed identifier and the user public key to a blockchain includes:

[0019] Saving the user public key to a distributed identification document;

[0020] The distributed identification and the distributed identification document are uploaded to the blockchain accordingly.

[0021] Optionally, distributing the access credential encrypted based on the institution's private key to the target user, so that the target user uses the access credential to initiate an access request to the identity resolution system, and the identity resolution system uses the institution's public key in the blockchain to respond to the access request, including:

[0022] The access credential encrypted based on the institution's private key is distributed to the target user, so that the target user uses the access credential to initiate an access request to the identity resolution system, so that the identity resolution system uses the institution's public key in the blockchain to decrypt the access credential to obtain the user's access rights, and responds to the access request when the user's access rights satisfy the access resources in the access request.

[0023] In a second aspect, the present application further discloses a resource access device, which is applied to an authentication management agency, wherein the authentication management agency is in communication connection with both a user management system and an identity resolution system, and the device comprises:

[0024] A first receiving module, configured to receive an identification application generated by the user management system based on user identity information, and send the identification application to the identification resolution system for qualification verification;

[0025] A generation module, used for generating a distributed identifier, a user public key, and a user private key of a target user when the qualification verification passes, distributing the distributed identifier and the user private key to the target user, and uploading the distributed identifier and the user public key to a blockchain;

[0026] A second receiving module, configured to receive a permission application generated by the user management system based on the permission application information, wherein the permission application is generated based on encryption of the user private key;

[0027] A verification module, used to obtain the user public key from the blockchain using the distributed identifier in the permission application to verify the permission application, and send the permission application information to the identity resolution system for permission verification when the verification passes;

[0028] The access module is used to distribute the access credentials encrypted based on the institution's private key to the target user when the authority verification is passed, so that the target user can use the access credentials to initiate an access request to the identity resolution system, and the identity resolution system can respond to the access request using the institution's public key in the blockchain.

[0029] In a third aspect, the present application further discloses an electronic device, comprising:

[0030] Memory for storing computer programs;

[0031] A processor is used to implement the steps of any one of the resource access methods described above when executing the computer program.

[0032] In a fourth aspect, the present application further discloses a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of any one of the resource access methods described above are implemented.

[0033] In a fifth aspect, the present application further discloses a computer program product, including a computer program / instruction, which implements the steps of any one of the resource access methods described above when executed by a processor.

[0034] The present application provides a resource access method, which is applied to an authentication management agency, wherein the authentication management agency is in communication connection with both a user management system and an identity resolution system, and the method comprises: receiving an identity application generated by the user management system based on user identity information, and sending the identity application to the identity resolution system for qualification verification; when the qualification verification passes, generating a distributed identity, a user public key, and a user private key of a target user, and distributing the distributed identity and the user private key to the target user, and uploading the distributed identity and the user public key to a blockchain; receiving a permission application generated by the user management system based on permission application information, wherein the permission application is generated based on encryption of the user private key; using the distributed identity in the permission application to obtain the user public key from the blockchain to verify the permission application, and sending the permission application information to the identity resolution system for permission verification when the verification passes; when the permission verification passes, distributing an access credential encrypted based on the institution private key to the target user, so that the target user uses the access credential to initiate an access request to the identity resolution system, and the identity resolution system uses the institution public key in the blockchain to respond to the access request.

[0035] By applying the technical solution provided by this application, a resource access system based on distributed identification is realized based on the user management system, the certification management agency, the identification resolution system and the blockchain. In this resource access system, each user is given a unique distributed identification using blockchain technology, and the user authority management of the identification resolution system is transferred from the center side to the user side, so as to effectively ensure that the user's access rights are autonomous and controllable, and the lightweight management of the identification resolution system access control is realized while protecting the privacy of the user's access rights and preventing malicious tampering. It can be seen that this technical solution realizes simple and convenient identification resolution system management, and further realizes more secure and efficient identification resolution system access.

[0036] A resource access device, electronic device, computer-readable storage medium, and computer program product provided in this application also have the above-mentioned technical effects, which will not be described in detail in this application. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the prior art and the embodiments of the present application, the drawings required for use in the description of the prior art and the embodiments of the present application are briefly introduced below. Of course, the drawings described below in relation to the embodiments of the present application are only part of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without creative work, and the obtained other drawings also belong to the protection scope of the present application.

[0038] Figure 1 A schematic diagram of the structure of a resource access system provided by this application;

[0039] Figure 2 A flowchart of a resource access method provided by this application;

[0040] Figure 3 A schematic diagram of the DID operation mechanism provided for this application;

[0041] Figure 4 A structural diagram of a DID-based identity resolution system user management system provided in this application;

[0042] Figure 5 A working principle diagram of a user identity management subsystem provided by this application;

[0043] Figure 6 A working principle diagram of a user rights management subsystem provided for this application;

[0044] Figure 7 A working principle diagram of a user access control subsystem provided in this application;

[0045] Figure 8 A flowchart of another resource access method provided by this application;

[0046] Fig. 9 A schematic diagram of the structure of a resource access device provided by this application;

[0047] Fig.10 A schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0048] The core of this application is to provide a resource access method, which can realize simple and convenient identification resolution system management, thereby realizing more secure and efficient identification resolution system access; another core of this application is to provide a resource access device, electronic device, computer-readable storage medium and computer program product, all of which have the above-mentioned beneficial effects.

[0049] In order to describe the technical solutions in the embodiments of the present application more clearly and completely, the technical solutions in the embodiments of the present application will be introduced below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0050] An embodiment of the present application provides a resource access method.

[0051] First, please refer to Figure 1 , Figure 1 This is a structural diagram of a resource access system provided in this application. The resource access system mainly includes a user management system, an authentication management agency, and an identification resolution system. The authentication management agency is communicatively connected to the user management system and the identification resolution system. The resource access method provided in this application is implemented based on the resource access system.

[0052] For further information, please refer to Figure 2 , Figure 2 A schematic diagram of a resource access method provided in this application, which is applied to Figure 1 The certification management agency shown may include the following S101 to S105.

[0053] S101: receiving an identification application generated by a user management system based on user identity information, and sending the identification application to an identification resolution system for qualification verification.

[0054] Specifically, the target user can enter his or her own identity information in the user management system, including but not limited to user name, user password, user type and other types of information related to the target user, so that the user management system generates a corresponding identification application based on the user identity information. It can be understood that the identification application is used to apply for a unique distributed identification for the target user; further, the identification application is sent to the identification resolution system for qualification verification, so as to determine whether the target user is qualified to access the identification resolution system.

[0055] Among them, sending the identification application to the identification resolution system for qualification verification may include: sending the identification application to the identification resolution system, so that the identification resolution system determines whether the target user belongs to a preset applicable object according to the user identity information, so as to realize qualification verification.

[0056] The embodiment of the present application provides a method for implementing qualification verification for identification application. Specifically, there are multiple types of applicable objects preset in the identification resolution system, such as root node operation organization management users, national top-level node operation organization management users, secondary node operation organization management users, enterprise node operation organization management users, enterprise users and individual users, etc. Only when the user type of the target user hits the preset applicable object of the identification resolution system, can the target user be considered qualified to access the identification resolution system, that is, the qualification verification is passed.

[0057] S102: When the qualification verification is passed, the distributed identification, user public key, and user private key of the target user are generated, and the distributed identification and user private key are distributed to the target user, and the distributed identification and user public key are uploaded to the blockchain.

[0058] Specifically, when the qualification verification is passed, that is, when it is determined that the target user has the qualifications to access the identity resolution system, a unique distributed identity can be assigned to the target user, and a corresponding user private key and user public key can be generated for the target user. The user private key and the distributed identity are distributed to the target user together, and the user public key and the distributed identity are uploaded to the blockchain network together. In addition, when the qualification verification fails, the verification failure prompt can be directly fed back to the target user through the user management system.

[0059] It should be noted that the Decentralized Identifier (DID) is a decentralized identity identifier proposed by the W3C standardization organization. It is implemented based on blockchain technology and relies on the blockchain's tamper-proof, decentralization, and multi-party participation characteristics to provide users with self-sovereign, decentralized, verifiable, highly private, and globally unique digital identities.

[0060] Among them, generating the distributed identification of the target user may include: generating the distributed identification of the target user according to the user type of the target user; wherein the distributed identification may include a fixed field, a user type field, and a user identification field.

[0061] The embodiment of the present application provides a method for generating a distributed identification for a target user. Specifically, the distributed identification of the target user can be divided into three fields, namely a fixed field, a user type field, and a user identification field, wherein the user type field indicates the user type of the target user, and the user representation field can be implemented by generating a unique hash value of the target user based on a hash algorithm.

[0062] In a possible implementation, the five-level user distributed identification can be designed as "did:rs:user type.user subtype.user identification". "did:rs:" is a fixed field; "user type.user subtype" is an optional field (user type field), where user types are divided into administrators (ad) and ordinary users (us). If the user type is an administrator, the user subtype is divided into root node operating organization management user (root), national top-level node operating organization management user (tl), secondary node operating organization management user (sl), enterprise node operating organization management user (en). If the user type is an ordinary user, the user subtype is divided into enterprise users (eu) and individual users (iu); "user identification" can be generated using a hash algorithm (user identification field). For example, if a user is a root node operating organization management user, his distributed identification can be "did:rs:ad.root.s@wlx7".

[0063] Among them, uploading the distributed identification and the user public key to the blockchain may include: saving the user public key to the distributed identification document; and uploading the distributed identification and the distributed identification document to the blockchain accordingly.

[0064] The embodiment of the present application provides a method for uploading a distributed identifier and a user public key to a blockchain. First, the user public key is saved to a distributed identifier document; then, the distributed identifier and the distributed identifier document are uploaded to the blockchain in correspondence with each other. It should be noted that the distributed identifier document is structured data associated with a distributed identifier, which contains information such as the public key and creation time related to the identity, and is generally stored on the blockchain.

[0065] S103: Receive a permission application generated by the user management system based on the permission application information, where the permission application is generated based on encryption of the user's private key.

[0066] Specifically, after the distributed identification and user private key are distributed to the target user, the target user can determine that he or she is qualified to access the identification resolution system. At this time, he or she can continue to enter his or her own permission application information in the user management system, including but not limited to adding node content permission application, deleting node content permission application, modifying node content permission application, querying node content permission application, etc., and then encrypting it with the user's private key and sending it to the certification service agency to effectively ensure the security of user information.

[0067] S104: Use the distributed identifier in the permission application to obtain the user's public key from the blockchain to verify the permission application, and send the permission application information to the identity resolution system for permission verification when the verification passes.

[0068] Specifically, after receiving the target user's permission application, the authentication service agency will first verify the target user's identity, and when the identity verification passes, forward the permission application information to the identity resolution system for permission verification. Among them, the authentication service agency's identity verification for permission application is specifically: determine the target user's distributed identity based on the permission application, and use the distributed identity to obtain the corresponding user public key in the blockchain, and then use the user public key to decrypt the permission application. If the decryption is successful, it can be considered that the target user's identity verification has passed. If the decryption fails, it can be considered that the target user's identity verification has failed. In addition, the identity resolution system's permission verification for permission application information specifically refers to verifying whether the access rights applied by the target user for the identity resolution system meet the corresponding permission management specifications.

[0069] Among them, sending the permission application information to the identity resolution system for permission verification may include: sending the permission application information to the identity resolution system, so that the identity resolution system determines whether the application permission of the target user meets the user type of the target user according to the permission application information, so as to realize permission verification.

[0070] The embodiment of the present application provides a method for implementing permission verification for permission application information. Specifically, in the identification resolution system, different applicable permissions are pre-set for different user types. For example, management users have the permission to add, delete, modify and query the content of each node in the identification resolution system, while ordinary users only have the permission to query the content of each node in the identification resolution system; based on this, the identification resolution system can verify the permission of the target user by judging whether the application permission of the target user meets the applicable application permission corresponding to the user type of the target user.

[0071] S105: When the authority verification is passed, the access credential encrypted based on the institution's private key is distributed to the target user, so that the target user can use the access credential to initiate an access request to the identity resolution system, and the identity resolution system can respond to the access request using the institution's public key in the blockchain.

[0072] Specifically, when the authority verification is passed, the certification service agency can assign access credentials to the target user. The access credentials are encrypted based on the private key of the certification service agency. It can be understood that the private key of the certification service agency is pre-stored locally, and the corresponding public key is uploaded to the blockchain storage. Therefore, when the target user needs to access resources in the identity resolution system, the access credential can be used to initiate an access request to the identity resolution system. Then, the identity resolution system can obtain the public key of the certification service agency from the blockchain network to verify the access credential, and respond to the target user's access request after the verification is passed. Similarly, when the authority verification or access credential verification fails, the verification failure prompt can be directly fed back to the target user through the user management system.

[0073] Among them, distributing the access credentials encrypted based on the institution's private key to the target user so that the target user can use the access credentials to initiate an access request to the identity resolution system, and the identity resolution system can respond to the access request using the institution's public key in the blockchain. This can include: distributing the access credentials encrypted based on the institution's private key to the target user so that the target user can use the access credentials to initiate an access request to the identity resolution system, and the identity resolution system can use the institution's public key in the blockchain to decrypt the access credentials to obtain the user's access rights, and respond to the access request when the user's access rights meet the access resources in the access request.

[0074] The embodiment of the present application provides a method for implementing an identity resolution system to respond to a target user's access request. Specifically, the identity resolution system's verification of the access credential is mainly divided into two aspects: one is that the access credential can be successfully decrypted using the institution's public key, and the other is that the user access rights in the access credential can completely cover the resources that the target user actually requests to access. Only when both conditions are met can the target user's access request be responded to, allowing the target user to access the corresponding resources of the identity resolution system.

[0075] It can be seen that the resource access method provided in the embodiment of the present application realizes a resource access system based on distributed identification based on the user management system, the authentication management agency, the identification resolution system and the blockchain. In the resource access system, the blockchain technology is used to assign a unique distributed identification to each user, and the user authority management of the identification resolution system is transferred from the center side to the user side, so as to effectively ensure that the user's access rights are autonomous and controllable, realize the lightweight management of the identification resolution system access control, protect the privacy of the user's access rights, and prevent malicious tampering. It can be seen that the technical solution realizes simple and convenient identification resolution system management, and further realizes more secure and efficient identification resolution system access.

[0076] Based on the above-mentioned application embodiments, the present application provides another resource access method.

[0077] The embodiment of the present application mainly introduces the resource access method through the following four parts: application objects of the user management system of the identity resolution system based on DID, DID operation mechanism, introduction to the user management system of the identity resolution system based on DID, and operation process of the user management system of the identity resolution system based on DID.

[0078] 1. Application objects of user management system based on DID identification resolution system.

[0079] The DID-based identity resolution system user management system application object defines various access entities in the actual identity resolution system, including root node operating organization management users, national top-level node operating organization management users, secondary node operating organization management users, enterprise node operating organization management users, enterprise users and individual users.

[0080] 1. Root node operation organization management users: manage root resolution services worldwide and be responsible for root resolution user access control.

[0081] 2. National top-level node operating organization manages users: manages top-level logo registration and logo resolution services nationwide, has logo filing, logo certification and other management capabilities, and is responsible for national top-level node user access control.

[0082] 3. Secondary node operating organization manages users: manages the secondary identification registration and identification resolution services nationwide, has the management capabilities of identification filing and identification certification, and is responsible for the secondary analysis node user access control.

[0083] 4. Enterprise node operating organization management users: manage enterprise identity registration and identity resolution services nationwide, have identity filing, identity certification and other management capabilities, and are responsible for enterprise analysis node user access control.

[0084] 5. Enterprise users and individual users: Users with identity registration and identity resolution requests can access top-level nodes, secondary nodes or enterprise nodes.

[0085] 2. DID operation mechanism.

[0086] First of all, DID identification is a new type of universal unique identifier defined by W3C. Its core elements are DID identifier, DID document and verifiable credentials.

[0087] 1. DID identifier: A unique string used to prove the user's identity, consisting of the prefix did, the DID method, and an identification string, such as "did:pml:abc", where "did" is the prefix did, "pml" is the DID method, and "abc" is the identification string. The generation of the DID identifier must comply with the W3C standard specifications.

[0088] 2. DID document: DID document is structured data associated with the DID identifier, containing information such as the public key and creation time related to the identity, and is generally stored on the blockchain.

[0089] 3. Verifiable credentials (i.e. access credentials): A DID user endorses certain attributes of another DID user and attaches his own private key signature to form a digital certificate to prove the authenticity of these attributes.

[0090] Secondly, DID operation requires four participants, namely users, issuers, blockchains, and applications.

[0091] 1. User: The user of DID, created and managed through different DID clients.

[0092] 2. Issuer: refers to the organization or individual that creates and issues verifiable credentials to users.

[0093] 3. Application party: It is the application service provider identified by the user using DID, which verifies the user's DID and verifiable credentials, and indirectly verifies the authenticity of the user.

[0094] 4. Blockchain: used to store DID identifiers and DID documents, through which user identity authentication can be performed.

[0095] Finally, please refer to Figure 3 , Figure 3 A schematic diagram of the DID operation mechanism provided for this application. For example: a user (with a DID) applies for an electronic identity from the Public Security Bureau (issuer). After the Public Security Bureau verifies the user's DID, it issues a verifiable credential to the user; the user presents the verifiable credential to the school (application party), and the school obtains the public key in the Public Security Bureau's DID document from the blockchain for verification to prove the user's identity.

[0096] 3. Introduction to the user management system based on DID identification resolution system.

[0097] First, please refer to Figure 4 , Figure 4 This is a structural diagram of a DID-based identity resolution system user management system provided in this application. The DID-based identity resolution system user management system includes a user identity management subsystem, a user authority management subsystem and a user access control subsystem.

[0098] 1. The user identity management subsystem issues a DID to the user based on the qualification information submitted by the user. The user can log in to the permission management subsystem based on the obtained DID to apply for permission acquisition and permission update.

[0099] 2. The user rights management subsystem issues verifiable credentials (i.e., access credentials) to users based on user qualification information. The verifiable credentials store user access control permissions.

[0100] 3. The user access control subsystem receives the user access identity resolution system request and obtains the user access rights in the blockchain to decide whether to allow the user to access the corresponding resources.

[0101] Secondly, the interaction of the user management system based on the DID identity resolution system involves four parts, namely users, identity resolution system, blockchain, and identity authentication and access rights management agency (authentication management agency).

[0102] 1. The identity authentication and access rights management agency has its own DID identification, local private key and DID document stored on the blockchain, and is responsible for issuing user DID identification and verifiable credentials.

[0103] 2. The blockchain is responsible for the storage of user DID identification and DID documents, supports the use of identity management smart contracts to store and query user DID documents, and supports the use of identity management smart contracts to query identity authentication and access rights management agency DID documents.

[0104] 3. The identity resolution system is responsible for reviewing the qualification information of users when they apply for DID identification and access rights, as well as user access responses.

[0105] Finally, a detailed introduction to each subsystem within the user management system based on the DID identity resolution system is given.

[0106] 1. User identity management subsystem.

[0107] Please refer to Figure 5 , Figure 5 This is a working principle diagram of a user identity management subsystem provided for this application. Specifically, the user registers his identity in the user identity management subsystem and submits his qualification information. The identity authentication and access rights management agency receives the request (identification application) and submits it to the identity resolution system for review. If the review is passed, the identity authentication and access rights management agency generates a unique DID identifier and public and private keys (user public key and user private key) for the user, where the public key information is recorded in the DID document, stored on the chain through the identity management smart contract, and the DID identifier and private key are sent to the user's digital wallet for storage.

[0108] Among them, the DID identification of the 5th level user is designed as "did:rs:user type.user subtype.user identification". "did:rs:" is a fixed field; "user type.user subtype" is an optional field (user type field), where the user type is divided into administrator (ad) and ordinary user (us). If the user type is administrator, the user subtype is divided into root node operation organization management user (root), national top-level node operation organization management user (tl), secondary node operation organization management user (sl), enterprise node operation organization management user (en). If the user type is ordinary user, the user subtype is divided into enterprise user (eu) and individual user (iu); "user identification" can be generated by hash algorithm (user identification field). For example, if a user is a root node operation organization management user, his DID identification can be "did:rs:ad.root.s@wlx7".

[0109] 2. User authority management subsystem.

[0110] Please refer to Figure 6 , Figure 6 A working principle diagram of a user rights management subsystem provided for this application. Specifically, after the user has a DID identification, he can submit an access permission application. The access permission includes adding, deleting, modifying, and querying the content of each node in the identity resolution system. After the user fills in the qualification information, the user's private key is obtained from the digital wallet to encrypt the request, and the encrypted request (permission application) is submitted to the identity authentication and access permission management agency. The identity authentication and access permission management agency receives the request and obtains the user's public key through the identity management smart contract based on the user's DID identification to verify the user's request. If the verification is successful, the identity authentication and access permission management agency sends the request to the identity resolution system. The identity resolution system reviews the rationality of the access permission application based on the user's DID identification and qualification information, and responds to the identity authentication and access permission management agency with the review results. If the review is successful, the identity authentication and access permission management agency issues a verifiable credential to the user. The credential is signed by the private key of the identity authentication and access permission management agency. The user obtains the verifiable credential and stores it in the digital wallet.

[0111] 3. User access control subsystem.

[0112] Please refer to Figure 7 , Figure 7This is a working principle diagram of a user access control subsystem provided by this application. Specifically, after the user obtains the access rights of the corresponding node of the identity resolution system, he can access the corresponding node. The user attaches a verifiable credential and sends the access request to the identity resolution system. The identity resolution system accesses the blockchain access management smart contract, searches for the DID public key information of the identity authentication and access rights management agency, and verifies the user's verifiable credential. After the verification is passed, the identity resolution system compares the access resources requested by the user and the user access rights in the verifiable credential. If the user's access resources are within the scope of authority, access is allowed and the response result is fed back to the user.

[0113] 4. Operation process of user management system based on DID identification resolution system.

[0114] Please refer to Figure 8 , Figure 8 A flowchart of another resource access method provided by this application, the implementation process of which may include:

[0115] Step 1: The user fills in the qualification information, identity type and identity subtype (user identity information) in the system, applies for a DID from the identity authentication and access rights management agency, and proceeds to step 2;

[0116] Step 2: The identity authentication and access rights management agency sends the request to the identity resolution system, which verifies the user's qualification information and returns the verification result, and then proceeds to step 3;

[0117] Step 3: The identity authentication and access rights management agency obtains the verification result. If the verification is successful, it proceeds to step 5, otherwise it proceeds to step 4;

[0118] Step 4: The identity authentication and access rights management agency returns the result of "Qualification Verification Failed" to the user, and the process ends;

[0119] Step 5: The identity authentication and access rights management agency generates a DID and public and private keys for the user, and returns the DID and user private key to the user, who stores them in the digital wallet and proceeds to step 6;

[0120] Step 6: The identity authentication and access rights management agency stores the user's public key in the DID document, and puts the user's DID identifier and DID document on the chain through the identity management smart contract, and proceeds to step 7;

[0121] Step 7: The user fills in the qualification information and access permission application information in the system, encrypts it with the private key, and initiates a permission application request to the identity authentication and access permission management agency, and proceeds to step 8;

[0122] Step 8: The identity authentication and access rights management agency obtains the encrypted request and obtains the user's public key through the identity management smart contract to decrypt the user request. If the decryption is successful, proceed to step 10, otherwise proceed to step 9;

[0123] Step 9: Return the result of "user identity authentication failed" to the user, and then end;

[0124] Step 10: The identity authentication and access rights management agency sends the decrypted request to the identity resolution system, and the identity resolution system verifies the request. If the verification is successful, it proceeds to step 12, otherwise it proceeds to step 11;

[0125] Step 11: Return "Permission application failed" to the user, and the process ends;

[0126] Step 12: The identity authentication and access rights management agency generates a verifiable credential that carries the access rights information, signs it with its local private key, returns a "permission application approved" result to the user, and stores the verifiable credential in the user's digital wallet, and proceeds to step 13;

[0127] Step 13: The user initiates an access request to the identity resolution system. The identity resolution system obtains the user's verifiable credentials and obtains the public key of the identity authentication and access rights management agency through the rights management smart contract to decrypt the verifiable credentials. If the decryption is successful, proceed to step 15, otherwise proceed to step 14;

[0128] Step 14: The identity resolution system returns a result of "verifiable credential verification failed" to the user;

[0129] Step 15: The identity resolution system obtains the decrypted verifiable credential, obtains the user's access rights, and compares them with the user's actual access to resources. If the access rights cover the access resources, proceed to step 17, otherwise proceed to step 16;

[0130] Step 16: The identity resolution system returns a result of "does not have access to the resource" to the user, and the process ends;

[0131] Step 17: The identity resolution system returns the access result to the user, and the process ends.

[0132] It can be seen that the resource access method provided in the embodiment of the present application realizes a resource access system based on distributed identification based on the user management system, the authentication management agency, the identification resolution system and the blockchain. In the resource access system, the blockchain technology is used to assign a unique distributed identification to each user, and the user authority management of the transmission representation resolution system is transferred from the center side to the user side, so as to effectively ensure that the user's access rights are autonomous and controllable, realize the lightweight management of the identification resolution system access control, protect the privacy of the user's access rights, and prevent malicious tampering. It can be seen that the technical solution realizes simple and convenient identification resolution system management, and further realizes more secure and efficient identification resolution system access.

[0133] An embodiment of the present application provides a resource access device.

[0134] Please refer to Fig. 9 , Fig. 9 This is a schematic diagram of the structure of a resource access device provided by the present application. The resource access device is applied to an authentication management agency. The authentication management agency is in communication connection with a user management system and an identity resolution system. It may include:

[0135] The first receiving module 1 is used to receive an identification application generated by the user management system based on the user identity information, and send the identification application to the identification resolution system for qualification verification;

[0136] Generation module 2 is used to generate the target user's distributed identification, user public key, and user private key when the qualification verification is passed, and distribute the distributed identification and user private key to the target user, and upload the distributed identification and user public key to the blockchain;

[0137] The second receiving module 3 is used to receive a permission application generated by the user management system based on the permission application information, where the permission application is generated based on encryption of the user's private key;

[0138] Verification module 4 is used to obtain the user's public key from the blockchain using the distributed identifier in the permission application to verify the permission application, and send the permission application information to the identity resolution system for permission verification when the verification passes;

[0139] Access module 5 is used to distribute the access credentials encrypted based on the institution's private key to the target user when the authority verification is passed, so that the target user can use the access credentials to initiate an access request to the identity resolution system, and the identity resolution system can respond to the access request using the institution's public key in the blockchain.

[0140] It can be seen that the resource access device provided in the embodiment of the present application realizes a resource access system based on distributed identification based on the user management system, the authentication management agency, the identification resolution system and the blockchain. In the resource access system, the blockchain technology is used to assign a unique distributed identification to each user, and the user authority management of the identification resolution system is transferred from the center side to the user side, so as to effectively ensure that the user's access rights are autonomous and controllable, realize the lightweight management of the identification resolution system access control, protect the privacy of the user's access rights, and prevent malicious tampering. It can be seen that the technical solution realizes simple and convenient identification resolution system management, and further realizes more secure and efficient identification resolution system access.

[0141] In one embodiment of the present application, the first receiving module 1 can be specifically used to send an identification application to an identification resolution system, so that the identification resolution system determines whether the target user belongs to a preset applicable object according to the user identity information, so as to realize qualification verification.

[0142] In one embodiment of the present application, the verification module 4 can be specifically used to send permission application information to the identity resolution system, so that the identity resolution system determines whether the target user's application permissions meet the user type of the target user based on the permission application information to implement permission verification.

[0143] In one embodiment of the present application, the generating module 2 may be specifically configured to generate a distributed identifier of the target user according to the user type of the target user.

[0144] In one embodiment of the present application, the above-mentioned generation module 2 can be specifically used to save the user public key to a distributed identification document; and upload the distributed identification and the distributed identification document to the blockchain accordingly.

[0145] In one embodiment of the present application, the above-mentioned access module 5 can be specifically used to distribute access credentials encrypted based on the institution's private key to the target user, so that the target user can use the access credentials to initiate an access request to the identity resolution system, so that the identity resolution system uses the institution's public key in the blockchain to decrypt the access credentials to obtain the user's access rights, and respond to the access request when the user's access rights meet the access resources in the access request.

[0146] For an introduction to the device provided in the embodiments of the present application, please refer to the above method embodiments, and the present application will not elaborate on them here.

[0147] An embodiment of the present application provides an electronic device.

[0148] Please refer to Fig.10 , Fig.10 This is a schematic diagram of the structure of an electronic device provided in this application, and the electronic device may include:

[0149] Memory for storing computer programs;

[0150] A processor, which is used to implement the steps of any one of the resource access methods described above when executing a computer program.

[0151] like Fig.10 , which is a schematic diagram of the composition structure of an electronic device, the electronic device may include: a processor 10, a memory 11, a communication interface 12 and a communication bus 13. The processor 10, the memory 11 and the communication interface 12 all communicate with each other through the communication bus 13.

[0152] In the embodiment of the present application, the processor 10 may be a central processing unit (CPU), an application specific integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic devices.

[0153] The processor 10 may call a program stored in the memory 11. Specifically, the processor 10 may execute operations in the embodiment of the resource access method.

[0154] The memory 11 is used to store one or more programs, which may include program codes, and the program codes include computer operation instructions. In the embodiment of the present application, the memory 11 at least stores programs for implementing the following functions:

[0155] Receive identification applications generated by the user management system based on user identity information, and send the identification applications to the identification resolution system for qualification verification;

[0156] When the qualification verification is passed, the target user's distributed identification, user public key, and user private key are generated, and the distributed identification and user private key are distributed to the target user, and the distributed identification and user public key are uploaded to the blockchain;

[0157] Receive the permission application generated by the user management system based on the permission application information, where the permission application is generated based on the user's private key encryption;

[0158] Use the distributed identifier in the permission application to obtain the user's public key from the blockchain to verify the permission application, and send the permission application information to the identity resolution system for permission verification if the verification passes;

[0159] When the authority verification is passed, the access credentials encrypted based on the institution's private key will be distributed to the target user, so that the target user can use the access credentials to initiate an access request to the identity resolution system, and the identity resolution system will respond to the access request using the institution's public key in the blockchain.

[0160] In a possible implementation, the memory 11 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function, etc.; the data storage area may store data created during use.

[0161] In addition, the memory 11 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0162] The communication interface 12 may be an interface of a communication module, and is used to connect to other devices or systems.

[0163] Of course, it should be noted that Fig.10 The structure shown does not constitute a limitation on the electronic device in the embodiment of the present application. In actual applications, the electronic device may include Fig.10 More or fewer components than shown, or combinations of certain components.

[0164] An embodiment of the present application provides a computer-readable storage medium.

[0165] The computer-readable storage medium provided in the embodiment of the present application stores a computer program, and when the computer program is executed by a processor, the steps of any one of the above-mentioned resource access methods can be implemented.

[0166] Among them, the computer-readable storage medium can be any available medium that can be stored in a computer or a data storage device such as a server or data center that includes one or more available media integrated. For example, it can be a magnetic medium (such as a floppy disk, hard disk, magnetic tape, etc.), an optical medium (such as a DVD) or a semiconductor medium (such as a solid-state hard disk) and other media that can store computer program codes.

[0167] For an introduction to the computer-readable storage medium provided in the embodiments of the present application, please refer to the above method embodiments, and the present application will not elaborate on them here.

[0168] An embodiment of the present application provides a computer program product.

[0169] The computer program product provided in the embodiments of the present application includes a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps of any one of the above-mentioned resource access methods can be implemented.

[0170] Specifically, in the above embodiments, all or part of them can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of them can be implemented in the form of a computer program product.

[0171] Among them, the computer program product may include one or more computer programs / instructions, and when the computer program / instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application may be generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions may be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line, etc.) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0172] For an introduction to the computer program product provided in the embodiments of the present application, please refer to the above method embodiments, and the present application will not elaborate on them here.

[0173] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0174] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0175] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0176] The technical solution provided by the present application is described in detail above. The principle and implementation method of the present application are described in detail using specific examples herein, and the description of the above embodiments is only used to help understand the method and core idea of ​​the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. A resource access method, characterized in that: Applied to an authentication management agency, the authentication management agency is in communication connection with both a user management system and an identity resolution system, the method comprises: Receiving an identification application generated by the user management system based on user identity information, and sending the identification application to the identification resolution system for qualification verification; When the qualification verification is passed, a distributed identifier, a user public key, and a user private key of the target user are generated, and the distributed identifier and the user private key are distributed to the target user, and the distributed identifier and the user public key are uploaded to the blockchain; Receive a permission application generated by the user management system based on the permission application information, where the permission application is generated based on encryption of the user private key; Using the distributed identifier in the permission application, the user public key is obtained from the blockchain to verify the permission application, and when the verification passes, the permission application information is sent to the identity resolution system for permission verification; When the authority verification is passed, the access credential encrypted based on the institution's private key is distributed to the target user, so that the target user can use the access credential to initiate an access request to the identity resolution system, and the identity resolution system can respond to the access request using the institution's public key in the blockchain.

2. The resource access method according to claim 1, characterized in that: Sending the identification application to the identification resolution system for qualification verification includes: The identification application is sent to the identification resolution system, so that the identification resolution system determines whether the target user belongs to a preset applicable object according to the user identity information, so as to realize the qualification verification.

3. The resource access method according to claim 1, characterized in that: Sending the permission application information to the identity resolution system for permission verification includes: The permission application information is sent to the identity resolution system, so that the identity resolution system determines whether the application permission of the target user meets the user type of the target user according to the permission application information, so as to realize the permission verification.

4. The resource access method according to claim 1, characterized in that: Generate a distributed identity for the target user, including: A distributed identifier of the target user is generated according to the user type of the target user.

5. The resource access method according to claim 1, characterized in that: Uploading the distributed identifier and the user public key to the blockchain includes: Saving the user public key to a distributed identification document; The distributed identification and the distributed identification document are uploaded to the blockchain accordingly.

6. The resource access method according to claim 1, characterized in that: Distributing the access credential encrypted based on the institution's private key to the target user, so that the target user uses the access credential to initiate an access request to the identity resolution system, and the identity resolution system uses the institution's public key in the blockchain to respond to the access request, including: The access credential encrypted based on the institution's private key is distributed to the target user, so that the target user uses the access credential to initiate an access request to the identity resolution system, so that the identity resolution system uses the institution's public key in the blockchain to decrypt the access credential to obtain the user's access rights, and responds to the access request when the user's access rights satisfy the access resources in the access request.

7. A resource access device, characterized in that: Applied to an authentication management agency, the authentication management agency is in communication connection with both a user management system and an identity resolution system, and the device comprises: A first receiving module, configured to receive an identification application generated by the user management system based on user identity information, and send the identification application to the identification resolution system for qualification verification; A generation module, used for generating a distributed identifier, a user public key, and a user private key of a target user when the qualification verification passes, distributing the distributed identifier and the user private key to the target user, and uploading the distributed identifier and the user public key to a blockchain; A second receiving module, configured to receive a permission application generated by the user management system based on the permission application information, wherein the permission application is generated based on encryption of the user private key; A verification module, used to obtain the user public key from the blockchain using the distributed identifier in the permission application to verify the permission application, and send the permission application information to the identity resolution system for permission verification when the verification passes; The access module is used to distribute the access credentials encrypted based on the institution's private key to the target user when the authority verification is passed, so that the target user can use the access credentials to initiate an access request to the identity resolution system, and the identity resolution system can respond to the access request using the institution's public key in the blockchain.

8. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the resource access method according to any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the resource access method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the resource access method according to any one of claims 1 to 6 are implemented.

Images