Resource access method, apparatus, device, storage medium, and computer program product

Abstract

The application discloses a resource access method and device, electronic equipment, computer readable medium and computer program product, which can realize simple, convenient, safe and efficient identification analysis system management. The method is applied to an authentication management agency, and includes the following steps: receiving an identification application generated by a user management system based on user identity information, and sending the identification application to an identification analysis system for qualification verification; when the qualification verification is passed, distributing a distributed identification and a user private key to a target user, and uploading the distributed identification and a user public key to a block chain; receiving a permission application generated by the user management system based on user private key encrypted permission application information, and using the distributed identification to obtain the user public key from the block chain to verify the permission application information, and when the verification is passed, sending the permission application information to the identification analysis system for permission verification; and when the permission verification is passed, distributing an access credential encrypted based on an agency private key to the target user, so that the target user uses the access credential to access the identification analysis system.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to a resource access method, as well as a resource access device, electronic device, computer-readable storage medium, and computer program product. Background Technology

[0002] The Industrial Internet Identifier Resolution System (hereinafter referred to as the Identifier Resolution System) is an important component of the Industrial Internet. Its internal nodes have a wide variety of users, and different types of users have different access permissions to the nodes of the Identifier Resolution System. Therefore, the Identifier Resolution System authorizes different users to access identifier resources through access control policies.

[0003] Traditional identifier resolution systems primarily employ role-based and identity-based access control policies to manage user access. However, as the number of users in the identifier resolution system continues to increase and the types of users accessing identifier resolution nodes become increasingly complex, these traditional strategies have revealed several shortcomings. First, there is the problem of poor scalability: as the number of users accessing identifier resolution nodes increases, traditional strategies need to manage complex "user-node-access permission" mapping relationships, resulting in large mapping tables and increased query times. Furthermore, a user may have multiple access permissions on a single identifier resolution node; if a user's access permissions change, multiple mapping tables need to be updated, causing maintenance difficulties and poor scalability. Second, there is the problem of difficulty in centralized management: in traditional identifier resolution systems, all user access permissions are centrally managed. If the server storing user access permissions experiences a power outage or crash, it will be unable to continuously provide services to users. In addition, user access permissions in traditional identifier resolution systems are usually centrally managed by administrators, which makes it possible for data to be tampered with.

[0004] Therefore, how to achieve simple and convenient management of the identifier resolution system, and thus enable more secure and efficient access to the identifier resolution system, is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide a resource access method that enables simple and convenient management of the identifier resolution system, thereby achieving more secure and efficient access to the identifier resolution system. Another purpose of this application is to provide a resource access device, electronic device, computer-readable storage medium, and computer program product, all of which have the above-mentioned beneficial effects.

[0006] In a first aspect, this application discloses a resource access method applied to an authentication management authority, wherein the authentication management authority is communicatively connected to both a user management system and an identifier resolution system, and the method includes:

[0007] Receive the identifier application generated by the user management system based on the user's identity information, and send the identifier application to the identifier resolution system for qualification verification;

[0008] When the qualification verification is successful, a distributed identifier, a user public key, and a user private key are generated for the target user. The distributed identifier and the user private key are then distributed to the target user, and the distributed identifier and the user public key are uploaded to the blockchain.

[0009] Receives a permission request generated by the user management system based on permission request information, wherein the permission request is generated by encryption based on the user's private key;

[0010] The user's public key is obtained from the blockchain using the distributed identifier in the permission request to verify the permission request. If the verification passes, the permission request information is sent to the identifier resolution system for permission verification.

[0011] When the permission verification is successful, an access credential encrypted with the organization's private key is distributed to the target user, enabling the target user to use the access credential to initiate an access request to the identifier resolution system, and enabling the identifier resolution system to respond to the access request using the organization's public key in the blockchain.

[0012] Optionally, sending the identifier application to the identifier resolution system for qualification verification includes:

[0013] The identifier application is sent to the identifier resolution system so that the identifier resolution system can determine whether the target user belongs to the preset applicable object based on the user identity information, thereby realizing the qualification verification.

[0014] Optionally, sending the permission request information to the identifier resolution system for permission verification includes:

[0015] The permission request information is sent to the identifier resolution system so that the identifier resolution system can determine whether the requested permission of the target user meets the user type of the target user based on the permission request information, thereby realizing the permission verification.

[0016] Optionally, a distributed identifier for the target user is generated, including:

[0017] Generate a distributed identifier for the target user based on the target user's user type.

[0018] Optionally, uploading the distributed identifier and the user's public key to the blockchain includes:

[0019] Save the user's public key to a distributed identity document;

[0020] The distributed identifier and the corresponding distributed identifier document are uploaded to the blockchain.

[0021] Optionally, access credentials encrypted with the institution's private key are distributed to the target user, enabling the target user to initiate an access request to the identifier resolution system using the access credentials, and causing the identifier resolution system to respond to the access request using the institution's public key in the blockchain, including:

[0022] The access credentials encrypted with the institution's private key are distributed to the target user, enabling the target user to initiate an access request to the identifier resolution system using the access credentials. The identifier resolution system then uses the institution's public key in the blockchain to decrypt the access credentials to obtain the user's access permissions and responds to the access request when the user's access permissions satisfy the access resources in the access request.

[0023] Secondly, this application also discloses a resource access device applied to an authentication management authority, wherein the authentication management authority is communicatively connected to both a user management system and an identifier resolution system, and the device includes:

[0024] The first receiving module is used to receive the identifier application generated by the user management system based on the user's identity information, and send the identifier application to the identifier resolution system for qualification verification;

[0025] The generation module is used to generate a distributed identifier, a user public key, and a user private key for the target user when the qualification verification is passed, and to distribute the distributed identifier and the user private key to the target user and upload the distributed identifier and the user public key to the blockchain;

[0026] The second receiving module is used to receive the permission request generated by the user management system based on the permission request information, wherein the permission request is generated by encryption based on the user's private key.

[0027] The verification module is used to obtain the user's public key from the blockchain using the distributed identifier in the permission request to verify the permission request, and send the permission request information to the identifier resolution system for permission verification when the verification is successful;

[0028] The access module is used to distribute access credentials encrypted with the organization's private key to the target user when the permission verification is successful, so that the target user can use the access credentials to initiate an access request to the identifier resolution system, and the identifier resolution system can use the organization's public key in the blockchain to respond to the access request.

[0029] Thirdly, this application also discloses an electronic device, comprising:

[0030] Memory, used to store computer programs;

[0031] A processor, used to implement any of the resource access methods described above when executing the computer program.

[0032] Fourthly, this application also discloses a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of any of the resource access methods described above.

[0033] Fifthly, this application also discloses a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of any of the resource access methods described above.

[0034] This application provides a resource access method applied to an authentication management authority, which is communicatively connected to both a user management system and an identifier resolution system. The method includes: receiving an identifier application generated by the user management system based on user identity information, and sending the identifier application to the identifier resolution system for qualification verification; when the qualification verification is successful, generating a distributed identifier, a user public key, and a user private key for the target user, distributing the distributed identifier and the user private key to the target user, and uploading the distributed identifier and the user public key to a blockchain; receiving a permission application generated by the user management system based on permission application information, the permission application being encrypted using the user private key; using the distributed identifier in the permission application to obtain the user public key from the blockchain to verify the permission application, and when the verification is successful, sending the permission application information to the identifier resolution system for permission verification; when the permission verification is successful, distributing an access credential encrypted based on the authority's private key to the target user, enabling the target user to initiate an access request to the identifier resolution system using the access credential, and enabling the identifier resolution system to respond to the access request using the authority's public key in the blockchain.

[0035] By applying the technical solution provided in this application, a resource access system based on distributed identifiers is implemented, utilizing a user management system, an authentication management authority, an identifier resolution system, and blockchain. Within this system, blockchain technology assigns a unique distributed identifier to each user, and user access control of the identifier resolution system is transferred from the central side to the user side. This effectively ensures user access permissions are autonomous and controllable, achieving lightweight management of identifier resolution system access control while protecting user access privacy and preventing malicious tampering. Therefore, this technical solution achieves simple and convenient identifier resolution system management, and further enables more secure and efficient identifier resolution system access.

[0036] The resource access device, electronic device, computer-readable storage medium, and computer program product provided in this application also have the above-mentioned technical effects, and will not be described in detail here. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the prior art and the embodiments of this application, the accompanying drawings used in the description of the prior art and the embodiments of this application will be briefly introduced below. Of course, the accompanying drawings described below with respect to the embodiments of this application are only a part of the embodiments in this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort, and such other drawings also fall within the protection scope of this application.

[0038] Figure 1 A schematic diagram of the structure of a resource access system provided in this application;

[0039] Figure 2 A flowchart illustrating a resource access method provided in this application;

[0040] Figure 3 A schematic diagram of the DID operation mechanism provided in this application;

[0041] Figure 4 A schematic diagram of the structure of a user management system based on a DID identifier resolution system provided in this application;

[0042] Figure 5 A schematic diagram of the working principle of a user identity management subsystem provided in this application;

[0043] Figure 6 A schematic diagram of the working principle of a user rights management subsystem provided in this application;

[0044] Figure 7 A schematic diagram of the working principle of a user access control subsystem provided in this application;

[0045] Figure 8 A flowchart illustrating another resource access method provided in this application;

[0046] Figure 9 A schematic diagram of a resource access device provided in this application;

[0047] Figure 10 This is a schematic diagram of the structure of an electronic device provided in this application. Detailed Implementation

[0048] The core of this application is to provide a resource access method that enables simple and convenient management of the identifier resolution system, thereby achieving more secure and efficient access to the identifier resolution system. Another core aspect of this application is to provide a resource access device, electronic device, computer-readable storage medium, and computer program product, all of which have the aforementioned beneficial effects.

[0049] To provide a clearer and more complete description of the technical solutions in the embodiments of this application, the technical solutions in the embodiments of this application will be described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0050] This application provides a resource access method.

[0051] First, please refer to Figure 1 , Figure 1 This is a schematic diagram of the structure of a resource access system provided in this application. The resource access system mainly includes a user management system, an authentication management authority, and an identifier resolution system. The authentication management authority is communicatively connected to both the user management system and the identifier resolution system. The resource access method provided in this application is implemented based on this resource access system.

[0052] For further information, please refer to [link / reference]. Figure 2 , Figure 2 This is a flowchart illustrating a resource access method provided in this application, which is applied to... Figure 1 The certification management body shown may include the following S101 to S105.

[0053] S101: Receive the identifier application generated by the user management system based on the user's identity information, and send the identifier application to the identifier resolution system for qualification verification.

[0054] Specifically, target users can enter their own identity information into the user management system, including but not limited to username, password, user type, and other information related to the target user. This allows the user management system to generate a corresponding identifier application based on the user's identity information. It can be understood that this identifier application is used to apply for a unique distributed identifier for the target user. Furthermore, the identifier application is sent to the identifier resolution system for qualification verification in order to determine whether the target user is qualified to access the identifier resolution system.

[0055] Sending an identifier application to the identifier resolution system for qualification verification may include: sending an identifier application to the identifier resolution system so that the identifier resolution system can determine whether the target user belongs to the preset applicable objects based on the user's identity information, thereby achieving qualification verification.

[0056] This application provides a method for verifying the qualifications of an identifier application. Specifically, the identifier resolution system has several types of pre-defined applicable objects, such as root node operation organization management users, national top-level node operation organization management users, second-level node operation organization management users, enterprise node operation organization management users, enterprise users, and individual users. Only when the user type of the target user matches one of the pre-defined applicable objects of the identifier resolution system can the target user be considered qualified to access the identifier resolution system, i.e., the qualification verification is passed.

[0057] S102: When the qualification verification is successful, generate the target user's distributed identifier, user public key, and user private key, distribute the distributed identifier and user private key to the target user, and upload the distributed identifier and user public key to the blockchain.

[0058] Specifically, when the qualification verification is successful, meaning the target user is determined to be qualified to access the identifier resolution system, a unique distributed identifier is assigned to the target user. Simultaneously, a corresponding user private key and user public key are generated for them. The user private key is distributed to the target user along with the distributed identifier, while the user public key and distributed identifier are uploaded to the blockchain network together. Furthermore, if the qualification verification fails, a verification failure notification is directly sent to the target user through the user management system.

[0059] It should be noted that the Decentralized Identifier (DID) is a decentralized identity identifier proposed by the W3C standardization organization. It is implemented based on blockchain technology and relies on the tamper-proof, decentralized, and multi-party participation characteristics of blockchain to provide users with a digital identity that is self-sovereign, decentralized, verifiable, highly private, and globally unique.

[0060] The process of generating a distributed identifier for the target user may include: generating a distributed identifier for the target user based on the user type of the target user; wherein the distributed identifier may include a fixed field, a user type field, and a user identifier field.

[0061] This application provides a method for generating a distributed identifier for a target user. Specifically, the distributed identifier for the target user can be divided into three fields: a fixed field, a user type field, and a user identifier field. The user type field indicates the user type of the target user, and the user identifier field can be implemented by generating a unique hash value for the target user based on a hash algorithm.

[0062] In one possible implementation, a 5-level user distributed identifier can be designed as "did:rs:user type.user subtype.user identifier". "did:rs:" is a fixed field; "user type.user subtype" is an optional field (user type field). The user type is divided into administrator (ad) and ordinary user (us). If the user type is administrator, the user subtype is divided into root node operation organization management user (root), national top-level node operation organization management user (tl), second-level node operation organization management user (sl), and enterprise node operation organization management user (en). If the user type is ordinary user, the user subtype is divided into enterprise user (eu) and individual user (iu). The "user identifier" can be generated using a hash algorithm (user identifier field). For example, a user who is a root node operation organization management user could have a distributed identifier of "did:rs:ad.root.s@wlx7".

[0063] Uploading the distributed identifier and user public key to the blockchain can include: saving the user public key to a distributed identifier document; and uploading the distributed identifier and the distributed identifier document to the blockchain.

[0064] This application provides a method for uploading a distributed identifier and a user's public key to a blockchain. First, the user's public key is saved to a distributed identifier document; then, the distributed identifier and the distributed identifier document are uploaded to the blockchain together. It should be noted that the distributed identifier document is structured data associated with the distributed identifier, containing information such as the public key related to that identity and the creation time, and is generally stored on the blockchain.

[0065] S103: Receives permission requests generated by the user management system based on permission request information. The permission requests are generated by encryption based on the user's private key.

[0066] Specifically, once the distributed identifier and user private key are distributed to the target user, the target user can determine that they are qualified to access the identifier resolution system. At this point, they can continue to enter their permission application information in the user management system, including but not limited to requests to add node content permissions, delete node content permissions, modify node content permissions, and query node content permissions. Then, the user's private key is used to encrypt the information and send it to the authentication service authority to effectively ensure the security of user information.

[0067] S104: Use the distributed identifier in the permission request to obtain the user's public key from the blockchain to verify the permission request, and send the permission request information to the identifier resolution system for permission verification when the verification is successful.

[0068] Specifically, after receiving a permission request from a target user, the authentication service provider first verifies the user's identity. If the identity verification is successful, the service provider forwards the permission request information to the identifier resolution system for further permission verification. The authentication service provider's identity verification for the permission request involves: determining the target user's distributed identifier based on the request; using this identifier to obtain the corresponding public key from the blockchain; and then using this public key to decrypt the permission request. If decryption is successful, the target user's identity verification is considered successful; if decryption fails, the identity verification is considered unsuccessful. Furthermore, the identifier resolution system's permission verification specifically refers to verifying whether the target user's requested access permissions to the identifier resolution system comply with the relevant permission management specifications.

[0069] Sending permission request information to the identifier resolution system for permission verification may include: sending permission request information to the identifier resolution system so that the identifier resolution system can determine whether the requested permission of the target user meets the user type of the target user based on the permission request information, thereby realizing permission verification.

[0070] This application provides a method for verifying permissions for permission request information. Specifically, in the identifier resolution system, different requestable permissions are pre-defined for different user types. For example, management users have the permission to add, delete, modify, and query the content of each node in the identifier resolution system, while ordinary users only have the permission to query the content of each node in the identifier resolution system. Based on this, the identifier resolution system can verify the permissions of the target user by determining whether the target user's request permissions meet the allowed request permissions corresponding to the user type of the target user.

[0071] S105: When the authorization verification is successful, the access credential encrypted with the organization's private key will be distributed to the target user, so that the target user can use the access credential to initiate an access request to the identifier resolution system, and the identifier resolution system can use the organization's public key in the blockchain to respond to the access request.

[0072] Specifically, when authorization verification is successful, the authentication service authority (Authentication Authority) assigns an access credential to the target user. This credential is encrypted using the Authentication Authority's private key. Essentially, the Authentication Authority's private key is pre-stored locally, while the corresponding public key is uploaded to the blockchain for storage. Therefore, when the target user needs to access resources within the identifier resolution system, they can use this access credential to initiate an access request. The identifier resolution system can then retrieve the Authentication Authority's public key from the blockchain network to verify the access credential and respond to the target user's access request upon successful verification. Similarly, if authorization verification or access credential verification fails, the user management system can directly notify the target user of the verification failure.

[0073] The process of distributing access credentials encrypted with the organization's private key to target users, enabling them to initiate access requests to the identifier resolution system using these credentials, and then having the identifier resolution system respond to the access requests using the organization's public key in the blockchain, can include: distributing access credentials encrypted with the organization's private key to target users, enabling them to initiate access requests to the identifier resolution system using these credentials, and having the identifier resolution system decrypt the access credentials using the organization's public key in the blockchain to obtain the user's access permissions, and responding to the access requests when the user's access permissions satisfy the access resources in the access requests.

[0074] This application provides a method for an identifier resolution system to respond to a target user's access request. Specifically, the identifier resolution system verifies access credentials in two main ways: first, the access credential can be successfully decrypted using the organization's public key; second, the user access permissions in the access credential can completely cover the resources actually requested by the target user. Only when both conditions are met can the system respond to the target user's access request, allowing the target user to access the corresponding resources of the identifier resolution system.

[0075] As can be seen, the resource access method provided in this application embodiment implements a distributed identifier-based resource access system based on a user management system, an authentication management authority, an identifier resolution system, and blockchain. Within this resource access system, blockchain technology assigns a unique distributed identifier to each user, and the user permission management of the identifier resolution system is transferred from the central side to the user side. This effectively ensures that user access permissions are autonomous and controllable, achieving lightweight management of identifier resolution system access control while protecting user access permission privacy and preventing malicious tampering. Therefore, this technical solution achieves simple and convenient identifier resolution system management, and further realizes more secure and efficient identifier resolution system access.

[0076] Based on the above-described embodiments, this application provides another resource access method.

[0077] This application mainly introduces the resource access method through the following four parts: application objects of the DID-based identifier resolution system user management system, DID operation mechanism, introduction of the DID-based identifier resolution system user management system, and operation process of the DID-based identifier resolution system user management system.

[0078] I. Application Objects of the User Management System Based on DID Identifier Resolution System

[0079] The DID-based identifier resolution system user management system application objects define various access entities for the actual identifier resolution system, including root node operation organization management users, national top-level node operation organization management users, second-level node operation organization management users, enterprise node operation organization management users, enterprise users, and individual users.

[0080] 1. Root node runtime management users: manages root resolution services globally and is responsible for root resolution user access control.

[0081] 2. National Top-Level Node Operation Management User: Manages top-level identifier registration and identifier resolution services nationwide, and has management capabilities such as identifier filing and identifier authentication, and is responsible for access control of national top-level node users.

[0082] 3. Secondary node operation organization management users: manage the registration and resolution services of secondary identifiers nationwide, and have management capabilities such as identifier filing and identifier authentication, and are responsible for access control of secondary node users.

[0083] 4. Enterprise Node Operation Management User: Manages enterprise identifier registration and identifier resolution services nationwide, and has management capabilities such as identifier filing and identifier authentication, and is responsible for enterprise node user access control.

[0084] 5. Enterprise users and individual users: Users with identifier registration and identifier resolution requests can access top-level nodes, second-level nodes, or enterprise nodes.

[0085] II. DID Operation Mechanism.

[0086] First, the DID identifier is a new type of universally unique identifier defined by the W3C. Its core elements are the DID identifier, the DID document, and the verifiable credentials.

[0087] 1. DID Identifier: A unique string used to prove a user's identity. It consists of the prefix "did", the DID method, and the identifier string, such as "did:pml:abc", where "did" is the prefix "did", "pml" is the DID method, and "abc" is the identifier string. The generation of DID identifiers must meet the W3C standard specifications.

[0088] 2. DID Document: A DID document is structured data associated with a DID identifier, containing information such as the public key and creation time related to that identity, and is generally stored on a blockchain.

[0089] 3. Verifiable credentials (i.e., access credentials): These are digital certificates formed by a DID user endorsing certain attributes of another DID user and attaching their own private key signature, proving the authenticity of these attributes.

[0090] Secondly, DID operation requires four parties: users, certificate issuers, blockchain, and application providers.

[0091] 1. User: The user of DID, who creates and manages DID through different DID clients.

[0092] 2. Issuing party: refers to the organization or individual that creates and issues verifiable credentials to users.

[0093] 3. Application provider: The application service provider that uses the DID identifier to verify the user's DID and verifiable credentials, thereby indirectly verifying the user's authenticity.

[0094] 4. Blockchain: Used to store DID identifiers and DID documents, which can be used for user authentication.

[0095] Finally, please refer to Figure 3 , Figure 3 This application provides a schematic diagram of a DID operating mechanism. For example: A user (with a DID identifier) ​​applies to the Public Security Bureau (the issuer) for an electronic identity. After verifying the user's DID identifier, the Public Security Bureau issues a verifiable credential to the user. The user presents this verifiable credential to the school (the application provider), and the school retrieves the public key from the Public Security Bureau's DID document from the blockchain for verification to prove the user's identity.

[0096] III. Introduction to the DID-based identifier resolution system user management system.

[0097] First, please refer to Figure 4 , Figure 4 This application provides a schematic diagram of the structure of a DID-based identifier resolution system user management system, which includes a user identity management subsystem, a user permission management subsystem, and a user access control subsystem.

[0098] 1. The user identity management subsystem issues a DID identifier to the user based on the qualification information submitted by the user. The user can log in to the permission management subsystem with the obtained DID identifier to apply for permission acquisition and permission update.

[0099] 2. The user access management subsystem issues verifiable credentials (i.e., access credentials) to users based on their qualification information. These verifiable credentials store the user's access control permissions.

[0100] 3. The user access control subsystem receives user access identifier resolution system requests, obtains user access permissions from the blockchain, and decides whether to allow users to access the corresponding resources.

[0101] Secondly, the user management system interaction based on the DID identifier resolution system involves four parts: users, identifier resolution system, blockchain, and identity authentication and access control management authority (authentication management authority).

[0102] 1. The identity authentication and access control management organization has its own DID identifier, local private key and DID document stored on the blockchain, and is responsible for issuing user DID identifiers and verifiable credentials.

[0103] 2. The blockchain is responsible for storing user DID identifiers and DID documents, and supports the use of identity management smart contracts to store and query user DID documents, as well as the use of identity management smart contracts to query DID documents of identity authentication and access control management organizations.

[0104] 3. The identifier resolution system is responsible for verifying the qualification information of users when they apply for DID identifiers and access permissions, as well as responding to user access requests.

[0105] Finally, a detailed introduction to the various subsystems within the DID-based identifier resolution system user management system.

[0106] 1. User Identity Management Subsystem.

[0107] Please refer to Figure 5 , Figure 5 This is a schematic diagram illustrating the working principle of a user identity management subsystem provided in this application. Specifically, users register their identities and submit qualification information in the user identity management subsystem. The identity authentication and access control management agency receives the request (identity application) and submits it to the identity resolution system for review. Upon successful review, the identity authentication and access control management agency generates a unique DID identifier and public and private keys (user public key and user private key) for the user. The public key information is recorded in the DID document and stored on the blockchain through the identity management smart contract. The DID identifier and private key are then distributed to the user's digital wallet for storage.

[0108] The design specifies a 5-level user DID identifier as "did:rs:user type.user subtype.user identifier". "did:rs:" is a fixed field; "user type.user subtype" is an optional field (user type field). User types are divided into administrator (ad) and regular user (us). If the user type is administrator, the user subtypes are root node management user (root), national top-level node management user (tl), second-level node management user (sl), and enterprise node management user (en). If the user type is regular user, the user subtypes are enterprise user (eu) and individual user (iu). The "user identifier" can be generated using a hash algorithm (user identifier field). For example, a user who is a root node management user would have a DID identifier of "did:rs:ad.root.s@wlx7".

[0109] 2. User rights management subsystem.

[0110] Please refer to Figure 6 , Figure 6 This application provides a schematic diagram illustrating the working principle of a user access control subsystem. Specifically, after obtaining a DID (Distributed ID) identifier, a user can submit an access permission request. Access permissions include adding, deleting, modifying, and querying content at various nodes of the identifier resolution system. After filling in qualification information, the user obtains their private key from their digital wallet to encrypt the request and submits the encrypted request (access permission request) to the identity authentication and access control management authority. The authority receives the request, obtains the user's public key through an identity management smart contract based on the user's DID identifier, and verifies the user's request. If verification is successful, the authority sends the request to the identifier resolution system. The identifier resolution system reviews the reasonableness of the access permission request based on the user's DID identifier and qualification information, and responds to the authority with the review result. If the review is successful, the authority issues a verifiable credential to the user. This credential is signed by the authority's private key, and the user obtains the verifiable credential and stores it in their digital wallet.

[0111] 3. User access control subsystem.

[0112] Please refer to Figure 7 , Figure 7This application provides a schematic diagram illustrating the working principle of a user access control subsystem. Specifically, after obtaining access permissions to the corresponding node in the identifier resolution system, the user can access that node. The user attaches verifiable credentials and sends the access request to the identifier resolution system. The identifier resolution system accesses the blockchain access management smart contract, retrieves the public key information of the DID identifier of the identity authentication and access permission management authority, and verifies the user's verifiable credentials using this information. If the verification is successful, the identifier resolution system compares the user's access request for the accessed resource with the user's access permissions within their verifiable credentials. If the user's access to the resource is within the scope of their permissions, access is permitted, and a response result is sent back to the user.

[0113] IV. Operation process of user management system based on DID identifier resolution system.

[0114] Please refer to Figure 8 , Figure 8 The flowchart illustrating another resource access method provided in this application may include the following steps:

[0115] Step 1: The user fills in the qualification information, identity type and identity subtype (user identity information) in the system, applies for a DID identifier from the identity authentication and access control management agency, and proceeds to Step 2;

[0116] Step 2: The identity authentication and access control management organization sends the request to the identifier resolution system. The identifier resolution system verifies the user's qualification information and returns the verification result, proceeding to Step 3.

[0117] Step 3: The identity authentication and access control management organization obtains the verification result. If the verification is successful, proceed to step 5; otherwise, proceed to step 4.

[0118] Step 4: The identity authentication and access control management organization returns a "verification failed" result to the user, and the process ends;

[0119] Step 5: The identity authentication and access control management organization generates a DID identifier and public / private keys for the user, and returns the DID identifier and user private key to the user. The user stores them in their digital wallet and proceeds to Step 6.

[0120] Step 6: The identity authentication and access control authority stores the user's public key in the DID document and uploads the user's DID identifier and DID document to the blockchain through the identity management smart contract, proceeding to Step 7;

[0121] Step 7: The user fills in the qualification information and access permission application information in the system, encrypts it with the private key, and sends an access permission application request to the identity authentication and access permission management authority, then proceeds to Step 8;

[0122] Step 8: The identity authentication and access control management agency obtains the encryption request and decrypts the user request using the user's public key obtained through the identity management smart contract. If decryption is successful, proceed to step 10; otherwise, proceed to step 9.

[0123] Step 9: Return a "User authentication failed" result to the user, and the process ends;

[0124] Step 10: The identity authentication and access control management organization sends the decrypted request to the identifier resolution system. The identifier resolution system verifies the request. If the verification is successful, proceed to step 12; otherwise, proceed to step 11.

[0125] Step 11: Return "Permission request denied" to the user, and the process ends;

[0126] Step 12: The identity authentication and access control management organization generates a verifiable credential carrying access control information, signs it with its local private key, returns a "permission application approved" result to the user, and stores the verifiable credential in the user's digital wallet, proceeding to Step 13;

[0127] Step 13: The user initiates an access request to the identifier resolution system. The identifier resolution system obtains the user's verifiable credentials and decrypts the verifiable credentials using the public key of the identity authentication and access control management authority obtained through the permission management smart contract. If the decryption is successful, proceed to step 15; otherwise, proceed to step 14.

[0128] Step 14: The identifier resolution system returns a "verifiable credential verification failed" result to the user;

[0129] Step 15: The identifier resolution system obtains the decrypted verifiable credentials, obtains the user access permissions, and compares them with the user's actual access to resources. If the access permissions cover the accessed resources, proceed to step 17; otherwise, proceed to step 16.

[0130] Step 16: The identifier resolution system returns a "Does not have access permission for this resource" result to the user, and the process ends;

[0131] Step 17: The identifier resolution system returns the access result to the user, and the process ends.

[0132] As can be seen, the resource access method provided in this application embodiment implements a distributed identifier-based resource access system based on a user management system, an authentication management authority, an identifier resolution system, and blockchain. Within this resource access system, blockchain technology assigns a unique distributed identifier to each user, and the user permission management of the identifier resolution system is transferred from the central side to the user side. This effectively ensures that user access permissions are autonomous and controllable, achieving lightweight management of identifier resolution system access control while protecting user access privacy and preventing malicious tampering. Therefore, this technical solution achieves simple and convenient identifier resolution system management, and further realizes more secure and efficient identifier resolution system access.

[0133] This application provides a resource access device.

[0134] Please refer to Figure 9 , Figure 9 This application provides a schematic diagram of a resource access device, which is applied to an authentication management authority. The authentication management authority is communicatively connected to both the user management system and the identifier resolution system, and may include:

[0135] The first receiving module 1 is used to receive the identifier application generated by the user management system based on the user's identity information, and send the identifier application to the identifier resolution system for qualification verification;

[0136] Generation module 2 is used to generate the target user's distributed identifier, user public key, and user private key when the qualification verification is passed, and to distribute the distributed identifier and user private key to the target user and upload the distributed identifier and user public key to the blockchain;

[0137] The second receiving module 3 is used to receive permission requests generated by the user management system based on permission request information. The permission requests are generated by encryption based on the user's private key.

[0138] Verification module 4 is used to obtain the user's public key from the blockchain using the distributed identifier in the permission request to verify the permission request, and send the permission request information to the identifier resolution system for permission verification when the verification is successful;

[0139] Access module 5 is used to distribute access credentials encrypted with the organization's private key to the target user when the permission verification is successful. This allows the target user to use the access credentials to initiate an access request to the identifier resolution system, which then responds to the access request using the organization's public key in the blockchain.

[0140] As can be seen, the resource access device provided in this application embodiment implements a distributed identifier-based resource access system based on a user management system, an authentication management authority, an identifier resolution system, and blockchain. Within this resource access system, blockchain technology assigns a unique distributed identifier to each user, and the user permission management of the identifier resolution system is transferred from the central side to the user side. This effectively ensures that user access permissions are autonomous and controllable, achieving lightweight management of identifier resolution system access control while protecting user access permission privacy and preventing malicious tampering. Therefore, this technical solution achieves simple and convenient identifier resolution system management, and further realizes more secure and efficient identifier resolution system access.

[0141] In one embodiment of this application, the first receiving module 1 described above may be specifically used to send an identifier application to an identifier resolution system, so that the identifier resolution system can determine whether the target user belongs to a preset applicable object based on the user's identity information, thereby achieving qualification verification.

[0142] In one embodiment of this application, the verification module 4 described above can be specifically used to send permission request information to the identifier resolution system, so that the identifier resolution system can determine whether the requested permission of the target user meets the user type of the target user based on the permission request information, so as to realize permission verification.

[0143] In one embodiment of this application, the generation module 2 described above can be specifically used to generate a distributed identifier for the target user based on the user type of the target user.

[0144] In one embodiment of this application, the generation module 2 described above can be specifically used to save the user's public key to a distributed identifier document; and to upload the distributed identifier and the distributed identifier document to the blockchain.

[0145] In one embodiment of this application, the access module 5 can be specifically used to distribute access credentials encrypted based on the institution's private key to the target user, so that the target user can use the access credentials to initiate an access request to the identifier resolution system, so that the identifier resolution system can use the institution's public key in the blockchain to decrypt the access credentials to obtain the user's access permissions, and respond to the access request when the user's access permissions satisfy the access resources in the access request.

[0146] For a description of the apparatus provided in the embodiments of this application, please refer to the above method embodiments; further details will not be repeated here.

[0147] This application provides an electronic device.

[0148] Please refer to Figure 10 , Figure 10 This application provides a schematic diagram of the structure of an electronic device, which may include:

[0149] Memory, used to store computer programs;

[0150] A processor is used to execute computer programs to implement any of the resource access methods described above.

[0151] like Figure 10 The diagram shows the structural composition of an electronic device, which may include a processor 10, a memory 11, a communication interface 12, and a communication bus 13. The processor 10, memory 11, and communication interface 12 all communicate with each other through the communication bus 13.

[0152] In this embodiment, the processor 10 may be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic devices.

[0153] The processor 10 can call programs stored in the memory 11. Specifically, the processor 10 can execute operations in the embodiments of the resource access method.

[0154] The memory 11 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment, the memory 11 stores at least a program for implementing the following functions:

[0155] Receive identifier applications generated by the user management system based on user identity information, and send the identifier applications to the identifier resolution system for qualification verification;

[0156] When the qualification verification is successful, a distributed identifier, user public key, and user private key of the target user are generated, and the distributed identifier and user private key are distributed to the target user, while the distributed identifier and user public key are uploaded to the blockchain;

[0157] Receive permission requests generated by the user management system based on permission request information. The permission requests are generated by encryption using the user's private key.

[0158] The user's public key is obtained from the blockchain using the distributed identifier in the permission request to verify the permission request. When the verification is successful, the permission request information is sent to the identifier resolution system for permission verification.

[0159] When the authorization verification is successful, the access credential encrypted with the organization's private key will be distributed to the target user, so that the target user can use the access credential to initiate an access request to the identifier resolution system, and the identifier resolution system can respond to the access request using the organization's public key in the blockchain.

[0160] In one possible implementation, the memory 11 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0161] In addition, memory 11 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0162] Communication interface 12 can be an interface for the communication module, used to connect with other devices or systems.

[0163] Of course, it should be noted that, Figure 10 The structure shown does not constitute a limitation on the electronic device in the embodiments of this application. In practical applications, the electronic device may include more than Figure 10 More or fewer components as shown, or combinations of certain components.

[0164] This application provides a computer-readable storage medium.

[0165] The computer-readable storage medium provided in this application embodiment stores a computer program, which, when executed by a processor, can implement the steps of any of the resource access methods described above.

[0166] The computer-readable storage medium can be any available medium that a computer can store, or a data storage device such as a server or data center that integrates one or more available media. For example, it can be any medium that can store computer program code, such as magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives).

[0167] For a description of the computer-readable storage medium provided in the embodiments of this application, please refer to the above method embodiments; further details will not be repeated here.

[0168] This application provides a computer program product.

[0169] The computer program product provided in this application includes a computer program / instruction, which, when executed by a processor, can implement the steps of any of the resource access methods described above.

[0170] Specifically, in the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, in the form of a computer program product.

[0171] The computer program product may include one or more computer programs / instructions, which, when loaded and executed on a computer, can generate all or part of the processes or functions described in the embodiments of this application. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions may be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line, etc.) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0172] For a description of the computer program products provided in the embodiments of this application, please refer to the above method embodiments; further details will not be repeated here.

[0173] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0174] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0175] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0176] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the methods and core ideas of this application. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A resource access method, characterized in that, Applied to certification management authorities, which are communicatively connected to both the user management system and the identifier resolution system, the method includes: Receive the identifier application generated by the user management system based on the user's identity information, and send the identifier application to the identifier resolution system for qualification verification; When the qualification verification is successful, a distributed identifier, a user public key, and a user private key are generated for the target user. The distributed identifier and the user private key are then distributed to the target user, and the distributed identifier and the user public key are uploaded to the blockchain. Receives a permission request generated by the user management system based on permission request information, wherein the permission request is generated by encryption based on the user's private key; The user's public key is obtained from the blockchain using the distributed identifier in the permission request to verify the permission request. If the verification passes, the permission request information is sent to the identifier resolution system for permission verification. When the permission verification is successful, the access credential encrypted based on the institution's private key is distributed to the target user, so that the target user can use the access credential to initiate an access request to the identifier resolution system, and the identifier resolution system can use the institution's public key in the blockchain to respond to the access request. The process involves distributing access credentials encrypted with an organization's private key to the target user, enabling the target user to initiate an access request to the identifier resolution system using the access credentials, and causing the identifier resolution system to respond to the access request using the organization's public key in the blockchain. This includes: distributing the access credentials encrypted with the organization's private key to the target user, enabling the target user to initiate an access request to the identifier resolution system using the access credentials, causing the identifier resolution system to decrypt the access credentials using the organization's public key in the blockchain to obtain user access permissions, and responding to the access request when the user access permissions satisfy the access resources in the access request.

2. The resource access method according to claim 1, characterized in that, Sending the identifier application to the identifier resolution system for qualification verification includes: The identifier application is sent to the identifier resolution system so that the identifier resolution system can determine whether the target user belongs to the preset applicable object based on the user identity information, thereby realizing the qualification verification.

3. The resource access method according to claim 1, characterized in that, Sending the permission request information to the identifier resolution system for permission verification includes: The permission request information is sent to the identifier resolution system so that the identifier resolution system can determine whether the requested permission of the target user meets the user type of the target user based on the permission request information, thereby realizing the permission verification.

4. The resource access method according to claim 1, characterized in that, Generate a distributed identifier for the target user, including: Generate a distributed identifier for the target user based on the target user's user type.

5. The resource access method according to claim 1, characterized in that, Uploading the distributed identifier and the user's public key to the blockchain includes: Save the user's public key to a distributed identity document; The distributed identifier and the corresponding distributed identifier document are uploaded to the blockchain.

6. A resource access device, characterized in that, Applied to certification management authorities, which are communicatively connected to both user management systems and identifier resolution systems, the device includes: The first receiving module is used to receive the identifier application generated by the user management system based on the user's identity information, and send the identifier application to the identifier resolution system for qualification verification; The generation module is used to generate a distributed identifier, a user public key, and a user private key for the target user when the qualification verification is passed, and to distribute the distributed identifier and the user private key to the target user and upload the distributed identifier and the user public key to the blockchain; The second receiving module is used to receive the permission request generated by the user management system based on the permission request information, wherein the permission request is generated by encryption based on the user's private key. The verification module is used to obtain the user's public key from the blockchain using the distributed identifier in the permission request to verify the permission request, and send the permission request information to the identifier resolution system for permission verification when the verification is successful; The access module is used to distribute access credentials encrypted with the organization's private key to the target user when the permission verification is successful, so that the target user can use the access credentials to initiate an access request to the identifier resolution system, and the identifier resolution system can use the organization's public key in the blockchain to respond to the access request. Specifically, the access module is used to distribute the access credential encrypted with the institution's private key to the target user, so that the target user can use the access credential to initiate an access request to the identifier resolution system, and the identifier resolution system can use the institution's public key in the blockchain to decrypt the access credential to obtain the user's access rights, and respond to the access request when the user's access rights satisfy the access resources in the access request.

7. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the resource access method as described in any one of claims 1 to 5 when executing the computer program.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the resource access method as described in any one of claims 1 to 5.

9. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the resource access method according to any one of claims 1 to 5.

Images