Digital identity generation method based on block chain
By obtaining trusted verification results and hash values from external institutions, combined with blockchain and asymmetric key technology, reliable verification and privacy protection of user identity are achieved, solving the difficulties of identity verification and privacy protection in the existing technology, and improving security and applicability.
Patent Information
- Application Number
- CN202411680362.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-22
- Publication Date
- 2025-04-11
AI Technical Summary
While protecting user privacy information, the prior art is difficult to achieve reliable user identity authentication, and there are problems such as performance bottlenecks, low computing efficiency and difficulty in establishing trust.
By obtaining the trusted verification results of user identity information by external institutions, obtaining the identity hash value and information hash value, using the State Secret algorithm or RSA algorithm to generate an asymmetric key group, the user's digital identity and system public key are distributedly stored, and consensus is made on the blockchain, and the user's private key is issued to the user.
It realizes reliable verification of user identity without revealing user privacy, improves security and applicability, avoids complex algorithms and layouts, and can seamlessly integrate with existing blockchain systems.
Smart Images
Figure CN119814315A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of blockchain encryption technology, and more specifically, to a method for generating digital identity based on blockchain. Background Art
[0002] Blockchain technology has the characteristics of decentralization, immutability, transparency and traceability, and can play a certain role in information security. With the frequent occurrence of user information security incidents, the protection of user information security has become a greater challenge. How to effectively protect user privacy information and reliably verify user identity is a key direction of current research. There are currently several ideas: zero-knowledge verification, homomorphic encryption, and federated learning.
[0003] Zero-knowledge verification: allows one party to prove that it has certain information without revealing the specific content of the information. This technology uses complex mathematical algorithms to ensure that the user's private data is not leaked during the verification process, and the verifier can be sure of the authenticity of the information. This technology provides an innovative solution for identity verification while protecting user privacy.
[0004] Homomorphic encryption: It is a technology that allows encrypted data to be calculated and the encrypted result is the same as the result obtained by directly calculating the plaintext data after decryption. This means that data can be processed and analyzed without exposing the original data. It is very suitable for scenarios that need to protect data privacy while performing necessary calculations, such as big data analysis, cloud computing services, etc.
[0005] Federated learning, as a distributed machine learning framework, allows multiple participants to jointly train models without sharing original data. Each participant trains part of the model on its own data and shares the encrypted gradients or model parameters with other participants, which are finally aggregated to form a global model. This method protects data privacy while achieving model optimization and sharing, which is of great significance for cross-organizational data cooperation.
[0006] However, although these technologies provide a balance between user privacy protection and identity authentication, they also face many technical problems. For example, the implementation of zero-knowledge verification technology often involves complex mathematical operations, which may lead to performance bottlenecks; although homomorphic encryption is powerful, its computational efficiency and key management issues are still key factors restricting its widespread application; federated learning needs to solve problems such as communication overhead, security proof, and trust establishment between participants during model training while ensuring data privacy.
[0007] Therefore, how to effectively protect the user's privacy information and reliably verify the user's identity in order to provide users with a more secure, reliable and convenient digital identity generation and verification solution is a problem that needs to be solved in this field. Summary of the invention
[0008] The purpose of the embodiments of the present application is to provide a blockchain-based digital identity generation method to provide users with a safer, more reliable and convenient digital identity generation and verification solution while effectively protecting user privacy.
[0009] In order to achieve the above purpose, the embodiments of the present application are implemented in the following ways:
[0010] In the first aspect, an embodiment of the present application provides a blockchain-based digital identity generation method, which is applied to the blockchain, including: obtaining a verification result of a user's identity information; if the verification is passed, obtaining an identity hash value corresponding to the user's identity information and an information hash value corresponding to multiple user information, the identity hash value being used as the user's digital identity, and the information hash value being stored confidentially in the blockchain; generating a set of asymmetric key groups for the user, the asymmetric key group including a system public key and a user private key, distributively storing and publishing the user's digital identity and the system public key, reaching a consensus on the blockchain, and sending the user's private key to the user.
[0011] In combination with the first aspect, in a first possible implementation method of the first aspect, an identity hash value corresponding to the user identity information and information hash values corresponding to multiple pieces of user information are obtained, the identity hash value is used as the digital identity of the user, and the information hash value is confidentially stored in the blockchain, including: obtaining the identity hash value corresponding to the user identity information, wherein the identity hash value is used as the digital identity of the user; obtaining the information hash value corresponding to each item of user information in the user identity information, wherein each information hash value is associated with a continuous serial number; and storing each information hash value confidentially in the blockchain according to the serial number associated with the information hash value.
[0012] In combination with the first aspect, in a second possible implementation of the first aspect, a group of asymmetric key groups is generated for the user, including: using the national secret algorithm SM9 or the RSA algorithm to generate an asymmetric key group for the user.
[0013] In combination with the first aspect, in a third possible implementation of the first aspect, the method also includes: obtaining a user request sent by a user terminal, wherein the user request is signed by a user private key; performing signature verification on the user request based on a system public key and a user's digital identity; if the verification passes, processing the user request; if the verification fails, rejecting the user request and returning a prompt message to the user terminal.
[0014] In combination with the third possible implementation manner of the first aspect, in a fourth possible implementation manner of the first aspect, the user terminal signs the user request by: generating a request hash value H based on the request content of the user request. q ; Get the timestamp of the user request; Based on the value of the request timestamp, determine the target information and target splicing method in the user identity information; Perform hash processing on the target information to obtain the target information hash value H i ; Based on the target splicing method, the target information hash value H i 、Identity hash value H d and request hash value H q Perform splicing to obtain the spliced content; perform hash calculation on the spliced content to obtain the verification hash value H t ; Verify the hash value H based on the user's private key t Sign, generate a digital signature S, and send the user request carrying the digital signature S and the request timestamp to the blockchain.
[0015] In combination with the fourth possible implementation method of the first aspect, in a fifth possible implementation method of the first aspect, based on the value of the request timestamp, the target information and the target splicing method in the user identity information are determined, including: adding the year, month, and day in the request timestamp, dividing the result by the number of items in the user identity information, and taking the remainder to determine the target information from the user identity information; adding the hours, minutes, and seconds in the request timestamp, dividing the result by the number of splicing methods, and taking the remainder to determine the target splicing method from all splicing methods.
[0016] In combination with the fifth possible implementation manner of the first aspect, in a sixth possible implementation manner of the first aspect, based on the system public key and the digital identity of the user, the signature verification of the user request includes: generating a request hash value H based on the request content of the user request; q '; Based on the value of the request timestamp, determine the target information and target splicing method in the user identity information; perform hash processing on the target information to obtain the target information hash value H i '; Based on the target splicing method, the target information hash value H i ', identity hash value H d ' and request hash value H q 'Concatenate and obtain the concatenated content; perform hash calculation on the concatenated content to obtain the verification hash value H t '; Based on the verification hash value H t ', use the system public key to verify the digital signature S.
[0017] In combination with the third possible implementation manner of the first aspect, in a seventh possible implementation manner of the first aspect, the user terminal signs the user request by: generating a request hash value H based on the request content of the user request.q ; Get the timestamp of the user's request; Based on the value of the request timestamp, determine the identity hash value H d , request hash value H q , the segmentation method and the mosaic method of the information hash value, and the identity hash value H based on the segmentation method and the mosaic method d , request hash value H q , the information hash value is segmented and chimerized to obtain chimera data; the chimera data is hashed to obtain the verification hash value H t ; Verify the hash value H based on the user's private key t Sign, generate a digital signature S, and send the user request carrying the digital signature S and the request timestamp to the blockchain.
[0018] In combination with the seventh possible implementation manner of the first aspect, in an eighth possible implementation manner of the first aspect, based on the value of the request timestamp, the identity hash value H is determined. d , request hash value H q , the segmentation method and the mosaic method of the information hash value, and the identity hash value H based on the segmentation method and the mosaic method d , request hash value H q , information hash value is segmented and chimerized to obtain chimerized data, including: adding the year and second in the request timestamp and dividing it by the identity hash value H d The length of the remainder is taken from the identity hash value H d Determine the target field; add the month and minute in the request timestamp and divide it by the request hash value H q The length of the request hash value H is taken as the remainder q The target field is determined; the day and time in the request timestamp are added, divided by the length of the hash value of each information item, and the remainder is taken to determine the target field from the hash value of each information item; according to the length of each target field, all target fields are chimerized to obtain chimerized data.
[0019] In combination with the eighth possible implementation manner of the first aspect, in a ninth possible implementation manner of the first aspect, based on the system public key and the digital identity of the user, the signature verification of the user request includes: generating a request hash value H based on the request content of the user request; q '; Based on the value of the request timestamp, determine the identity hash value H d '、Request hash value H q ', the division method and the mosaic method of the information hash value, and the identity hash value H based on the division method and the mosaic method d '、Request hash value H q ', the information hash value is divided and chimerized to obtain chimerized data; the chimera data is hashed to obtain the verification hash value H t'; Based on the verification hash value H t ', use the system public key to verify the digital signature S.
[0020] Beneficial effects:
[0021] 1. This solution saves the process of user identity information verification by obtaining the trusted verification results issued by external institutions for user identity information, obtains the identity hash value corresponding to the user identity information (as the user's digital identity) and the information hash value corresponding to multiple user information (as auxiliary verification in identity authentication scenarios, it can improve the ability to respond to extreme situations of user private key leakage and improve security), and the information hash value is stored confidentially in the blockchain. The national secret algorithm SM9 or RSA algorithm is used to generate a set of asymmetric key groups (including system public keys and user private keys) for the user, and the user's digital identity and system public key are distributed and publicly stored, and consensus is reached on the blockchain, and the user private key is issued to the user. Therefore, it is not necessary to store user information in the blockchain, but to use the identity hash value and the information hash value corresponding to multiple user information for storage, and use the designed algorithm for verification during verification to achieve identity authentication and prevent the leakage of user privacy. In addition, this solution does not require complex algorithms and layouts, and can achieve verification in a simple and reliable way. It can also be applied to scenarios with user identity authentication requirements to improve security and applicability.
[0022] 2. During verification, this scheme obtains the user request sent by the user terminal (signed by the user's private key), and the blockchain can perform signature verification on the user request based on the system public key and the user's digital identity. Two sets of verification schemes that can be applied to user identity authentication scenarios are designed, combining timestamps, user digital identities, information hash values, request hash values and other information to achieve signature verification. These two sets of verification schemes can effectively avoid the use of plaintext user information. They only need to use the digital identity (identity hash value) and information hash value corresponding to the agreed user information. Even if the private key is leaked, effective verification can be implemented. User information will not be stored in plaintext in the blockchain, which effectively improves security. By integrating user identity information and identity hash values into the signing process, the scheme realizes implicit authentication of user identity. At the same time, since the signing process depends on the user's private key, this further ensures that only legitimate users can generate valid signatures. The two sets of schemes can be seamlessly integrated with the existing blockchain system without large-scale transformation of the blockchain network. At the same time, due to the widespread application and standardization of digital signature technology, these two sets of schemes are also easy to interoperate and integrate with other systems.
[0023] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.
[0025] Figure 1 A flowchart of a blockchain-based digital identity generation method provided in an embodiment of the present application.
[0026] Figure 2 Flowchart for digital signature of users in scenario 1.
[0027] Figure 3 Flowchart of signature verification for blockchain in Solution 1.
[0028] Figure 4 Flowchart for digital signature of users in Solution 2.
[0029] Figure 5 Flowchart of signature verification for blockchain in Solution 2. DETAILED DESCRIPTION
[0030] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.
[0031] See also Figure 1 , Figure 1 A flowchart of a method for generating a digital identity based on blockchain provided in an embodiment of the present application. In this embodiment, the method for generating a digital identity based on blockchain may include step S11, step S12, and step S13.
[0032] First, before creating a digital identity, users need to provide a verification result after a trusted third-party organization verifies the user's identity information. For example, the user's identity information includes basic information such as name, ID number, work unit, gender, etc. It can also include some other information, such as bank statements, social security information, and credit information. This information can be initially evaluated and verified by the relevant trusted third-party organization and a trusted verification result can be issued.
[0033] Based on this, the blockchain can run step S11.
[0034] Step S11: Obtain the verification result of the user identity information.
[0035] In this embodiment, the blockchain can obtain the verification results of the user's identity information (issued by a recognized trusted third-party organization, such as XX assessment agency, verification agency, certain public departments, units, etc.).
[0036] After obtaining the verification result, if the verification is passed, the blockchain accepts the user's registration request (i.e., the generation of a digital identity), and step S12 can be executed.
[0037] Step S12: If the verification is successful, the identity hash value corresponding to the user identity information and the information hash values corresponding to multiple pieces of user information are obtained. The identity hash value serves as the user's digital identity, and the information hash value is stored confidentially in the blockchain.
[0038] In this embodiment, the blockchain can obtain the identity hash value corresponding to the user identity information, use the identity hash value as the user's digital identity, and obtain the information hash value corresponding to each item of user information in the user identity information, each information hash value is associated with a continuous sequence number (the continuous sequence number here actually means that these information hash values are stored in a predetermined order and cannot be misordered, because they will be needed for identity verification). Accordingly, the blockchain can store each information hash value confidentially in the blockchain according to the sequence number associated with the information hash value.
[0039] In addition, the identity hash value here (for example, using SHA-256, the corresponding hash value occupies 32 bytes) and the information hash value corresponding to the user information (for example, using SHA-256) are obtained by processing the relevant information, including preprocessing and hashing. For example, for all information of user identity information (understood as user profile), each information can be processed to a certain extent (for example, converting characters into word vectors), then aggregated and concatenated, and then hashed to obtain the identity hash value. The information hash value corresponding to each information is obtained by hashing after a certain processing (for example, converting characters into word vectors) to obtain the information hash value corresponding to each information.
[0040] Whether it is the user end or the blockchain, the same hash processing solution needs to be deployed. This does not mean that all hash processing uses the same hash algorithm, but that when the blockchain and the user end obtain the hash value corresponding to the same information (such as the identity hash value, or the information hash value corresponding to the ID card number), the same processing method and algorithm need to be used to ensure that the hash value is certain.
[0041] Afterwards, the blockchain can run step S13.
[0042] Step S13: Generate a set of asymmetric key groups for the user, which include a system public key and a user private key. The user's digital identity and the system public key are distributed and stored publicly, and consensus is reached on the blockchain, and the user private key is sent to the user.
[0043] In this embodiment, the national secret algorithm SM9 or RSA algorithm can be used to generate an asymmetric key group (including a system public key and a user private key) for the user, so that the user's digital identity and system public key are distributed and stored and made public, and consensus is reached on the blockchain, and the user private key is issued to the user. Note that the generation and distribution of keys is usually achieved through external key generation and issuance agencies. This embodiment will not be further elaborated on this and can be regarded as blockchain distribution.
[0044] Thus, the user's digital identity generation is completed. The following will introduce the verification process of the user request.
[0045] First, when a user accesses a service, he needs to generate a user request. The blockchain needs to verify the user request, so to determine the user's identity, the user terminal needs to sign the user request with the user's private key, and the blockchain verifies the digital signature of the user request to determine the correspondence between the user request and the user's identity.
[0046] In this embodiment, two solutions are designed for the digital signature of the private key and the signature verification of the public key, which are introduced here one by one.
[0047] Option 1:
[0048] See also Figure 2 , Figure 2 The flowchart for performing digital signature for a user (Solution 1) may include step S21, step S22, step S23, step S24, step S25, step S26, and step S27.
[0049] First, the user terminal may execute step S21.
[0050] Step S21: Generate a request hash value H based on the request content of the user request q .
[0051] In this embodiment, the user terminal can generate a request hash value H based on the request content of the user request. q Specifically, the request content can be converted into a word vector, and then processed using SHA-256 (or other hash algorithms) to obtain the request hash value H q .
[0052] Get the request hash value H q After that, the user terminal can execute step S22.
[0053] Step S22: Obtain the timestamp requested by the user.
[0054] In this embodiment, the user request has a timestamp, which can be the timestamp when the user request is generated, generally year-month-day-hour-minute-second-millisecond. This embodiment takes it to the second level, and the value of year-month-day-hour-minute-second is used subsequently.
[0055] After obtaining the timestamp requested by the user, the user terminal may execute step S23.
[0056] Step S23: Based on the value of the request timestamp, determine the target information and the target splicing method in the user identity information.
[0057] In this embodiment, the user terminal may determine the target information and the target splicing mode in the user identity information based on the value of the request timestamp (ie, the user request timestamp).
[0058] Exemplarily, the user terminal can add the year, month, and day in the request timestamp, divide it by the number of items in the user identity information, and take the remainder to determine the target information from the user identity information. For example, September 23, 2024, 14:58:17, then add the year, month, and day to get 2024+9+23=2056. Assuming that the number of items in the user identity information is 15, then 2056÷15=137...1, that is, the remainder is 1, then the first item in the user identity information (such as name) is taken as the target information.
[0059] Similarly, add the hours, minutes, and seconds in the request timestamp, divide it by the number of splicing methods, and take the remainder to determine the target splicing method from all splicing methods. q is the intermediate, target information hash value H i and the identity hash value H d There are two options for splicing on both sides), then, 14+58+17=89, 89÷2=44…1, then take the first splicing method (assuming that the splicing method is the identity hash value H d -Request hash value H q - Target information hash value H i ) is the target splicing mode. It should be noted that, assuming the situation of 0 hours, 0 minutes and 0 seconds, the last splicing mode is directly taken as the target mode. Of course, more splicing modes can be designed (such as permutations and combinations), for example, 3! (ie, 3×2×1=6), which is not limited here.
[0060] After determining the target information and the target splicing method, the user terminal may execute step S24.
[0061] Step S24: Perform hash processing on the target information to obtain the target information hash value H i .
[0062] In this embodiment, the user terminal can perform hash processing on the target information (for example, still using SHA-256) to obtain a hash value H of the target information. i .
[0063] Afterwards, the user terminal may execute step S25.
[0064] Step S25: Hash the target information based on the target splicing method i 、Identity hash value H d and request hash value H q Perform splicing to obtain splicing content.
[0065] In this embodiment, the user terminal can generate a target information hash value H according to the determined target splicing method. i 、Identity hash value H d and request hash value H q Perform concatenation to obtain the concatenated content (essentially a 96-byte string).
[0066] After obtaining the spliced content, the user terminal may execute step S26.
[0067] Step S26: Perform hash calculation on the spliced content to obtain a verification hash value H t .
[0068] In this embodiment, the user terminal can perform hash calculation on the spliced content to obtain a verification hash value H t Here, the hash calculation algorithm may continue to use SHA-256, or other hash algorithms may be used.
[0069] Get the verification hash value H t After that, the user terminal can execute step S27.
[0070] Step S27: Verify the hash value H based on the user's private key pair t Sign, generate a digital signature S, and send the user request carrying the digital signature S and the request timestamp to the blockchain.
[0071] In this embodiment, the user terminal uses its own user private key to verify the hash value H t Sign and generate a digital signature S. Then, the user terminal can send the user request carrying the digital signature S and the request timestamp to the blockchain.
[0072] Based on this, the blockchain can obtain the user request sent by the user terminal (signed by the user's private key), and the blockchain (the verification node therein) can then verify the signature of the user request based on the system public key and the user's digital identity.
[0073] like Figure 3As shown, the process of blockchain signature verification may include step S31, step S32, step S33, step S34, step S35, and step S36. In this embodiment, when blockchain verifies the signature, it needs to use the same process and algorithm as when the user terminal performs signature processing until the corresponding verification hash value H is obtained. t Therefore, steps S31 to S35 will not be described in detail here.
[0074] First, the blockchain can run steps S31 to S35 until the verification hash value H is obtained. t '.
[0075] Step S31: Generate a request hash value H based on the request content of the user request q '.
[0076] Step S32: Based on the value of the request timestamp, determine the target information and the target splicing method in the user identity information.
[0077] Step S33: Perform hash processing on the target information to obtain the target information hash value H i '.
[0078] Step S34: Hash the target information based on the target splicing method i ', identity hash value H d ' and request hash value H q 'Perform splicing and obtain the splicing content.
[0079] Step S35: Perform hash calculation on the spliced content to obtain a verification hash value H t '.
[0080] By running steps S31 to S35, the blockchain can obtain the calculated verification hash value H t ', then verification is required and step S36 is executed.
[0081] Step S36: Based on the verification hash value H t ', use the system public key to verify the digital signature S.
[0082] In this embodiment, the blockchain can be based on the verification hash value H t ', use the system public key to verify the digital signature S. For example, using the corresponding signature verification algorithm (for RSA, generally using B / T verification), the verification result can be finally obtained.
[0083] This is an introduction to signature and verification in Solution 1. Solution 2 will be introduced below.
[0084] Option 2:
[0085] See also Figure 4 , Figure 4 The flowchart for performing digital signature for a user (Solution 2) may include step S41, step S42, step S43, step S44, and step S45.
[0086] First, the user terminal may execute step S41.
[0087] Step S41: Generate a request hash value H based on the request content of the user request q .
[0088] In this embodiment, the user terminal can generate a request hash value H based on the request content of the user request. q Specifically, the request content can be converted into a word vector, and then processed using SHA-256 (or other hash algorithms) to obtain the request hash value H q .
[0089] Get the request hash value H q After that, the user terminal can execute step S42.
[0090] Step S42: Obtain the timestamp requested by the user.
[0091] In this embodiment, the user request has a timestamp, which can be the timestamp when the user request is generated, generally year-month-day-hour-minute-second-millisecond. This embodiment takes it to the second level, and the value of year-month-day-hour-minute-second is used subsequently.
[0092] After obtaining the timestamp requested by the user, the user terminal may execute step S43.
[0093] Step S43: Determine the identity hash value H based on the value of the request timestamp d , request hash value H q , the segmentation method and the mosaic method of the information hash value, and the identity hash value H based on the segmentation method and the mosaic method d , request hash value H q , information hash values are segmented and joined to obtain joined data.
[0094] In this embodiment, the user terminal may add the year and the second in the request timestamp and divide the result by the identity hash value H. d The length of the remainder is taken from the identity hash value H d For example, 16:23:45 on September 23, 2024, then add the year and the second to get 2024+45=2069, and the identity hash value H d The length of is 32 bytes, 2069÷32=64……21, then the identity hash value Hd Count from left to right to 21 digits, truncate and take the longer segment (if they are equal in length, take the first segment and discard the second segment), and get the identity hash value H d The target field.
[0095] The user terminal can add the month and minute in the request timestamp and divide it by the request hash value H q The length of the request hash value H is taken as the remainder q Continuing with the above example, add the month and minute to get 9+23=32, 32÷32=1…0, and the requested hash value H q If it is exactly 32 bytes and the remainder is 0, the entire segment is taken as the requested hash value H q The target field.
[0096] Furthermore, the user terminal can add the day and time in the request timestamp, divide it by the length of the hash value of each information item, and take the remainder to determine the target field from the hash value of each information item. Continuing the above example, add the day and time to get 23+16=39, 39÷32=1...7, then for each information hash value, cut off from the 7th bit, take the longer segment (if the lengths are equal, take the front segment and discard the back segment), and get the target field corresponding to each information hash value.
[0097] Then, according to the length of each target field, all target fields are joined to obtain joined data. For example, the fields are arranged from long to short. If target fields of equal length are encountered, the identity hash value H is used to separate them. d , request hash value H q , the information hash values are arranged and spliced, and the target fields of the information hash values are arranged and spliced according to their associated sequence numbers to obtain chimeric data.
[0098] After obtaining the chimeric data, the user terminal may execute step S44.
[0099] Step S44: Perform hash calculation on the chimeric data to obtain a verification hash value H t .
[0100] In this embodiment, the user terminal can perform hash calculation on the mosaic data to obtain a verification hash value H t Here, the hash calculation algorithm may continue to use SHA-256, or other hash algorithms may be used.
[0101] Get the verification hash value H t After that, the user terminal can execute step S45.
[0102] Step S45: Verify the hash value H based on the user's private key pair t Sign, generate a digital signature S, and send the user request carrying the digital signature S and the request timestamp to the blockchain.
[0103] In this embodiment, the user terminal uses its own user private key to verify the hash value H t Sign and generate a digital signature S. Then, the user terminal can send the user request carrying the digital signature S and the request timestamp to the blockchain.
[0104] Based on this, the blockchain can obtain the user request sent by the user terminal (signed by the user's private key), and the blockchain (the verification node therein) can then verify the signature of the user request based on the system public key and the user's digital identity.
[0105] like Figure 5 As shown, the process of blockchain signature verification may include step S51, step S52, step S53, and step S54. In this embodiment, when blockchain verifies the signature, it needs to use the same process and algorithm as the signature processing of the user terminal until the corresponding verification hash value H is obtained. t Therefore, steps S51 to S53 will not be described in detail here.
[0106] Step S51: Generate a request hash value H based on the request content of the user request q '.
[0107] Step S52: Determine the identity hash value H based on the value of the request timestamp d '、Request hash value H q ', the division method and the mosaic method of the information hash value, and the identity hash value H based on the division method and the mosaic method d '、Request hash value H q ', the information hash value is segmented and chimerized to obtain chimera data.
[0108] Step S53: Perform hash calculation on the chimeric data to obtain a verification hash value H t '.
[0109] Get the verification hash value H t 'After that, the user terminal can execute step S54.
[0110] Step S54: Based on the verification hash value H t ', use the system public key to verify the digital signature S.
[0111] In this embodiment, the blockchain can be based on the verification hash value H t ', use the system public key to verify the digital signature S. For example, using the corresponding signature verification algorithm (for RSA, generally using B / T verification), the verification result can be finally obtained.
[0112] The above is an introduction to the two signature verification schemes.
[0113] After obtaining the verification result, the blockchain can process the request accordingly. If the verification is successful, the blockchain can process the user request; if the verification fails, the blockchain will reject the user request and return a prompt message to the user terminal.
[0114] When a user wishes to change user information (for example, to increase the level of credibility and issue a new trusted verification result), he or she needs to first request verification (verify identity) and transmit the information hash value (list) corresponding to the updated user information confidentially (for example, encrypted with a symmetric key) to the blockchain. After the blockchain is updated accordingly, it returns an updated message. At this time, the user terminal updates the corresponding information hash value (list) locally to complete the update.
[0115] In summary, the embodiment of the present application provides a digital identity generation method based on blockchain, which saves the process of user identity information verification by obtaining the trusted verification result issued by an external organization for the user identity information, obtains the identity hash value corresponding to the user identity information (as the user's digital identity) and the information hash value corresponding to multiple user information (as an auxiliary verification in the identity authentication scenario, which can improve the ability to cope with extreme situations of user private key leakage and improve security), and the information hash value is stored confidentially in the blockchain. The national secret algorithm SM9 or RSA algorithm is used to generate a set of asymmetric key groups (system public key and user private key) for the user, and the user's digital identity and system public key are distributed and publicly stored, and consensus is reached on the blockchain, and the user private key is issued to the user. Therefore, it is not necessary to store user information in the blockchain, but to store the identity hash value and the information hash value corresponding to multiple user information, and to use the designed algorithm for verification during verification to achieve identity authentication and prevent the leakage of user privacy. Moreover, this solution does not require complex algorithms and layouts, and can achieve verification in a simple and reliable way. It can also be applied to scenarios with user identity authentication requirements to improve security and applicability.
[0116] During verification, this scheme obtains the user request sent by the user terminal (signed by the user's private key), and the blockchain can perform signature verification on the user request based on the system public key and the user's digital identity. Two sets of verification schemes that can be applied to user identity authentication scenarios are designed, combining timestamps, user digital identities, information hash values, request hash values and other information to achieve signature verification. These two sets of verification schemes can effectively avoid the use of plaintext user information. They only need to use the digital identity (identity hash value) and information hash value corresponding to the agreed user information. Even if the private key is leaked, effective verification can be implemented. User information will not be stored in plaintext in the blockchain, which effectively improves security. By integrating user identity information and identity hash values into the signing process, the scheme realizes implicit authentication of user identity. At the same time, since the signing process depends on the user's private key, this further ensures that only legitimate users can generate valid signatures. The two sets of schemes can be seamlessly integrated with the existing blockchain system without large-scale transformation of the blockchain network. At the same time, due to the widespread application and standardization of digital signature technology, these two sets of schemes are also easy to interoperate and integrate with other systems.
[0117] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.
[0118] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims
1. A method for generating digital identity based on blockchain, characterized in that: Applications in blockchain include: Obtain verification results of user identity information; If the verification is successful, the identity hash value corresponding to the user's identity information and the information hash values corresponding to multiple user information are obtained. The identity hash value is used as the user's digital identity, and the information hash value is stored confidentially in the blockchain; Generate a set of asymmetric key groups for the user, which include the system public key and the user private key. The user's digital identity and the system public key are distributed and stored publicly, and consensus is reached on the blockchain, and the user private key is sent to the user.
2. The method for generating a digital identity based on blockchain according to claim 1, characterized in that: Obtain the identity hash value corresponding to the user's identity information and the information hash values corresponding to multiple user information. The identity hash value is used as the user's digital identity, and the information hash value is stored confidentially in the blockchain, including: Obtaining an identity hash value corresponding to the user identity information, wherein the identity hash value is used as the user's digital identity; Obtaining an information hash value corresponding to each item of user information in the user identity information, wherein each information hash value is associated with a continuous sequence number; Each information hash value is stored confidentially in the blockchain according to the serial number associated with the information hash value.
3. The method for generating a digital identity based on blockchain according to claim 1, characterized in that: Generate a set of asymmetric keys for the user, including: Use the national secret algorithm SM9 or RSA algorithm to generate an asymmetric key group for the user.
4. The method for generating a digital identity based on blockchain according to claim 1, characterized in that: The method further comprises: Obtaining a user request sent by a user terminal, wherein the user request is signed by a user private key; Perform signature verification on user requests based on the system public key and the user's digital identity; If the verification is successful, the user request is processed; If the verification fails, the user request is rejected and a prompt message is returned to the user terminal.
5. The method for generating a digital identity based on blockchain according to claim 4, characterized in that: The way in which the user terminal signs the user request is as follows: Generate a request hash value H based on the request content of the user request q ; Get the timestamp of the user's request; Based on the value of the request timestamp, determine the target information and the target splicing method in the user identity information; Perform hash processing on the target information to obtain the target information hash value H i ; The target information hash value H is calculated based on the target splicing method. i 、Identity hash value H d and request hash value H q Perform splicing to obtain splicing content; Perform hash calculation on the concatenated content to obtain the verification hash value H t ; Verify the hash value H based on the user's private key pair t Sign, generate a digital signature S, and send the user request carrying the digital signature S and the request timestamp to the blockchain.
6. The method for generating a digital identity based on blockchain according to claim 5, characterized in that: Based on the value of the request timestamp, the target information and the target splicing method in the user identity information are determined, including: Add the year, month, and day in the request timestamp, divide it by the number of items in the user identity information, and take the remainder to determine the target information from the user identity information; Add the hours, minutes, and seconds in the request timestamp, divide it by the number of splicing methods, and take the remainder to determine the target splicing method from all splicing methods.
7. The method for generating a digital identity based on blockchain according to claim 6, characterized in that: Based on the system public key and the user's digital identity, the signature of the user request is verified, including: Generate a request hash value H based on the request content of the user request q '; Based on the value of the request timestamp, determine the target information and the target splicing method in the user identity information; Perform hash processing on the target information to obtain the target information hash value H i '; The target information hash value H is calculated based on the target splicing method. i ', identity hash value H d ' and request hash value H q 'Perform splicing and obtain the splicing content; Perform hash calculation on the concatenated content to obtain the verification hash value H t '; Based on the verification hash value H t ', use the system public key to verify the digital signature S.
8. The method for generating a digital identity based on blockchain according to claim 4, characterized in that: The way in which the user terminal signs the user request is as follows: Generate a request hash value H based on the request content of the user request q ; Get the timestamp of the user's request; Based on the value of the request timestamp, determine the identity hash value H d , request hash value H q , the segmentation method and the mosaic method of the information hash value, and the identity hash value H based on the segmentation method and the mosaic method d , request hash value H q , information hash values are segmented and joined to obtain joined data; Perform hash calculation on the chimeric data to obtain the verification hash value H t ; Verify the hash value H based on the user's private key pair t Sign, generate a digital signature S, and send the user request carrying the digital signature S and the request timestamp to the blockchain.
9. The method for generating a digital identity based on blockchain according to claim 8, characterized in that: Based on the value of the request timestamp, determine the identity hash value H d , request hash value H q , the segmentation method and the mosaic method of the information hash value, and the identity hash value H based on the segmentation method and the mosaic method d , request hash value H q , information hash values are segmented and chimerized to obtain chimerized data, including: Add the years and seconds in the request timestamp and divide by the identity hash value H d The length of the remainder is taken from the identity hash value H d Determine the target field in Add the month and minute in the request timestamp and divide by the request hash value H q The length of the request hash value H is taken as the remainder q Determine the target field in Add the day and time in the request timestamp, divide by the length of the hash value of each information item, and take the remainder to determine the target field from the hash value of each information item; According to the length of each target field, all target fields are chimerized to obtain chimerized data.
10. The method for generating a digital identity based on blockchain according to claim 9, characterized in that: Based on the system public key and the user's digital identity, the signature of the user request is verified, including: Generate a request hash value H based on the request content of the user request q '; Based on the value of the request timestamp, determine the identity hash value H d '、Request hash value H q ', the division method and the mosaic method of the information hash value, and the identity hash value H based on the division method and the mosaic method d '、Request hash value H q ', information hash values are segmented and chimerized to obtain chimerized data; Perform hash calculation on the chimeric data to obtain the verification hash value H t '; Based on the verification hash value H t ', use the system public key to verify the digital signature S.