Method for verifying identity, electronic device, computer program product

Abstract

According to the embodiment of the invention, a method for verifying the identity is provided, and the method comprises the step of determining the confidence coefficient of a verification node based on the historical behavior, consensus, contribution degree and security of the verification node. The method further includes, in response to the verification node being a trusted node, receiving, by the verification node, encrypted data of the user, where the verification node is a node in the decentralized network and is connected to the Internet over a communication protocol to receive and verify the encrypted data from the Internet, the encrypted data includes personal information associated with the user information and a signature published by a publisher, decrypting the encrypted data, and determining an identity of the user based on verification of the decrypted data. By using the method provided by the invention, the implementation complexity of decentration is reduced, the user experience of the service provider is improved, and multiple login selections are provided for the user.

Description

Technical Field

[0001] Embodiments of the present disclosure generally relate to the field of data processing, and in particular to a method, an electronic device, and a computer program product for verifying identity. Background Art

[0002] Sensitive information usually needs to be encrypted and protected in computer networks because the leakage or unauthorized access of sensitive information may lead to a series of negative consequences, including but not limited to the use of personal privacy data for improper activities, the leakage of intellectual property rights caused by unauthorized access, network viruses, etc.

[0003] Self-Sovereign Identity provides a more secure way to store sensitive information while providing identity and attribution verification capabilities. Users own their own personal information without centralized management, and can show and prove the authenticity of selected attributes to requesters. This improves the security of user data and protects private information from being leaked to unrelated parties. Summary of the invention

[0004] Embodiments of the present disclosure provide a method, electronic device, device, and computer program product for verifying identity.

[0005] According to a first aspect of the present disclosure, a method for verifying identity is provided, the method comprising determining the confidence of a verification node based on the historical behavior, consensus, contribution, and security of the verification node. The method also comprises receiving encrypted data of a user by the verification node in response to the confidence indicating that the verification node is a trusted node, wherein the verification node is a node in a decentralized network and is connected to the Internet through a communication protocol to receive and verify encrypted data from the Internet, the encrypted data comprising personal information associated with the user information and a signature issued by a publisher, decrypting the encrypted data, and determining the identity of the user based on the verification of the decrypted data.

[0006] According to a second aspect of the present disclosure, there is provided an electronic device for verifying identity, the electronic device comprising at least one processor, and a memory, coupled to the at least one processor and having instructions stored thereon, the instructions causing the electronic device to perform actions when executed by the at least one processor, the actions comprising determining the confidence of the verification node based on the historical behavior, consensus, contribution, and security of the verification node. The actions also include receiving encrypted data of the user by the verification node in response to the verification node being a trusted node, wherein the verification node is a node in a decentralized network and is connected to the Internet through a communication protocol to receive and verify encrypted data from the Internet, the encrypted data comprising personal information associated with the user information and a signature issued by the publisher, decrypting the encrypted data, and determining the identity of the user based on the verification of the decrypted data.

[0007] According to a third aspect of the present disclosure, there is provided a computer program product, which is tangibly stored on a non-volatile computer-readable medium and includes machine-executable instructions, which when executed cause a machine to perform the steps of the method implemented in the first aspect of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] The above and other objects, features and advantages of the present disclosure will become more apparent through a more detailed description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, wherein like reference numerals generally represent like elements throughout the exemplary embodiments of the present disclosure.

[0009] Figure 1A A schematic diagram showing a system based on self-sovereign identity in which the apparatus and / or method of embodiments of the present disclosure may be implemented according to embodiments of the present disclosure;

[0010] Figure 1B A schematic diagram based on centralized identity management is shown in which the device and / or method of the embodiments of the present disclosure according to the embodiments of the present disclosure may be implemented;

[0011] Figure 2 A flow chart of a method for identity authentication according to an embodiment of the present disclosure is shown;

[0012] Figure 3A Describes a schematic diagram of a hybrid system based on SSI and IAM according to an embodiment of the present disclosure;

[0013] Figure 3B A schematic diagram of another hybrid system based on SSI and IAM according to an embodiment of the present disclosure is described;

[0014] Figure 4 A schematic diagram describing the interaction process between the hybrid system and other systems according to an embodiment of the present disclosure; and

[0015] Figure 5 A schematic block diagram of an example device that can be used to implement embodiments of the present disclosure is described. DETAILED DESCRIPTION

[0016] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0017] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0018] Self-sovereign identity usually relies on verifiable credentials, decentralized identifiers, and protocols such as blockchain. It is a decentralized technology, which is different from centralized identity management (IAM) solutions. Therefore, when the industry tries to integrate it into the current IAM-related architecture, it encounters problems because the current main IAM architecture is still a centralized architecture, and user profiles are stored in local IT infrastructure or cloud providers, which is different from the decentralized SSI-based mechanism. In this hybrid identity environment where SSI systems and centralized IAM systems run in parallel to provide identity services, users face many inconveniences when navigating. For example, developers of service providers should implement SSI support from scratch, which requires expertise in decentralization and security. Users need to log in to different applications across login mechanisms, and need to switch back and forth between different login methods, with the risk of confusing or losing these credentials or logging in with the wrong tool. All of this hinders the adoption of this secure identity management approach.

[0019] At least to address the above and other potential problems, an embodiment of the present disclosure provides a method for verifying identity, the method comprising determining the confidence of a verification node based on factors such as the verification node's historical behavior, consensus, contribution, and security. The method also includes receiving encrypted data from a user by the verification node in response to the confidence indicating that the verification node is a trusted node. The verification node is a node in a decentralized network. And the verification node is also connected to the Internet through a communication protocol to receive and verify encrypted data from the Internet. The encrypted data includes personal information associated with the user information and a signature issued by the publisher. The verification node decrypts the encrypted data and determines the identity of the user based on the verification of the decrypted data.

[0020] By using the method implemented by the present disclosure, a hybrid IAM solution is realized, which can implement an SSI solution while providing IAM functions and interfaces, reduce the complexity of decentralized implementation, improve the user experience of service providers, and provide users with multiple login options.

[0021] The basic principles and several exemplary embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. Figure 1AA schematic diagram of a system based on self-sovereign identity in which the apparatus and / or method of the embodiments of the present disclosure can be implemented according to the embodiments of the present disclosure is illustrated. It should be understood that Figure 1A The number and arrangement of the objects, components, and elements shown are only examples, and the schematic diagram may include components, elements, nodes, objects, and various additional elements in different numbers and arrangements. It should also be understood that although the system 100a used as an example in the present disclosure is a system based on SSI, the method implemented based on the present disclosure can also be applied to systems based on any architecture or system.

[0022] like Figure 1A As shown, in the SSI-based system, a publisher 102, a holder 104, and a verifier 106 may be included, and these elements may be nodes in a decentralized network. According to an embodiment of the present disclosure, the publisher 102 may be a device used by a trusted institution, the holder 104 may be a device used by a user, and the verifier 106 may be a device used by a service provider, and these devices are the basic units that constitute the SSI-based system. These devices may be computers, hardware devices, servers, storage arrays, etc., which work together to provide data storage and access services. Each device typically has its own processing power, storage resources, network connection and other functions. Additionally or alternatively, the SSI-based system may have different devices and functions.

[0023] In some embodiments, the SSI-based system 100a may also include, among other things, verifiable credentials, decentralized identifiers (DIDs) 112, and distributed ledger technology (DLT) or blockchain 114. Verifiable credentials are digitally encrypted secure versions of paper and digital credentials that can be provided to organizations that need them for verification. DID 112 is a globally unique identifier consisting of a string of letters and numbers that is independent of any organization. DID 112 is public to the relevant parties and can be securely connected to the verifiable credentials. Blockchain 114 allows each participant in a secure network to have the same source of truth about the validity of the credentials.

[0024] In some embodiments, a user can use a secure repository 116 on a holder 104 device to generate a public and private key pair, store the private key in the holder 104, and publish the public key to a decentralized ledger or blockchain 114. The blockchain 114 can generate a DID 112 for the user of the public key and store it in its data repository. The user then requests the issuer (trusted authority) 102 to provide a verified digital identity statement (verifiable credentials) or signed statement and store it in the repository 116 application on the holder 104 as a countersigned statement.

[0025] When the verifier (service provider) 106 requires user information, the user can provide the entire statement of the verified credentials or only a subset of the statement from the secure repository 116 on the holder 104. The verifier 106 can verify the authenticity of the identity by verifying the public key signatures of the holder DID and the issuer DID on the decentralized ledger or network 114. Thus, the SSI-based system 100A provides a safer way to protect sensitive information. In SSI, users own their own data and do not rely on institutions to prove their identity. Unlike other forms of digital identity, SSI does not require sharing all information on the ID every time. By sharing relevant information only with the ID requester, it can help ensure privacy and security.

[0026] The SSI-based system 100a can help various industries enhance user experience and protect user data. For example, in the banking industry, the SSI-based system 100a can help protect user data and maintain privacy. In the human resources department, the SSI-based system 100a can speed up employee onboarding and help individuals verify necessary information. The SSI-based system 100a can also provide public services, allowing users to control their own identities without relying on centralized institutions. The SSI-based system 100a can also include decentralized node deployment and connection, as well as API support that is easy to configure and use.

[0027] As an example, a system such as SSI-based 100a can be installed in any computing device that has processing computing resources or storage resources. For example, a computing device can have common capabilities such as receiving and sending data requests, real-time data analysis, local data storage, and real-time network connection. Computing devices can generally include various types of devices. Examples of computing devices may include, but are not limited to: database servers, rack servers, server clusters, blade servers, enterprise-level servers, application servers, desktop computers, notebook computers, smart phones, wearable devices, security equipment, smart manufacturing equipment, smart home equipment, Internet of Things equipment, smart cars, drones, etc., and the present disclosure does not impose any restrictions on this.

[0028] Figure 1B The diagram illustrates a schematic diagram based on centralized identity management in which the device and / or method of the embodiment of the present disclosure according to the embodiment of the present disclosure can be implemented. It should be understood that Figure 1B The number and arrangement of the data, objects, components, and elements shown are only examples, and the schematic diagram may include components, elements, processing nodes, objects, and various additional elements in different numbers and arrangements. It should also be understood that although the system 100b used as an example in the present disclosure is an IAM-based system, the method implemented based on the present disclosure can also be applied to systems based on any architecture or system.

[0029] like Figure 1B As shown, in the IAM-based system 100b, elements or components such as a server 105, a directory server 115, an authentication service 110, an enterprise resource planning (ERP) or human resources (HR) system 125, a customer relationship management (CRM) server 120, and a policy database 130 may be included. According to an embodiment of the present disclosure, the IAM-based system 100b may be centralized in a local IT infrastructure or a cloud provider.

[0030] The directory server 115 can store information identities associated with user accounts. It is specifically used to store and manage structured data, and can include user information, organizational structure, resource information, etc. The directory server 115 can run based on the directory service protocol (Lightweight Directory Access Protocol, LDAP) to organize and retrieve data stored in the directory. The verification service 110 can provide user authentication for users. In some embodiments, the implementation of the verification service 110 can include multi-factor authentication (MFA), single sign-on (SSO), token authentication, biometric authentication, etc. Different applications can use different authentication methods, and the specific choice depends on security requirements, user experience, and specific requirements of the application.

[0031] In some embodiments, the policy database 130 can be used to determine access control and authorization. For example, the policy database 130 can store rules and permissions that define which users, groups, or entities can access specific resources and what operations can be performed on the resources. In some embodiments, identity and role assignment information from the ERPHR system 125 can be configured into the directory server 115 based on predetermined policies and rules through an internal configuration process.

[0032] In some embodiments, the server 105 can enforce assigned permissions based on applicable policies to control access to the system. In some embodiments, the server 105 identifies important events that require auditing, which are significant and relevant to the security of the information system. The organization specifies which information system components perform audit activities. Audit activities may affect information system performance. Therefore, the organization decides which events require continuous auditing based on risk assessment and which events require auditing in response to specific situations.

[0033] In some embodiments, the server 105 may also provide various services and resource allocations for other services or components. Allocate storage capacity, data resources, etc. to control which users or entities can access these resources and the operations they can perform. Administrators can assign permissions and policies through the server 105 to ensure that only authorized users or services can access resources and operate in the desired manner. These resources may be data stored in the cloud, virtual machines, policy databases 130, storage buckets, etc.

[0034] In some embodiments, the ERP system 125 can coordinate and integrate various business processes and functions of various departments within the organization. The ERP system 125 increases the efficiency, effectiveness and decision support of the organization by providing a unified information and workflow management platform. The ERP system 125 may include multiple modules, such as finance, human resources, supply chain management, production planning, procurement, sales, inventory management, etc. These modules can be integrated in a unified database so that various departments can share data and information, reduce data duplication and improve data accuracy.

[0035] In some embodiments, the CRM server 120 can be used to help organizations establish, maintain, and improve relationships with customers. For example, the CRM server 120 can centrally store customer information, including contact information, purchase history, communication records, etc., so as to achieve customer data management and provide more personalized services. The CRM server 120 can also provide data analysis tools to help organizations understand customer behavior, trends, and needs, so as to better formulate strategies and make decisions.

[0036] In some embodiments, roles such as business partners 135 may contribute through alliance agreements or through contractual provisions to keep their ID information up to date in the server 105 and directory server 115. In some embodiments, roles such as individual customers 140 accept agreements that define the purpose and boundaries of data use, thereby enabling access to the server 105 and directory server 115. In some embodiments, role information such as enterprise employees 145 may be entered into the server 105 and directory server 115 to enable enterprise management and control of employees.

[0037] Combined with the above Figure 1A and Figure 1B A block diagram of an environment in which some embodiments of the present disclosure can be implemented is described below. Figure 2 A flowchart of a method 200 for identity according to an embodiment of the present disclosure is described. The method 200 may be Figure 1AThe SSI-based system 100a and the IAM-based system 100b, as well as the hybrid system based on both SSI and IAM, are executed at any suitable computing device. The hybrid system based on SSI and IAM will be described in detail below in conjunction with FIG. 3 .

[0038] At block 202, the confidence of the verification node is determined based on the historical behavior, consensus, contribution, and security of the verification node. As an example, a hybrid system based on SSI and IAM or a user may determine the confidence of the verification node to be transmitted before transmitting encrypted data associated with the user. In some embodiments, the verification node may Figure 1A The verification node can also communicate with the verification party 106 shown in FIG. Figure 1B The server 105 and / or directory server 115 are connected or integrated to have the ability to access information associated with the user.

[0039] In some embodiments, the method of determining the confidence of a verification node may include determining whether the verification node has authentication and authorization, for example, by determining whether the verification node has a valid digital certificate, SSL / TLS certificate or other form of authentication mechanism, and only when the verification node has a valid digital certificate can it be determined that the verification node is a trusted node.

[0040] In some embodiments, the method of determining the confidence of the verification node may include determining whether the verification node is a trusted node through a consensus algorithm based on multiple nodes in a decentralized network, such as proof of work (PoW), proof of stake (PoS), or Byzantine fault tolerance (BFT). When more nodes consider the verification node to be a safe node, the verification node can be considered a trusted node. In some embodiments, the confidence of the verification node can also be determined based on the reputation of the verification node, for example, the reputation and history of the node can be understood. Whether the node has performed its duties honestly in the past, or whether there is a record of misconduct, what the community or other users think of the node, etc.

[0041] In some embodiments, the confidence of the verification node can also be determined based on the contribution of the verification node, for example, the contribution of the node's computing power, storage, bandwidth and other resources, and whether the node actively supports the operation of the network can be considered. In some embodiments, the node's historical data, including performance, availability and security records, whether there have been past attacks or failures, the node's operating time and availability, the community's evaluation of the node, and other factors can also be considered.

[0042] In some embodiments, the confidence of the verification node may also be determined based on the security measures of the verification node, such as whether the node has taken security measures such as firewalls, encrypted communications, and vulnerability management, and whether these security measures are strong enough. In some embodiments, the confidence of the verification node may also be determined based on other user feedback and whether other users report problems related to the node, as well as by regularly reviewing and monitoring the verification node.

[0043] Through the method described above at block 202, the hybrid system based on SSI and IAM can determine whether the verification node to which data is to be transmitted is a trusted node or an untrusted node. At block 204, in response to the verification node being a trusted node, the verification node receives the encrypted data of the user, wherein the verification node is a node in a decentralized network and is connected to the Internet through a communication protocol to receive and verify the encrypted data from the Internet, the encrypted data including personal information associated with the user information and a signature issued by the issuing party.

[0044] When the verification node is determined to be a trusted node, the hybrid system based on SSI and IAM can allow the user to send encrypted data to the verification node, which data can be data associated with user identity, personal profile, etc. For example, the content of the encrypted data can be credentials or data such as identity cards, passports, driver's licenses, graduation certificates, company employee information, etc. issued to the user by a corresponding institution such as the issuer 102.

[0045] In the context of a decentralized network, data associated with a user may first be hashed and then encrypted by a private key such as that held by the publisher 102 to generate encrypted data. In some embodiments, the publisher 102 may also add a digital signature to the data it publishes, and the encrypted data may also be referred to as a statement. The verification node may communicate with an external network such as the Internet based on a communication protocol.

[0046] Additionally or alternatively, in some embodiments, the external network may be a centralized network based on the Internet, such as a social media platform, an email service provider, a video sharing platform, a banking network, a telecommunications and Internet service provider, a cloud computing service network, a public institution network, etc. In some embodiments, these communication protocols may include the OpenAuthorization 2.0 protocol, the OpenID Connect protocol, and the Security Assertion Markup Language (SAML) 2.0, etc.

[0047] At block 206, the encrypted data is decrypted. As an example, the verification node may decrypt the encrypted data using a public key stored in a decentralized identifier (DID) document in a decentralized network. In some embodiments, a decentralized identifier may be used to identify a digital identifier of an entity to provide decentralized, verifiable, and controllable identity authentication. A decentralized identifier document may include a DID URL that points to a resource associated with the DID, such as a public key.

[0048] In some embodiments, data from the user may first be encrypted using a private key provided by the publisher based on a hash function such as RSA (Rivest-Shamir-Adleman) algorithm, AES (Advanced Encryption Standard) algorithm, and a corresponding public key and a decentralized identifier associated with the public key are generated based on these private keys. The generated public key and decentralized identifier may be stored in a decentralized identifier document for decryption and authentication by a verification node.

[0049] The decentralized identifier document may include one or more public key entries that associate a public key with a specific DID. Each public key entry may include the value of the public key used for digital signing and verification, the public key type (the encryption algorithm or signature algorithm used, for example, specifying that the public key is an RSA public key or an elliptic curve digital signature public key), the controller (for example, the DID owner who can use the public key for signing and verification), and the purpose (specifying the purpose of the public key, such as signing, encryption, etc.).

[0050] At block 208, the identity of the user is determined based on the verification of the decrypted data. In some embodiments, the verification node may verify whether the data has been tampered with by comparing the signature contained in the decrypted data with the publisher's signature in the publishing node. If the signatures are inconsistent, the data has been tampered with. In some embodiments, the verification node may compare the actual hash value in the decrypted data with the expected hash value calculated based on the declared content.

[0051] If the actual hash value matches the expected hash value, this means that the data integrity is verified because the data has not been tampered with during transmission. If the actual hash value does not match the expected hash value, this may indicate that the data has been tampered with, or there was a data transmission or decryption error. In this case, the data can no longer be trusted.

[0052] In some embodiments, the verification node may also have a policy control module, which may limit which nodes or users can access, view or modify specific data to ensure the privacy of the data, thereby controlling the user's access rights. For example, when the user has administrator privileges, the verification node may allow the user to add data to the decentralized network, delete data from the decentralized network, and modify data in the decentralized network. When the user has ordinary user privileges, the verification node may allow the user to only browse the user data associated with the user in the decentralized network, such as a user profile.

[0053] In some embodiments, the verification node may also issue an identity signature or statement to the user, and the identity signature may be used to verify with another verification node. For example, when the verification node is a school, it may issue an identity signature or statement associated with a degree certificate to the student. When the student is submitting a resume, he or she may present the identity signature or statement to another verification node such as a company or public institution to verify the authenticity and validity of the degree certificate.

[0054] Additionally or alternatively, in some embodiments, when the identity signature is invalid, the verification node can revoke or modify the identity signature. For example, when the school as a verification node finds that the student does not meet the graduation requirements during the actual study period, it can revoke or modify the identity signature or statement associated with the degree certificate that has been issued to the student.

[0055] In some embodiments, the verification node can communicate with an identity federator to verify the identity of the user. The identity federator can pass authentication and authorization information from one identity provider to another identity provider, thereby realizing identity federation and single sign-on functionality. The identity federator establishes trust between multiple independent authentication domains, enabling users to seamlessly access resources and services between these domains without having to log in or enter credentials multiple times. For example, the identity federator can allow users to access multiple associated applications and services with a single login, without having to enter different credentials for each application. In some embodiments, the identity federator can connect to different identity providers, such as the enterprise's directory server 115, social media login, or other authentication systems to establish a joint authentication. By communicating with the identity federator, the verification node can provide authentication services for applications from different systems on multiple platforms.

[0056] Combined with the above Figure 2 A flowchart of a method 200 for identity authentication according to an embodiment of the present disclosure is described. Figure 3A A schematic diagram of a hybrid system 300a based on SSI and IAM according to an embodiment of the present disclosure is described.

[0057] like Figure 3A As shown, in some embodiments, an issuer 302 such as a school, a company, or a notary office may issue various credentials, such as a degree certificate, a driver's license, an employee card, etc., to a holder 304 such as a student or an enterprise employee. These credentials may be included in various statements and include a corresponding digital signature of the issuer 302. The digital signature may be produced by hashing the credential content and encrypting it using the private key of the issuer 302.

[0058] The data associated with the credential may then be stored at the holder 304. When the holder 302 needs to authenticate the verification node 306, it may send encrypted data including the credential and the digital signature to the verification node. In some embodiments, the holder 302 may check whether the verification node 306 is a trusted node before transmitting the encrypted data to the verification node 306. For example, the verification node 306 may be confirmed to be a trusted node by checking the historical behavior, consensus, contribution, and security factors of the verification node 306.

[0059] The verification node 306 can be a built-in decentralized node in a global decentralized network that can support decentralized identities. The verification node 306 can accept encrypted data or statements from the holder 304. In some embodiments, the verification node 306 can have a decryption and verification module 308 that can decrypt and verify the encrypted data and act as a validator based on SSI. For example, the decryption and verification module 308 can use a public key obtained from a DID document 312 stored in a distributed ledger 310 or a blockchain network to decrypt the encrypted data or statement of the holder 304.

[0060] In some embodiments, the decryption and verification module 308 can compare the hash value obtained by decrypting the public key with the hash value calculated based on the declared content to determine whether the encrypted data has been tampered with. In this way, attacks and leaks in centralized authorization can be prevented while maintaining its immutability and credibility.

[0061] In some embodiments, when the verification is successful, the verification node 306 can extract the user attributes in the encrypted data, such as the user's permission level, as input to the policy control module 314, which is the authorization part of the IAM. The policy control module 314 can be used to define which users, roles, or entities can access resources or data in the hybrid system 300a, and determine their permission levels. For example, when an enterprise employee attempts to access a human resources file that can only be accessed by human resources department staff, the policy control module 314 will not allow the enterprise employee to access the corresponding file because the enterprise employee does not have the corresponding permission level.

[0062] In some embodiments, the hybrid system 300a also supports using protocols to communicate with users. For example, the hybrid system 300a can provide service providers with protocols 318 such as OAuth2, OpenID, SAML, etc. to provide authentication and authorization functions, and the service provider does not need to care about the details of the hybrid system 300. The previous integration with IAM can be maintained in these protocols 318 without developing additional logic.

[0063] In some embodiments, for IT administrators, the hybrid system 300a can provide a management console 316 to add, delete, and modify user information. For example, the management console 316 can include a user interface or tool for managing and monitoring applications, networks, or services in the management console 316. It is typically used by administrators or operators to configure, monitor, troubleshoot, and manage various aspects of the hybrid system 300a.

[0064] Additionally or alternatively, in some embodiments, the verification node 306 may also include a decentralized node 324 or be part of a decentralized node 324. In some embodiments, the issuer 302, the holder 304, and the verification node 306 may be connected to a distributed ledger or blockchain network 322 via a decentralized identity or decentralized identifier 320 and become part of the network 322.

[0065] Figure 3B A schematic diagram of another hybrid system 300b based on SSI and IAM according to an embodiment of the present disclosure is described. Figure 3B As shown, in a hybrid system 300b based on a hybrid IAM architecture, the system may include Figure 3A The verification node 306, decryption and verification module 308, management console 316, policy control module 314 and other elements or components described in the above. In some embodiments, the verification node 306 in the hybrid system 300b can also serve as another SSI-based issuer 326 connected to the global decentralized identity.

[0066] The publisher 326 may publish data such as signatures, statements, etc. related to the identity of the holder 304 to the holder 304, such as a user. These signatures and / or statements, etc., may then be stored by the holder and published to another verification node or distributed ledger 322. In one embodiment, for example, when a new user profile needs to be created, such as an enterprise employee profile, the enterprise hybrid system 300b implemented according to the present disclosure may issue a statement or identity signature for the individual's employment information.

[0067] The statement or identity signature can be held by the individual. The individual can make this statement to other verification nodes or other IAMs when necessary. Similarly, the hybrid system 300b can be modified by revoking and reissuing the corresponding statement to the individual. For example, when an employee retires, the hybrid system 300b can revoke the employee's identity authentication or statement. Additionally or alternatively, the hybrid system 300b can also modify the employee's identity authentication status to a retired status and resend the identity authentication or statement to the employee. Thus, the present disclosure implements operations different from general IAM systems, because in general IAM systems, a set of new data about newly created users will be generated in its database. In the hybrid system 300b based on the present disclosure, since all statements or data are held by individuals, creating a user in the hybrid system 300b based on the present disclosure means issuing a new statement to the individual.

[0068] Figure 4 A schematic diagram of a hybrid system and other systems interaction process 400 according to an embodiment of the present disclosure is described. Figure 4 As shown, in some embodiments, multiple applications 402-1, 402-2, ... 402-n from a service provider 404 may send encrypted data to an identity federation party or a federated identity authentication 406 in a centralized point 408. In some embodiments, the applications 402-1, 402-2, ... 402-n may be applications with different functions and transmitted using different protocols, such as social media applications, video applications, etc. The centralized point 408 may be a centralized location, system, or entity for centrally managing or processing specific functions, data, or processes, etc.

[0069] In some embodiments, the identity federation 406 can be an authentication point where users only need to log in and verify their identity without providing credentials in each application or system. The identity federation 406 can use standard authentication protocols such as SAML, OAuth, or OpenID Connect to communicate with a variety of different applications and systems. The service provider 404 only needs to communicate with the identity federation 406 as a single point, and all necessary IAMs can be connected to the identity federation 406 and configured in the identity federation 406. In this mechanism, the service provider 404 can obtain the required user information and authorization through the unified interaction mechanism of the identity federation 406 and the industrial protocol.

[0070] In some embodiments, the identity federation party 406 can communicate and interact with the general centralized IAM 410 via a communication protocol such as SAML to transmit the user's encrypted data. In some embodiments, the identity federation party 406 can communicate and interact with the hybrid IAM 412 implemented based on the present disclosure via a communication protocol such as OpenID to transmit the user's encrypted data.

[0071] According to the method implemented in the present disclosure, a self-sovereign identity may be included in the hybrid IAM 412, which may be a decentralized distributed IAM. The hybrid IAM 412 can handle the complexity of decentralization, so the user information and verification obtained from the SSI can be seamlessly integrated into the architecture. The service provider 404 does not need to process different verification logics and deploy decentralized nodes to obtain DID information. In this architecture, the service provider 404 can easily support various login mechanisms in traditional and decentralized IAMs, and customers can also freely choose the login mechanisms they often use and are familiar with without confusing credentials in different platforms.

[0072] The method implemented by the present disclosure can realize the functional mapping between SSI and traditional IAM. It establishes a connection between universal IAM and SSI, making it possible to realize all the functions of IAM in the decentralized world. The authentication in the universal IAM 410 can be mapped to the decryption and verification of the verifier in SSI. Authorization is the extraction of attributes from the statement after verification and the addition of logic. And user modification is the issuance and revocation of the statement in SSI.

[0073] The method implemented by the present disclosure can also implement IAM 412 built-in decentralized nodes. This makes IAM 412 part of a decentralized identity system and provides IAM 412 with the full functionality of self-sovereign identity. A single IAM 412 acts as both an issuer and a verifier in an SSI-based system. It can issue claims, similar to creating a user in a general IAM 410, and verify the claims, which is the identity authentication and attribution extraction part in IAM. In some embodiments, a general protocol can be provided for IAM 412 federation. The proposed hybrid IAM 412 solution can support OpenID, SAML 2.0, and other identity protocols, which helps it to be integrated by a federated identity provider.

[0074] Thus, using all of these approaches, more secure and privacy-preserving decentralized identities can be easily and comprehensively adopted in the current centralized IAM ecosystem, without requiring modifications and integration complexity for developers on the service provider side, while providing a seamless user experience for users.

[0075] Figure 5A schematic block diagram of an example device 500 that can be used to implement an embodiment of the present disclosure is shown. The computing device in Figure 1 can be implemented using device 500. As shown, device 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 502 or computer program instructions loaded from a storage unit 508 into a random access memory (RAM) 503. In RAM 503, various programs and data required for the operation of storage device 500 can also be included. CPU 501, ROM 502 and RAM 503 are connected to each other via bus 404. Input / output (I / O) interface 505 is also connected to bus 504.

[0076] A number of components in the device 500 are connected to the I / O interface 505, including: an input unit 506, such as a keyboard, a mouse, etc.; an output unit 507, such as various types of displays, speakers, etc.; a storage page 508, such as a disk, an optical disk, etc.; and a communication unit 509, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 509 allows the device 500 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0077] The various processes and processing described above, such as method 200, may be performed by processing unit 501. For example, in some embodiments, method 200 may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by CPU 501, one or more actions of method 200 described above may be performed.

[0078] The present disclosure may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present disclosure.

[0079] Computer readable storage medium can be a tangible device that can hold and store instructions used by an instruction execution device. Computer readable storage medium can be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. More specific examples (non-exhaustive list) of computer readable storage medium include: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device, such as a punch card or a convex structure in a groove on which instructions are stored, and any suitable combination of the above. The computer readable storage medium used here is not interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (e.g., a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0080] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0081] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0082] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0083] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0084] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0085] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0086] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The choice of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for verifying identity, comprising: Determine the confidence of the verification node based on the verification node's historical behavior, consensus, contribution, and security; In response to the confidence indicating that the verification node is a trusted node, receiving encrypted data of the user by the verification node, wherein the verification node is a node in a decentralized network and is connected to the Internet through a communication protocol to receive and verify encrypted data from the Internet, the encrypted data including personal information associated with the user information and a signature issued by an issuer; decrypting the encrypted data; as well as The identity of the user is determined based on verification of the decrypted data.

2. The method according to claim 1, wherein decrypting the encrypted data by the verification node comprises: The encrypted data is decrypted using a public key stored in a decentralized identifier (DID) document in the decentralized network.

3. The method according to claim 1, wherein verifying, by the verification node, the decrypted data comprises: The data is verified by determining the consistency of the signature in the data with the publisher's signature in the publishing node.

4. The method according to claim 1, further comprising: Determining the authority of the user based on the policy control in the verification node and the encrypted data; as well as The user is allowed to perform operations on the decentralized network based on the permissions of the user.

5. The method of claim 4, wherein allowing the user to perform the operation on the decentralized network comprises: adding data to the decentralized network; Deleting data from said decentralized network; as well as Modify data in said decentralized network.

6. The method according to claim 1, further comprising: An identity signature is issued by the verification node to the user, wherein the identity signature is used for verification with another verification node.

7. The method according to claim 6, further comprising: In response to the expiration of the identity signature, the verification node revokes or modifies the identity signature.

8. The method of claim 1, wherein a verification node communicates with an identity federation party to verify the identity of the user.

9. A method according to claim 2, wherein the encrypted data is encrypted using a private key provided by the issuer, the public key is generated based on the private key, and the decentralized network generates a decentralized identifier associated with the user based on the public key and stores it in a decentralized identifier document.

10. An electronic device comprising: processor; as well as A memory is coupled to the processor and stores instructions that, when executed by the processor, cause the device to perform the following actions: Determine the confidence of the verification node based on the verification node's historical behavior, consensus, contribution, and security; In response to the confidence indicating that the verification node is a trusted node, receiving encrypted data of the user by the verification node, wherein the verification node is a node in a decentralized network and is connected to the Internet through a communication protocol to receive and verify encrypted data from the Internet, the encrypted data including personal information associated with the user information and a signature issued by an issuer; decrypting the encrypted data; as well as The identity of the user is determined based on verification of the decrypted data.

11. The electronic device of claim 10, wherein decrypting the encrypted data comprises: The encrypted data is decrypted using a public key stored in a decentralized identifier (DID) document in the decentralized network.

12. The electronic device of claim 10, wherein verifying the decrypted data comprises: The data is verified by determining the consistency of the signature in the data with the publisher's signature in the publishing node.

13. The electronic device according to claim 10, further comprising: Determining the authority of the user based on the policy control in the verification node and the encrypted data; as well as The user is allowed to perform operations on the decentralized network based on the permissions of the user.

14. The electronic device of claim 13, wherein allowing the user to perform the operation on the decentralized network comprises: adding data to the decentralized network; Deleting data from said decentralized network; as well as Modify data in said decentralized network.

15. The electronic device according to claim 10, further comprising: An identity signature is issued by the verification node to the user, wherein the identity signature is used for verification with another verification node.

16. The electronic device according to claim 15, further comprising: In response to the expiration of the identity signature, the verification node revokes or modifies the identity signature.

17. The electronic device of claim 10, wherein a verification node communicates with an identity federation party to verify the identity of the user.

18. An electronic device according to claim 11, wherein the encrypted data is encrypted using a private key provided by the issuer, the public key is generated based on the private key, and the decentralized network generates a decentralized identifier associated with the user based on the public key and stores it in the decentralized identifier document.

19. A computer program product tangibly stored on a non-transitory computer readable storage medium and comprising computer executable instructions that, when executed, cause a computer to: Determine the confidence of the verification node based on the verification node's historical behavior, consensus, contribution, and security; In response to the confidence level, the verification node is a trusted node, receiving encrypted data of the user by the verification node, wherein the verification node is a node in a decentralized network and is connected to the Internet through a communication protocol to receive and verify encrypted data from the Internet, wherein the encrypted data includes personal information associated with the user information and a signature issued by an issuer; decrypting the encrypted data; as well as The identity of the user is determined based on verification of the decrypted data.

20. The computer program product of claim 19, wherein decrypting the encrypted data comprises: The encrypted data is decrypted using a public key stored in a decentralized identifier (DID) document in the decentralized network.

Images