Digital identity generation method, digital identity authentication method, electronic device, and computer program product

Abstract

Embodiments of the present disclosure provide a digital identity generation method, a digital identity authentication method, a computer-readable storage medium, an electronic device, and a computer program product. The digital identity generation method comprises: acquiring a private key of a first digital identity, and receiving, from a second node, an authenticity proof of the first digital identity, information of the first digital identity, and a signature of the first digital identity, wherein the information of the first digital identity is stored in the form of a hash tree; and generating the first digital identity on the basis of the private key of the first digital identity, the authenticity proof of the first digital identity, the information of the first digital identity, and the signature of the first digital identity. Therefore, the problem in the related art that authenticity and ownership of a digital identity cannot be authenticated can be at least solved.

Description

Digital identity generation methods, digital identity authentication methods, electronic devices and computer program products

[0001] Cross-reference of related applications

[0002] This disclosure is based on and claims priority to Chinese Patent Application No. 2025102787240, filed on March 10, 2025, entitled “Digital Identity Generation Method, Digital Identity Authentication Method, Electronic Device and Computer Program Product”, and incorporates the entire contents of that patent application by reference. Technical Field

[0003] This disclosure relates to the field of communication technology, and more specifically, to a digital identity generation method, a digital identity authentication method, an electronic device, and a computer program product. Background Technology

[0004] In related technologies, the digital identity structure mainly consists of three parts: identifier, attributes, and credentials. Identifiers are used to uniquely identify a digital identity subject, such as usernames and email addresses. Attributes describe the characteristics and information of the digital identity subject, such as name, age, gender, and address. Credentials are credentials used to verify a digital identity, such as passwords, digital certificates, and biometrics. These components together constitute a complete digital identity, used to identify and verify the identity of an entity in a digital environment, but they cannot authenticate the authenticity and ownership of the digital identity. Summary of the Invention

[0005] This disclosure provides a digital identity generation method, a digital identity authentication method, a computer-readable storage medium, an electronic device, and a computer program product to at least solve the problems of uneven load, low bandwidth utilization, and inaccurate congestion control encountered in single-connection transmission in related technologies.

[0006] According to one embodiment of this disclosure, a digital identity generation method is provided, applied to a first node, including:

[0007] Obtain the private key of the first digital identity, and receive the authenticity certificate of the first digital identity, the information of the first digital identity, and the signature of the first digital identity from the second node, wherein the information of the first digital identity is stored in the form of a hash tree;

[0008] The first digital identity is generated based on the private key of the first digital identity, the proof of authenticity of the first digital identity, the information of the first digital identity, and the signature of the first digital identity.

[0009] According to another embodiment of this disclosure, a digital identity authentication method is also provided, applied to a first node, comprising:

[0010] Two-way authentication is performed between the first digital identity and the fourth node. The first digital identity consists of the private key of the first digital identity, the proof of authenticity of the first digital identity, the information of the first digital identity, and the signature of the first digital identity. The information of the first digital identity is stored in the form of a hash tree.

[0011] According to yet another embodiment of this disclosure, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when it is run.

[0012] According to yet another embodiment of this disclosure, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0013] According to yet another embodiment of this disclosure, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps in any of the above method embodiments. Attached Figure Description

[0014] Figure 1 is a schematic diagram of the hardware structure of the mobile terminal operating in the embodiments of the method disclosed herein;

[0015] Figure 2 is a flowchart of a digital identity generation method according to an embodiment of the present disclosure;

[0016] Figure 3 is a schematic diagram of a digital identity structure according to an embodiment of the present disclosure;

[0017] Figure 4 is a structural schematic diagram of the authenticity proof according to the embodiments of this disclosure;

[0018] Figure 5 is a schematic diagram of the structure of a hash tree according to an embodiment of the present disclosure;

[0019] Figure 6 is a second schematic diagram of the structure of digital identity according to an embodiment of the present disclosure;

[0020] Figure 7 is a schematic diagram of the structure of the authenticity certificate provided to users connecting to a data network according to an embodiment of the present disclosure;

[0021] Figure 8 is a structural schematic diagram of the authenticity proof according to the embodiments of this disclosure;

[0022] Figure 9 is a schematic diagram of the structure of information in a digital identity according to an embodiment of the present disclosure;

[0023] Figure 10 is a flowchart of a digital identity authentication method according to an embodiment of the present disclosure;

[0024] Figure 11 is a flowchart of a digital identity authentication method according to an optional embodiment of the present disclosure. Detailed Implementation

[0025] The embodiments of this disclosure will be described in detail below with reference to the accompanying drawings and examples.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0027] The method embodiments provided in this disclosure can be executed in a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, FIG1 is a schematic diagram of the hardware structure of a mobile terminal running in the method embodiments of this disclosure. As shown in FIG1, the mobile terminal may include one or more (only one is shown in FIG1) processors 102 (processor 102 may include, but is not limited to, processing devices such as microprocessors MCUs or programmable logic devices FPGAs) and a memory 104 for storing data. The mobile terminal may also include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that the structure shown in FIG1 is only illustrative and does not limit the structure of the mobile terminal. For example, the mobile terminal may also include more or fewer components than shown in FIG1, or have a different configuration than shown in FIG1.

[0028] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the digital identity generation method in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0029] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0030] This embodiment provides a digital identity generation method operating on the aforementioned mobile terminal or network architecture. Figure 2 is a flowchart of the digital identity generation method according to an embodiment of this disclosure. As shown in Figure 2, applied to the first node, the process includes the following steps:

[0031] Step S202: Obtain the private key of the first digital identity, and receive the authenticity certificate of the first digital identity, the information of the first digital identity, and the signature of the first digital identity from the second node, wherein the information of the first digital identity is stored in the form of a hash tree;

[0032] Step S204: Generate the first digital identity based on the private key of the first digital identity, the proof of authenticity of the first digital identity, the information of the first digital identity, and the signature of the first digital identity.

[0033] Through the above embodiments of this disclosure, a digital identity is generated based on the private key of the digital identity, the proof of authenticity of the digital identity, the information of the digital identity, and the signature. The authenticity and ownership of the digital identity can be authenticated through the proof of authenticity of the digital identity.

[0034] A hash tree is a data structure that uses a hash function to convert data into fixed-length hash values ​​and stores them in a tree-like structure. The hash value of each non-leaf node is the combination of the hash values ​​of all its child nodes, which ensures data integrity and security. Storing digital identity information using hash trees can effectively prevent information from being tampered with, because any modification to the information will change the hash value, thus being detected during verification.

[0035] In one embodiment, obtaining the private key of a digital identity may include: sending a first request message to a second node requesting the granting of a digital identity; and receiving the private key of the first digital identity sent by the second node, wherein the private key of the first digital identity is the private key in a public-private key pair generated by the second node for the first node based on the first request message. The public-private key pair is a core security mechanism in the digital identity system; the public key is used to encrypt and verify signatures, while the private key is used to decrypt and generate signatures. By generating a public-private key pair for the first node by the second node and sending the private key to the first node, the uniqueness and security of the first node's digital identity are ensured.

[0036] In another embodiment, obtaining the private key of the first digital identity may include: generating a public-private key pair; and obtaining the private key of the first digital identity from the public-private key pair. The first node can autonomously generate the public-private key pair, thereby enabling it to have complete control over its private key and enhancing the security and autonomy of its digital identity.

[0037] In an optional embodiment, the method further includes: sending a second request message to the second node requesting the grant of a digital identity; receiving a public-private key pair verification from the second node; encrypting the public-private key verification pair using the private key; sending the encrypted public-private key verification pair and the public key from the public-private key pair to the second node, so that the second node decrypts the encrypted public-private key verification pair using the public key; comparing the decrypted public-private key verification pair with the stored public-private key verification pair; and if the comparison result is the same, sending the authenticity certificate of the first digital identity, the information of the first digital identity, and the signature of the first digital identity. Through public-private key pair verification, the correctness and consistency of the public-private key pair can be ensured, preventing man-in-the-middle attacks and the use of forged public-private key pairs. This process is a key step in private key verification and digital identity granting, ensuring the validity and consistency of the public-private key pair. When applying for a digital identity, a node not only needs to send a request message but also needs to verify the correctness of its public-private key pair through encryption and decryption. This verification process is a prerequisite for digital identity generation. Only upon successful verification will the second node grant the first node proof of authenticity, information, and its signature for the digital identity. Verification of the public-private key pair ensures the accuracy and consistency of digital identity generation. Before applying for a digital identity, a node needs to verify the validity of its public-private key pair. This not only ensures the correct generation of the key pair but also verifies the authenticity of the node's request. This method solves the problem of public-private key pair verification in digital identity systems. Through encryption and decryption, it ensures the consistency of the key pair, providing a solid foundation for digital identity generation and subsequent authentication processes. In practical applications, this method effectively prevents nodes from using invalid or tampered public-private key pairs to generate digital identities, further enhancing the security and reliability of the digital identity system.

[0038] For example, a first node generates a public-private key pair, and a second node grants the first node a digital identity based on this pair. The first node requests the digital identity from the second node. The second node sends the public-private key pair verification to the first node. The first node uses its private key to encrypt the verification and sends it back to the second node along with its public key. The second node uses its public key to decrypt the encrypted verification and compares the decryption result with its own verified public-private key pair. If they match, the second node generates the identity information and authenticity certificate of the first node's digital identity according to the format described above, writes the public key and validity period of the identity information sent by the first node into the first node's digital identity, and signs the identity information, public key, and validity period using its own private key. The second node sends the information, signature, and authenticity certificate back to the first node. The first node combines the received information, signature, and authenticity certificate with its private key to form a complete digital identity.

[0039] In an optional embodiment, the method further includes: sending a third request message to a third node requesting the granting of a digital identity; receiving a third digital identity sent by the third node, wherein the third digital identity consists of the private key from the public-private key pair generated by the third node for the first node, the authenticity certificate of the third digital identity, the information of the third digital identity, and the signature of the third digital identity. By requesting digital identities from multiple nodes, a distributed identity management system can be constructed, enhancing the system's reliability and robustness. The authenticity certificate, information, and signature of the third digital identity are similar in structure to the first digital identity, but may contain different permissions or information to adapt to different application scenarios. Through cross-node digital identity granting, the diversity and adaptability of digital identities are achieved. Nodes can request additional digital identities from other nodes to adapt to different application scenarios or obtain new permissions. This method solves the problem that a single identity in a digital identity system cannot meet the needs of multiple scenarios. Through cross-node digital identity granting, not only are the types of digital identities enriched, but the flexibility and adaptability of the digital identity system are also enhanced.

[0040] For example, a third node generates a public-private key pair and grants a digital identity to the first node based on this pair. The first node requests a digital identity from the third node. The third node generates the public-private key pair. Following the digital identity structure, the third node generates the identity information and proof of authenticity for the first node's digital identity, writes the public key and validity period sent by the first node into the first node's digital identity, and signs the identity information, public key, and validity period using its own private key. The third node combines the private key from the public-private key pair with the first node's information, signature, and proof of authenticity to form a complete third digital identity. The third node then sends this third digital identity to the first node.

[0041] In this embodiment of the disclosure, step S204 may include: encrypting the hash value of the information of the first digital identity using the private key of the second digital identity of the second node to obtain a signature of the digital identity, wherein the second digital identity includes the private key of the second digital identity, the information and signature of the second digital identity, and proof of authenticity of the second digital identity; generating a first digital identity based on the private key of the first digital identity, proof of authenticity of the first digital identity, the information and signature of the first digital identity, wherein the proof of authenticity of the first digital identity includes: a trusted storage address of the public key corresponding to the private key of the second node or a digital identity traceability chain, wherein the digital identity traceability chain includes the digital identity information and signature of the second node and the multi-level superior nodes that granted the second digital identity to the second node. The digital identity information signature is obtained by encrypting the hash value of the information using the private key, which ensures the immutability of the information. The proof of authenticity, by providing a trusted storage address of the public key or a digital identity traceability chain, can verify the source and authenticity of the digital identity, even when the network is offline.

[0042] Furthermore, the information and signature of the first digital identity are stored in the first digital identity in the form of a hash tree. The private key and proof of authenticity of the first digital identity are also written into the first digital identity. The information of the first digital identity includes at least the identity information of the first node, identity permissions, validity period of the identity information, and the public key corresponding to the private key. By storing the digital identity information and signature in the form of a hash tree, the integrity and security of the information can be ensured. Simultaneously, by writing the private key and proof of authenticity into the digital identity, self-verification of the digital identity can be achieved, improving the efficiency and security of verification.

[0043] In this embodiment, the first-level intermediate nodes of the hash tree include three nodes: the public key corresponding to the private key of the first digital identity, the validity period of the identity information, and the hash calculation results of other information. The other information refers to all information in the first digital identity except for the public key corresponding to the private key of the first digital identity and the validity period of the identity information. The root node of the hash tree is obtained by performing layer-by-layer hash calculations on the information of the first digital identity according to the hash tree structure. By placing key information (such as the public key and validity period) in the first level of the hash tree, this information can be quickly verified, improving verification efficiency.

[0044] The multi-level parent nodes that grant the second digital identity to the second node are in a relationship of granting and receiving digital identities. Each parent node includes at least a root identity management authority, which is the highest-level node. By constructing a multi-level digital identity granting relationship, a hierarchical identity management system can be formed, improving the system's scalability and management efficiency.

[0045] Preferably, when the second node is the root identity management authority, the proof of authenticity of the first digital identity includes: the digital identity of the root identity management authority; and the trusted storage address of the public key corresponding to the private key of the second node, which is either a storage address in the database or a query address of the identity management authority that manages the digital identity. The root identity management authority is the source of trust in the entire identity management system, and the authenticity of its digital identity is the foundation of system trust. By providing a trusted storage address for the digital identity and public key of the root identity management authority, the trustworthiness of the source of the digital identity can be ensured, improving the overall security of the system.

[0046] In this embodiment of the disclosure, the granting node refers to a node with a legitimate digital identity, which can grant sub-digital identities to other nodes based on its own digital identity. The nodes in this embodiment of the disclosure (including the first to fifth nodes) can be a network, a user device, a network device, or a digitized virtual human. The aforementioned first node can be either the granting node or the granting node. The legitimate digital identity of the granting node can be a root digital identity granted by an identity granting authority or a sub-digital identity granted by other nodes.

[0047] Figure 3 is a schematic diagram of a digital identity structure according to an embodiment of this disclosure. As shown in Figure 3, the digital identity (including the first digital identity, second digital identity, third digital identity, and fourth digital identity mentioned above) comprises the following three parts: a private key; information and signature; and proof of authenticity. Depending on the granting scenario and requirements, the public-private key pair of the granted node can be generated by the granted node or by the granting node. The private key is generally stored separately by the granted node and is not used together with the other two parts. The information includes the identity information of the granted node, the public key of the granted node, the validity period of the identity information, etc. The identity information includes various types of information, such as name and number, corresponding to the flexible generation and granting requirements of the digital identity. The identity information also includes the identity's permissions, such as the identity's usability scenarios and credit rating. The granted node can independently choose to provide at least a portion of its digital identity externally. The content of the information is stored in the form of a hash tree. The granting node's private key signs the root node of the hash tree composed of all the information to prevent tampering.

[0048] The aforementioned proof of authenticity is provided by the granting node. Figure 4 is a schematic diagram of the structure of the proof of authenticity according to an embodiment of this disclosure. As shown in Figure 4, it includes two parts: a trusted storage address for the granting node's public key, such as a distributed ledger address or an identity management authority storage address; and the granting node's digital identity. The granting node's digital identity includes the granting node's information and signature, and the proof of authenticity, but does not include the granting node's private key. When displaying the proof of authenticity externally, the node can display both parts or only one part.

[0049] The authenticity proof in the recipient's digital identity includes the grantor's digital identity, and the authenticity proof in the grantor's digital identity in turn includes the grantor's digital identity. In this structure, authenticity proofs can be nested in multiple layers according to the identity granting relationship, ultimately tracing back to the root identity management authority. The root identity management authority, as the original granting node, autonomously issues and publishes its digital identity, which is pre-installed in the device.

[0050] A hash tree is a tree-like data structure where the leaf nodes contain the stored data, and the non-leaf nodes (including intermediate and root nodes) are the hash values ​​of their child nodes. Specifically, the hash value is obtained by adding the hash values ​​of the child nodes together and then performing a hash operation. Any change to the data in any node will affect the value of its parent node. This prevents data tampering unless all related nodes are modified, making it impossible to reconcile the values. When displaying data, users can choose to show the leaf nodes as either the data itself or as hash values ​​of that data.

[0051] Figure 5 is a schematic diagram of the hash tree structure according to an embodiment of the present disclosure. As shown in Figure 5, Hash1 and node b are child nodes; Hash2 and Hash3 are intermediate nodes, each containing the hash values ​​of all its child nodes. When a user needs to provide data for node b, they can provide only the data for b, along with Hash1, Hash2, and Hash3. The recipient can then calculate the value of the root node and compare it with the correct root node value. In this way, the user can decide which child node data to display in plaintext and provide the relevant node hash values ​​to verify the authenticity of the data.

[0052] Figure 6 is a second schematic diagram of the structure of digital identity according to an embodiment of this disclosure. As shown in Figure 6, digital identity includes the following three parts: private key; information and signature; and proof of authenticity. The information includes various identity information of the granted node, the public key of the granted node, and the validity period of the identity information, etc., which are stored in the form of a hash tree. The public key and validity period serve as the first-level nodes of the hash tree. Other information besides the public key and validity period, whose hash values ​​are calculated using the hash tree, also serve as first-level nodes. After hashing the three nodes in the first level to obtain the hash value, it is encrypted using the private key of the granted node to form a signature node. Here, the public key and validity period are in plaintext; how to calculate the hash value of other information can be determined according to different scenarios. When using the granted node, it can decide which parts of the other information are displayed in plaintext.

[0053] The aforementioned proof of authenticity is provided by the granting node and consists of two parts. In actual use, one part can be selected based on the user type of the other party. Figure 7 is a schematic diagram of the structure of the proof of authenticity provided to users connected to the data network according to an embodiment of this disclosure. As shown in Figure 7, one part is provided for authentication by users who can connect to the data network, as shown in Figure 5. Figure 8 is a second schematic diagram of the structure of the proof of authenticity according to an embodiment of this disclosure. As shown in Figure 8, one part is provided for authentication by users who cannot connect to the data network.

[0054] As shown in Figure 8, the authenticity certificate can contain any number of nested levels, with the illustration showing four levels. When generating the authenticity certificate for the granted node, the granting node can choose whether all information in the authenticity certificate is in plaintext or a hash value. However, all public keys and expiration dates must be given in plaintext; the remaining information is determined by the granting node. When providing the authenticity certificate externally, the granted node can decide whether to display the aforementioned plaintext information in plaintext.

[0055] The second node (including the identity management structure, user, etc.) grants the first digital identity, which can generate a digital identity according to the digital identity structure shown in Figure 6. The second node generates a public-private key pair and identity information, determines its permissions and validity period, and uses the public key and validity period as the first-level sub-nodes of the information. Figure 9 is a schematic diagram of the information structure in the digital identity according to an embodiment of this disclosure. As shown in Figure 9, permission information and digital human identifier are the second-level sub-nodes of the information in the digital identity. The structure of the remaining information can be customized. Here, the permissions do not exceed the permission scope in the authenticity proof of the digital identity. The second node constructs the digital identity based on the generated identity information, and all permissions in the authenticity proof must be granted in plaintext.

[0056] Another aspect of this disclosure provides a digital identity authentication method. Figure 10 is a flowchart of a digital identity authentication method according to an embodiment of this disclosure. As shown in Figure 10, the method is applied to a first node and includes:

[0057] S1002, perform two-way authentication with the fourth node based on the first digital identity, wherein the first digital identity consists of the private key of the first digital identity, the proof of authenticity of the first digital identity, the information of the first digital identity, and the signature of the first digital identity, and the information of the first digital identity is stored in the form of a hash tree.

[0058] Digital identity authentication is a crucial step in a digital identity system, ensuring that communication between nodes is based on authentic and trusted identities. The two-way authentication process involves a first and a fourth node, verifying the digital identity's private key, proof of authenticity, information, and its signature to ensure the accuracy and consistency of the identity information of both parties. Two-way authentication achieves both security and reliability in inter-node communication. Before communicating, nodes need to verify the digital identity's private key, proof of authenticity, information, and its signature to ensure the accuracy and consistency of the identity information of both parties. This method solves the problem of secure inter-node communication in digital identity systems. Through two-way authentication, it not only improves the security of inter-node communication but also ensures the trustworthiness of the communicating parties. In practical applications, this method can effectively prevent unauthorized third-party interference or impersonation in inter-node communication, further enhancing the security of the digital identity system and the user experience.

[0059] Figure 11 is a flowchart of a digital identity authentication method according to an optional embodiment of the present disclosure. As shown in Figure 11, step S1002 may include:

[0060] Step S1102: Send a first network identifier (whether to connect to the data network), a first authentication material, a second encrypted material, and a first target digital identity to the fourth node, so that the fourth node can authenticate the second encrypted material and the first target digital identity. The second encrypted material is obtained by the first node encrypting the second authentication material of the fourth node using the private key of the first digital identity. The first target digital identity includes the authenticity proof of the first digital identity, the information of the first digital identity, and the signature of the first digital identity.

[0061] Step S1104: Receive the second network identifier (whether connected to the data network), second authentication material, first encryption material, and fourth target digital identity sent by the fourth node; or receive the first encryption material, second authentication material, and fourth target digital identity sent by the fourth node, and authenticate the first encryption material and fourth target digital identity. The first encryption material is obtained by the fourth node encrypting the first authentication material using the private key of the fourth digital identity. The fourth target digital identity includes: proof of authenticity of the fourth target digital identity, information of the fourth target digital identity, and signature of the fourth target digital identity. The fourth digital identity includes the private key of the fourth target digital identity, proof of authenticity of the fourth target digital identity, information of the fourth target digital identity, and signature of the fourth target digital identity.

[0062] The execution order of the above steps S1102 and S1104 can be interchanged. That is, S1102 can be executed first and then S1104, or S1104 can be executed first and then S1102.

[0063] When the first node and the fourth node perform two-way authentication using the first digital identity, the following steps can be taken:

[0064] Step 11: The first node sends an authentication request to the fourth node. The authentication request includes an identifier indicating whether or not the data network is connected.

[0065] Step 12: If the fourth node agrees to the authentication, it replies with "agree to authentication," which includes the second authentication materials and an identifier indicating whether the data network is connected.

[0066] Step 13: The first node uses the private key corresponding to the first target digital identity to encrypt the second authentication material to form the second encrypted material. Then, the second encrypted material and the required first target digital identity are sent to the fourth node.

[0067] The information in the first target digital identity can expose only the parts that need verification. The first node determines the content of the authenticity proof in the first target digital identity based on whether the fourth node is connected to the data network. If it can connect to the data network, it can provide the trusted address part of the granting node's public key. If it cannot connect to the data network, it must provide the digital identity part.

[0068] Step 14: The fourth node verifies the authenticity of the first target digital identity and the correctness of the second encrypted material.

[0069] Specifically, if the fourth node can connect to the data network, it accesses the trusted address of the granting node's public key in the first target digital identity to obtain the granting node's public key for the first target digital identity, and uses the public key to decrypt the signature of the first target digital identity. If it can be decrypted, then the first target digital identity is authentic.

[0070] If the fourth node cannot connect to the data network, it accesses the granting node's digital identity portion of the first target digital identity, retrieves the root identity management authority's identity contained therein, and compares it with its own pre-set root identity management authority's identity. If the comparison is inconsistent, authentication fails, an authentication failure message is sent to the first node, and authentication ends. If the comparison is consistent, it decrypts each digital identity signature according to the granting order of digital identities, starting with the built-in root identity management authority's public key, to verify the authenticity of the digital identity. If any step in this process fails, authentication fails, an authentication failure message is sent to the first node, and authentication ends. If all steps are successful, the authenticity of the first target digital identity is successfully verified.

[0071] Step 15: The fourth node uses the public key of the decrypted first target digital identity to decrypt the second encrypted material and compares it with the second authentication material. If they do not match, authentication fails, and the node sends an authentication failure message to the first node, ending the authentication process. If they match, authentication succeeds.

[0072] Step 16: The fourth node uses the private key corresponding to the fourth target digital identity to encrypt the first authentication material to form the first encrypted material. The first encrypted material and the required fourth target digital identity are then sent to the first node.

[0073] The fourth target digital identity information can expose only the parts that need verification. The fourth node determines the authenticity proof content in digital identity information 2 based on whether the first node is connected to the data network. If it can connect to the data network, it can provide the trusted address of the granting node's public key. If it cannot connect to the data network, it must provide the granting node's digital identity information.

[0074] Step 17: The first node verifies the authenticity of the fourth target digital identity and the correctness of the first encrypted material according to the process described in Step 14. If authentication fails, it sends an authentication failure message to the fourth node, ending the authentication process.

[0075] If authentication is successful, the first node generates a subsequent communication key, encrypts the communication key using the public key of the fourth target's digital identity, and then sends it to the fourth node.

[0076] Step 18: The fourth node uses the private key of the fourth target digital identity to decrypt the communication key encrypted in step 17, and obtains the communication key for subsequent communication encryption with the first node.

[0077] When the first node and the fourth node perform two-way authentication using the first digital identity, the following steps can also be taken to reduce the number of interaction steps:

[0078] Step 21: The first node sends an authentication request to the fourth node. The authentication request includes the first authentication materials, the first target digital identity that needs to be provided, and an identifier indicating whether the data network is connected.

[0079] In the first target digital identity, only the information portion that needs verification can be exposed. The authenticity verification portion must contain all information.

[0080] Step 22: If the fourth node agrees to authentication, it encrypts the first authentication material using its own private key to form the first encrypted material. It then sends the first encrypted material, the required fourth target digital identity, the second authentication material, and an identifier indicating whether the data network is connected to the first node.

[0081] The fourth target digital identity can expose only the parts that need verification. The fourth node determines the content of the authenticity proof in the fourth target digital identity based on whether the first node is connected to the data network. If it can connect to the data network, it can provide the trusted address of the granting node's public key. If it cannot connect to the data network, it must provide the granting node's digital identity portion.

[0082] Step 23: The first node verifies the authenticity of the fourth target digital identity and the correctness of the first encrypted material according to the process described in Step 14 above. If authentication fails, an authentication failure message is sent to the fourth node, ending the authentication process.

[0083] If authentication is successful, proceed to step 13 above.

[0084] Step 24 is the same as step 14 above.

[0085] Step 25: If authentication is successful, the fourth node generates a subsequent communication key, encrypts the communication key using the public key of the first target's digital identity, and sends it to the first node.

[0086] Step 26: The first node uses the private key of the first target digital identity to decrypt the communication key encrypted in step 25, and obtains the communication key for subsequent communication encryption with the fourth node.

[0087] The specific process of two-way authentication includes the sending and receiving of encrypted materials and the verification of digital identities. This process ensures that communication between nodes is based on authentic and trusted identities, while enhancing communication security and privacy through the use of encrypted materials. By sending and receiving encrypted materials and verifying digital identities, security and privacy are achieved in inter-node communication. When performing two-way authentication, nodes not only verify the authenticity of digital identities but also ensure data security and privacy during communication through the use of encrypted materials. This method solves the problem of security and privacy in inter-node communication within a digital identity system. Through encrypted materials and digital identity verification, it not only improves the security of inter-node communication but also ensures data privacy during communication. In practical applications, this method can effectively prevent unauthorized third parties from eavesdropping or tampering with inter-node communication, further enhancing the security and user experience of the digital identity system.

[0088] Furthermore, authenticating the first encrypted material and the fourth target digital identity may include: querying whether the first node stores the public key of the root identity management structure in the digital identity traceability chain; if it has, then following the order of digital identity granting, starting with the public key of the built-in root identity management authority, decrypting the signatures of each digital identity in the digital identity traceability chain to authenticate the authenticity of the digital identity; if it has not been stored or one step of authentication fails, authentication fails, an authentication failure message is sent to the fourth node, and authentication ends; if the signature of the fourth target digital identity is successfully decrypted, the authenticity of the fourth target digital identity is successfully authenticated; using the decrypted public key of the fourth target digital identity to decrypt the first encrypted material, comparing the decrypted first authentication material with the stored first authentication material; if the comparison is inconsistent, authentication of the first encrypted material fails, an authentication failure message is sent to the fourth node, and authentication ends; if the comparison is consistent, authentication of the first encrypted material passes. Flexible authentication can be achieved by accessing the trusted storage address of the public key online or accessing the digital identity traceability chain offline, improving the system's adaptability and reliability. This method, through online and offline verification mechanisms, improves the flexibility of digital identity authentication and solves the authentication problem under changing network environments.

[0089] In an optional embodiment, after authenticating the first encrypted material and the fourth target digital identity, the method further includes: if both authentications pass, generating a communication key, encrypting the communication key using the public key in the fourth target digital identity, and sending the encrypted communication key to the fourth node; and encrypting communication with the fourth node using the communication key. By generating a communication key and encrypting it with the public key, the security of communication can be ensured, preventing the leakage of communication content. This method improves the security of communication after digital identity authentication by encrypting the communication key, and solves the security problem of communication content.

[0090] In one embodiment, if the second network identifier indicates that the fourth node is connected to the data network, the authenticity proof sent to the fourth node in the first target digital identity includes the trusted storage address of the public key corresponding to the private key of the second digital identity; if the second network identifier indicates that the fourth node is not connected to the data network, the authenticity proof sent to the fourth node in the first target digital identity includes a digital identity traceability chain, wherein the digital identity traceability chain includes information about the digital identities of the second node and the multi-level superior nodes that granted the second digital identity, as well as the signature of the digital identity. By selecting different authenticity proof methods according to the network connection status, flexible authentication can be achieved, improving the adaptability and reliability of the system. This method improves the flexibility of digital identity authentication through network status awareness and solves the authentication problem under changing network environments.

[0091] In another embodiment, if the first network identifier indicates that the first node is connected to the data network, the authenticity proof in the fourth target digital identity sent by the fourth node includes the trusted storage address of the public key corresponding to the private key of the node that granted the fourth target digital identity; if the first network identifier indicates that the first node is not connected to the data network, the authenticity proof in the fourth target digital identity sent by the fourth node includes a digital identity traceability chain, wherein the digital identity traceability chain includes information on the digital identities of the fifth node that granted the fourth target digital identity and the digital identities of the multi-level superior nodes that granted the digital identity to the fifth node, as well as the signature of the digital identity. This method improves the flexibility of digital identity authentication through network state awareness and solves the authentication problem under changing network environments, including but not limited to identity verification in various network environments such as mobile networks, fixed networks, wired networks, and wireless networks, ensuring the system's wide applicability and efficiency.

[0092] When the first node uses digital identity for authentication and authorization, the following steps can be taken:

[0093] Step 31: The first node sends an authentication request to the fourth node, which includes information from the first node's first digital identity.

[0094] The first node exposes a portion of the information as needed, including the validity period, permissions, and digital human identifier, all of which must be provided in plaintext.

[0095] Step 32: If the fourth node agrees to the authentication, it sends the second authentication materials and the identifier of whether or not the data network is connected to the first node.

[0096] Step 33: The first node uses the private key of the first digital identity to encrypt the second authentication material to form the second encrypted material. Then, it sends the second encrypted material, the first authentication material, the public key of the first digital identity, proof of authenticity, and an identifier indicating whether the data network is connected to the fourth node.

[0097] The authenticity verification depends on whether the fourth node can connect to the data network. If it can connect, it can provide the trusted address of the granting node's public key. If it cannot connect, it must provide the granting node's digital identity, in which all public keys, validity periods, permissions, and digital human identifiers must be displayed in plaintext.

[0098] Step 34: The fourth node uses the authenticity proof contained in the first digital identity to verify the authenticity of the information in the first digital identity. If verification fails, the authentication process terminates.

[0099] Step 35: If verification is successful, the fourth node uses the decrypted first digital identity public key to decrypt the second encrypted material and compares it with the second authentication material. If they are the same, the authentication is successful.

[0100] Step 36: The fourth node queries the permissions of the first digital identity and compares them with the permissions of each layer contained in its authenticity proof. According to the rule that the permissions of the granted node are less than or equal to the permissions of the granting node, the permissions of the first node are determined.

[0101] Step 37: The fourth node uses the private key of the fourth digital identity to encrypt the first authentication material to form the first encrypted material. The first encrypted material and the fourth digital identity are then sent to the first node.

[0102] The information in the fourth digital identity is exposed on demand, and the validity period, permissions, and digital human identifier must all be provided in plaintext. The content of the authenticity proof is determined according to the rules in step 33.

[0103] Step 38: The first node verifies the authenticity of the fourth digital identity using the authenticity proof contained within the fourth digital identity. If verification fails, the authentication process terminates.

[0104] Step 39: If verification is possible, the first node uses the decrypted fourth digital identity public key to decrypt the first encrypted material and compares it with the first authentication material. If they are the same, the authentication is successful.

[0105] Step 310: The first node queries the permissions of the fourth digital identity and compares them with the permissions of each layer contained in its authenticity proof. According to the rule that the permissions of the granted node are less than or equal to the permissions of the granting node, the permissions of the fourth node are determined.

[0106] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this disclosure.

[0107] This embodiment also provides a digital identity generation device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated. Applied to a first node, the device includes:

[0108] The acquisition module is configured to acquire the private key of the first digital identity and receive the authenticity certificate of the first digital identity, the information of the first digital identity, and the signature of the first digital identity from the second node, wherein the information of the first digital identity is stored in the form of a hash tree.

[0109] The generation module is configured to generate the first digital identity based on the private key of the first digital identity, the proof of authenticity of the first digital identity, the information of the first digital identity, and the signature of the first digital identity.

[0110] This disclosure also provides a digital identity authentication device, applied to a first node, comprising:

[0111] The authentication module is configured to perform two-way authentication with the fourth node based on the first digital identity. The first digital identity consists of the private key of the first digital identity, the proof of authenticity of the first digital identity, the information of the first digital identity, and the signature of the first digital identity. The information of the first digital identity is stored in the form of a hash tree.

[0112] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0113] Embodiments of this disclosure also provide a computer-readable storage medium storing a computer program configured to perform the steps in any of the above method embodiments when executed.

[0114] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0115] Embodiments of this disclosure also provide an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.

[0116] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0117] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0118] It is obvious to those skilled in the art that the modules or steps of this disclosure described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this disclosure is not limited to any particular combination of hardware and software.

[0119] The above description is merely a preferred embodiment of this disclosure and is not intended to limit this disclosure. Various modifications and variations can be made to this disclosure by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A digital identity generation method, applied to a first node, comprising: Obtain the private key of the first digital identity, and receive the authenticity certificate of the first digital identity, the information of the first digital identity, and the signature of the first digital identity from the second node, wherein the information of the first digital identity is stored in the form of a hash tree; The first digital identity is generated based on the private key of the first digital identity, the proof of authenticity of the first digital identity, the information of the first digital identity, and the signature of the first digital identity.

2. The method according to claim 1, wherein, The private key used to obtain a digital identity includes: Send a first request message to the second node requesting the granting of a digital identity; The system receives the private key of the first digital identity sent by the second node, wherein the private key of the first digital identity is the private key in the public-private key pair generated by the second node for the first node based on the first request message.

3. The method according to claim 1, wherein, The private key for obtaining the first digital identity includes: Generate a public / private key pair; Obtain the private key of the first digital identity from the public-private key pair.

4. The method according to claim 3, wherein, The method further includes: Send a second request message to the second node requesting the granting of a digital identity; Receive the public / private key pair sent by the second node for verification; The public-private key pair is used to encrypt the public-private key verification pair; The encrypted public-private key pair verification is sent to the second node along with the public key in the public-private key pair verification, so that the second node can use the public key to decrypt the encrypted public-private key pair verification. The decrypted public-private key pair verification is compared with the stored public-private key pair verification. If the comparison result is the same, the authenticity certificate of the first digital identity, the information of the first digital identity, and the signature of the first digital identity are sent.

5. The method according to claim 1, wherein, The method further includes: Send a third request message to the third node requesting the granting of a digital identity; The third digital identity is received from the third node, wherein the third digital identity consists of the private key in the public-private key pair generated by the third node for the first node, the authenticity certificate of the third digital identity, the information of the third digital identity, and the signature of the third digital identity.

6. The method according to claim 1, wherein, Generating the first digital identity based on the private key of the first digital identity, proof of the authenticity of the first digital identity, information of the first digital identity, and signature of the first digital identity includes: The signature of the digital identity is obtained by encrypting the hash value of the information of the first digital identity using the private key of the second digital identity of the second node. The second digital identity includes the private key of the second digital identity, the information and signature of the second digital identity, and the proof of authenticity of the second digital identity. The first digital identity is generated based on the private key of the first digital identity, the proof of authenticity of the first digital identity, the information of the first digital identity, and the signature of the first digital identity. The proof of authenticity of the first digital identity includes: a trusted storage address of the public key corresponding to the private key of the second digital identity or a digital identity traceability chain. The digital identity traceability chain includes the digital identity information of the second node and the multi-level superior nodes that granted the second digital identity to the second node, as well as the signature of the digital identity.

7. The method according to claim 6, wherein, Generating the first digital identity based on the private key of the first digital identity, proof of the authenticity of the first digital identity, information of the first digital identity, and signature of the first digital identity includes: The information and signature of the first digital identity are stored in the first digital identity in the form of a hash tree. The private key and the authenticity certificate of the first digital identity are written into the first digital identity. The information of the first digital identity includes at least the identity information, identity permissions, validity period of the identity information, and the public key corresponding to the private key.

8. The method according to claim 7, wherein, The first-level intermediate nodes of the hash tree include three nodes, a public key corresponding to the private key of the first digital identity, the validity period of the identity information, and the hash calculation results of other information, wherein the other information is the information of the first digital identity other than the public key corresponding to the private key of the first digital identity and the validity period of the identity information. The root node of the hash tree is obtained by performing layer-by-layer hash calculations on the information of the first digital identity according to the hash tree structure.

9. The method according to claim 6, wherein, The relationship between the multi-level superior nodes that grant the second digital identity to the second node is that of a granting node and a granted node of digital identity, wherein the multi-level superior nodes include at least a root identity management authority and the root identity management authority is the highest level node.

10. The method according to claim 7, wherein, When the second node is the root identity management authority, the authenticity proof of the first digital identity includes: the digital identity of the root identity management authority; The trusted storage address of the public key corresponding to the private key of the second node is either the storage address in the database or the query address of the identity management agency that manages digital identities.

11. A digital identity authentication method, applied to a first node, comprising: Two-way authentication is performed between the first digital identity and the fourth node. The first digital identity consists of the private key of the first digital identity, the proof of authenticity of the first digital identity, the information of the first digital identity, and the signature of the first digital identity. The information of the first digital identity is stored in the form of a hash tree.

12. The method according to claim 11, wherein, Two-way authentication based on the first digital identity and the fourth node includes: The system sends a first network identifier (whether it is connected to the data network), a first authentication material, a second encrypted material, and a first target digital identity to the fourth node, so that the fourth node can authenticate the second encrypted material and the first target digital identity. The second encrypted material is obtained by the first node encrypting the second authentication material of the fourth node using the private key of the first digital identity. The first target digital identity includes the authenticity certificate of the first digital identity, the information of the first digital identity, and the signature of the first digital identity. The system receives a second network identifier indicating whether it is connected to a data network, a second authentication material, a first encrypted material, and a fourth target digital identity sent by the fourth node; or it receives a first encrypted material, a second authentication material, and a fourth target digital identity sent by the fourth node, and authenticates the first encrypted material and the fourth target digital identity. The first encrypted material is obtained by the fourth node encrypting the first authentication material using the private key of the fourth digital identity. The fourth target digital identity includes: proof of authenticity of the fourth target digital identity, information of the fourth target digital identity, and a signature of the fourth target digital identity. The fourth digital identity includes the private key of the fourth target digital identity, proof of authenticity of the fourth target digital identity, information of the fourth target digital identity, and a signature of the fourth target digital identity.

13. The method according to claim 12, wherein, Authenticating the first encrypted material and the fourth target digital identity includes: If the first node is connected to the data network, it accesses the trusted storage address of the public key in the authenticity proof of the fourth target digital identity to obtain the corresponding public key, and uses the public key to decrypt the signature of the fourth target digital identity. If the decryption is successful, the authentication of the fourth target digital identity is passed. If the first node is not connected to the data network, it accesses the digital identity traceability chain in the fourth target digital identity and queries whether the first node has saved the public key of the root identity management structure in the digital identity traceability chain. If it has saved it, it decrypts the signatures of each digital identity in the digital identity traceability chain according to the order of digital identity granting, starting with the public key of the built-in root identity management authority, to authenticate the authenticity of the digital identity. If it has not saved it or one step of authentication fails, the authentication fails, and an authentication failure message is sent to the fourth node and the authentication ends. If the signature of the fourth target digital identity is successfully decrypted, the authenticity of the fourth target digital identity is successfully authenticated. The first encrypted material is decrypted using the public key of the decrypted fourth target digital identity. The decrypted first authentication material is then compared with the stored first authentication material. If the comparison is inconsistent, the authentication of the first encrypted material fails, and an authentication failure message is sent to the fourth node to end the authentication process. If the comparison is consistent, the authentication of the first encrypted material is successful.

14. The method according to claim 12, wherein, After authenticating the first encrypted material and the fourth target digital identity, the method further includes: If all authentications are successful, a communication key is generated, the communication key is encrypted using the public key in the fourth target digital identity, and the encrypted communication key is sent to the fourth node. The communication with the fourth node is encrypted using the communication key.

15. The method according to any one of claims 12 to 14, wherein, If the second network identifier instructs the fourth node to connect to the data network, the authenticity proof in the first target digital identity sent to the fourth node includes the trusted storage address of the public key corresponding to the private key of the second digital identity, wherein the second digital identity is the digital identity of the second node, and the second digital identity includes the private key of the second digital identity, the information and signature of the second digital identity, and the authenticity proof of the second digital identity. If the second network identifier indicates that the fourth node is not connected to the data network, the authenticity proof in the first target digital identity sent to the fourth node includes a digital identity traceability chain, wherein the digital identity traceability chain includes information on the digital identities of the second node and the multi-level superior nodes that granted the second digital identity, as well as the signature of the digital identity.

16. The method according to any one of claims 12 to 14, wherein, If the first network identifier indicates that the first node connects to the data network, the authenticity proof in the fourth target digital identity sent by the fourth node includes the trusted storage address of the public key corresponding to the private key of the node that granted the fourth target digital identity; If the first network identifier indicates that the first node is not connected to the data network, the authenticity proof in the fourth target digital identity sent by the fourth node includes a digital identity traceability chain, wherein the digital identity traceability chain includes information on the digital identities of the fifth node that granted the fourth target digital identity and the multi-level superior nodes that granted the digital identity to the fifth node, as well as the signature of the digital identity.

17. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, performs the steps of the method according to any one of claims 1 to 10, 11 to 16.

18. A computer program product comprising a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1 to 10, 11 to 16.

Images