WO2019127530A1

WO2019127530A1 - Account unifying method and device and storage medium

Info

Publication number: WO2019127530A1
Application number: PCT/CN2017/120263
Authority: WO
Inventors: 谢辉; 王健; 陈敏
Original assignee: 深圳前海达闼云端智能科技有限公司
Priority date: 2017-12-29
Filing date: 2017-12-29
Publication date: 2019-07-04
Also published as: CN108235805A; CN108235805B

Abstract

An account unifying method and device and a storage medium used for solving the technical problem of inconvenience to users caused by using different accounts in different application servers in the prior art. The method is applied to an application client, and the method comprises: creating an identity contract and associating the identity contract with a user entity account; deploying the identity contract on a block chain to obtain an identity contract address of the identity contract; and sending a registration request including the identity contract address to an application server, the identity contract address being used for indicating the application server to use the identity contract address as an account identification of the user entity account in the application server.

Description

Account unified method, device and storage medium

Technical field

The present disclosure relates to the field of information technology, and in particular, to an account unified method, apparatus, and storage medium.

Background technique

With the rapid development of the Internet, various mobile applications, WEB websites, and cloud services have become an indispensable part of people's daily lives. Accounts play an extremely important role as credentials and identities for accessing individual services. At present, whether it is a different application server or a different application system within the unified enterprise, the user needs to complete the registration independently before using and remember the account and password of each system, and the numerous accounts and passwords are easy to confuse or even forget. Inconvenience to the user.

Summary of the invention

The main purpose of the present disclosure is to provide an account unified method, apparatus, and storage medium for solving the technical problem of inconvenience to users caused by using different accounts in different application servers in the prior art.

In order to achieve the above object, a first aspect of the present disclosure provides an account unification method, applied to a client, the method comprising: creating an identity contract and associating the identity contract with a user entity account; deploying the same on a blockchain An identity contract, obtaining an identity contract address of the identity contract; transmitting, to the application server, a registration request including the identity contract address, the identity contract address being used to instruct the application server to use the identity contract address as the user entity The account ID of the account on the application server.

A second aspect of the present disclosure provides a method for unifying an account, which is applied to a client, the method comprising: sending a registration request to an application server, where the registration request includes a blockchain address of a user entity account, and the blockchain address is used by the blockchain address And the application server deploys an identity contract associated with the user entity account according to the blockchain address; receiving a registration success response sent by the application server, where the registration request includes an identity contract associated with the user entity account address.

A third aspect of the present disclosure provides a method for unifying an account, which is applied to an application server, the method comprising: receiving a registration request sent by a client, where the registration request includes an identity contract address associated with a user entity account to be registered; The identity contract address is used as an account identifier of the user entity account on the application server.

A fourth aspect of the present disclosure provides a method for unifying an account, which is applied to an application server, the method comprising: receiving a registration request sent by a client, where the registration request includes a blockchain address of a user entity account to be registered; The blockchain address of the user entity account creates an identity contract and associates with the user entity account; deploying the identity contract on the blockchain to obtain an identity contract address of the identity contract; using the identity contract address as the The account identity of the user entity account on the application server and a registration success response including the identity contract address is sent to the client.

A fifth aspect of the present disclosure provides an account unification device, which is applied to a client, the device comprising: a first identity contract creation module, configured to create an identity contract and associate the identity contract with a user entity account; a deployment module, configured to deploy the identity contract on a blockchain, to obtain an identity contract address of the identity contract, and a first registration request sending module, configured to send, to the application server, a registration request including the identity contract address, where The identity contract address is used to instruct the application server to use the identity contract address as an account identifier of the user entity account on the application server.

A sixth aspect of the present disclosure provides an account unified apparatus, which is applied to a client, where the apparatus includes: a second registration request sending module, configured to send a registration request to an application server, where the registration request includes a blockchain of a user entity account. An address, the blockchain address is used by the application server to deploy an identity contract associated with the user entity account according to the blockchain address; the registration success response receiving module is configured to receive the registration success sent by the application server In response, the registration request includes an identity contract address associated with the user entity account.

A seventh aspect of the present disclosure provides an account unified device, which is applied to an application server, where the device includes: a first registration request receiving module, configured to receive a registration request sent by a client, where the registration request includes an identity contract address; An account identifier determining module is configured to use the identity contract address as an account identifier of the user entity account on the application server.

An eighth aspect of the present disclosure provides an account unified device, which is applied to an application server, where the device includes: a second registration request receiving module, configured to receive a registration request sent by a client, where the registration request includes a user entity account to be registered a blockchain address; a second identity contract creation module, configured to create an identity contract according to a blockchain address of the user entity account and associated with the user entity account; and a second identity contract deployment module for use in the block Deploying the identity contract on the chain to obtain an identity contract address of the identity contract; a second account identifier determining module, configured to use the identity contract address as an account identifier of the user entity account on the application server and A registration success response including the identity contract address is sent to the client.

A ninth aspect of the present disclosure provides a computer readable storage medium comprising one or more programs for performing the method of the first aspect.

A tenth aspect of the present disclosure provides an account unified device, which is applied to a client, comprising: the computer readable storage medium of the ninth aspect; and one or more processors for executing the computer readable storage medium program of.

An eleventh aspect of the present disclosure provides a computer readable storage medium comprising one or more programs for performing the method of the second aspect.

A twelfth aspect of the present disclosure provides an account unified device, which is applied to a client, comprising: the computer readable storage medium of the eleventh aspect; and one or more processors for executing the computer readable storage The program in the media.

A thirteenth aspect of the present disclosure provides a computer readable storage medium comprising one or more programs for performing the method of the third aspect.

A fourteenth aspect of the present disclosure provides an account unified apparatus, which is applied to an application server, comprising: the computer readable storage medium of the thirteenth aspect; and one or more processors for executing the computer readable storage The program in the media.

A fifteenth aspect of the present disclosure provides a computer readable storage medium, comprising one or more programs, the one or more programs for performing the method of the fourth aspect.

A sixteenth aspect of the present disclosure provides an account unified apparatus, applicable to an application server, comprising: the computer readable storage medium of the fifteenth aspect; and one or more processors for executing the computer readable storage The program in the media.

Using the above technical solution, based on the blockchain technology, the client deploys an identity contract associated with the user entity account on the blockchain, and sends a registration request including the identity contract address to the application server to instruct the application server to use the identity contract address as The account identifier of the user entity account can facilitate the user to uniformly use the identity contract address to participate in various application services, thereby fundamentally solving the problem that a large number of accounts bring inconvenience to the user. At the same time, the decentralization of the blockchain makes the relationship between the identity contract and the user entity account cannot be falsified and forged, which can ensure the security of using the identity contract as the account identifier on each application server, compared to the application server. Using the same account and password reduces the loss of lost or stolen accounts.

Other features and advantages of the present disclosure will be described in detail in the detailed description which follows.

DRAWINGS

FIG. 1 is a flowchart of an account unification method according to an exemplary embodiment of the present disclosure, where the method is applied to a client;

FIG. 2 is a flowchart of an account unification method according to an exemplary embodiment of the present disclosure, where the method is applied to an application server;

FIG. 3 is a schematic diagram showing a relationship between a user entity account and an identity contract according to an exemplary embodiment of the present disclosure; FIG.

FIG. 4 is a schematic diagram of signaling interaction of an account unification method according to an exemplary embodiment of the present disclosure; FIG.

FIG. 5 is a schematic diagram of signaling interaction of an account unification method according to another exemplary embodiment of the present disclosure; FIG.

FIG. 6 is a schematic diagram showing an implementation environment according to an exemplary embodiment of the present disclosure; FIG.

FIG. 7 is a flowchart of a method for replacing a user entity account according to an exemplary embodiment of the present disclosure; FIG.

FIG. 8 is a schematic diagram of signaling interaction of a single sign-on and logout method according to an exemplary embodiment of the present disclosure; FIG.

FIG. 9 is a block diagram of an account unification apparatus according to an exemplary embodiment of the present disclosure, wherein the apparatus is applied to an application server;

FIG. 10 is a block diagram showing an account unification apparatus according to another exemplary embodiment of the present disclosure, wherein the apparatus is applied to an application server;

FIG. 11 is a block diagram of an account unification apparatus according to an exemplary embodiment of the present disclosure, where the apparatus is applied to a client;

FIG. 12 is a block diagram of an account unification apparatus according to another exemplary embodiment of the present disclosure, wherein the apparatus is applied to a client.

Detailed ways

The technical solutions in the embodiments of the present disclosure will be clearly and completely described in conjunction with the drawings in the embodiments of the present disclosure. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

In order to make it easier for a person skilled in the art to understand the technical solutions provided by the embodiments of the present disclosure, the related technologies involved will be briefly introduced below.

A blockchain is a decentralized distributed database system in which all nodes in a blockchain network participate in maintenance. It is composed of a series of data blocks generated by cryptography, and each block is a blockchain. One block. According to the order of the generation time, the blocks are linked together in an orderly manner to form a data chain, which is aptly called a blockchain. The blockchain is generated and validated by its special blocks and transactions, with unchangeable, unforgeable and fully traceable security features.

Description of related concepts involved in blockchain technology:

Blockchain node: The blockchain network is based on a P2P (Peer to Peer) network. Each P2P network node participating in transaction and block storage, verification, and forwarding is a node in a blockchain network.

User identity: The user identity in the blockchain is represented by a public key, and the public key and the private key appear in pairs, wherein the private key is mastered by the user and not posted to the above-mentioned blockchain network, and the public key passes through the specific The hash and encoding become the "address", the "address" represents the user, and the public key and "address" can be freely published in the blockchain network. It is worth mentioning that there is no one-to-one correspondence between user identity and blockchain nodes. Users can use their own private key on any blockchain node.

Blockchain data write: The blockchain node writes data to the blockchain by issuing a "transaction" to the blockchain network. The transaction contains the signature of the user using his or her private key to prove the identity of the user. The transaction is recorded by the “miner” (block chain node that implements the blockchain consensus competition mechanism) into the generated new block, and then released to the blockchain network, and verified and passed by other blockchain nodes, the transaction data is Is written to the blockchain.

1 is a flowchart of an account unification method according to an exemplary embodiment of the present disclosure. The method is applied to a client. As shown in FIG. 1, the method includes:

In step S101, an identity contract is created and the identity contract is associated with the user entity account.

In step S102, an identity contract is deployed on the blockchain to obtain an identity contract address of the identity contract.

In an embodiment of the present disclosure, the blockchain may be an Ethereum blockchain. There are two kinds of physical accounts on the Ethereum blockchain, one is a user entity account (corresponding to a person or a smart device), and the corresponding one has a pair of public and private keys, and the hash code of the public key (for example, The first 20 bytes of the hash value is the blockchain address of the user entity account; the other is the program entity, that is, the smart contract, which only has the address value of the preset number of bytes (for example, 20 bytes) Address value), does not have an associated private key.

In an embodiment of the present disclosure, the client can generate its own user entity account by running a blockchain program. In addition, the client can also create an identity contract (ie a type of smart contract) and associate the identity contract with the user entity account (eg, write the blockchain address of the user entity account into the identity contract) and pass the block The identity contract is deployed on the chain to obtain the address of the identity contract.

In step S103, a registration request including an identity contract address is transmitted to the application server.

The identity contract address is used to instruct the application server to use the identity contract address as the account identifier of the user entity account on the application server.

FIG. 2 is a flowchart of an account unification method according to an exemplary embodiment of the present disclosure, where the method is applied to an application server, as described in FIG. 2, the method includes:

In step S201, a registration request sent by the client is received, and the registration request includes an identity contract address associated with the user entity account to be registered.

In step S202, the identity contract address is used as the account identifier of the user entity account on the application server.

Optionally, the application server may record the identity contract address into an account information contract in its account database or blockchain, wherein the account information contract may be pre-deployed on the blockchain and each registered identity contract is recorded. The contract of the address.

The application server can use the identity contract address as the account identifier of the user entity account on the application server. Therefore, after the user completes the registration on each application server through the client, the user can uniformly use the identity contract address to log in on each application server.

It should be noted that, in the embodiment of the present disclosure, as shown in FIG. 3, optionally, the client may create an identity contract and associate the user entity account with the identity contract, thereby using the identity contract address as the user. The unique account identifier of the physical account, so that the user can conveniently use the identity contract address on each application server.

Optionally, the client may also create multiple identity contracts and associate the user entity accounts with multiple identity contracts, thereby allowing users to participate in different application services with different identity contract addresses (ie different account identifiers). And it is convenient to use only a single entity account.

Using the above method, based on the blockchain technology, the client deploys an identity contract associated with the user entity account on the blockchain and registers with the application server using the identity contract address, so that the application server uses the identity contract address as the user entity. The account identifier of the account on the application server, so that the user can conveniently use the identity contract address to participate in various application services, thereby fundamentally solving the problem that the complicated account brings inconvenience to the user. At the same time, the decentralization of the blockchain makes the relationship between the identity contract and the user entity account cannot be falsified and forged, which can ensure the security of using the identity contract as the account identifier on each application server, compared to the application server. Using the same account and password reduces the loss of lost or stolen accounts.

In other embodiments of the present disclosure, if there is other account information registered by the user in the application server, when the user logs in to the application server by using the other account information registered by the client, the client may send the application server to include other The account information and the identity contract address login request, the application server authenticates the other account information, and returns the login success response to the client after the identity authentication is passed. At the same time, the application server can also replace or associate the registered account information with other account information, so that the application server can migrate the identity contract address as the account identifier of the user entity account.

In order to make the technical solutions of the present disclosure easier to understand, the technical solutions of the present disclosure are further described in detail through the signaling interaction diagrams of the following possible implementation manners.

FIG. 4 is a schematic diagram of signaling interaction of an account unification method according to an exemplary embodiment of the present disclosure. As shown in FIG. 4, the method includes:

In step S401, the client creates an identity contract and associates the identity contract with the user entity account.

In step S402, the client deploys an identity contract on the blockchain to obtain the identity contract address of the identity contract.

In step S403, the client sends a registration request including an identity contract address to the application server.

In step S404, when receiving the registration request sent by the client, the application server uses the identity contract address as the account identifier of the user entity account on the application server.

In step S405, the application server sends a registration success response to the client.

It can be seen that, through the above technical solution of the embodiment of the present disclosure, based on the blockchain technology, the client can generate a user entity account and deploy an identity contract on the blockchain, associate the user entity account with the identity contract, and can use the identity contract address. The application server registers, and the application server can use the identity contract address as the account identifier of the user entity account when receiving the registration request sent by the client, thereby facilitating the user to uniformly use the identity contract address to participate in various application services, fundamentally Resolving a large number of accounts brings problems to users. At the same time, the decentralization of the blockchain makes the relationship between the identity contract and the user entity account cannot be falsified and forged, which can ensure the security of using the identity contract as the account identifier on each application server, compared to the application server. Using the same account and password reduces the loss of lost or stolen accounts.

In other embodiments of the present disclosure, the identity contract may also be created and deployed by the application server, in which case the client only needs to provide the blockchain address of the user entity account when registering with the application server. For example, for users within the same enterprise, when receiving the registration request sent by each client, the application server may create an identity contract according to the blockchain address of each user entity account and establish an association relationship between the identity contract and the user entity account. . Accordingly, as shown in FIG. 5, the account unified method may include:

In step S501, the client sends a registration request to the application server, the registration request including the blockchain address of the user entity account.

In step S502, when receiving the registration request sent by the client, the application server creates an identity contract according to the blockchain address of the user entity account and associates the identity contract with the user entity account.

In step S503, the application server deploys an identity contract on the blockchain to obtain an identity contract address of the identity contract.

In step S504, the application server uses the identity contract address as the account identifier of the user entity account on the application server.

In step S505, the application server sends a registration success response to the client, and the registration success response includes the identity contract address.

As shown in FIG. 3, optionally, the application server may associate each user entity account to be registered with an identity contract to identify the identity contract address as a unique account of the user entity account, so that the user can conveniently use each application. The identity contract address is used uniformly on the server.

Optionally, the application server may also associate each user entity account with multiple identity contracts, thereby supporting the user to use different application servers with different identity contract addresses (ie different account identifiers), and internally It is convenient to use only a single physical account.

Optionally, the application server may also associate multiple user entity accounts with the same identity contract. The setting may be applicable to related business scenarios, such as a mobile device in which the user has multiple different preset or assigned user entity accounts. The configuration allows the user entity accounts of these mobile devices to be associated with a same identity contract, in which case the user can participate in various application services with the identity of the same identity contract regardless of which mobile device is used. It can solve the problem that users cannot easily identify the same identity with different private keys.

Optionally, the application server can also set a many-to-many relationship between the user entity account and the identity contract to support more complex or special business needs.

It should be noted that the process of creating and deploying an identity contract by the application server may refer to the process of creating and deploying an identity contract by the client in the unified account method provided in FIG. 1 , and details are not described herein again.

In an embodiment of the present disclosure, in order to solve the problem that the user cannot easily replace the physical account, in a possible implementation manner, the client may add a user entity account association management function in the identity contract. For example, the current user entity account associated with the identity contract has the right to specify, add a new user entity account to associate with the identity contract. In this way, the client does not need to update the participating identity contract, only need to replace the user entity account associated with the identity contract, so as not to affect the application server data and logic.

In another possible implementation manner, the client may also add a user entity account association arbitration function in the identity contract, that is, the client may set multiple arbitration clients in the identity contract (such as the user's trusted friend client). End or third-party trusted authority, etc., through the program logic to give the arbitration client the function of managing the association relationship between the user entity account and the identity contract, and setting the arbitration rules.

In order to make those skilled in the art more understand the technical solutions provided by the above embodiments of the present disclosure, the above embodiments will be described in detail below with reference to FIG. 6.

FIG. 6 is a schematic diagram showing an implementation environment according to an exemplary embodiment of the present disclosure. As shown in FIG. 6, the implementation environment includes a client 61, an identity contract created by the client 61, and a user entity associated with the identity contract. Account and multiple arbitration clients 62. With reference to FIG. 6, a method for replacing a user entity account provided by an embodiment of the present disclosure is as shown in FIG. 7, and includes:

In step S701, the client 61 deploys an identity contract on the blockchain and sets account information and arbitration rules of the plurality of arbitration clients in the identity contract.

In step S702, the client 61 creates a new user entity account.

In step S703, the client 61 sends a physical account replacement request to a plurality of arbitration clients, respectively.

The physical account replacement request may include an identity contract address and a blockchain address of the new user entity account.

In a possible implementation manner, the client may separately send an entity account replacement request to each arbitration client by means of an unidentified identity outside the chain. For example, the client may send the entity account replacement to each arbitration client by using an email or the like. The request and the physical account replacement request carry identification information indicating that it is associated with the identity contract.

In step S704, after confirming the identity of the original user entity account, each arbitration client 62 sends an arbitration result to the identity contract by calling the interface of the identity contract.

In step S705, the identity contract associates the new user entity account with the identity contract according to the arbitration result sent by each arbitration client, the account information of each arbitration client, and the arbitration rule.

For example, the arbitration rule may modify the user entity account associated with the identity contract for more than half of the arbitration client's consent. Correspondingly, if the identity contract receives more than half of the arbitration clients confirming the arbitration result of associating the new user entity account with the identity contract, the new user entity account is associated with the new user entity account according to the blockchain address of the new user entity account. .

The technical solution provided by the foregoing embodiment can not only solve the problem that the user cannot easily replace the physical account, but at the same time, the identity contract and the new user can be managed through arbitration after the private key of the original user entity account is lost or stolen. The entity account is associated, which solves the problem that the identity contract cannot be used after the private key is lost and the private key is stolen.

In an embodiment of the present disclosure, the private key is a vital information for the user entity account, and in addition to the case where the security hardware is not exportable, the private key is usually backed up for security purposes if possible. Users can choose to encrypt or clear offline backup, but considering this method still needs to consider the security of backup files and the problems of forgetting and losing backup files or encrypted passwords, users can also choose online encryption backup methods, such as through password technology. The private key (or seed) of the user entity account is encrypted and saved to the blockchain and restored by appropriate decryption when appropriate. Loss of private keys can be avoided by using appropriate backup and recovery techniques.

In a possible implementation manner, when the private key of the user entity account needs to be backed up, the client may block the private key of the user entity account by using a preset algorithm (for example, Shamir's Secret Sharing algorithm) to obtain n (n). ≥ 2) Data block, correspondingly, any k data blocks (n ≥ k ≥ 1) can recover the entire private key. Then, the client may separately hash the n data blocks, for example, use a hash algorithm to calculate the hash values of the n data blocks, and again use the hash algorithm to calculate the hash value of each data block hash value. As the fingerprint of each data block, these fingerprints can be used as verification when restoring the private key. Then, the client can share s(k ≤ s ≤ n) data blocks to c (c ≥ 1) buddy clients, and encrypt the s data blocks using the public keys of the c buddy clients (such as each buddy). The client's public key encrypts one or more of the s data blocks to ensure that s data blocks are encrypted, and all the encrypted data blocks, the hash values corresponding to the encrypted data blocks, and the c friend clients. The blockchain address is logged to the identity contract associated with the user entity account.

It should be noted that the k value, the s value, and the c value determine the strength of the key sharing backup, wherein the smaller the k value, the larger the s value and the c value, the less likely the private key is lost.

In addition, in order to indicate the association relationship between the user entity account and the identity contract to the friend account when the key is restored, the client can inform the friend client of the associated identity contract when sharing the encrypted data to the friend client, so as to make the friend client The end records the association. The client may also record challenge information (eg, questions and answers encrypted with the buddy client's public key) or record the identity of the user entity account (eg, the identity ID hash of the user entity account) in the identity contract associated with the user entity account. .

When the private key needs to be restored, the client may query, from the identity contract, the blockchain address of the target friend account corresponding to the at least k encrypted data blocks, and send the private key to the at least k target friends according to the blockchain address. Restore the request. Each target friend account verifies the identity of the client when receiving the private key recovery request, and after the verification is passed, accesses the identity contract according to the identity contract address and obtains the encrypted encrypted data block from the identity contract, and encrypts the data block. After decryption, it is stored in the identity contract by the public key specified by the user entity account. When the client can obtain k or more data blocks encrypted by the specified public key from the identity contract, the decrypted k data can be obtained by decrypting with the relevant private key, and verified by the hash value recorded in the identity contract. Validity of k data, applying a preset algorithm after verification (eg Shamir's The Secret Sharing algorithm can restore the original private key of the user entity account.

It should be noted that the user entity account association relationship management function, the user entity account association relationship arbitration function, the private key backup and recovery function, and the like provided by the foregoing embodiments are not limited to the program logic of joining the identity contract, and may also be extracted to other In the program entity, the disclosure does not limit this.

In the embodiment of the present disclosure, after the user completes the registration on each application server by using the client, the user may log in to each application platform by using the associated identity contract address as the account identifier, and the specific login process may be The user sends a login request to the server through the client, and queries and selects the identity contract address associated with the blockchain address of the entity account on the client. The client responds to the login challenge of the application server, wherein the login challenge response may include challenge signature information and an identity contract address of the user entity account. After receiving the login challenge response sent by the client, the application platform verifies whether the identity contract address is registered and verifies whether the user entity account is an associated account of the identity contract based on the challenge signature mechanism, if the identity contract address is registered and the user entity account is The associated account of the identity contract sends a login success response to the client; otherwise, the login request of the user entity account is rejected.

Compared with the traditional user password login, the above embodiment of the present disclosure logs in based on the challenge signature mechanism, and the application server needs the signature information of the user entity account sent by the client to verify the identity of the user entity account. In addition, the client can also integrate technologies such as biometric authentication, such as iris unlocking, fingerprint unlocking, and face unlocking, to prevent users from entering passwords. After the biometric authentication succeeds, the client can use the private key of the user entity account to sign the relevant information of the application server and send it to the application server to provide the server with the challenge signature authentication.

In other embodiments of the present disclosure, based on the above account unified method, after the user completes registration on each application server through the client, the identity contract address (ie, account identifier) can also be used to implement single sign-on on each application server. Logout. In order to make the technical solution easier to understand, the technical solution will be described in detail below with reference to FIG. 8. FIG. 8 is a schematic diagram of signaling interaction of a single sign-on and logout method according to an exemplary embodiment of the present disclosure, the method includes:

In step S801, the client sends a first login request to the first application server, where the first login request includes first signature information of the user entity account and an identity contract address associated with the user entity account.

The first signature information of the user entity account may be obtained by signing the domain name of the first application server and the current time of the private key of the user entity account.

In step S802, when receiving the login request sent by the client, the first application server verifies whether the identity contract address has been logged in.

In step S803, when the first application server verifies that the identity contract address is not logged in, the first application server queries the login information contract on the blockchain according to the identity contract address to determine the login status of the identity contract address on other trusted application servers.

The login information contract is a contract pre-deployed on the blockchain that records the login status of each identity contract address on each trusted application server.

In step S804, if it is determined that the login status of the identity contract address on the other trusted application server is not logged in, the first application server verifies whether the user entity account is associated with the identity contract address according to the identity contract address and the first signature information.

In step S805, the first application server sends a login challenge page to the client when determining that the user entity account is associated with the identity contract address.

In step S806, the client responds to the challenge of the first application server using the identity contract address.

In step S807, the first application server authenticates the challenge response of the client and marks the login status of the identity contract information on the login status as logged in after the authentication succeeds.

In an embodiment of the present disclosure, the identity contract has at least one specific interface that can be used to determine whether the user entity account is associated with the identity contract. Optionally, the first application server may use the public key of the user entity account to perform signature verification on the first signature information, and after the signature verification succeeds, query the corresponding identity contract according to the identity contract address and view through the interface of the identity contract. The blockchain address of the user entity account recorded in the identity contract to determine whether the user entity account to which the first signature information belongs is associated with the identity contract address.

In step S808, the first application server records the logged-in status of the identity contract address thereon into the login information contract.

In step S809, the first application server returns a first login success response to the client.

The first login success response may include a session ID of the first application server.

In step S810, the client sends a second login request to the second application server, where the second login request includes the second signature information of the user entity account and the identity contract address associated with the user entity account.

The second signature information of the user entity account may be obtained by using the domain name of the second application server and the current time of the private key of the user entity account.

In step S811, when receiving the login request sent by the client, the second application server verifies whether the identity contract address has been logged in.

In step S812, the second application server, when verifying that the identity contract address is not logged in, queries the login information contract on the blockchain according to the identity contract address to determine the login status of the identity contract address on other trusted application servers.

In step S813, the second application server queries whether the login status of the identity contract address on the first application server is logged in, and then verifies whether the user entity account is associated with the identity contract address according to the identity contract address and the second signature information.

The process of verifying, by the second application server, whether the user entity account is associated with the identity contract address according to the identity contract address and the second signature information may refer to the process of verifying, by the first application server, whether the user entity account is associated with the identity contract address in step S805. I won't go into details here.

In step S814, when it is determined that the user entity account is associated with the identity contract address, the second application server marks the login status of the identity contract information as having been logged in.

In step S815, the second application server returns a second login success response to the client.

The second login success response may include a session ID of the second application server.

In step S816, the client sends a logout request to the second application server, the logout request including an identity contract address associated with the user entity account.

In step S817, the second application server marks the login status of the identity contract information as not logged in.

In step S818, the second application server records the unlogged-in status of the identity contract address thereon into the login information contract.

In step S819, the second application server sends a login challenge interface to the client.

In step S820, the first application server monitors or rotates the query login information contract.

In step S821, when the first application server knows that the login status of the identity information contract on the second application server is not logged in, the login status of the identity contract is marked as not logged in.

It should be noted that, in various embodiments of the present disclosure, the application server may be an application server on a blockchain or an application server outside the blockchain. For the application server on the blockchain, it can verify the association between the identity contract and the user entity account through the interface of the identity contract. For the application server outside the blockchain, it can access, read, write or call the identity contract on the blockchain through the API interface of the blockchain to verify the association between the identity contract and the user entity account.

It can be seen that, by using the above method, each application server can have its own login control, and the user does not need to perform the voucher delivery with other application platforms to be logged in after using the identity contract address to log in on any application server, and realize the decentralized login and logout. At the same time, the robustness of the single sign-on and log-out system consisting of client, multiple application platforms and blockchain is added.

It should be noted that, in the embodiment of the present disclosure, any one of the mutually trusted application servers may become the certification authority in the related single sign-on and log-out system, and the mutually trusted application server may not be limited to the same enterprise.

In addition, the above method embodiments are described as a series of action combinations for the sake of simple description, but those skilled in the art should understand that the present disclosure is not limited by the described action sequence. In the following, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the present disclosure.

FIG. 9 is a block diagram of an account unification device 900, which is applied to an application server, and the device 900 includes:

The first registration request receiving module 901 is configured to receive a registration request sent by the client, where the registration request includes an identity contract address;

The first account identifier determining module 902 is configured to use the identity contract address as an account identifier of the user entity account on the application server.

Optionally, the device 900 further includes:

The first login request receiving module 903 is configured to receive a login request sent by the client, where the login request includes the identity contract address and challenge signature information of the user entity account;

The first association verification module 904 is configured to verify, according to the identity contract address and the challenge signature information, whether the user entity account is associated with the identity contract address;

The first login success response module 905 is configured to return a login success response to the client when it is determined that the user entity account is associated with the identity contract address and the challenge signature information is verified.

Optionally, the device 900 further includes:

The second login request receiving module 906 is configured to receive a login request sent by the client, where the login request includes the identity contract address and signature information of the user entity account;

The login status determining module 907 is configured to query a login information contract on the blockchain according to the identity contract address, and determine a login status of the identity contract address on another trusted application server, where the login information contract Is a contract pre-deployed on the blockchain that records the login status of each identity contract address on each trusted application server;

The second association verification module 908 is configured to verify the user entity according to the identity contract address and the signature information when determining that the login status of the identity contract address on the other trusted application server is logged in. Whether the account is associated with the identity contract address;

The second login success response module 909 is configured to return a login success response to the client when determining that the user entity account is associated with the identity contract address.

Optionally, the device 900 further includes:

The third association verification module 910 is configured to verify the user entity according to the identity contract address and the signature information when determining that the login status of the identity contract address on the other trusted application server is not logged in. Whether the account is associated with the identity contract address and signature verification of the signature information;

a first login status marking module 911, configured to perform challenge authentication on the user entity account when determining that the user entity account is associated with the identity contract address, and after the authentication is passed, the identity contract address is in the The login status on the application server is marked as logged in and recorded in the login information contract.

Optionally, the device 900 further includes:

The logout request receiving module 912 is configured to receive a logout request sent by the client, where the logout request includes the identity contract address;

The second login status marking module 913 is configured to mark the login status of the identity contract address on the application server as not logged in and recorded in the login information contract.

Correspondingly, an embodiment of the present disclosure further provides a computer readable storage medium, where the computer readable storage medium includes one or more programs, and the one or more programs are used to execute the foregoing. The account uniform method shown in the example is applied to the application server.

Accordingly, an embodiment of the present disclosure further provides an account unified device, which is applied to an application server, including the above computer readable storage medium, and one or more processors for executing a program in the computer readable storage medium.

FIG. 10 is a block diagram of an account unification device 1000, which is applied to an application server, according to another exemplary embodiment of the present disclosure, the device 1000 includes:

The second registration request receiving module 1001 is configured to receive a registration request sent by the client, where the registration request includes a blockchain address of the user entity account to be registered;

a second identity contract creation module 1002, configured to create an identity contract according to the blockchain address of the user entity account and associate with the user entity account;

a second identity contract deployment module 1003, configured to deploy the identity contract on a blockchain to obtain an identity contract address of the identity contract;

The second account identifier determining module 1004 is configured to send the identity contract address as an account identifier of the user entity account on the application server and send a registration success response including the identity contract address to the client.

Correspondingly, an embodiment of the present disclosure further provides a computer readable storage medium, where the computer readable storage medium includes one or more programs, and the one or more programs are used to execute the foregoing. The unified method of accounts applied to the application server provided in the example.

FIG. 11 is a block diagram of an account unification device 1100, which is applied to a client, and the device 1100 includes:

a first identity contract creation module 1101, configured to create an identity contract and associate the identity contract with a user entity account;

a first identity contract deployment module 1102, configured to deploy the identity contract on a blockchain to obtain an identity contract address of the identity contract;

a first registration request sending module 1103, configured to send, to the application server, a registration request including the identity contract address, where the identity contract address is used to instruct the application server to use the identity contract address as the user entity account The account ID on the application server.

Optionally, the device 1100 further includes:

a login request sending module 1104, configured to send a login request to the application server, where the login request includes the identity contract address and signature information, wherein the identity contract address and the signature information are used by the application server to determine Whether the user entity account is associated with the identity contract address and signature verification of the signature information.

Optionally, the identity contract further includes account information of multiple arbitration clients and an arbitration rule;

The device 1100 further includes:

An entity account creation module 1105, configured to create a new user entity account;

The replacement request sending module 1106 is configured to separately send an entity account replacement request to the plurality of arbitration clients according to the account information of the plurality of arbitration clients, where the entity account replacement request includes the identity contract address and the new user a blockchain address of the physical account, wherein the identity contract address is used to instruct the plurality of arbitration clients to send an arbitration result to the identity contract, and the blockchain address of the new user entity account is used to indicate the The identity contract associates the new user entity account with the identity contract based on the arbitration results of the plurality of arbitration clients and the arbitration rules.

Optionally, the device 1100 further includes:

The private key blocking module 1107 is configured to block the private key of the user entity account according to a preset algorithm to obtain n data blocks, where n≥2;

a hash processing module 1108, configured to perform hash processing on the n data blocks, respectively, to obtain a hash value of the n data blocks;

The data block encryption module 1109 is configured to encrypt s data blocks in the n data blocks according to the public key of the c buddy clients, to obtain s encrypted data blocks, where c ≥ 1, n ≥ s ≥ k ;

The information writing module 1110 is configured to write the s encrypted data blocks, the blockchain addresses of the c buddy clients, and the hash values of the n data blocks into the identity contract.

Optionally, the device 1100 further includes:

a target buddy client address obtaining module 1111, configured to access the identity contract according to the identity contract address, and obtain a blockchain address of a target buddy client corresponding to at least k encrypted data blocks in the s encrypted data blocks, where , n≥k≥1;

The private key recovery request sending module 1112 is configured to send a private key recovery request to the at least k target buddy clients according to the blockchain address of the at least k target buddy clients, where the private key recovery request is used to indicate Obtaining, by the at least k target buddy clients, the at least k encrypted data blocks from the identity contract, and decrypting and re-encrypting to store the identity contract;

The private key recovery module 1113 is configured to query the at least k re-encrypted encrypted data blocks and the corresponding hash value from the identity contract and decrypt the private key of the user entity account.

Correspondingly, an embodiment of the present disclosure further provides a computer readable storage medium, where the computer readable storage medium includes one or more programs, and the one or more programs are used to execute the foregoing. The unified method of the account applied to the client provided in the example.

Correspondingly, an embodiment of the present disclosure further provides an account unified device, which is applied to a client, including the above computer readable storage medium, and one or more processors for executing a program in the computer readable storage medium.

FIG. 12 is a block diagram of an account unification device 1200, which is applied to a client, and the device 1200 includes:

a second registration request sending module 1201, configured to send a registration request to the application server, where the registration request includes a blockchain address of the user entity account, where the blockchain address is used by the application server according to the blockchain address Deploying an identity contract associated with the user entity account;

The registration success response receiving module 1202 is configured to receive a registration success response sent by the application server, where the registration request includes an identity contract address associated with the user entity account.

It should be clearly understood that those skilled in the art can clearly understand that, for the convenience and brevity of the description, the account unified device shown in the above embodiments is only illustrated by the division of the above functional units, in practical application. The above function assignment can be completed by different functional units as needed, that is, the internal structure of the device is divided into different functional units to complete all or part of the functions described above. For the specific working process of the foregoing description of the functional unit, refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. All should be covered by the scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

An account unified method, which is characterized in that it is applied to a client, and the method includes:

Create an identity contract and associate the identity contract with a user entity account;

Deploying the identity contract on a blockchain to obtain an identity contract address of the identity contract;

Sending a registration request including the identity contract address to the application server, the identity contract address being used to instruct the application server to use the identity contract address as an account identifier of the user entity account on the application server.
The method of claim 1 further comprising:

Sending a login request to the application server, the login request including the identity contract address and signature information, wherein the identity contract address and the signature information are used by the application server to determine the user entity account and the Whether the identity contract address is associated and signature verification of the signature information.
The method according to claim 1, wherein said identity contract further comprises account information of a plurality of arbitration clients and an arbitration rule;

The method further includes:

Create a new user entity account;

And sending an entity account replacement request to the plurality of arbitration clients according to the account information of the plurality of arbitration clients, where the entity account replacement request includes the identity contract address and a blockchain address of the new user entity account, The identity contract address is used to instruct the multiple arbitration clients to send an arbitration result to the identity contract, and the blockchain address of the new user entity account is used to indicate that the identity contract is based on the multiple arbitrations. The client's arbitration result and the arbitration rule associate the new user entity account with the identity contract.
The method of claim 1 further comprising:

The private key of the user entity account is partitioned according to a preset algorithm to obtain n data blocks, where n≥2;

Performing hash processing on the n data blocks to obtain hash values of the n data blocks;

Encrypting the s data blocks in the n data blocks according to the public key of the c buddy clients, to obtain s encrypted data blocks, where c ≥ 1, n ≥ s ≥ k;

Writing the s encrypted data blocks, the blockchain addresses of the c buddy clients, and the hash values of the n data blocks into the identity contract.
The method of claim 4, wherein the method further comprises:

Obtaining, according to the identity contract address, the identity contract, obtaining a blockchain address of a target friend client corresponding to at least k encrypted data blocks of the s encrypted data blocks, where n≥k≥1;

Sending a private key recovery request to the at least k target buddy clients according to the blockchain address of the at least k target buddy clients, where the private key recovery request is used to indicate that the at least k target buddy clients are Obtaining the at least k encrypted data blocks in the identity contract, and decrypting and re-encrypting to store the identity contract;

Querying the at least k re-encrypted encrypted data blocks and the corresponding hash value from the identity contract and decrypting the private key of the user entity account.
An account unified method, which is characterized in that it is applied to a client, and the method includes:

Sending a registration request to an application server, the registration request including a blockchain address of a user entity account, the blockchain address being used by the application server to deploy an identity associated with the user entity account according to the blockchain address contract;

Receiving a registration success response sent by the application server, the registration request including an identity contract address associated with the user entity account.
An account unified method, which is applied to an application server, and the method includes:

Receiving a registration request sent by the client, where the registration request includes an identity contract address associated with the user entity account to be registered;

The identity contract address is used as an account identifier of the user entity account on the application server.
The method of claim 7, wherein the method further comprises:

Receiving a login request sent by the client, where the login request includes the identity contract address and challenge signature information of the user entity account;

Verifying whether the user entity account is associated with the identity contract address based on the identity contract address and the challenge signature information;

Upon determining that the user entity account is associated with the identity contract address and validating the challenge signature information, a login success response is returned to the client.
The method of claim 7, wherein the method further comprises:

Receiving a login request sent by the client, where the login request includes the identity contract address and signature information of the user entity account;

Querying a login information contract on the blockchain according to the identity contract address, determining a login status of the identity contract address on another trusted application server, wherein the login information contract is pre-deployed in the block The record on the chain has a contract for the login status of each identity contract address on each trusted application server;

When it is determined that the login status of the identity contract address on the other trusted application server is logged in, verifying whether the user entity account is associated with the identity contract address according to the identity contract address and the signature information;

Upon determining that the user entity account is associated with the identity contract address, a login success response is returned to the client.
The method of claim 9 wherein the method further comprises:

When it is determined that the login status of the identity contract address on the other trusted application server is not logged in, verifying whether the user entity account is associated with the identity contract address according to the identity contract address and the signature information;

When it is determined that the user entity account is associated with the identity contract address, performing challenge authentication on the user entity account, and marking the login status of the identity contract address on the application server as logged in after the authentication is passed And recorded in the login information contract.
The method according to claim 9 or 10, wherein the method further comprises:

Receiving a logout request sent by the client, where the logout request includes the identity contract address;

The login status of the identity contract address on the application server is marked as not logged in and recorded in the login information contract.
An account unified method, which is applied to an application server, and the method includes:

Receiving a registration request sent by the client, where the registration request includes a blockchain address of the user entity account to be registered;

Creating an identity contract according to a blockchain address of the user entity account and associating with the user entity account;

Deploying the identity contract on a blockchain to obtain an identity contract address of the identity contract;

The identity contract address is used as an account identifier of the user entity account on the application server and a registration success response including the identity contract address is sent to the client.
An account unified device, which is applied to a client, and the device includes:

a first identity contract creation module for creating an identity contract and associating the identity contract with a user entity account;

a first identity contract deployment module, configured to deploy the identity contract on a blockchain to obtain an identity contract address of the identity contract;

a first registration request sending module, configured to send, to the application server, a registration request including the identity contract address, where the identity contract address is used to instruct the application server to use the identity contract address as the user entity account The account ID on the application server.
The device according to claim 13, wherein the device further comprises:

a login request sending module, configured to send a login request to the application server, where the login request includes the identity contract address and signature information, wherein the identity contract address and the signature information are used by the application server to determine Whether the user entity account is associated with the identity contract address and signature verification of the signature information.
The apparatus according to claim 13, wherein said identity contract further comprises account information of a plurality of arbitration clients and an arbitration rule;

The device also includes:

An entity account creation module for creating a new user entity account;

And a replacement request sending module, configured to separately send an entity account replacement request to the plurality of arbitration clients according to the account information of the plurality of arbitration clients, where the entity account replacement request includes the identity contract address and the new user entity a blockchain address of the account, wherein the identity contract address is used to instruct the plurality of arbitration clients to send an arbitration result to the identity contract, and the blockchain address of the new user entity account is used to indicate the identity The contract associates the new user entity account with the identity contract based on the arbitration results of the plurality of arbitration clients and the arbitration rules.
The device according to claim 13, wherein the device further comprises:

a private key blocking module, configured to block a private key of the user entity account according to a preset algorithm, to obtain n data blocks, where n≥2;

a hash processing module, configured to perform hash processing on the n data blocks, respectively, to obtain a hash value of the n data blocks;

a data block encryption module, configured to encrypt s data blocks in the n data blocks according to a public key of the c buddy clients, to obtain s encrypted data blocks, where c ≥ 1, n ≥ s ≥ k;

The information writing module is configured to write the s encrypted data blocks, the blockchain addresses of the c buddy clients, and the hash values of the n data blocks into the identity contract.
The method of claim 16 wherein said apparatus further comprises:

a target buddy client address obtaining module, configured to access the identity contract according to the identity contract address, and obtain a blockchain address of a target buddy client corresponding to at least k encrypted data blocks of the s encrypted data blocks, where N≥k≥1;

a private key recovery request sending module, configured to send a private key recovery request to the at least k target buddy clients according to the blockchain address of the at least k target buddy clients, where the private key recovery request is used to indicate Dedicating at least k target buddy clients to obtain the at least k encrypted data blocks from the identity contract, and decrypting and re-encrypting to store the identity contract;

And a private key recovery module, configured to query the at least k re-encrypted encrypted data blocks and the corresponding hash value from the identity contract and decrypt the private key of the user entity account.
An account unified device, which is applied to a client, and the device includes:

a second registration request sending module, configured to send a registration request to the application server, where the registration request includes a blockchain address of the user entity account, where the blockchain address is used by the application server to deploy according to the blockchain address An identity contract associated with the user entity account;

The registration success response receiving module is configured to receive a registration success response sent by the application server, where the registration request includes an identity contract address associated with the user entity account.
An account unified device, which is applied to an application server, and the device includes:

a first registration request receiving module, configured to receive a registration request sent by the client, where the registration request includes an identity contract address associated with the user entity account to be registered;

And a first account identifier determining module, configured to use the identity contract address as an account identifier of the user entity account on the application server.
The device of claim 19, wherein the device further comprises:

a first login request receiving module, configured to receive a login request sent by the client, where the login request includes the identity contract address and challenge signature information of the user entity account;

a first association verification module, configured to verify, according to the identity contract address and the challenge signature information, whether the user entity account is associated with the identity contract address;

The first login success response module is configured to return a login success response to the client when it is determined that the user entity account is associated with the identity contract address and the challenge signature information is verified.
The device of claim 19, wherein the device further comprises:

a second login request receiving module, configured to receive a login request sent by the client, where the login request includes the identity contract address and signature information of the user entity account;

a login status determining module, configured to query a login information contract on the blockchain according to the identity contract address, and determine a login status of the identity contract address on another trusted application server, where the login information contract is a contract pre-deployed on the blockchain with a login status of each identity contract address on each trusted application server;

a second association verification module, configured to verify the user entity account according to the identity contract address and the signature information when determining that the login status of the identity contract address on the other trusted application server is logged in Whether it is associated with the identity contract address;

The second login success response module is configured to return a login success response to the client when determining that the user entity account is associated with the identity contract address.
The device of claim 21, wherein the device further comprises:

a third association verification module, configured to verify the user entity account according to the identity contract address and the signature information when determining that the login status of the identity contract address on the other trusted application server is not logged in Whether to associate with the identity contract address and perform signature verification on the signature information;

a first login status marking module, configured to perform challenge authentication on the user entity account when determining that the user entity account is associated with the identity contract address, and to perform the identity contract after the authentication is passed after the authentication is passed The login status of the address on the application server is marked as logged in and recorded in the login information contract.
The device according to claim 21 or 22, wherein the device further comprises:

a logout request receiving module, configured to receive a logout request sent by the client, where the logout request includes the identity contract address;

The second login status marking module is configured to mark the login status of the identity contract address on the application server as not logged in and recorded in the login information contract.
An account unified device, which is applied to an application server, and the device includes:

a second registration request receiving module, configured to receive a registration request sent by the client, where the registration request includes a blockchain address of the user entity account to be registered;

a second identity contract creation module, configured to create an identity contract according to a blockchain address of the user entity account and associate with the user entity account;

a second identity contract deployment module, configured to deploy the identity contract on a blockchain to obtain an identity contract address of the identity contract;

And a second account identifier determining module, configured to send the identity contract address as an account identifier of the user entity account on the application server, and send a registration success response including the identity contract address to the client.
A computer readable storage medium, comprising: one or more programs, the one or more programs for performing the method of any one of claims 1-5 .
An account unified device, applied to a client, comprising: the computer readable storage medium of claim 25; and one or more processors for executing a program in the computer readable storage medium .
A computer readable storage medium, comprising: one or more programs, the one or more programs for performing the method of claim 6.
An account unified device, applied to a client, comprising: the computer readable storage medium of claim 27; and one or more processors for executing a program in the computer readable storage medium .
A computer readable storage medium, comprising: one or more programs, the one or more programs for performing the method of any one of claims 7-11 .
An account unified device, applied to an application server, comprising: the computer readable storage medium of claim 29; and one or more processors for executing a program in the computer readable storage medium .
A computer readable storage medium, comprising: one or more programs, the one or more programs for performing the method of claim 12.
An account unified device, applied to an application server, comprising: the computer readable storage medium of claim 31; and one or more processors for executing a program in the computer readable storage medium .