WO2020191928A1 - 一种数字身份认证方法、设备、装置、系统及存储介质 - Google Patents

一种数字身份认证方法、设备、装置、系统及存储介质 Download PDF

Info

Publication number
WO2020191928A1
WO2020191928A1 PCT/CN2019/091806 CN2019091806W WO2020191928A1 WO 2020191928 A1 WO2020191928 A1 WO 2020191928A1 CN 2019091806 W CN2019091806 W CN 2019091806W WO 2020191928 A1 WO2020191928 A1 WO 2020191928A1
Authority
WO
WIPO (PCT)
Prior art keywords
digital identity
ciphertext
identity information
verification
terminal
Prior art date
Application number
PCT/CN2019/091806
Other languages
English (en)
French (fr)
Inventor
张骁
Original Assignee
深圳市网心科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市网心科技有限公司 filed Critical 深圳市网心科技有限公司
Publication of WO2020191928A1 publication Critical patent/WO2020191928A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the present invention relates to the field of blockchain technology, in particular to a digital identity authentication method, equipment, device, system and computer readable storage medium.
  • the main purpose of the present invention is to provide a digital identity authentication method, equipment, device, system and computer readable storage medium, which aims to solve the technical problems of single digital identity authentication form and low security performance in the prior art.
  • this application provides a digital identity authentication method, which is applied to a blockchain platform, and the blockchain platform pre-stores the digital identity information ciphertext, encrypted and generated by the approval terminal according to the personal information of the registered user. And the security level corresponding to the ciphertext of the digital identity information generated by the blockchain platform, the digital identity authentication method includes:
  • the verification terminal In response to the digital identity information acquisition request sent by the verification terminal, the ciphertext of the digital identity information of the target user and the security level are sent to the verification terminal, so that the verification terminal determines that the digital identity information is encrypted When the text matches the plain text of the digital identity information submitted by the user terminal, the verification terminal performs security verification corresponding to the security level on the user terminal.
  • the security level includes a first security level, a second security level, and a third security level; the security verification corresponding to the first security level is empty, and the security verification corresponding to the second security level includes Biological information verification.
  • the types of security verification corresponding to the third security level include biological information verification and hardware key device verification.
  • the biological information verification includes any one or any combination of the following:
  • Fingerprint verification face verification, iris verification, voiceprint verification.
  • the blockchain platform generates the encrypted public key and the user private key of the registered user after the user is registered, so that the approval terminal uses the encrypted public key obtained by the query to encrypt according to the personal information of the registered user
  • the digital identity information ciphertext is generated, and the user terminal uses the user private key sent by the blockchain platform to decrypt to generate the digital identity information plaintext.
  • the digital identity information ciphertext includes a first encrypted message and a second encrypted message, the first encrypted message includes a first ciphertext, and the second encrypted message includes a second ciphertext;
  • Encrypting and generating the digital identity information ciphertext according to the registered user's personal information by the approval terminal using the encrypted public key obtained by the query includes:
  • the random key is encrypted by using the encryption public key to generate the second ciphertext.
  • the first encrypted message further includes a third ciphertext generated by the approval terminal using a hash algorithm to encrypt the hash value.
  • the first encrypted message further includes a first signature value generated by the approval terminal using an approval terminal key to sign the first ciphertext and the third ciphertext;
  • the second encrypted message also includes a second signature value generated by the approval terminal using the approval terminal key to sign the second ciphertext.
  • the user terminal using the user private key sent by the blockchain platform to decrypt and generate the digital identity information plaintext includes:
  • the user terminal uses the user private key to decrypt the second ciphertext in the digital identity information ciphertext to generate the random key; and uses the random key to decrypt the second ciphertext in the digital identity information ciphertext to generate the random key; Decrypting the first ciphertext to generate the hash value;
  • the determining by the verification terminal whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal includes:
  • the verification terminal uses a hash algorithm to encrypt the hash value submitted by the user terminal to generate a third verification ciphertext; and determine whether the third verification ciphertext is the third ciphertext in the digital identity information ciphertext. Whether the text is consistent; if so, use the verification terminal public key to sign the first ciphertext and the third ciphertext in the digital identity information ciphertext to generate a first signature verification value, and determine the first signature Whether the verification value is consistent with the first signature value in the ciphertext of the digital identity information; if so, it is determined that the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal; if not, it is determined that all The ciphertext of the digital identity information does not match the plaintext of the digital identity information submitted by the user terminal.
  • This application also provides a digital identity authentication device applied to a blockchain platform, including:
  • the storage module is configured to pre-store the digital identity information ciphertext encrypted and generated by the approval terminal according to the personal information of the registered user, and the security level corresponding to the digital identity information ciphertext generated by the blockchain platform;
  • the first processing module is configured to send the digital identity information ciphertext of the target user to the user terminal in response to the digital identity information acquisition request sent by the user terminal, so that the user terminal can decrypt the digital identity information ciphertext To obtain the clear text of digital identity information;
  • the second processing module is configured to send the digital identity information cipher text and the security level of the target user to the verification terminal in response to the digital identity information acquisition request sent by the verification terminal, so that the verification terminal can When it is determined that the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal, the verification terminal performs a security verification corresponding to the security level on the user terminal.
  • the security level includes a first security level, a second security level, and a third security level; the security verification corresponding to the first security level is empty, and the security verification corresponding to the second security level includes Biological information verification.
  • the types of security verification corresponding to the third security level include biological information verification and hardware key device verification.
  • the biological information verification includes any one or any combination of the following: fingerprint verification, face verification, iris verification, and voiceprint verification.
  • the digital identity authentication device further includes:
  • a generating module used to generate the encrypted public key and the user private key of the registered user after the user registers
  • a sending module configured to send the user private key to the user terminal, so that the user terminal uses the user private key to decrypt and generate the digital identity information plaintext;
  • the storage module is also used to store the encrypted public key, so that the approval terminal uses the encrypted public key obtained by the query to encrypt and generate the digital identity information ciphertext according to the personal information of the registered user.
  • the digital identity information ciphertext includes a first encrypted message and a second encrypted message, the first encrypted message includes the first ciphertext, and the second encrypted message includes the second ciphertext; the first ciphertext is generated by the approval terminal using The random key is generated by encrypting a hash value composed of personal information and the generated random salt value; the second ciphertext is generated by encrypting the random key by the approval terminal using the encryption public key.
  • the first encrypted message further includes a third ciphertext generated by the approval terminal using a hash algorithm to encrypt the hash value.
  • the first encrypted message further includes the first signature value generated by the approval terminal using the approval terminal key to sign the first ciphertext and the third ciphertext; the second encrypted message further includes the approval terminal using the approval terminal The second signature value generated by the key signing the second ciphertext.
  • This application also provides another digital identity authentication method, which is applied to the verification terminal, including:
  • the block chain platform stores the digital identity information ciphertext of each registered user generated by the approval terminal and the security level corresponding to the digital identity information ciphertext generated by the block chain platform;
  • This application also provides another digital identity authentication device, which is applied to a verification terminal, including:
  • the first receiving module is used to receive the digital identity verification request and the plaintext of digital identity information sent by the user terminal;
  • the plaintext of digital identity information is generated by the user terminal by decrypting the ciphertext of the target user's digital identity information obtained by querying on the blockchain platform,
  • the blockchain platform stores the ciphertext of the digital identity information of each registered user generated by the approval terminal, and the security level corresponding to the ciphertext of the digital identity information generated by the blockchain platform;
  • the request module is used to send a request for obtaining digital identity information to the blockchain platform
  • the second receiving module receives the ciphertext and security level of the target user's digital identity information sent by the blockchain platform;
  • the judgment module is used to judge whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal;
  • the security verification module is configured to perform security verification on the user terminal corresponding to the security level when the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal.
  • the plaintext of the digital identity information submitted by the user terminal includes:
  • the user terminal uses the user private key to decrypt the second ciphertext in the digital identity information ciphertext to generate a random key, and then uses the random key to decrypt the first ciphertext in the digital identity information ciphertext to generate a hash value;
  • the judgment module 104 includes:
  • the hash calculation unit is configured to use a hash algorithm to encrypt the hash value submitted by the user terminal to generate the third verification ciphertext;
  • the hash judgment unit is used to judge whether the third verification ciphertext is consistent with the third ciphertext in the digital identity information ciphertext; if not, it is judged that the digital identity information ciphertext does not match the plaintext of the digital identity information submitted by the user terminal;
  • the signature unit is used for signing the first ciphertext and the third ciphertext in the digital identity information ciphertext by using the verification terminal public key when the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal to generate the first Signature verification value;
  • the signature judgment unit is used to judge whether the first signature verification value is consistent with the first signature value in the ciphertext of the digital identity information; if so, it is judged that the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal; if not, then Determine that the ciphertext of the digital identity information does not match the plaintext of the digital identity information submitted by the user terminal.
  • the present application also provides a digital identity authentication device, including a memory and a processor, the memory stores a digital identity authentication program that can run on the processor, and the digital identity authentication program is executed by the processor When realizing any of the above-mentioned digital identity authentication methods.
  • This application also provides a digital identity authentication system, including a blockchain platform, an approval terminal and a verification terminal connected to the blockchain platform; wherein, the approval terminal is used to encrypt and generate digital data based on the personal information of registered users.
  • the ciphertext of the identity information is sent to the blockchain platform for storage; the blockchain platform is used to generate the security level corresponding to the ciphertext of the digital identity information, and respond to the digital identity acquisition request sent by the user terminal , Sending the ciphertext of the digital identity information of the target user to the user terminal, so that the user terminal decrypts the ciphertext of the digital identity information to obtain the plaintext of the digital identity information; the verification terminal is used to respond to the user
  • the digital identity verification request sent by the terminal when it is determined that the ciphertext of the digital identity information obtained from the blockchain platform query matches the plaintext of the digital identity information submitted by the user terminal, the user terminal is Security verification corresponding to the security level.
  • the present application also provides a computer-readable storage medium with a digital identity authentication program stored on the computer-readable storage medium, and the digital identity authentication program can be executed by one or more processors to realize the above Any kind of digital identity authentication method.
  • This application uses the blockchain platform to pre-store the digital identity information ciphertext generated by the approval terminal based on the personal information of the registered user, and the security level corresponding to the digital identity information ciphertext generated by the blockchain platform , Sending the digital identity information ciphertext of the target user to the user terminal in response to the digital identity information acquisition request sent by the user terminal, so that the user terminal can decrypt the digital identity information ciphertext to obtain the digital identity information Clear text; and in response to the digital identity information acquisition request sent by the verification terminal, the ciphertext of the digital identity information of the target user and the security level are sent to the verification terminal, so that the verification terminal is determining the number When the ciphertext of the identity information matches the plaintext of the digital identity information submitted by the user terminal, the verification terminal performs security verification on the user terminal corresponding to the security level.
  • the digital identity authentication method provided by this application introduces additional security verification corresponding to the preset security level, and uses the blockchain platform to store and manage the user’s digital identity information and security level, so that the verification terminal is verifying After the target user's digital identity information continues to perform additional security verification corresponding to the security level, it can meet the customization requirements of multiple authentication methods under different users and different application scenarios, and further improve the security and reliability of digital identity authentication.
  • Figure 1 is a schematic diagram of an application scenario of the digital identity authentication method in the present invention
  • FIG. 2 is a schematic flowchart of a digital identity authentication method in an embodiment of the present invention.
  • FIG. 3 is a detailed flow diagram of the process of encrypting and generating digital identity information ciphertext by the approval terminal in FIG. 2;
  • FIG. 4 is a detailed flowchart of the process of decrypting and generating the plaintext of digital identity information by the user terminal in FIG. 2;
  • 5 is a detailed flow diagram of a process in which the verification terminal judges whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal in an embodiment of the present invention
  • FIG. 6 is a detailed flow diagram of the process in which the verification terminal judges whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal in another embodiment of the present invention
  • FIG. 7 is a schematic flowchart of a digital identity authentication method in another embodiment of the present invention.
  • FIG. 8 is a schematic diagram of the internal structure of a digital identity authentication device disclosed in an embodiment of the present invention.
  • FIG. 9 is a schematic diagram of the internal structure of a digital identity authentication device disclosed in an embodiment of the present invention.
  • FIG. 10 is a schematic diagram of the internal structure of a digital identity authentication device disclosed in another embodiment of the present invention.
  • Fig. 1 is a schematic diagram of an application scenario of the digital identity authentication method in the present invention.
  • the approval terminal belongs to the approver of the digital identity and is used to issue digital identities to users who have passed the audit;
  • the verification terminal belongs to the verifier and is used to authenticate the user's digital identity;
  • the blockchain platform serves as a use
  • the data center for data storage management with blockchain technology is used to store the user's digital identity information and the corresponding security level issued by the approval terminal, and provide query services to the user terminal and the verification terminal.
  • the blockchain platform stores the digital identity information issued by the approval terminal for the user, and sets a corresponding security level for the digital identity information of each registered user .
  • the blockchain platform provided by this application serves as a data storage center independent of the approver, verifier, and user. It uses blockchain technology to securely store, operate, maintain, and manage the user's digital identity information, which can provide security and convenience , Timely information query service, acting as an intermediary and communication bridge in the process of digital identity authentication.
  • the blockchain is the underlying technical architecture of Bitcoin, which is essentially a decentralized distributed ledger.
  • Blockchain technology as a continuously growing chain data structure organized into blocks in sequence, participates in the calculation and recording of data through multiple nodes in the network, and mutually verifies the validity of its information. Putting data on the blockchain platform can free up more data, so that the data can be truly "circulated”.
  • FIG. 2 is a schematic flowchart of a digital identity authentication method in an embodiment of the present invention.
  • the digital identity authentication method provided by the present invention is applied to a blockchain platform.
  • the blockchain platform pre-stores the digital identity information ciphertext encrypted and generated by the approval terminal according to the personal information of the registered user, and the digital identity information generated by the blockchain platform.
  • the security level corresponding to the ciphertext of the digital identity information, and the digital identity authentication methods include:
  • S21 In response to the digital identity information acquisition request sent by the user terminal, send the digital identity information ciphertext of the target user to the user terminal, so that the user terminal can decrypt the digital identity information ciphertext to obtain the digital identity information plaintext.
  • S22 In response to the digital identity information acquisition request sent by the verification terminal, send the target user's digital identity information ciphertext and security level to the verification terminal, so that the verification terminal determines the digital identity information ciphertext and the digital identity information plaintext submitted by the user terminal When matching, the verification terminal performs security verification corresponding to the security level on the user terminal.
  • this application also specifically introduces the setting of security levels, so that after the digital identity information is verified, the user can continue to perform corresponding security levels. Additional security verification.
  • the user can register on the blockchain platform first, and apply for a digital identity to the approver of the digital identity.
  • the approving party reviews the personal information submitted by the user (such as name, date of birth, household registration, photos, etc.), and after the approval is passed, the digital identity information is agreed to be issued, and the approval terminal generates digital identity information ciphertext through encryption based on the user’s personal information. And send it to the blockchain platform for storage.
  • the blockchain platform sets a corresponding security level for the digital identity information of each registered user. Generally, the higher the security level, the higher the security requirements for digital identity authentication, and the higher the safety factor of the corresponding security verification.
  • the blockchain platform will generate a user ID when a user registers, so as to store and manage the ciphertext and security level of each registered user's digital identity information according to the user ID.
  • users may be required to register with their real names.
  • the blockchain platform when setting the security level, can set different security levels for different registered users according to user needs; in addition, for the same user, it can also be set according to specific digital identity authentication application scenarios Different security levels. For example, in the application scenario of digital identity authentication for personnel entering and exiting an office building, a lower security level can be set; and when a bank acts as a verifier and needs to perform digital identity authentication for banking users, a higher security level can be set Security level to ensure the safety of user funds.
  • security levels are specifically set and which security verification items each security level corresponds to, those skilled in the art can also choose and set them according to actual application conditions, and this application does not limit it.
  • the blockchain platform can receive the digital identity information acquisition request (carrying the user ID of the target user) from the user terminal, and then the target requested by the user terminal
  • the ciphertext of the user's digital identity information is sent to the user terminal, so that the user terminal obtains the plaintext of the digital identity information corresponding to the target user through decryption, thereby submits the plaintext of the digital identity information to the verification terminal, and requests the verification terminal for digital identity authentication.
  • the verification terminal After the verification terminal receives the digital identity authentication request sent by the user terminal, it can send the digital identity information acquisition request for the target user to the blockchain platform, so as to also obtain the digital identity of the target user stored in the blockchain platform Information ciphertext, at the same time, the blockchain platform will also send the corresponding security level to the verification terminal.
  • the verification terminal can verify the plaintext of the digital identity information submitted by the user terminal according to the ciphertext of the digital identity information provided by the blockchain platform, and perform additional security verification corresponding to the security level of the target user. Only when the digital identity information and additional security verification are passed, the digital identity verification of the target user is determined to be successful.
  • This application uses the blockchain platform to pre-store the digital identity information ciphertext generated by the approval terminal based on the personal information of the registered user, and the security level corresponding to the digital identity information ciphertext generated by the blockchain platform.
  • the digital identity information acquisition request sent by the user terminal sends the ciphertext of the digital identity information of the target user to the user terminal so that the user terminal can decrypt the ciphertext of the digital identity information to obtain the plaintext of the digital identity information; and respond to the digital identity information sent by the verification terminal
  • the identity information acquisition request sends the target user's digital identity information ciphertext and security level to the verification terminal, so that when the verification terminal determines that the digital identity information ciphertext matches the digital identity information submitted by the user terminal, the verification terminal will Perform security verification corresponding to the security level.
  • the digital identity authentication method provided by this application introduces additional security verification corresponding to the preset security level, and uses the blockchain platform to store and manage the user’s digital identity information and security level, so that the verification terminal is verifying After the target user's digital identity information continues to perform additional security verification corresponding to the security level, it can meet the customization requirements of multiple authentication methods under different users and different application scenarios, and further improve the security and reliability of digital identity authentication.
  • the security level includes a first security level, a second security level, and a third security level; corresponding to the first security level
  • the security verification of is empty, the security verification corresponding to the second security level includes biometric information verification, and the types of security verification corresponding to the third security level include biometric information verification and hardware key device verification.
  • the biological information verification is aimed at the biological characteristics of the target user.
  • the biological information verification may include any one or any combination of the following:
  • Fingerprint verification face verification, iris verification, voiceprint verification.
  • the verification terminal can specifically call a third-party system to complete the biometric verification of the target user.
  • the data system of the public security department may already store the fingerprint information and face information of local residents, and the verification terminal only needs to obtain the fingerprint information or face information of the target user through the relevant fingerprint collection device or face recognition device. And send it to the data system of the public security department for matching verification.
  • the biological information verification of the target user can also be completed without the aid of a third-party system.
  • the user needs to directly or indirectly enter his biological information into the blockchain platform in advance in order to verify the biological information and area collected by the terminal.
  • the biological information stored in the blockchain platform is compared and verified.
  • hardware key device verification is a common security verification method in online banking transactions. Specifically, when a user registers on the blockchain platform, the blockchain platform can generate and store a corresponding key for each registered user, and then can issue a hardware key device storing the key to the registered user. When the verification terminal requires the user to verify the hardware key device, the user can insert the hardware key device into the verification terminal for reading and verification.
  • the higher the security level the higher the safety factor of the corresponding security verification. Therefore, the number of security verification items corresponding to the high security level can be higher than that of the low security level.
  • the specific security verification methods can be fingerprint verification, face verification, iris verification, voiceprint verification, hardware key device verification choose among other methods, and this application is not limited.
  • the regional connection platform has three types of security levels: the security verification corresponding to the first security level is empty, that is, no additional security verification is performed except for the verification of digital identity information; the second security level corresponds to The security verification is biometric verification, for example, fingerprint verification plus face verification; the security verification corresponding to the third security level includes biometric verification and hardware key device verification, for example, fingerprint verification plus face verification plus Hardware key device verification.
  • the digital identity authentication method provided in this application is based on the above content.
  • the blockchain platform generates and stores the encrypted public key and user private key of the registered user after the user is registered for approval
  • the terminal uses the encrypted public key obtained by the query to encrypt the ciphertext of the digital identity information according to the personal information of the registered user, and the user terminal uses the user private key sent by the blockchain platform to decrypt and generate the plaintext of the digital identity information.
  • the ciphertext of the user's digital identity information is specifically encrypted with a key.
  • the blockchain platform can generate a pair of keys for each registered user, including an encrypted public key and a user's private key.
  • the user's private key is sent to the user terminal and managed by the user; the encrypted public key can be stored in the public key smart contract, so that the approval terminal can obtain the encryption by querying the public key smart contract after reviewing the user's digital identity application
  • the public key is used for encryption to generate a ciphertext of the user's digital identity information.
  • the encrypted public key and user private key of each registered user are paired matching keys, and the user private key is used to decrypt the ciphertext of the digital identity information encrypted by the encrypted public key.
  • the user private key can be used as the key stored in the hardware key device described above.
  • the digital identity information ciphertext includes a first encrypted message and a second encrypted message, and the first encrypted message includes the first ciphertext, The second encrypted message includes the second ciphertext;
  • Figure 3 is a detailed flow diagram of the process in which the approval terminal uses the encrypted public key obtained by the query to encrypt the personal information of the registered user to generate a ciphertext of digital identity information:
  • the approval terminal may specifically use the encrypted public key pk obtained from the blockchain platform and the randomly generated random key s to generate two ciphertexts, so as to realize double encryption.
  • salt consisting of the user’s personal information plaintext and random salt values can be encrypted to generate the first ciphertext Es(plaintext
  • the encrypted public key pk can be used to encrypt the random key s to generate the second ciphertext Epk(s), and then the first encrypted message including the first ciphertext Es (plaintext
  • the second encrypted message of (s) is sent to the blockchain platform for storage, thereby further improving the security and reliability of digital identity authentication and ensuring that the user's personal authentication information is not stolen and leaked.
  • the first encrypted message further includes a third ciphertext H (plaintext
  • the approval terminal can also use a hash algorithm to encrypt and generate the third ciphertext H (plaintext
  • the first encrypted message further includes the approval terminal using the approval terminal key to sign the first ciphertext Es (plaintext
  • the second encrypted message also includes the second signature value Signature2 generated by the approval terminal using the approval terminal key to sign the second ciphertext Epk(s).
  • the approval terminal can also use a signature method to encrypt the digital identity information of the target user to further improve the security and confidentiality of the data. Therefore, use Msg1 to represent the first encrypted message, and Msg2 to represent the second encrypted message, then:
  • Msg1 Es(plaintext
  • Msg2 Epk(s)+Signature2.
  • decryption is the reverse process of encryption.
  • the user terminal can use the user private key to decrypt the random key s, and then use the random key s to decrypt the hash composed of the target user’s personal information and the random salt value.
  • salt is the plaintext of the said digital identity information.
  • FIG. 5 is a detailed flow diagram of the process in which the verification terminal judges whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal in an embodiment of the present invention:
  • S51 Use a hash algorithm to encrypt the hash value submitted by the user terminal to generate a third verification ciphertext.
  • S52 Determine whether the third verification ciphertext is consistent with the third ciphertext in the digital identity information ciphertext; if not, proceed to S53.
  • S53 Determine that the ciphertext of the digital identity information does not match the plaintext of the digital identity information submitted by the user terminal.
  • the verification terminal compares the ciphertext of the target user's digital identity information stored in the blockchain platform with the plaintext of the digital identity information submitted by the user terminal (that is, the hash value plaintext
  • the algorithm encrypts the hash value plaintext
  • FIG. 6 is a detailed flowchart of a process in which the verification terminal judges whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal in another embodiment of the present invention:
  • S61 Use a hash algorithm to encrypt the hash value submitted by the user terminal to generate a third verification ciphertext.
  • S62 Determine whether the third verification ciphertext is consistent with the third ciphertext in the digital identity information ciphertext; if not, go to S63; if yes, go to S64.
  • S63 Determine that the ciphertext of the digital identity information does not match the plaintext of the digital identity information submitted by the user terminal.
  • S64 Use the verification terminal public key to sign the first ciphertext and the third ciphertext in the ciphertext of the digital identity information to generate a first signature verification value; enter S65.
  • S65 Determine whether the first signature verification value is consistent with the first signature value in the ciphertext of the digital identity information; if yes, go to S66; if not, go to S63.
  • S66 Determine that the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal.
  • the verification terminal can perform two-sided matching verification on the plaintext of the digital identity information submitted by the user terminal, that is, on the basis of the hash verification performed in Figure 5, the signature verification is performed to further protect the data identity information Certified reliability.
  • the third verification ciphertext calculated by the hash algorithm is consistent with the third ciphertext and the signature verification also passes, it can be determined that the plaintext of the digital identity information submitted by the user terminal matches the ciphertext of the digital identity information in the blockchain platform , Which means that the user’s digital identity authentication is successful.
  • this application also provides a digital identity authentication method applied to a verification terminal, referring to FIG. 7, including:
  • S71 Receive the digital identity verification request and the digital identity information plaintext sent by the user terminal; the digital identity information plaintext is generated by the user terminal decrypting the ciphertext of the target user's digital identity information obtained by querying on the blockchain platform, so The blockchain platform stores the digital identity information ciphertext of each registered user generated by the approval terminal, and the security level corresponding to the digital identity information ciphertext generated by the blockchain platform.
  • S73 Receive the ciphertext and security level of the target user's digital identity information sent by the blockchain platform.
  • S74 Determine whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal; if so, proceed to S75.
  • S75 Perform security verification corresponding to the security level on the user terminal.
  • the specific content can refer to the digital identity authentication method applied to the blockchain platform described above, and similar content will not be repeated here.
  • the present application also provides a digital identity authentication device 8.
  • the digital identity authentication device 8 may include a memory 81, a processor 82, and a bus 83.
  • the memory 81 is stored and can run on the processor 82.
  • the digital identity authentication program is executed by the processor 82 to implement any of the above-mentioned digital identity authentication methods.
  • the digital identity authentication device 8 may be a PC (Personal Computer, personal computer), or a smart phone, a tablet computer, a palmtop computer, a portable computer, or a network storage terminal device.
  • the digital identity authentication device 8 may be a node forming a CDN network or a blockchain network.
  • the memory 81 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), magnetic memory, magnetic disk, optical disk, etc.
  • the memory 81 may be an internal storage unit of the digital identity authentication device 8 in some embodiments, for example, the hard disk of the digital identity authentication device 8. In other embodiments, the memory 81 may also be an external storage device of the digital identity authentication device 8, such as a plug-in hard disk equipped on the digital identity authentication device 8, a smart media card (SMC), and a secure digital (Secure Digital). Digital, SD) card, flash card (Flash Card), etc.
  • the memory 81 may also include both an internal storage unit of the digital identity authentication device 8 and an external storage device.
  • the memory 81 can be used not only to store application software and various data installed in the digital identity authentication device 8, such as the code of a digital identity authentication program, but also to temporarily store data that has been output or will be output.
  • the processor 82 may be a central processing unit (CPU), controller, microcontroller, microprocessor or other data processing chip in some embodiments, and is used to run the program code or processing stored in the memory 81 Data, such as the implementation of digital identity authentication procedures, etc.
  • CPU central processing unit
  • controller microcontroller
  • microprocessor or other data processing chip in some embodiments, and is used to run the program code or processing stored in the memory 81 Data, such as the implementation of digital identity authentication procedures, etc.
  • the bus 83 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into address bus, data bus, control bus, etc. For ease of presentation, only one thick line is used in FIG. 8 to represent, but it does not mean that there is only one bus or one type of bus.
  • the digital identity authentication device 8 may also include a network interface 14.
  • the network interface 14 may optionally include a wired interface and/or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is usually used in a digital identity authentication device 8 Establish a communication connection with other electronic devices.
  • the digital identity authentication device 8 may also include a user interface.
  • the user interface may include a display (Display) and an input unit such as a keyboard (Keyboard).
  • the optional user interface may also include a standard wired interface and a wireless interface.
  • the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode, organic light emitting diode) touch device, etc.
  • the display can also be appropriately called a display screen or a display unit, which is used to display the information processed in the digital identity authentication device 8 and to display a visual user interface.
  • FIG. 8 only shows a digital identity authentication device 8 with components 81-83 and a digital identity authentication program. Those skilled in the art can understand that the structure shown in FIG. 8 does not constitute a limitation on the digital identity authentication device 8. It may include fewer or more components than shown, or a combination of certain components, or a different component arrangement.
  • this application also provides a digital identity authentication device applied to a blockchain platform.
  • FIG. 9 is a schematic diagram of the internal structure of the digital identity authentication device disclosed in an embodiment of the application, including:
  • the storage module 91 is configured to pre-store the digital identity information ciphertext encrypted and generated by the approval terminal according to the personal information of the registered user, and the security level corresponding to the digital identity information ciphertext generated by the blockchain platform;
  • the first processing module 92 is configured to send the digital identity information ciphertext of the target user to the user terminal in response to the digital identity information acquisition request sent by the user terminal, so that the user terminal can decrypt the digital identity information ciphertext to obtain the digital identity information. Clear text of identity information;
  • the second processing module 93 is configured to send the digital identity information ciphertext and security level of the target user to the verification terminal in response to the digital identity information acquisition request sent by the verification terminal, so that the verification terminal is determining whether the digital identity information ciphertext and the user terminal When the submitted digital identity information matches in plain text, the verification terminal performs security verification corresponding to the security level of the user terminal.
  • this application introduces additional security verification corresponding to the preset security level, using the blockchain platform to store and manage the user's digital identity information and security level, so that the verification terminal can continue after verifying the target user's digital identity information
  • Carrying out additional security verification corresponding to the security level can meet the customization requirements for multiple authentication methods under different users and different application scenarios, and further improve the security and reliability of digital identity authentication.
  • the security level includes a first security level, a second security level, and a third security level; the security verification corresponding to the first security level is empty, and the security verification corresponding to the second security level includes Biological information verification.
  • the security verification corresponding to the third security level includes biological information verification and hardware key device verification.
  • the biological information verification includes any one or any combination of the following: fingerprint verification, face verification, iris verification, and voiceprint verification.
  • the digital identity authentication device further includes:
  • a generating module used to generate the encrypted public key and the user private key of the registered user after the user registers
  • a sending module configured to send the user private key to the user terminal, so that the user terminal uses the user private key to decrypt and generate the digital identity information plaintext;
  • the storage module is also used to store the encrypted public key, so that the approval terminal uses the encrypted public key obtained by the query to encrypt and generate the digital identity information ciphertext according to the personal information of the registered user.
  • the digital identity information ciphertext includes a first encrypted message and a second encrypted message, the first encrypted message includes the first ciphertext, and the second encrypted message includes the second ciphertext; the first ciphertext
  • the approval terminal uses the generated random key to encrypt the hash value composed of the personal information and the generated random salt value; the second ciphertext is generated by the approval terminal to encrypt the random key with the encrypted public key.
  • the first encrypted message further includes a third ciphertext generated by the approval terminal using a hash algorithm to encrypt the hash value.
  • the first encrypted message further includes the first signature value generated by the approval terminal using the approval terminal key to sign the first ciphertext and the third ciphertext; the second encrypted message also includes The second signature value generated by the approval terminal using the approval terminal key to sign the second ciphertext.
  • this application also provides another digital identity authentication device, which is applied to a blockchain platform.
  • FIG. 10 is a schematic diagram of the internal structure of the digital identity authentication device disclosed in another embodiment of the application, including:
  • the first receiving module 101 is used to receive the digital identity verification request and the plaintext of the digital identity information sent by the user terminal; the plaintext of the digital identity information is generated by the user terminal decrypting the ciphertext of the target user's digital identity information obtained by querying on the blockchain platform ,
  • the blockchain platform stores the ciphertext of the digital identity information of each registered user generated by the approval terminal, and the security level corresponding to the ciphertext of the digital identity information generated by the blockchain platform;
  • the request module 102 is used to send a digital identity information acquisition request to the blockchain platform;
  • the second receiving module 103 receives the ciphertext and security level of the digital identity information of the target user sent by the blockchain platform;
  • the judging module 104 is used to judge whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal;
  • the security verification module 105 is configured to perform security verification on the user terminal corresponding to the security level when the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal.
  • the plaintext of the digital identity information submitted by the user terminal includes:
  • the user terminal uses the user private key to decrypt the second ciphertext in the digital identity information ciphertext to generate a random key, and then uses the random key to decrypt the first ciphertext in the digital identity information ciphertext to generate a hash value;
  • the judgment module 104 includes:
  • the hash calculation unit is configured to use a hash algorithm to encrypt the hash value submitted by the user terminal to generate the third verification ciphertext;
  • the hash determination unit is used to determine whether the third verification ciphertext is consistent with the third ciphertext in the digital identity information ciphertext; if not, it is determined that the digital identity information ciphertext does not match the digital identity information plaintext submitted by the user terminal;
  • the signature unit is used for signing the first ciphertext and the third ciphertext in the digital identity information ciphertext by using the verification terminal public key when the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal to generate the first Signature verification value;
  • the signature judgment unit is used to judge whether the first signature verification value is consistent with the first signature value in the ciphertext of the digital identity information; if so, it is judged that the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal; if not, then Determine that the ciphertext of the digital identity information does not match the plaintext of the digital identity information submitted by the user terminal.
  • this application also provides a digital identity authentication system, including a blockchain platform, an approval terminal and a verification terminal connected to the blockchain platform; wherein the approval terminal is used to encrypt and generate a digital identity based on the personal information of registered users
  • the information ciphertext is sent to the blockchain platform for storage; the blockchain platform is used to generate the security level corresponding to the ciphertext of the digital identity information, and in response to the digital identity acquisition request sent by the user terminal, the target user’s digital identity
  • the information ciphertext is sent to the user terminal so that the user terminal can decrypt the ciphertext of the digital identity information to obtain the plaintext of the digital identity information; the verification terminal is used to respond to the digital identity verification request sent by the user terminal.
  • the user terminal is subjected to security verification corresponding to the security level.
  • the present application also provides a computer-readable storage medium having a digital identity authentication program stored on the computer-readable storage medium, and the digital identity authentication program can be executed by one or more processors to achieve the above Any of the aforementioned digital identity authentication methods.
  • this application also provides a computer program product, including computer instructions, which when run on a computer, enable the computer to execute any of the above-mentioned digital identity authentication methods.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center. Transmission to another website site, computer, server or data center via wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • wired such as coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server or data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)), etc.
  • the disclosed system, device, and method can be implemented in other ways.
  • the system embodiment described above is only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , Including several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program code .

Abstract

一种数字身份认证方法、设备、装置、系统及计算机可读存储介质，所述数字身份认证方法应用于区块链平台，包括：响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至用户终端，以便用户终端对数字身份信息密文进行解密以生成数字身份信息明文；响应于验证终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文以及安全层级发送至验证终端，以便验证终端判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配，若是，则对用户终端进行与安全层级对应的安全验证。本发明可满足对多种认证方式的定制化需求，提高了数字身份认证的安全可靠性。

Description

一种数字身份认证方法、设备、装置、系统及存储介质
本申请要求于2019年3月27日提交中国专利局、申请号为201910238454.5、发明名称为“一种数字身份认证方法、设备、装置、系统及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及区块链技术领域，尤其涉及一种数字身份认证方法、设备、装置、系统及计算机可读存储介质。
背景技术
随着信息技术和网络技术的发展，数字身份验证已经成为当今社会中的常见场景。然而，现有技术中的数字身份验证普遍较为简单和单一，对不同重要程度的验证场景也并无区分，均是仅由验证方利用签发数字身份的审批方所提供的数字身份信息与用户提供的证明材料进行比对验证。因此，对于一些安全等级要求较高的应用场景如银行业务场景等，现有技术的安全可靠性显然有待提高。鉴于此，提供一种解决上述问题的方法已经成为本领域技术人员所需重点关注的。
发明内容
本发明的主要目的在于提供一种数字身份认证方法、设备、装置、系统及计算机可读存储介质，旨在解决现有技术中数字身份认证形式单一、安全性能较低的技术问题。
为实现上述目的，本申请提供了一种数字身份认证方法，应用于区块链平台，所述区块链平台预先存储有由审批终端根据注册用户的个人信息加密生成的数字身份信息密文、以及由所述区块链平台生成的与所述数字身份信息密文对应的安全层级，所述数字身份认证方法包括：
响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至所述用户终端，以便所述用户终端对所述数字身份信息 密文进行解密以获取数字身份信息明文；
应于验证终端发送的数字身份信息获取请求，将所述目标用户的所述数字身份信息密文以及所述安全层级发送至所述验证终端，以便所述验证终端在判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文匹配时，由所述验证终端对所述用户终端进行与所述安全层级对应的安全验证。
可选地，所述安全层级包括第一安全层级、第二安全层级和第三安全层级；与所述第一安全层级对应的安全验证为空，与所述第二安全层级对应的安全验证包括生物信息验证，与所述第三安全层级对应的安全验证的类型包括生物信息验证和硬件密钥设备验证。
可选地，所述生物信息验证包括以下任意一项或者任意组合：
指纹验证、人脸验证、虹膜验证、声纹验证。
可选地，所述区块链平台在用户注册后生成注册用户的加密公钥和用户私钥，以便由所述审批终端利用查询获取的所述加密公钥根据所述注册用户的个人信息加密生成所述数字身份信息密文，并由所述用户终端利用所述区块链平台发送的所述用户私钥解密生成所述数字身份信息明文。
可选地，所述数字身份信息密文包括第一加密消息和第二加密消息，所述第一加密消息包括第一密文，所述第二加密消息包括第二密文；
所述审批终端利用查询获取的所述加密公钥根据所述注册用户的个人信息加密生成所述数字身份信息密文包括：
向所述区块链平台查询获取所述加密公钥；
生成随机密钥和随机salt值；
利用所述随机密钥对由所述个人信息和所述随机salt值构成的散列值进行加密以生成所述第一密文；
利用所述加密公钥对所述随机密钥进行加密以生成所述第二密文。
可选地，所述第一加密消息还包括由所述审批终端利用哈希算法对所述散列值进行加密而生成的第三密文。
可选地，所述第一加密消息还包括由所述审批终端利用审批终端密钥对所述第一密文和所述第三密文进行签名而生成的第一签名值；
所述第二加密消息还包括由所述审批终端利用所述审批终端密钥对所述第二密文进行签名而生成的第二签名值。
可选地，所述用户终端利用所述区块链平台发送的所述用户私钥解密生成所述数字身份信息明文包括：
所述用户终端利用所述用户私钥对所述数字身份信息密文中的所述第二密文解密生成所述随机密钥；利用所述随机密钥对所述数字身份信息密文中的所述第一密文解密生成所述散列值；
所述验证终端判断所述数字身份信息密文与所述用户终端提交的数字身份信息明文是否匹配包括：
所述验证终端利用哈希算法对所述用户终端提交的所述散列值加密生成第三验证密文；判断所述第三验证密文与所述数字身份信息密文中的所述第三密文是否一致；若是，则利用验证终端公钥对所述数字身份信息密文中的所述第一密文和所述第三密文进行签名以生成第一签名验证值，判断所述第一签名验证值与所述数字身份信息密文中的所述第一签名值是否一致；若是，则判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文匹配；若否，则判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文不匹配。
本申请还提供了一种数字身份认证装置，应用于区块链平台，包括：
存储模块，用于预先存储由审批终端根据注册用户的个人信息加密生成的数字身份信息密文、以及由所述区块链平台生成的与所述数字身份信息密文对应的安全层级；
第一处理模块，用于响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至所述用户终端，以便所述用户终端对所述数字身份信息密文进行解密以获取数字身份信息明文；
第二处理模块，用于响应于验证终端发送的数字身份信息获取请求，将所述目标用户的所述数字身份信息密文以及所述安全层级发送至所述验证终端，以便所述验证终端在判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文匹配时，由所述验证终端对所述用户终端进行与所述安全层级对应的安全验证。
可选地，所述安全层级包括第一安全层级、第二安全层级和第三安全层级；与所述第一安全层级对应的安全验证为空，与所述第二安全层级对应的安全验证包括生物信息验证，与所述第三安全层级对应的安全验证的类型包括生物信息验证和硬件密钥设备验证。
在上述内容的基础上，优选地，生物信息验证包括以下任意一项或者任意组合：指纹验证、人脸验证、虹膜验证、声纹验证。
可选地，数字身份认证装置还包括：
生成模块，用于在用户注册后生成所述注册用户的加密公钥和用户私钥；
发送模块，用于将所述用户私钥发送至所述用户终端，以便由所述用户终端利用所述用户私钥解密生成所述数字身份信息明文；
所述存储模块还用于存储所述加密公钥，以便由所述审批终端利用查询获取的所述加密公钥根据所述注册用户的个人信息加密生成所述数字身份信息密文。
可选地，数字身份信息密文包括第一加密消息和第二加密消息，第一加密消息包括第一密文，第二加密消息包括第二密文；第一密文由审批终端利用生成的随机密钥对由个人信息和生成的随机salt值构成的散列值进行加密而生成；第二密文由审批终端利用加密公钥对随机密钥进行加密而生成。
可选地，第一加密消息还包括由审批终端利用哈希算法对散列值进行加密而生成的第三密文。
可选地，第一加密消息还包括由审批终端利用审批终端密钥对第一密文和第三密文进行签名而生成的第一签名值；第二加密消息还包括由审批终端利用审批终端密钥对第二密文进行签名而生成的第二签名值。
本申请还提供了另一种数字身份认证方法，应用于验证终端，包括：
接收用户终端发送的数字身份验证请求和数字身份信息明文；所述数字身份信息明文由所述用户终端对在区块链平台中查询获取的目标用户的数字身份信息密文解密生成，所述区块链平台中存储有审批终端生成的各注册用户的数字身份信息密文、以及所述区块链平台生成的与所述数字身 份信息密文对应的安全层级；
向所述区块链平台发送数字身份信息获取请求；
接收所述区块链平台发送的所述目标用户的所述数字身份信息密文和所述安全层级；
判断所述数字身份信息密文与所述用户终端提交的所述数字身份信息明文是否匹配；
若是，则对所述用户终端进行与所述安全层级对应的安全验证。
本申请还提供了另一种数字身份认证装置，应用于验证终端，包括：
第一接收模块，用于接收用户终端发送的数字身份验证请求和数字身份信息明文；数字身份信息明文由用户终端对在区块链平台中查询获取的目标用户的数字身份信息密文解密生成，区块链平台中存储有审批终端生成的各注册用户的数字身份信息密文、以及区块链平台生成的与数字身份信息密文对应的安全层级；
请求模块，用于向区块链平台发送数字身份信息获取请求；
第二接收模块，接收区块链平台发送的目标用户的数字身份信息密文和安全层级；
判断模块，用于判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配；
安全验证模块，用于当所述数字身份信息密文与用户终端提交的数字身份信息明文匹配时，对用户终端进行与安全层级对应的安全验证。
可选地，用户终端提交的数字身份信息明文包括：
由用户终端在利用用户私钥对数字身份信息密文中的第二密文解密生成随机密钥后，利用随机密钥对数字身份信息密文中的第一密文解密生成的散列值；
判断模块104包括：
哈希计算单元，用于利用哈希算法对用户终端提交的散列值加密生成第三验证密文；
哈希判断单元，用于判断第三验证密文与数字身份信息密文中的第三密文是否一致；若否，则判定数字身份信息密文与用户终端提交的数字身 份信息明文不匹配；
签名单元，用于当数字身份信息密文与用户终端提交的数字身份信息明文匹配时，利用验证终端公钥对数字身份信息密文中的第一密文和第三密文进行签名以生成第一签名验证值；
签名判断单元，用于判断第一签名验证值与数字身份信息密文中的第一签名值是否一致；若是，则判定数字身份信息密文与用户终端提交的数字身份信息明文匹配；若否，则判定数字身份信息密文与用户终端提交的数字身份信息明文不匹配。
本申请还提供了一种数字身份认证设备，包括存储器和处理器，所述存储器上存储有可在所述处理器上运行的数字身份认证程序，所述数字身份认证程序被所述处理器执行时实现如上所述的任一种数字身份认证方法。
本申请还提供了一种数字身份认证系统，包括区块链平台、与所述区块链平台连接的审批终端和验证终端；其中，所述审批终端用于根据注册用户的个人信息加密生成数字身份信息密文，并发送至所述区块链平台进行存储；所述区块链平台用于生成与所述数字身份信息密文对应的安全层级，并响应于用户终端发送的数字身份获取请求，将目标用户的数字身份信息密文发送至所述用户终端，以便所述用户终端对所述数字身份信息密文进行解密以获取数字身份信息明文；所述验证终端用于响应于所述用户终端发送的数字身份验证请求，在判定从所述区块链平台查询获取的所述数字身份信息密文与所述用户终端提交的所述数字身份信息明文匹配时，对所述用户终端进行与所述安全层级对应的安全验证。
本申请还提供了一种计算机可读存储介质，所述计算机可读存储介质上存储有数字身份认证程序，所述数字身份认证程序可被一个或者多个处理器执行，以实现如上所述的任一种数字身份认证方法。
本申请利用区块链平台预先存储有由审批终端根据注册用户的个人信息加密生成的数字身份信息密文、以及由所述区块链平台生成的与所述数字身份信息密文对应的安全层级，通过响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至所述用户终端，以便 所述用户终端对所述数字身份信息密文进行解密以获取数字身份信息明文；并响应于验证终端发送的数字身份信息获取请求，将所述目标用户的所述数字身份信息密文以及所述安全层级发送至所述验证终端，以便所述验证终端在判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文匹配时，由所述验证终端对所述用户终端进行与所述安全层级对应的安全验证。
可见，本申请所提供的数字身份认证方法，引入了与预设的安全层级对应的额外的安全验证，利用区块链平台存储和管理用户的数字身份信息与安全层级，令验证终端在验证了目标用户的数字身份信息之后继续进行与安全层级对应的额外的安全验证，可满足不同用户、不同应用场景下对多种认证方式的定制化需求，进一步提高了数字身份认证的安全可靠性。
附图说明
为了更清楚地说明现有技术和本申请实施例中的技术方案，下面将对现有技术和本申请实施例描述中需要使用的附图作简要的介绍。当然，下面有关本申请实施例的附图描述的仅仅是本申请中的一部分实施例，对于本领域普通技术人员来说，在不付出创造性劳动的前提下，还可以根据提供的附图获得其他的附图，所获得的其他附图也属于本申请的保护范围。
图1为本发明中数字身份认证方法的应用场景示意图；
图2为本发明一实施例中数字身份认证方法的流程示意图；
图3为图2中审批终端加密生成数字身份信息密文的过程的细化流程示意图；
图4为图2中用户终端解密生成数字身份信息明文的过程的细化流程示意图；
图5为本发明一实施例中验证终端判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配的过程的细化流程示意图；
图6为本发明另一实施例中验证终端判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配的过程的细化流程示意图；
图7为本发明另一实施例中数字身份认证方法的流程示意图；
图8为本发明一实施例揭露的数字身份认证设备的内部结构示意图；
图9为本发明一实施例揭露的数字身份认证装置的内部结构示意图；
图10为本发明另一实施例揭露的数字身份认证装置的内部结构示意图。
本发明目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
具体实施方式
为了使本发明的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本发明进行进一步详细说明。应当理解，此处所描述的具体实施例仅用以解释本发明，并不用于限定本发明。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
需要说明的是，在本发明中涉及“第一”、“第二”等的描述仅用于描述目的，而不能理解为指示或暗示其相对重要性或者隐含指明所指示的技术特征的数量。由此，限定有“第一”、“第二”的特征可以明示或者隐含地包括至少一个该特征。另外，各个实施例之间的技术方案可以相互结合，但是必须是以本领域普通技术人员能够实现为基础，当技术方案的结合出现相互矛盾或无法实现时应当认为这种技术方案的结合不存在，也不在本发明要求的保护范围之内。
参照图1，图1为本发明中数字身份认证方法的应用场景示意图。
如图1所示，审批终端隶属于数字身份的审批方，用于向通过审核的用户签发数字身份；验证终端隶属于验证方，用于对用户进行数字身份认证；区块链平台，作为利用区块链技术进行数据存储管理的数据中心，用于存储审批终端所签发的用户的数字身份信息和对应的安全层级，并向用户终端和验证终端提供查询服务。
不同于现有技术，在本申请所提供的数字身份认证方法中，由区块链平台来存储审批终端为用户签发的数字身份信息，并且为各注册用户的数字身份信息设置了对应的安全层级。本申请所提供的区块链平台作为独立于审批方、验证方、以及用户的数据存储中心，利用区块链技术对用户的数字身份信息进行安全存储、运维和管理，可提供安全、便捷、及时的信息查询服务，充当着数字身份认证过程的中间媒介和沟通桥梁。
其中，区块链是比特币的底层技术架构，在本质上是一种去中心化的分布式账本。区块链技术作为一种持续增长的、按序整理成区块的链式数据结构，通过网络中多个节点共同参与数据的计算和记录，并且互相验证其信息的有效性。将数据放在区块链平台上，可以解放出更多数据，使数据可以真正“流通”起来。
参照图2，图2为本发明一实施例中数字身份认证方法的流程示意图。本发明提供的数字身份认证方法，应用于区块链平台，区块链平台预先存储有由审批终端根据注册用户的个人信息加密生成的数字身份信息密文、以及由区块链平台生成的与数字身份信息密文对应的安全层级，数字身份认证方法包括：
S21：响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至用户终端，以便用户终端对数字身份信息密文进行解密以获取数字身份信息明文。
S22：响应于验证终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文以及安全层级发送至验证终端，以便验证终端在判定数字身份信息密文与用户终端提交的数字身份信息明文匹配时，由验证终端对用户终端进行与安全层级对应的安全验证。
为了提高数字身份认证的安全可靠性、改善现有技术中认证方式单一的缺点，本申请中还具体引入了安全层级的设置，以便在验证了数字身份信息之后继续对用户进行与安全层级对应的额外的安全验证。具体地，用户可先在区块链平台进行注册，并向数字身份的审批方进行数字身份的申请。审批方对用户提交的个人信息(例如姓名、出生年月、户籍、照片等)进行审核，审核通过即同意签发数字身份信息后，审批终端根据用户的个人信息通过加密生成数字身份信息密文，并发送至区块链平台进行存储。区块链平台则为各注册用户的数字身份信息设置对应的安全层级。一般地，安全层级越高表示对数字身份认证的安全要求性越高，对应的安全验证的安全系数也越高。
容易理解的是，区块链平台会在用户注册时生成用户ID，以便依据用户ID对各个注册用户的数字身份信息密文和安全层级分别进行存储和管理。当然，处于加强安全保障目的，可要求用户进行实名注册。
具体地，在设置安全层级时，区块链平台可具体根据用户需求而为不同的注册用户设置不同的安全层级；此外，针对同一个用户，还可以根据具体的数字身份认证的应用场景而设置不同的安全层级。例如，在对出入某办公大厦的人员进行数字身份认证的应用场景中，可以设置较低的安全层级；而当银行作为验证方，需要对银行业务的用户进行数字身份认证时，可设置较高的安全层级，以便确保用户资金安全。此外，至于具体设置哪几个安全层级、每个安全层级分别对应哪些安全验证项目，本领域技术人员也可以根据实际应用情况自行选择并设置，本申请并不进行限定。
在用户使用区块链平台进行数字身份认证阶段，区块链平台在接收到来自用户终端的数字身份信息获取请求(携带有目标用户的用户ID)后，便可将该用户终端所请求的目标用户的数字身份信息密文发送至用户终端，以便用户终端通过解密获取目标用户对应的数字身份信息明文，从而将该数字身份信息明文递交至验证终端，并向验证终端请求进行数字身份认证。
验证终端在接收到用户终端发送的数字身份认证请求后，即可向区块链平台发送针对于目标用户的数字身份信息获取请求，以便同样获取区块 链平台中存储的该目标用户的数字身份信息密文，同时，区块链平台还会将对应的安全层级发送至验证终端。由此，验证终端即可依据区块链平台提供的该数字身份信息密文对用户终端提交的数字身份信息明文进行验证，并且对目标用户进行与安全层级对应的额外的安全验证。只有当数字身份信息与额外的安全验证均通过时，才认定该目标用户的数字身份认证成功。
本申请利用区块链平台预先存储有由审批终端根据注册用户的个人信息加密生成的数字身份信息密文、以及由区块链平台生成的与数字身份信息密文对应的安全层级，通过响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至用户终端，以便用户终端对数字身份信息密文进行解密以获取数字身份信息明文；并响应于验证终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文以及安全层级发送至验证终端，以便验证终端在判定数字身份信息密文与用户终端提交的数字身份信息明文匹配时，由验证终端对用户终端进行与安全层级对应的安全验证。
可见，本申请所提供的数字身份认证方法，引入了与预设的安全层级对应的额外的安全验证，利用区块链平台存储和管理用户的数字身份信息与安全层级，令验证终端在验证了目标用户的数字身份信息之后继续进行与安全层级对应的额外的安全验证，可满足不同用户、不同应用场景下对多种认证方式的定制化需求，进一步提高了数字身份认证的安全可靠性。
本申请所提供的数字身份认证方法，在上述内容的基础上，作为一种优选实施例，安全层级包括第一安全层级、第二安全层级和第三安全层级；与所述第一安全层级对应的安全验证为空，与所述第二安全层级对应的安全验证包括生物信息验证，与所述第三安全层级对应的安全验证的类型包括生物信息验证和硬件密钥设备验证。
其中，生物信息验证针对的是目标用户的生物特性，例如，作为一种优选实施例，所述生物信息验证可包括以下任意一项或者任意组合：
指纹验证、人脸验证、虹膜验证、声纹验证。
需要说明的是，验证终端在对目标用户进行生物信息验证时，具体可调用第三方系统来完成。例如，公安部门的数据系统中可能已经存储了当地居民的指纹信息与人脸信息，则验证终端只需通过相关的指纹采集设备或人脸识别设备来获取目标用户的指纹信息或人脸信息，并发送至公安部门的数据系统进行匹配验证即可。当然，对目标用户的生物信息验证也可以不借助于第三方系统来完成，则用户需要预先直接或者间接地向区块链平台录入自己的生物信息，以便验证终端将采集到的生物信息与区块链平台中存储的生物信息进行比对验证。
此外，硬件密钥设备验证是一种常见于网银交易业务中的安全验证方式。具体地，用户在注册区块链平台时，可由区块链平台为每个注册用户生成并存储对应的密钥，进而可向该注册用户发行存储有该密钥的硬件密钥设备。当验证终端要求用户进行硬件密钥设备验证时，用户即可将该硬件密钥设备插入验证终端供其读取验证。
需要补充的是，如前所述，安全层级越高，对应的安全验证的安全系数越高。因此，可令高安全层级对应的安全验证的项数高于低安全层级对应的安全验证，具体的安全验证方式可在指纹验证、人脸验证、虹膜验证、声纹验证、硬件密钥设备验证等方式中进行选择，本申请并不进行限定。
具体地，在本实施例中，区域连平台共设置有三类安全层级：第一安全层级对应的安全验证为空，即除了数字身份信息验证以外不进行任何额外的安全验证；第二安全层级对应的安全验证为生物信息验证，例如具体可以为指纹验证加人脸验证；第三安全层级对应的安全验证则包括生物信息验证和硬件密钥设备验证，例如具体可以为指纹验证加人脸验证加硬件密钥设备验证。
本申请所提供的数字身份认证方法，在上述内容的基础上，作为一种优选实施例，区块链平台在用户注册后生成并存储有注册用户的加密公钥和用户私钥，以便由审批终端利用查询获取的加密公钥根据注册用户的个人信息加密生成数字身份信息密文，并由用户终端利用区块链平台发送的用户私钥解密生成数字身份信息明文。
在本实施例中，用户的数字身份信息密文具体是通过密钥进行加密的。 在用户注册区块链平台时，区块链平台可针对各个注册用户分别生成一对密钥，包括加密公钥和用户私钥。其中，用户私钥发送至用户终端，由用户进行管理；加密公钥可存储在公钥智能合约中，以便审批终端在审核通过了用户的数字身份申请后，通过查询公钥智能合约获取该加密公钥，并利用该加密公钥进行加密以生成该用户的数字身份信息密文。容易理解的是，各注册用户的加密公钥和用户私钥均是成对的匹配密钥，利用用户私钥对由加密公钥加密生成的数字身份信息密文进行解密。其中，所说的用户私钥即可作为前文所述的硬件密钥设备中存储的密钥。
在上述内容的基础上，本申请所提供的数字身份认证方法，作为一种优选实施例，数字身份信息密文包括第一加密消息和第二加密消息，第一加密消息包括第一密文，第二加密消息包括第二密文；
参照图3，图3为审批终端利用查询获取的加密公钥对注册用户的个人信息加密生成数字身份信息密文的过程的细化流程示意图：
S31：向区块链平台查询获取加密公钥pk。
S32：生成随机密钥s和随机salt值。
S33：利用随机密钥s对由个人信息plaintext和随机salt值构成的散列值plaintext||salt进行加密以生成第一密文Es(plaintext||salt)。
S34：利用加密公钥pk对随机密钥s进行加密以生成第二密文Epk(s)。
在本实施例中，审批终端可具体利用从区块链平台获取的加密公钥pk以及随机生成的随机密钥s生成两个密文，以便实现双重加密。具体地，可将用户的个人信息plaintext和随机salt值构成的散列值plaintext||salt利用随机密钥s加密生成第一密文Es(plaintext||salt)，而为了保护随机密钥s，可利用加密公钥pk将随机密钥s加密生成第二密文Epk(s)，然后将包括了第一密文Es(plaintext||salt)的第一加密消息与包括了第二密文Epk(s)的第二加密消息发送至区块链平台进行存储，从而进一步提高数字身份认证的安全可靠性，保障用户的个人认证信息不被窃取外泄。
在上述内容的基础上，优选地，第一加密消息还包括由审批终端利用哈希算法对散列值plaintext||salt进行加密而生成的第三密文H(plaintext||salt)。在本实施例中，为了提高加密数据的复杂度以提高安全 性，审批终端还可利用哈希算法加密生成第三密文H(plaintext||salt)。
在上述内容的基础上，优选地，第一加密消息还包括由审批终端利用审批终端密钥对第一密文Es(plaintext||salt)和第三密文H(plaintext||salt)进行签名而生成的第一签名值Signature1；第二加密消息还包括由审批终端利用审批终端密钥对第二密文Epk(s)进行签名而生成的第二签名值Signature2。
在本实施例中，审批终端还可以利用签名的方法对目标用户的数字身份信息进行加密，以进一步提高数据的安全性和保密性。由此，用Msg1表示第一加密消息，用Msg2表示第二加密消息，则：
Msg1＝Es(plaintext||salt)+H(plaintext||salt)+Signature1；
Msg2＝Epk(s)+Signature2。
在采用上述Msg1和Msg2作为数字身份信息密文的基础上，参照图4，图4为用户终端利用区块链平台发送的用户私钥解密生成数字身份信息明文的过程的细化流程示意图：
S41：利用用户私钥对数字身份信息密文中的第二密文Epk(s)解密生成随机密钥s。
S42：利用随机密钥s对数字身份信息密文中的第一密文Es(plaintext||salt)解密生成散列值plaintext||salt。
容易理解的是，解密即为加密的逆过程，用户终端可利用用户私钥先解密出随机密钥s，再利用随机密钥s解密出由目标用户的个人信息与随机salt值构成的散列值plaintext||salt，即所说的数字身份信息明文。
参照图5，图5为本发明一实施例中验证终端判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配的过程的细化流程示意图：
S51：利用哈希算法对用户终端提交的散列值加密生成第三验证密文。
S52：判断第三验证密文与数字身份信息密文中的第三密文是否一致；若否，则进入S53。
S53：判定数字身份信息密文与用户终端提交的数字身份信息明文不匹配。
具体地，验证终端在比对区块链平台中存储的目标用户的数字身份信 息密文与用户终端提交的数字身份信息明文(即散列值plaintext||salt)时，首先可同样利用哈希算法对散列值plaintext||salt加密以生成第三验证密文，若第三验证密文与数字身份信息密文中的第三密文不一致，则可判定数字身份认证失败。
参照图6，图6为本发明另一实施例中验证终端判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配的过程的细化流程示意图：
S61：利用哈希算法对用户终端提交的散列值加密生成第三验证密文。
S62：判断第三验证密文与数字身份信息密文中的第三密文是否一致；若否，则进入S63；若是，则进入S64。
S63：判定数字身份信息密文与用户终端提交的数字身份信息明文不匹配。
S64：利用验证终端公钥对数字身份信息密文中的第一密文和第三密文进行签名以生成第一签名验证值；进入S65。
S65：判断第一签名验证值与数字身份信息密文中的第一签名值是否一致；若是，则进入S66；若否，则进入S63。
S66：判定数字身份信息密文与用户终端提交的数字身份信息明文匹配。
在本实施例中，验证终端对用户终端提交的数字身份信息明文可进行两方面的匹配验证，即在图5中进行的哈希验证的基础上，再进行签名验证，以便进一步保障数据身份信息认证的可靠性。当通过哈希算法计算的第三验证密文与第三密文一致、且签名验证也通过时，可判定用户终端提交的数字身份信息明文与区块链平台中的数字身份信息密文相匹配，即认定该用户的数字身份认证成功。
相对应地，本申请还提供了一种应用于验证终端的数字身份认证方法，参照图7，包括：
S71：接收用户终端发送的数字身份验证请求和数字身份信息明文；所述数字身份信息明文由所述用户终端对在区块链平台中查询获取的目标用 户的数字身份信息密文解密生成，所述区块链平台中存储有审批终端生成的各注册用户的数字身份信息密文、以及所述区块链平台生成的与所述数字身份信息密文对应的安全层级。
S72：向区块链平台发送数字身份信息获取请求。
S73：接收区块链平台发送的目标用户的数字身份信息密文和安全层级。
S74：判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配；若是，则进入S75。
S75：对用户终端进行与安全层级对应的安全验证。
具体内容可参考前文所述的应用于区块链平台的数字身份认证方法，类似内容这里就不再赘述。
进一步地，参照图8，本申请还提供了一种数字身份认证设备8，该数字身份认证设备8可以包括存储器81、处理器82和总线83，存储器81上存储有可在处理器82上运行的数字身份认证程序，所述数字身份认证程序被处理器82执行时实现如上所述的任一种数字身份认证方法。
在本实施例中，数字身份认证设备8可以是PC(Personal Computer，个人电脑)，也可以是智能手机、平板电脑、掌上电脑、便携计算机、网络存储终端设备。数字身份认证设备8可以是组成CDN网络或者区块链网络的节点。
其中，存储器81至少包括一种类型的可读存储介质，所述可读存储介质包括闪存、硬盘、多媒体卡、卡型存储器(例如，SD或DX存储器等)、磁性存储器、磁盘、光盘等。存储器81在一些实施例中可以是数字身份认证设备8的内部存储单元，例如该数字身份认证设备8的硬盘。存储器81在另一些实施例中也可以是数字身份认证设备8的外部存储设备，例如数字身份认证设备8上配备的插接式硬盘，智能存储卡(Smart Media Card,SMC)，安全数字(Secure Digital,SD)卡，闪存卡(Flash Card)等。进一步地，存储器81还可以既包括数字身份认证设备8的内部存储单元也包括外部存储设备。存储器81不仅可以用于存储安装于数字身份认证设备8 的应用软件及各类数据，例如数字身份认证程序的代码等，还可以用于暂时地存储已经输出或者将要输出的数据。
处理器82在一些实施例中可以是一中央处理器(Central Processing Unit,CPU)、控制器、微控制器、微处理器或其他数据处理芯片，用于运行存储器81中存储的程序代码或处理数据，例如执行数字身份认证程序等。
该总线83可以是外设部件互连标准(peripheral component interconnect，简称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。该总线可以分为地址总线、数据总线、控制总线等。为便于表示，图8中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
进一步地，数字身份认证设备8还可以包括网络接口14，网络接口14可选的可以包括有线接口和/或无线接口(如WI-FI接口、蓝牙接口等)，通常用于在数字身份认证设备8与其他电子设备之间建立通信连接。
可选地，该数字身份认证设备8还可以包括用户接口，用户接口可以包括显示器(Display)、输入单元比如键盘(Keyboard)，可选的用户接口还可以包括标准的有线接口、无线接口。可选地，在一些实施例中，显示器可以是LED显示器、液晶显示器、触控式液晶显示器以及OLED(Organic Light-Emitting Diode，有机发光二极管)触摸器等。其中，显示器也可以适当的称为显示屏或显示单元，用于显示在数字身份认证设备8中处理的信息以及用于显示可视化的用户界面。
图8仅示出了具有组件81-83以及数字身份认证程序的数字身份认证设备8，本领域技术人员可以理解的是，图8示出的结构并不构成对数字身份认证设备8的限定，可以包括比图示更少或者更多的部件，或者组合某些部件，或者不同的部件布置。
进一步地，本申请还提供了一种数字身份认证装置，应用于区块链平台，参照图9，图9为本申请一实施例揭露的数字身份认证装置的内部结构示意图包括：
存储模块91，用于预先存储由审批终端根据注册用户的个人信息加密生成的数字身份信息密文、以及由区块链平台生成的与数字身份信息密文对应的安全层级；
第一处理模块92，用于响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至用户终端，以便用户终端对所述数字身份信息密文进行解密以获取数字身份信息明文；
第二处理模块93，用于响应于验证终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文以及安全层级发送至验证终端，以便验证终端在判定数字身份信息密文与用户终端提交的数字身份信息明文匹配时，由验证终端对用户终端进行与安全层级对应的安全验证。
可见，本申请引入了与预设的安全层级对应的额外的安全验证，利用区块链平台存储和管理用户的数字身份信息与安全层级，令验证终端在验证了目标用户的数字身份信息之后继续进行与安全层级对应的额外的安全验证，可满足不同用户、不同应用场景下对多种认证方式的定制化需求，进一步提高了数字身份认证的安全可靠性。
在上述内容的基础上，优选地，安全层级包括第一安全层级、第二安全层级和第三安全层级；与第一安全层级对应的安全验证为空，与第二安全层级对应的安全验证包括生物信息验证，与第三安全层级对应的安全验证包括生物信息验证和硬件密钥设备验证。
在上述内容的基础上，优选地，生物信息验证包括以下任意一项或者任意组合：指纹验证、人脸验证、虹膜验证、声纹验证。
在上述内容的基础上，优选地，数字身份认证装置还包括：
生成模块，用于在用户注册后生成所述注册用户的加密公钥和用户私钥；
发送模块，用于将所述用户私钥发送至所述用户终端，以便由所述用户终端利用所述用户私钥解密生成所述数字身份信息明文；
所述存储模块还用于存储所述加密公钥，以便由所述审批终端利用查询获取的所述加密公钥根据所述注册用户的个人信息加密生成所述数字身份信息密文。
在上述内容的基础上，优选地，数字身份信息密文包括第一加密消息和第二加密消息，第一加密消息包括第一密文，第二加密消息包括第二密文；第一密文由审批终端利用生成的随机密钥对由个人信息和生成的随机salt值构成的散列值进行加密而生成；第二密文由审批终端利用加密公钥对随机密钥进行加密而生成。
在上述内容的基础上，优选地，第一加密消息还包括由审批终端利用哈希算法对散列值进行加密而生成的第三密文。
在上述内容的基础上，优选地，第一加密消息还包括由审批终端利用审批终端密钥对第一密文和第三密文进行签名而生成的第一签名值；第二加密消息还包括由审批终端利用审批终端密钥对第二密文进行签名而生成的第二签名值。
进一步地，本申请还提供了另一种数字身份认证装置，应用于区块链平台，参照图10，图10为本申请另一实施例揭露的数字身份认证装置的内部结构示意图，包括：
第一接收模块101，用于接收用户终端发送的数字身份验证请求和数字身份信息明文；数字身份信息明文由用户终端对在区块链平台中查询获取的目标用户的数字身份信息密文解密生成，区块链平台中存储有审批终端生成的各注册用户的数字身份信息密文、以及区块链平台生成的与数字身份信息密文对应的安全层级；
请求模块102，用于向区块链平台发送数字身份信息获取请求；
第二接收模块103，接收区块链平台发送的目标用户的数字身份信息密文和安全层级；
判断模块104，用于判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配；
安全验证模块105，用于当所述数字身份信息密文与用户终端提交的数字身份信息明文匹配时，对用户终端进行与安全层级对应的安全验证。
在上述内容的基础上，优选地，用户终端提交的数字身份信息明文包括：
由用户终端在利用用户私钥对数字身份信息密文中的第二密文解密生成随机密钥后，利用随机密钥对数字身份信息密文中的第一密文解密生成的散列值；
判断模块104包括：
哈希计算单元，用于利用哈希算法对用户终端提交的散列值加密生成第三验证密文；
哈希判断单元，用于判断第三验证密文与数字身份信息密文中的第三密文是否一致；若否，则判定数字身份信息密文与用户终端提交的数字身份信息明文不匹配；
签名单元，用于当数字身份信息密文与用户终端提交的数字身份信息明文匹配时，利用验证终端公钥对数字身份信息密文中的第一密文和第三密文进行签名以生成第一签名验证值；
签名判断单元，用于判断第一签名验证值与数字身份信息密文中的第一签名值是否一致；若是，则判定数字身份信息密文与用户终端提交的数字身份信息明文匹配；若否，则判定数字身份信息密文与用户终端提交的数字身份信息明文不匹配。
进一步地，本申请还提供了一种数字身份认证系统，包括区块链平台、与区块链平台连接的审批终端和验证终端；其中，审批终端用于根据注册用户的个人信息加密生成数字身份信息密文，并发送至区块链平台进行存储；区块链平台用于生成与数字身份信息密文对应的安全层级，并响应于用户终端发送的数字身份获取请求，将目标用户的数字身份信息密文发送至用户终端，以便用户终端对数字身份信息密文进行解密以获取数字身份信息明文；验证终端用于响应于用户终端发送的数字身份验证请求，在判定从区块链平台查询获取的数字身份信息密文与用户终端提交的数字身份信息明文匹配时，对用户终端进行与安全层级对应的安全验证。
进一步地，本申请还提供了一种计算机可读存储介质，所述计算机可读存储介质上存储有数字身份认证程序，所述数字身份认证程序可被一个或者多个处理器执行，以实现如上所述的任一种数字身份认证方法。
进一步地，本申请还提供了一种计算机程序产品，包括计算机指令， 当其在计算机上运行时，使得计算机可以执行上述任一种数字身份认证方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的数字身份认证设备、系统和计算机可读存储介质的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，设备和方法，可以通过其它的方式实现。例如，以上所描述的系统实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的， 作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
需要说明的是，上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。并且本文中的术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、装置、物品或者方法不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、装置、物品或者方法所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、装置、物品或者方法中还存在另外的相同要素。
以上仅为本发明的优选实施例，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。

Claims (13)

  1. 一种数字身份认证方法，其特征在于，应用于区块链平台，所述区块链平台预先存储有由审批终端根据注册用户的个人信息加密生成的数字身份信息密文、以及由所述区块链平台生成的与所述数字身份信息密文对应的安全层级，所述数字身份认证方法包括：
    响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至所述用户终端，以便所述用户终端对所述数字身份信息密文进行解密以获取数字身份信息明文；
    响应于验证终端发送的数字身份信息获取请求，将所述目标用户的所述数字身份信息密文以及所述安全层级发送至所述验证终端，以便所述验证终端在判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文匹配时，由所述验证终端对所述用户终端进行与所述安全层级对应的安全验证。
  2. 根据权利要求1所述的数字身份认证方法，其特征在于，所述安全层级包括第一安全层级、第二安全层级和第三安全层级；与所述第一安全层级对应的安全验证为空，与所述第二安全层级对应的安全验证包括生物信息验证，与所述第三安全层级对应的安全验证包括生物信息验证和硬件密钥设备验证。
  3. 根据权利要求2所述的数字身份认证方法，其特征在于，所述生物信息验证包括以下任意一项或者任意组合：
    指纹验证、人脸验证、虹膜验证、声纹验证。
  4. 根据权利要求1至3任一项所述的数字身份认证方法，其特征在于，所述区块链平台在用户注册后生成注册用户的加密公钥和用户私钥，以便由所述审批终端利用查询获取的所述加密公钥根据所述注册用户的个人信息加密生成所述数字身份信息密文，并由所述用户终端利用所述区块链平台发送的所述用户私钥解密生成所述数字身份信息明文。
  5. 根据权利要求4所述的数字身份认证方法，其特征在于，所述数字身份信息密文包括第一加密消息和第二加密消息，所述第一加密消息包括第一密文，所述第二加密消息包括第二密文；
    所述审批终端利用查询获取的所述加密公钥根据所述注册用户的个人信息加密生成所述数字身份信息密文包括：
    向所述区块链平台查询获取所述加密公钥；
    生成随机密钥和随机salt值；
    利用所述随机密钥对由所述个人信息和所述随机salt值构成的散列值进行加密以生成所述第一密文；
    利用所述加密公钥对所述随机密钥进行加密以生成所述第二密文。
  6. 根据权利要求5所述的数字身份认证方法，其特征在于，所述第一加密消息还包括由所述审批终端利用哈希算法对所述散列值进行加密而生成的第三密文。
  7. 根据权利要求6所述的数字身份认证方法，其特征在于，所述第一加密消息还包括由所述审批终端利用审批终端密钥对所述第一密文和所述第三密文进行签名而生成的第一签名值；
    所述第二加密消息还包括由所述审批终端利用所述审批终端密钥对所述第二密文进行签名而生成的第二签名值。
  8. 根据权利要求7所述的数字身份认证方法，其特征在于，所述用户终端利用所述区块链平台发送的所述用户私钥解密生成所述数字身份信息明文包括：
    所述用户终端利用所述用户私钥对所述数字身份信息密文中的所述第二密文解密生成所述随机密钥；利用所述随机密钥对所述数字身份信息密文中的所述第一密文解密生成所述散列值；
    所述验证终端判断所述数字身份信息密文与所述用户终端提交的数字身份信息明文是否匹配包括：
    所述验证终端利用哈希算法对所述用户终端提交的所述散列值加密生成第三验证密文；判断所述第三验证密文与所述数字身份信息密文中的所述第三密文是否一致；若是，则利用验证终端公钥对所述数字身份信息密文中的所述第一密文和所述第三密文进行签名以生成第一签名验证值，判断所述第一签名验证值与所述数字身份信息密文中的所述第一签名值是否一致；若是，则判定所述数字身份信息密文与所述用户终端提交的数字身 份信息明文匹配；若否，则判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文不匹配。
  9. 一种数字身份认证方法，其特征在于，应用于验证终端，包括：
    接收用户终端发送的数字身份验证请求和数字身份信息明文；所述数字身份信息明文由所述用户终端对在区块链平台中查询获取的目标用户的数字身份信息密文解密生成，所述区块链平台中存储有审批终端生成的各注册用户的数字身份信息密文、以及所述区块链平台生成的与所述数字身份信息密文对应的安全层级；
    向所述区块链平台发送数字身份信息获取请求；
    接收所述区块链平台发送的所述目标用户的所述数字身份信息密文和所述安全层级；
    判断所述数字身份信息密文与所述用户终端提交的所述数字身份信息明文是否匹配；
    若是，则对所述用户终端进行与所述安全层级对应的安全验证。
  10. 一种数字身份认证设备，其特征在于，包括存储器和处理器，所述存储器上存储有可在所述处理器上运行的数字身份认证程序，所述数字身份认证程序被所述处理器执行时实现如权利要求1至8任一项所述的数字身份认证方法。
  11. 一种数字身份认证装置，其特征在于，应用于区块链平台，包括：
    存储模块，用于预先存储由审批终端根据注册用户的个人信息加密生成的数字身份信息密文、以及由所述区块链平台生成的与所述数字身份信息密文对应的安全层级；
    第一处理模块，用于响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至所述用户终端，以便所述用户终端对所述数字身份信息密文进行解密以获取数字身份信息明文；
    第二处理模块，用于响应于验证终端发送的数字身份信息获取请求，将所述目标用户的所述数字身份信息密文以及所述安全层级发送至所述验证终端，以便所述验证终端在判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文匹配时，由所述验证终端对所述用户终端进行与 所述安全层级对应的安全验证。
  12. 一种数字身份认证系统，其特征在于，包括区块链平台、与所述区块链平台连接的审批终端和验证终端；其中，所述审批终端用于根据注册用户的个人信息加密生成数字身份信息密文，并发送至所述区块链平台进行存储；所述区块链平台用于生成与所述数字身份信息密文对应的安全层级，并响应于用户终端发送的数字身份获取请求，将目标用户的数字身份信息密文发送至所述用户终端，以便所述用户终端对所述数字身份信息密文进行解密以获取数字身份信息明文；所述验证终端用于响应于所述用户终端发送的数字身份验证请求，在判定从所述区块链平台查询获取的所述数字身份信息密文与所述用户终端提交的所述数字身份信息明文匹配时，对所述用户终端进行与所述安全层级对应的安全验证。
  13. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有数字身份认证程序，所述数字身份认证程序可被一个或者多个处理器执行，以实现如权利要求1至8任一项所述的数字身份认证方法。
PCT/CN2019/091806 2019-03-27 2019-06-19 一种数字身份认证方法、设备、装置、系统及存储介质 WO2020191928A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910238454.5 2019-03-27
CN201910238454.5A CN109951489B (zh) 2019-03-27 2019-03-27 一种数字身份认证方法、设备、装置、系统及存储介质

Publications (1)

Publication Number Publication Date
WO2020191928A1 true WO2020191928A1 (zh) 2020-10-01

Family

ID=67011930

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/091806 WO2020191928A1 (zh) 2019-03-27 2019-06-19 一种数字身份认证方法、设备、装置、系统及存储介质

Country Status (2)

Country Link
CN (1) CN109951489B (zh)
WO (1) WO2020191928A1 (zh)

Cited By (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112307448A (zh) * 2020-11-06 2021-02-02 上海八彦图信息科技有限公司 多重系统用户身份的设置方法及装置
CN112580099A (zh) * 2020-12-28 2021-03-30 福建中科星泰数据科技有限公司 基于联盟区块链网络的非对称加密系统及方法
CN113779534A (zh) * 2021-09-02 2021-12-10 广州大白互联网科技有限公司 一种基于数字身份的个人信息提供方法和业务平台
CN114499943A (zh) * 2021-12-22 2022-05-13 航天信息股份有限公司 一种基于微模块对身份信息进行认证的方法及系统
CN114499871A (zh) * 2021-12-23 2022-05-13 成都卫士通信息产业股份有限公司 一种签名加密方法、装置、系统及计算机可读存储介质
CN114745137A (zh) * 2022-05-10 2022-07-12 山东鲁软数字科技有限公司 一种实现安全通信方法及区块链物联代理装置
CN114782022A (zh) * 2022-05-11 2022-07-22 保利长大工程有限公司 基于身份认证的施工数字化监测方法、设备及存储介质
CN114928447A (zh) * 2022-02-10 2022-08-19 北京轻信科技有限公司 基于分布式身份的数据管理方法和系统
CN115118439A (zh) * 2022-08-29 2022-09-27 北京智芯微电子科技有限公司 终端数字身份的校验方法及系统
CN115118438A (zh) * 2022-08-29 2022-09-27 北京智芯微电子科技有限公司 基于区块链的终端数字身份管理方法及系统
CN115242545A (zh) * 2022-08-06 2022-10-25 山西工程科技职业大学 一种物联网设备数据的安全管理方法及系统
CN115577019A (zh) * 2022-12-07 2023-01-06 杭州恒生数字设备科技有限公司 口语测试方法、装置、设备及存储介质
CN115801222A (zh) * 2023-01-13 2023-03-14 佰聆数据股份有限公司 基于同态加密通信数据的电力用户真实性校验系统及方法
CN117014223A (zh) * 2023-09-06 2023-11-07 深圳龙电华鑫控股集团股份有限公司 集中器及其数据传输方法、装置及存储介质

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110990827A (zh) * 2019-10-28 2020-04-10 上海隔镜信息科技有限公司 一种身份信息验证方法、服务器及存储介质
CN110781509B (zh) * 2019-10-28 2021-07-06 腾讯科技（深圳）有限公司 数据验证方法、装置、存储介质和计算机设备
CN113271284B (zh) * 2020-02-14 2022-06-03 中移(苏州)软件技术有限公司 一种身份认证方法、服务器、终端及存储介质
CN111556007B (zh) * 2020-03-03 2021-09-24 支付宝实验室(新加坡)有限公司 基于区块链的身份校验方法、装置、设备及存储介质
CN111552935B (zh) * 2020-04-22 2023-09-29 中国银联股份有限公司 一种区块链数据授权访问方法及装置
CN111552940A (zh) * 2020-05-14 2020-08-18 华北理工大学 一种基于安全模块的数据传输系统及方法
CN112069481A (zh) * 2020-08-06 2020-12-11 广东工业大学 一种用于工业装备产品的交易管理方法和系统
CN114258006B (zh) * 2020-09-23 2023-07-18 华为技术有限公司 获取凭据的方法、装置及系统
CN112507301B (zh) * 2020-12-05 2021-10-08 广州技象科技有限公司 一种物联网设备控制方法、装置、设备及存储介质
CN113726519A (zh) * 2021-08-16 2021-11-30 山东伏羲智库互联网研究院 数字身份管理方法、装置、电子设备及存储介质
CN115760148A (zh) * 2021-09-29 2023-03-07 支付宝(杭州)信息技术有限公司 地理标志产品的数字身份生成方法和装置
CN117571305B (zh) * 2024-01-17 2024-04-16 长沙润伟机电科技有限责任公司 一种驱动跑合试验台控制系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106357640A (zh) * 2016-09-18 2017-01-25 江苏通付盾科技有限公司 基于区块链网络的身份认证方法、系统及服务器
CN107257340A (zh) * 2017-06-19 2017-10-17 阿里巴巴集团控股有限公司 一种认证方法、基于区块链的认证数据处理方法及设备
US20180144310A1 (en) * 2015-07-22 2018-05-24 Tendyron Corporation Data processing method and device, and pos transaction system
CN108769057A (zh) * 2018-06-15 2018-11-06 北京奇虎科技有限公司 基于区块链的身份识别方法及装置

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8971540B2 (en) * 2013-05-30 2015-03-03 CertiVox Ltd. Authentication
WO2018112948A1 (zh) * 2016-12-23 2018-06-28 深圳前海达闼云端智能科技有限公司 区块生成方法、装置和区块链网络
CN106972927B (zh) * 2017-03-31 2020-03-20 威海合联信息科技有限公司 一种针对不同安全等级的加密方法及系统
CN107579817A (zh) * 2017-09-12 2018-01-12 广州广电运通金融电子股份有限公司 基于区块链的用户身份验证方法、装置及系统
CN107888384B (zh) * 2017-11-30 2020-11-27 中链科技有限公司 一种身份数据管理方法、系统和计算机可读存储介质
CN108234515B (zh) * 2018-01-25 2020-07-24 中国科学院合肥物质科学研究院 一种基于智能合约的自认证数字身份管理系统及其方法
CN108805573B (zh) * 2018-04-21 2022-04-15 深圳市元征科技股份有限公司 一种信息验证方法、服务器及存储介质
CN108597082A (zh) * 2018-04-27 2018-09-28 深圳市零度智控科技有限公司 基于银行门禁的身份验证方法及系统、存储介质
CN109102358A (zh) * 2018-06-27 2018-12-28 深圳市元征科技股份有限公司 一种信息验证方法、服务器及存储介质
CN109039655A (zh) * 2018-09-13 2018-12-18 全链通有限公司 基于区块链的实名身份认证方法及装置、身份区块链

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180144310A1 (en) * 2015-07-22 2018-05-24 Tendyron Corporation Data processing method and device, and pos transaction system
CN106357640A (zh) * 2016-09-18 2017-01-25 江苏通付盾科技有限公司 基于区块链网络的身份认证方法、系统及服务器
CN107257340A (zh) * 2017-06-19 2017-10-17 阿里巴巴集团控股有限公司 一种认证方法、基于区块链的认证数据处理方法及设备
CN108769057A (zh) * 2018-06-15 2018-11-06 北京奇虎科技有限公司 基于区块链的身份识别方法及装置

Cited By (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112307448B (zh) * 2020-11-06 2024-03-29 上海八彦图信息科技有限公司 多重系统用户身份的设置方法及装置
CN112307448A (zh) * 2020-11-06 2021-02-02 上海八彦图信息科技有限公司 多重系统用户身份的设置方法及装置
CN112580099A (zh) * 2020-12-28 2021-03-30 福建中科星泰数据科技有限公司 基于联盟区块链网络的非对称加密系统及方法
CN112580099B (zh) * 2020-12-28 2024-01-30 福建中科星泰数据科技有限公司 基于联盟区块链网络的非对称加密系统及方法
CN113779534A (zh) * 2021-09-02 2021-12-10 广州大白互联网科技有限公司 一种基于数字身份的个人信息提供方法和业务平台
CN113779534B (zh) * 2021-09-02 2024-02-23 广州大白互联网科技有限公司 一种基于数字身份的个人信息提供方法和业务平台
CN114499943A (zh) * 2021-12-22 2022-05-13 航天信息股份有限公司 一种基于微模块对身份信息进行认证的方法及系统
CN114499871A (zh) * 2021-12-23 2022-05-13 成都卫士通信息产业股份有限公司 一种签名加密方法、装置、系统及计算机可读存储介质
CN114499871B (zh) * 2021-12-23 2024-01-09 成都卫士通信息产业股份有限公司 一种签名加密方法、装置、系统及计算机可读存储介质
CN114928447A (zh) * 2022-02-10 2022-08-19 北京轻信科技有限公司 基于分布式身份的数据管理方法和系统
CN114928447B (zh) * 2022-02-10 2024-04-30 北京轻信科技有限公司 基于分布式身份的数据管理方法和系统
CN114745137A (zh) * 2022-05-10 2022-07-12 山东鲁软数字科技有限公司 一种实现安全通信方法及区块链物联代理装置
CN114782022A (zh) * 2022-05-11 2022-07-22 保利长大工程有限公司 基于身份认证的施工数字化监测方法、设备及存储介质
CN115242545A (zh) * 2022-08-06 2022-10-25 山西工程科技职业大学 一种物联网设备数据的安全管理方法及系统
CN115242545B (zh) * 2022-08-06 2023-12-08 山西工程科技职业大学 一种物联网设备数据的安全管理方法及系统
CN115118438B (zh) * 2022-08-29 2023-01-20 北京智芯微电子科技有限公司 基于区块链的终端数字身份管理方法及系统
CN115118438A (zh) * 2022-08-29 2022-09-27 北京智芯微电子科技有限公司 基于区块链的终端数字身份管理方法及系统
CN115118439A (zh) * 2022-08-29 2022-09-27 北京智芯微电子科技有限公司 终端数字身份的校验方法及系统
CN115577019A (zh) * 2022-12-07 2023-01-06 杭州恒生数字设备科技有限公司 口语测试方法、装置、设备及存储介质
CN115801222B (zh) * 2023-01-13 2023-05-23 佰聆数据股份有限公司 基于同态加密通信数据的电力用户真实性校验系统及方法
CN115801222A (zh) * 2023-01-13 2023-03-14 佰聆数据股份有限公司 基于同态加密通信数据的电力用户真实性校验系统及方法
CN117014223A (zh) * 2023-09-06 2023-11-07 深圳龙电华鑫控股集团股份有限公司 集中器及其数据传输方法、装置及存储介质
CN117014223B (zh) * 2023-09-06 2024-02-27 深圳龙电华鑫控股集团股份有限公司 集中器及其数据传输方法、装置及存储介质

Also Published As

Publication number Publication date
CN109951489A (zh) 2019-06-28
CN109951489B (zh) 2020-11-03

Similar Documents

Publication Publication Date Title
WO2020191928A1 (zh) 一种数字身份认证方法、设备、装置、系统及存储介质
WO2020192773A1 (zh) 一种数字身份认证方法、设备、装置、系统及存储介质
US10880089B2 (en) Methods and systems for universal storage and access to user-owned credentials for trans-institutional digital authentication
CN111046352B (zh) 一种基于区块链的身份信息安全授权系统与方法
US9887989B2 (en) Protecting passwords and biometrics against back-end security breaches
KR102493744B1 (ko) 생체 특징에 기초한 보안 검증 방법, 클라이언트 단말, 및 서버
WO2020073513A1 (zh) 基于区块链的用户认证方法及终端设备
WO2020062668A1 (zh) 一种身份认证方法、身份认证装置及计算机可读介质
CN111680324B (zh) 用于区块链的凭证验证方法、管理方法以及签发方法
US11405207B2 (en) Dynamic implementation and management of hash-based consent and permissioning protocols
WO2018182890A1 (en) Method and system for protecting data keys in trusted computing
WO2021139140A1 (zh) 基于区块链的密码管理方法、装置、电子设备及计算机可读存储介质
WO2018111302A1 (en) System and method for securely processing an electronic identity
JP2023502346A (ja) 量子安全ネットワーキング
EP3477891A1 (en) Methods for recording and sharing a digital identity of a user using distributed ledgers
CN108989346A (zh) 基于账号隐匿的第三方有效身份托管敏捷认证访问模式
WO2016155281A1 (zh) 一种管理应用标识的方法及装置
WO2015188424A1 (zh) 一种密钥存储设备及其使用方法
MX2015002929A (es) Metodo y sistema para verificar una peticion de acceso.
CN110770774A (zh) 数据存储中的验证和加密方案
US11436597B1 (en) Biometrics-based e-signatures for pre-authorization and acceptance transfer
CN113347008B (zh) 一种加法同态加密的贷款信息存储方法
US20150310441A1 (en) Transaction system method, electronic signature tool, and network bank server authentication
US20220300962A1 (en) Authenticator App for Consent Architecture
CN113434882A (zh) 应用程序的通讯保护方法、装置、计算机设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19921005

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19921005

Country of ref document: EP

Kind code of ref document: A1