WO2020192773A1 - 一种数字身份认证方法、设备、装置、系统及存储介质 - Google Patents

一种数字身份认证方法、设备、装置、系统及存储介质 Download PDF

Info

Publication number
WO2020192773A1
WO2020192773A1 PCT/CN2020/081807 CN2020081807W WO2020192773A1 WO 2020192773 A1 WO2020192773 A1 WO 2020192773A1 CN 2020081807 W CN2020081807 W CN 2020081807W WO 2020192773 A1 WO2020192773 A1 WO 2020192773A1
Authority
WO
WIPO (PCT)
Prior art keywords
digital identity
ciphertext
identity information
user
terminal
Prior art date
Application number
PCT/CN2020/081807
Other languages
English (en)
French (fr)
Inventor
张骁
Original Assignee
深圳市网心科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市网心科技有限公司 filed Critical 深圳市网心科技有限公司
Publication of WO2020192773A1 publication Critical patent/WO2020192773A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present invention relates to the field of blockchain technology, in particular to a digital identity authentication method, equipment, device, system and computer readable storage medium.
  • Digital identity verification has become a common scenario in the modern information society.
  • the department that can issue digital identities that is, the approving party
  • the approver and the verifier usually belong to different organizational units and lack direct information communication channels
  • the verification work of the verifier is bound to be limited by the approver’s service opening hours, often due to time differences, geographic differences and other factors. Reduce the processing efficiency of the verifier.
  • providing a method for solving the above-mentioned technical problems has become the focus of attention of those skilled in the art.
  • the main purpose of the present invention is to provide a digital identity authentication method, equipment, device, system, and computer readable storage medium, aiming to solve the technical problem of low efficiency of digital identity authentication processing in the prior art.
  • the digital identity authentication method provided by the present invention is applied to a blockchain platform.
  • the blockchain platform pre-stores the ciphertext of the digital identity information of the registered user.
  • the ciphertext of the digital identity information is determined by the approval terminal according to
  • the personal information of the registered user is encrypted and generated, and the digital identity authentication method includes:
  • the ciphertext of the digital identity information of the target user is sent to the verification terminal, so that the verification terminal can determine the ciphertext of the digital identity information and the Whether the plain text of the digital identity information submitted by the user terminal matches.
  • the blockchain platform generates the encrypted public key and the user private key of the registered user after the user is registered, so that the approval terminal uses the encrypted public key obtained by the query to encrypt according to the personal information of the registered user
  • the digital identity information ciphertext is generated, and the user terminal uses the user private key sent by the blockchain platform to decrypt to generate the digital identity information plaintext.
  • the digital identity information ciphertext includes a first encrypted message and a second encrypted message, the first encrypted message includes a first ciphertext, and the second encrypted message includes a second ciphertext;
  • Encrypting the personal information of the registered user by the approval terminal using the encrypted public key obtained by the query to generate the digital identity information ciphertext includes:
  • the random key is encrypted by using the encryption public key to generate the second ciphertext.
  • the encrypting the personal information by using the random key to generate the first ciphertext includes:
  • the first encrypted message further includes a third ciphertext generated by the approval terminal using a hash algorithm to encrypt the hash value.
  • the first encrypted message further includes a first signature value generated by the approval terminal using an approval terminal key to sign the first ciphertext and the third ciphertext;
  • the second encrypted message also includes a second signature value generated by the approval terminal using the approval terminal key to sign the second ciphertext.
  • the user terminal using the user private key sent by the blockchain platform to decrypt and generate the digital identity information plaintext includes:
  • the user terminal uses the user private key to decrypt the second ciphertext in the digital identity information ciphertext to generate the random key; and uses the random key to decrypt the second ciphertext in the digital identity information ciphertext to generate the random key; Decrypting the first ciphertext to generate the hash value;
  • the determining by the verification terminal whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal includes:
  • the verification terminal uses a hash algorithm to encrypt the hash value submitted by the user terminal to generate a third verification ciphertext; and determine whether the third verification ciphertext is the third ciphertext in the digital identity information ciphertext. Whether the text is consistent; if not, it is determined that the ciphertext of the digital identity information does not match the plaintext of the digital identity information submitted by the user terminal.
  • the method further includes:
  • the verification terminal uses the verification terminal public key to sign the first ciphertext and the third ciphertext in the digital identity information ciphertext to generate a first signature verification value;
  • the present invention further provides a digital identity authentication device, including a memory, a processor, and a bus.
  • the memory stores a digital identity authentication program that can run on the processor.
  • the digital identity authentication When the program is executed by the processor, any digital identity authentication method as described above is realized.
  • the present invention further provides a digital identity authentication device applied to a blockchain platform, including:
  • the storage module is configured to pre-store the digital identity information ciphertext of the registered user, and the digital identity information ciphertext is encrypted and generated by the approval terminal according to the personal information of the registered user;
  • the first processing module is configured to send the digital identity information ciphertext of the target user to the user terminal in response to the digital identity information acquisition request sent by the user terminal, so that the user terminal can decrypt the digital identity information ciphertext To obtain the clear text of digital identity information;
  • the second processing module is configured to send the digital identity information ciphertext of the target user to the verification terminal in response to the digital identity information acquisition request sent by the verification terminal, so that the verification terminal can determine the digital identity information Whether the ciphertext matches the plaintext of the digital identity information submitted by the user terminal.
  • the digital identity authentication device further includes:
  • a generating module used to generate the encrypted public key and the user private key of the registered user after the user registers
  • a sending module configured to send the user private key to the user terminal, so that the user terminal uses the user private key to decrypt and generate the digital identity information plaintext;
  • the storage module is also used to store the encrypted public key, so that the approval terminal uses the encrypted public key obtained by the query to encrypt and generate the digital identity information ciphertext according to the personal information of the registered user.
  • the digital identity information ciphertext includes a first encrypted message and a second encrypted message, the first encrypted message includes a first ciphertext, and the second encrypted message includes a second ciphertext; the first The ciphertext is generated by encrypting the personal information by the approval terminal using the generated random key; the second ciphertext is generated by encrypting the random key by the approval terminal using the encryption public key .
  • the first ciphertext is specifically generated by the approval terminal using the random key to encrypt a hash value composed of the personal information and the generated random salt value.
  • the first encrypted message further includes a third ciphertext generated by the approval terminal using a hash algorithm to encrypt the hash value.
  • the first encrypted message further includes a first signature value generated by the approval terminal using an approval terminal key to sign the first ciphertext and the third ciphertext; the second The encrypted message also includes a second signature value generated by the approval terminal to sign the second ciphertext using the approval terminal key.
  • This application also provides another digital identity authentication method, which is applied to the verification terminal, including:
  • the plaintext of the digital identity information is generated by the user terminal by decrypting the ciphertext of the digital identity information of the target user that is queried and obtained in the blockchain platform.
  • the ciphertext of the digital identity information of each registered user generated by the approval terminal is stored in the blockchain platform;
  • This application also provides another digital identity authentication device, which is applied to a verification terminal, including:
  • the first receiving module is configured to receive the digital identity verification request and the plaintext of digital identity information sent by the user terminal; the user terminal encrypts the digital identity information of the target user obtained by querying on the blockchain platform for the digital identity information plaintext. Decryption and generation of the document, and the ciphertext of the digital identity information of each registered user generated by the approval terminal is stored in the blockchain platform;
  • the request module is used to send a digital identity information acquisition request to the blockchain platform
  • the second receiving module receives the ciphertext of the digital identity information of the target user sent by the blockchain platform;
  • the judgment module is configured to judge whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal.
  • the plaintext of the digital identity information submitted by the user terminal includes:
  • the user terminal uses the user private key to decrypt the second ciphertext in the digital identity information ciphertext to generate the random key
  • the user terminal uses the random key to decrypt the digital identity information ciphertext
  • the judgment module includes:
  • a hash calculation unit configured to use a hash algorithm to encrypt the hash value submitted by the user terminal to generate a third verification ciphertext
  • the hash judgment unit is configured to judge whether the third verification cipher text is consistent with the third cipher text in the digital identity information cipher text; if not, then judge the digital identity information cipher text and the user terminal The submitted digital identity information does not match in plain text.
  • the judgment module further includes:
  • the signature unit is configured to, after determining that the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal, use the verification terminal public key to verify the first ciphertext in the ciphertext of the digital identity information and Signing the third ciphertext to generate a first signature verification value;
  • the signature judgment unit is used to judge whether the first signature verification value is consistent with the first signature value in the ciphertext of the digital identity information; if so, it is judged that the ciphertext of the digital identity information is the same as that submitted by the user terminal
  • the digital identity information is plaintext matched; if not, it is determined that the ciphertext of the digital identity information does not match the plaintext of the digital identity information submitted by the user terminal.
  • the present invention further provides a digital identity authentication system, including a blockchain platform, an approval terminal and a verification terminal connected to the blockchain platform; wherein the approval terminal is used for Personal information is encrypted to generate a ciphertext of digital identity information, and sent to the blockchain platform for storage; the blockchain platform is used to respond to the digital identity acquisition request sent by the user terminal to cipher the digital identity information of the target user Sent to the user terminal so that the user terminal decrypts the digital identity information ciphertext to obtain the digital identity information plaintext; the verification terminal is used to respond to the digital identity authentication request sent by the user terminal to determine from The blockchain platform queries whether the acquired ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal.
  • the present invention further provides a computer-readable storage medium having a digital identity authentication program stored on the computer-readable storage medium, and the digital identity authentication program can be executed by one or more processors to Realize any of the above-mentioned digital identity authentication methods.
  • the present invention further provides a computer program product, including computer instructions, which when run on a computer, enable the computer to execute any of the foregoing digital identity authentication methods.
  • the present invention uses the blockchain platform to pre-store the ciphertext of the digital identity information of the registered user.
  • the ciphertext of the digital identity information is encrypted and generated by the approval terminal according to the personal information of the registered user;
  • the blockchain platform is obtained by responding to the digital identity information sent by the user terminal Request, send the target user's digital identity information ciphertext to the user terminal, so that the user terminal can decrypt the digital identity information ciphertext to obtain the digital identity information plaintext;
  • the blockchain platform responds to the digital identity information sent by the verification terminal
  • the acquisition request sends the ciphertext of the digital identity information of the target user to the verification terminal so that the verification terminal can determine whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal.
  • the present invention uses a highly available blockchain platform to store and manage digital identity information, can provide 24/7 uninterrupted service, and respond to query requests from user terminals and verification terminals in a timely manner, so that the verifier can verify the user's digital identity. It is no longer restricted by the service opening hours of the approving party and can proceed smoothly, thereby effectively improving the processing efficiency of digital identity authentication, reducing the occupation of user time, and improving user experience.
  • Figure 1 is a schematic diagram of an application scenario of the digital identity authentication method in the present invention
  • FIG. 2 is a schematic flowchart of a digital identity authentication method in an embodiment of the present invention.
  • FIG. 3 is a detailed flow diagram of the process of encrypting and generating digital identity information ciphertext by the approval terminal in FIG. 2;
  • FIG. 4 is a detailed flowchart of the process of decrypting and generating the plaintext of digital identity information by the user terminal in FIG. 2;
  • 5 is a detailed flow diagram of a process in which the verification terminal judges whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal in an embodiment of the present invention
  • FIG. 6 is a detailed flow diagram of the process in which the verification terminal judges whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal in another embodiment of the present invention
  • FIG. 7 is a schematic flowchart of a digital identity authentication method in another embodiment of the present invention.
  • FIG. 8 is a schematic diagram of the internal structure of a digital identity authentication device disclosed in an embodiment of the present invention.
  • FIG. 9 is a schematic diagram of the internal structure of a digital identity authentication device disclosed in an embodiment of the present invention.
  • FIG. 10 is a schematic diagram of the internal structure of a digital identity authentication device disclosed in another embodiment of the present invention.
  • Fig. 1 is a schematic diagram of an application scenario of the digital identity authentication method in the present invention.
  • the approval terminal belongs to the approver of the digital identity and is used to issue digital identities to users who have passed the audit;
  • the verification terminal belongs to the verifier and is used to authenticate the user's digital identity;
  • the blockchain platform serves as a use
  • the data center for data storage management with blockchain technology is used to store the user's digital identity information issued by the approval terminal and provide query services to the user terminal and the verification terminal.
  • FIG. 2 is a schematic flowchart of a digital identity authentication method in an embodiment of the present invention.
  • the method includes:
  • S21 In response to the digital identity information acquisition request sent by the user terminal, send the digital identity information ciphertext of the target user to the user terminal, so that the user terminal can decrypt the digital identity information ciphertext to obtain the digital identity information plaintext.
  • the digital identity information issued by the approval terminal for the user is specifically stored in the blockchain platform instead of the data center of the approver.
  • the blockchain platform provided by this application serves as a data storage center independent of the approver, verifier, and user. It uses blockchain technology to securely store, operate, maintain, and manage the user's digital identity information, which can provide security and convenience , Timely information query service, acting as an intermediary and communication bridge in the process of digital identity authentication.
  • the blockchain is the underlying technical architecture of Bitcoin, which is essentially a decentralized distributed ledger.
  • Blockchain technology as a continuously growing chain data structure organized into blocks in sequence, participates in the calculation and recording of data through multiple nodes in the network, and mutually verifies the validity of its information. Putting data on the blockchain platform can free up more data, so that the data can be truly "circulated”.
  • the user can register on the blockchain platform first, and apply for a digital identity to the approving party of the digital identity.
  • the approving party reviews the personal information submitted by the user (such as name, date of birth, household registration, photos, etc.), and after the approval is passed, the digital identity information is agreed to be issued, and the approval terminal generates digital identity information ciphertext through encryption based on the user’s personal information. And send it to the blockchain platform for storage.
  • the blockchain platform will generate a user ID when a user registers, so that the ciphertext of each registered user's digital identity information can be stored and managed separately according to the user ID.
  • users may be required to register with their real names.
  • the blockchain platform can receive the digital identity information acquisition request (carrying the user ID of the target user) from the user terminal, and then the target requested by the user terminal
  • the ciphertext of the user's digital identity information is sent to the user terminal, so that the user terminal obtains the plaintext of the digital identity information corresponding to the target user through decryption, thereby submits the plaintext of the digital identity information to the verification terminal, and requests the verification terminal for digital identity authentication.
  • the verification terminal After the verification terminal receives the digital identity authentication request sent by the user terminal, it can send the digital identity information acquisition request for the target user to the blockchain platform, so as to also obtain the digital identity of the target user stored in the blockchain platform Information ciphertext. Therefore, the verification terminal can perform digital identity authentication on the target user by determining whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal.
  • This embodiment uses the blockchain platform to pre-store the ciphertext of the digital identity information of the registered user.
  • the ciphertext of the digital identity information is encrypted and generated by the approval terminal according to the personal information of the registered user;
  • the blockchain platform responds to the digital identity information sent by the user terminal Get request, send the target user's digital identity information ciphertext to the user terminal, so that the user terminal can decrypt the digital identity information ciphertext to obtain the digital identity information plaintext;
  • the blockchain platform obtains the digital identity information in response to the verification terminal sent Request to send the ciphertext of the digital identity information of the target user to the verification terminal so that the verification terminal can determine whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal.
  • this embodiment uses a blockchain platform with high availability for storage and management of digital identity information, which can provide 24/7 uninterrupted service, respond to query requests from user terminals and verification terminals in a timely manner, and enable the verifier to verify the user’s digital identity.
  • the work is no longer restricted by the service opening hours of the approver and can proceed smoothly, thereby effectively improving the processing efficiency of digital identity authentication, reducing user time occupation and improving user experience.
  • the digital identity authentication method provided in this embodiment also has other additional beneficial effects: because the approving party that handles the digital identity issuance business in the prior art generally does not have professional data security storage Technology or equipment, the data center operated by the approving party is also facing major security vulnerabilities; and the blockchain platform used in this embodiment can not only guarantee the authenticity, security, and credibility of the data, but also After being damaged, the database application platform disaster recovery middleware using blockchain technology can be used for rapid recovery, which can effectively guarantee the storage security of digital identity information.
  • the digital identity authentication method provided in this application is based on the above content.
  • the blockchain platform generates the encrypted public key and user private key of the registered user after the user registers, so that the approval terminal can use the query
  • the obtained encrypted public key is encrypted to generate a digital identity information ciphertext according to the personal information of the registered user, and the user terminal uses the user private key sent by the blockchain platform to decrypt the digital identity information to generate a plaintext.
  • the ciphertext of the user's digital identity information is specifically encrypted with a key.
  • the blockchain platform can generate a pair of keys for each registered user, including an encrypted public key and a user's private key.
  • the user's private key is sent to the user terminal for storage management by the user; the encrypted public key can be stored in the public key smart contract, so that the approval terminal can obtain the public key smart contract by querying the public key smart contract after reviewing the user's digital identity application.
  • Encrypt the public key and use the encrypted public key to encrypt to generate the user's digital identity information ciphertext. It is easy to understand that the encrypted public key and user private key of each registered user are paired matching keys, and the user private key can be used to decrypt the ciphertext of the digital identity information encrypted by the encrypted public key.
  • the digital identity information ciphertext includes a first encrypted message and a second encrypted message, and the first encrypted message includes the first ciphertext, The second encrypted message includes the second ciphertext;
  • Figure 3 is a detailed flow diagram of the process in which the approval terminal uses the encrypted public key obtained by the query to encrypt the personal information of the registered user to generate a ciphertext of digital identity information:
  • the approval terminal may specifically use the encrypted public key pk obtained from the blockchain platform and the randomly generated random key s to generate two ciphertexts, so as to realize double encryption.
  • the user’s personal information is encrypted with a random key s to generate the first ciphertext, and in order to protect the random key s, the random key can be encrypted with the encryption public key pk to generate the second ciphertext, and then the The first encrypted message of a ciphertext and the second encrypted message including the second ciphertext are sent to the blockchain platform for storage, thereby further improving the security and reliability of digital identity authentication and ensuring that the user’s personal authentication information is not stolen. vent.
  • using a random key to encrypt the personal information in S33 to generate the first ciphertext includes:
  • Generate random salt value encrypt the hash value composed of personal information plaintext and random salt value to generate the first ciphertext.
  • the approval terminal may also perform encryption in combination with a random salt value.
  • the first encrypted message further includes a third ciphertext generated by the approval terminal using a hash algorithm to encrypt the hash value.
  • the approval terminal may also use a hash algorithm to encrypt and generate the third ciphertext H (plaintext
  • the first encrypted message further includes the first signature value Signature1 generated by the approval terminal using the approval terminal key to sign the first ciphertext and the third ciphertext; the second encrypted message also It includes the second signature value Signature2 generated by the approval terminal using the approval terminal key to sign the second ciphertext.
  • the approval terminal can also use a signature method to encrypt the digital identity information of the target user to further improve the security and confidentiality of the data. Therefore, use Msg1 to represent the first encrypted message, and Msg2 to represent the second encrypted message, then:
  • Msg1 Es(plaintext
  • Msg2 Epk(s)+Signature2.
  • decryption is the reverse process of encryption.
  • the user terminal can use the user private key to decrypt the random key s, and then use the random key s to decrypt the hash composed of the target user’s personal information and the random salt value.
  • salt is the plaintext of the said digital identity information.
  • FIG. 5 is a detailed flowchart of a process in which the verification terminal judges whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal in an embodiment:
  • S51 Use a hash algorithm to encrypt the hash value submitted by the user terminal to generate a third verification ciphertext.
  • S52 Determine whether the third verification ciphertext is consistent with the third ciphertext in the digital identity information ciphertext; if not, proceed to S53.
  • S53 Determine that the ciphertext of the digital identity information does not match the plaintext of the digital identity information submitted by the user terminal.
  • the verification terminal compares the ciphertext of the target user's digital identity information stored in the blockchain platform with the plaintext of the digital identity information submitted by the user terminal (that is, the hash value plaintext
  • the algorithm encrypts the hash value plaintext
  • FIG. 6 is a detailed flowchart of a process in which the verification terminal judges whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal in another embodiment of the present invention:
  • S61 Use a hash algorithm to encrypt the hash value submitted by the user terminal to generate a third verification ciphertext.
  • S62 Determine whether the third verification ciphertext is consistent with the third ciphertext in the digital identity information ciphertext; if not, go to S63; if yes, go to S64.
  • S63 Determine that the ciphertext of the digital identity information does not match the plaintext of the digital identity information submitted by the user terminal.
  • S64 Use the verification terminal public key to sign the first ciphertext and the third ciphertext in the ciphertext of the digital identity information to generate a first signature verification value; enter S65.
  • S65 Determine whether the first signature verification value is consistent with the first signature value in the ciphertext of the digital identity information; if yes, go to S66; if not, go to S63.
  • S66 Determine that the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal.
  • the verification terminal can perform two-sided matching verification on the plaintext of the digital identity information submitted by the user terminal, that is, on the basis of the hash verification performed in Figure 5, the signature verification is performed to further protect the data identity information Certified reliability.
  • the third verification ciphertext calculated by the hash algorithm is consistent with the third ciphertext and the signature verification also passes, it can be determined that the plaintext of the digital identity information submitted by the user terminal matches the ciphertext of the digital identity information in the blockchain platform , Which means that the user’s digital identity authentication is successful.
  • this application also provides a digital identity authentication method applied to a verification terminal, referring to FIG. 7, including:
  • S71 Receive the digital identity verification request and the plaintext of the digital identity information sent by the user terminal; the plaintext of the digital identity information is generated by the user terminal by decrypting the ciphertext of the target user's digital identity information obtained in the blockchain platform. The ciphertext of the digital identity information of each registered user generated by the approval terminal is stored.
  • S73 Receive the ciphertext of the digital identity information of the target user sent by the blockchain platform.
  • S74 Determine whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal.
  • the specific content can refer to the digital identity authentication method applied to the blockchain platform described above, and similar content will not be repeated here.
  • the present application also provides a digital identity authentication device 8.
  • the digital identity authentication device 8 may include a memory 81, a processor 82, and a bus 83.
  • the memory 81 is stored and can run on the processor 82.
  • the digital identity authentication program is executed by the processor 82 to implement any of the above-mentioned digital identity authentication methods.
  • the digital identity authentication device 8 may be a PC (Personal Computer, personal computer), or a smart phone, a tablet computer, a palmtop computer, a portable computer, or a network storage terminal device.
  • the digital identity authentication device 8 may be a node forming a CDN network or a blockchain network.
  • the memory 81 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), magnetic memory, magnetic disk, optical disk, etc.
  • the memory 81 may be an internal storage unit of the digital identity authentication device 8 in some embodiments, for example, the hard disk of the digital identity authentication device 8. In other embodiments, the memory 81 may also be an external storage device of the digital identity authentication device 8, such as a plug-in hard disk equipped on the digital identity authentication device 8, a smart media card (SMC), and a secure digital (Secure Digital). Digital, SD) card, flash card (Flash Card), etc.
  • the memory 81 may also include both an internal storage unit of the digital identity authentication device 8 and an external storage device.
  • the memory 81 can be used not only to store application software and various data installed in the digital identity authentication device 8, such as the code of a digital identity authentication program, etc., but also to temporarily store data that has been output or will be output.
  • the processor 82 may be a central processing unit (CPU), controller, microcontroller, microprocessor or other data processing chip in some embodiments, and is used to run the program code or processing stored in the memory 81 Data, such as the implementation of digital identity authentication procedures, etc.
  • CPU central processing unit
  • controller microcontroller
  • microprocessor or other data processing chip in some embodiments, and is used to run the program code or processing stored in the memory 81 Data, such as the implementation of digital identity authentication procedures, etc.
  • the bus 83 may be a peripheral component interconnection standard (peripheral component interconnect, referred to as PCI) bus or an extended industry standard architecture (extended industry standard architecture, referred to as EISA) bus, etc.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into address bus, data bus, control bus, etc. For ease of presentation, only one thick line is used in FIG. 8 to represent, but it does not mean that there is only one bus or one type of bus.
  • the digital identity authentication device 8 may also include a network interface 14.
  • the network interface 14 may optionally include a wired interface and/or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is usually used in a digital identity authentication device 8 Establish a communication connection with other electronic devices.
  • the digital identity authentication device 8 may also include a user interface.
  • the user interface may include a display (Display) and an input unit such as a keyboard (Keyboard).
  • the optional user interface may also include a standard wired interface and a wireless interface.
  • the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode, organic light emitting diode) touch device, etc.
  • the display can also be appropriately called a display screen or a display unit, which is used to display the information processed in the digital identity authentication device 8 and to display a visual user interface.
  • FIG. 8 only shows a digital identity authentication device 8 with components 81-83 and a digital identity authentication program. Those skilled in the art can understand that the structure shown in FIG. 8 does not constitute a limitation on the digital identity authentication device 8. It may include fewer or more components than shown, or a combination of certain components, or a different component arrangement.
  • this application also provides a digital identity authentication device applied to a blockchain platform.
  • FIG. 9 is a schematic diagram of the internal structure of the digital identity authentication device disclosed in an embodiment of the application, including:
  • the storage module 91 is configured to pre-store the digital identity information ciphertext of the registered user, and the digital identity information ciphertext is encrypted and generated by the approval terminal according to the personal information of the registered user;
  • the first processing module 92 is configured to send the digital identity information ciphertext of the target user to the user terminal in response to the digital identity information acquisition request sent by the user terminal, so that the user terminal performs the digital identity information ciphertext Decrypt to obtain the plaintext of digital identity information;
  • the second processing module 93 is configured to send the ciphertext of the digital identity information of the target user to the verification terminal in response to the digital identity information acquisition request sent by the verification terminal, so that the verification terminal can determine the Whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal.
  • this embodiment uses a blockchain platform with high availability for storage and management of digital identity information, which can provide 24/7 uninterrupted service, respond to query requests from user terminals and verification terminals in a timely manner, and enable the verifier to verify the user’s digital identity.
  • the work is no longer restricted by the service opening hours of the approver and can proceed smoothly, thereby effectively improving the processing efficiency of digital identity authentication, reducing user time occupation and improving user experience.
  • the digital identity authentication device further includes:
  • a generating module used to generate the encrypted public key and the user private key of the registered user after the user registers
  • a sending module configured to send the user private key to the user terminal, so that the user terminal uses the user private key to decrypt and generate the digital identity information plaintext;
  • the storage module is also used to store the encrypted public key, so that the approval terminal uses the encrypted public key obtained by the query to encrypt and generate the digital identity information ciphertext according to the personal information of the registered user.
  • the digital identity information ciphertext includes a first encrypted message and a second encrypted message, the first encrypted message includes the first ciphertext, and the second encrypted message includes the second ciphertext; the first ciphertext
  • the approval terminal uses the generated random key to encrypt personal information and generates the second cipher text; the approval terminal uses the encrypted public key to encrypt the random key and generates the second cipher text.
  • the first ciphertext is specifically generated by the approval terminal using a random key to encrypt a hash value composed of personal information and the generated random salt value.
  • the first encrypted message further includes a third ciphertext generated by the approval terminal using a hash algorithm to encrypt the hash value.
  • the first encrypted message further includes the first signature value generated by the approval terminal using the approval terminal key to sign the first ciphertext and the third ciphertext; the second encrypted message also includes The second signature value generated by the approval terminal using the approval terminal key to sign the second ciphertext.
  • this application also provides another digital identity authentication device, which is applied to a blockchain platform.
  • FIG. 10 is a schematic diagram of the internal structure of the digital identity authentication device disclosed in another embodiment of the application, including:
  • the first receiving module 101 is used to receive the digital identity verification request and the plaintext of the digital identity information sent by the user terminal; the plaintext of the digital identity information is generated by the user terminal decrypting the ciphertext of the target user's digital identity information obtained by querying on the blockchain platform , The ciphertext of the digital identity information of each registered user generated by the approval terminal is stored in the blockchain platform;
  • the request module 102 is used to send a digital identity information acquisition request to the blockchain platform;
  • the second receiving module 103 receives the ciphertext of the digital identity information of the target user sent by the blockchain platform;
  • the judgment module 104 is used to judge whether the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal.
  • the plaintext of the digital identity information submitted by the user terminal includes:
  • the user terminal uses the user private key to decrypt the second ciphertext in the digital identity information ciphertext to generate a random key, and then uses the random key to decrypt the first ciphertext in the digital identity information ciphertext to generate a hash value;
  • the judgment module 104 includes:
  • the hash calculation unit is configured to use a hash algorithm to encrypt the hash value submitted by the user terminal to generate the third verification ciphertext;
  • the hash determination unit is used to determine whether the third verification ciphertext is consistent with the third ciphertext in the digital identity information ciphertext; if not, it is determined that the digital identity information ciphertext does not match the digital identity information plaintext submitted by the user terminal.
  • the judgment module 104 further includes:
  • the signature unit is used to sign the first ciphertext and the third ciphertext in the digital identity information ciphertext by using the verification terminal public key after determining that the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal to generate the second A signature verification value;
  • the signature judgment unit is used to judge whether the first signature verification value is consistent with the first signature value in the ciphertext of the digital identity information; if so, it is judged that the ciphertext of the digital identity information matches the plaintext of the digital identity information submitted by the user terminal; if not, then Determine that the ciphertext of the digital identity information does not match the plaintext of the digital identity information submitted by the user terminal.
  • this application also provides a digital identity authentication system, including a blockchain platform, an approval terminal and a verification terminal connected to the blockchain platform; wherein the approval terminal is used to encrypt and generate a digital identity based on the personal information of registered users
  • the information ciphertext is sent to the blockchain platform for storage; the blockchain platform is used to respond to the digital identity acquisition request sent by the user terminal, and send the target user’s digital identity information ciphertext to the user terminal so that the user terminal can
  • the ciphertext of the identity information is decrypted to obtain the plaintext of the digital identity information;
  • the verification terminal is used to respond to the digital identity authentication request sent by the user terminal to determine the digital identity information ciphertext obtained from the blockchain platform query and the digital identity information submitted by the user terminal Whether the plaintext matches.
  • the present application also provides a computer-readable storage medium having a digital identity authentication program stored on the computer-readable storage medium, and the digital identity authentication program can be executed by one or more processors to achieve the above Any of the aforementioned digital identity authentication methods.
  • this application also provides a computer program product, including computer instructions, which when run on a computer, enable the computer to execute any of the above-mentioned digital identity authentication methods.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center. Transmission to another website site, computer, server or data center via wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • wired such as coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server or data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)), etc.
  • the disclosed system, device, and method can be implemented in other ways.
  • the system embodiment described above is only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , Including several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program code .

Abstract

本发明公开了一种数字身份认证方法，应用于预先存储有注册用户的数字身份信息密文的区块链平台，包括：响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至用户终端，以便用户终端对数字身份信息密文进行解密以获取数字身份信息明文；响应于验证终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至验证终端，以便验证终端判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配。本发明还公开了一种数字身份认证设备、系统及计算机可读存储介质。本发明利用可用性较高的区块链平台进行数字身份信息的存储，有效提高了数字身份认证的处理效率和用户体验。

Description

一种数字身份认证方法、设备、装置、系统及存储介质
本申请要求于2019年3月27日提交中国专利局、申请号为201910239256.0、发明名称为“一种数字身份认证方法、设备、装置、系统及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及区块链技术领域，尤其涉及一种数字身份认证方法、设备、装置、系统及计算机可读存储介质。
背景技术
数字身份验证已经成为了现代信息社会中的常见场景。在现有技术中，可进行数字身份签发的部门(即审批方)通过构建一个中心化的数据中心来存储各个用户的数字身份信息，以便提供给验证方进行数字身份验证。由于审批方与验证方通常属于不同的组织单位，缺乏直接的信息沟通渠道，因此，验证方的验证工作势必要受限于审批方的服务开放时间，经常会因时差差异、地理差异等因素而降低验证方的处理效率。鉴于此，提供一种解决上述技术问题的方法已经成为本领域技术人员所需重点关注的。
发明内容
本发明的主要目的在于提供一种数字身份认证方法、设备、装置、系统及计算机可读存储介质，旨在解决现有技术中数字身份认证处理效率低下的技术问题。
为实现上述目的，本发明提供的数字身份认证方法，应用于区块链平台，所述区块链平台预先存储有注册用户的数字身份信息密文，所述数字身份信息密文由审批终端根据所述注册用户的个人信息加密生成，所述数字身份认证方法包括：
响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至所述用户终端，以便所述用户终端对所述数字身份信息密文进行 解密以获取数字身份信息明文；
响应于所述验证终端发送的数字身份信息获取请求，将所述目标用户的所述数字身份信息密文发送至所述验证终端，以便所述验证终端判断所述数字身份信息密文与所述用户终端提交的数字身份信息明文是否匹配。
可选地，所述区块链平台在用户注册后生成注册用户的加密公钥和用户私钥，以便由所述审批终端利用查询获取的所述加密公钥根据所述注册用户的个人信息加密生成所述数字身份信息密文，并由所述用户终端利用所述区块链平台发送的所述用户私钥解密生成所述数字身份信息明文。
可选地，所述数字身份信息密文包括第一加密消息和第二加密消息，所述第一加密消息包括第一密文，所述第二加密消息包括第二密文；
所述审批终端利用查询获取的所述加密公钥对所述注册用户的个人信息加密生成所述数字身份信息密文包括：
向所述区块链平台查询获取所述加密公钥；
生成随机密钥；
利用所述随机密钥对所述个人信息进行加密以生成所述第一密文；
利用所述加密公钥对所述随机密钥进行加密以生成所述第二密文。
可选地，所述利用所述随机密钥对所述个人信息进行加密以生成所述第一密文包括：
生成随机salt值；
对由所述个人信息和所述随机salt值构成的散列值进行加密以生成所述第一密文。
可选地，所述第一加密消息还包括由所述审批终端利用哈希算法对所述散列值进行加密而生成的第三密文。
可选地，所述第一加密消息还包括由所述审批终端利用审批终端密钥对所述第一密文和所述第三密文进行签名而生成的第一签名值；
所述第二加密消息还包括由所述审批终端利用所述审批终端密钥对所述第二密文进行签名而生成的第二签名值。
可选地，所述用户终端利用所述区块链平台发送的所述用户私钥解密生成所述数字身份信息明文包括：
所述用户终端利用所述用户私钥对所述数字身份信息密文中的所述第二密文解密生成所述随机密钥；利用所述随机密钥对所述数字身份信息密文中的所述第一密文解密生成所述散列值；
所述验证终端判断所述数字身份信息密文与所述用户终端提交的数字身份信息明文是否匹配包括：
所述验证终端利用哈希算法对所述用户终端提交的所述散列值加密生成第三验证密文；判断所述第三验证密文与所述数字身份信息密文中的所述第三密文是否一致；若否，则判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文不匹配。
可选地，在所述判断所述第三验证密文与所述数字身份信息密文中的所述第三密文是否一致之后，还包括：
若是，则所述验证终端利用验证终端公钥对所述数字身份信息密文中的所述第一密文和所述第三密文进行签名以生成第一签名验证值；
判断所述第一签名验证值与所述数字身份信息密文中的所述第一签名值是否一致；
若是，则判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文匹配；
若否，则判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文不匹配。
为实现上述目的，本发明进一步提供了一种数字身份认证设备，包括存储器、处理器和总线，所述存储器上存储有可在所述处理器上运行的数字身份认证程序，所述数字身份认证程序被所述处理器执行时实现如上所述的任一种数字身份认证方法。
为实现上述目的，本发明进一步提供了一种数字身份认证装置，应用于区块链平台，包括：
存储模块，用于预先存储注册用户的数字身份信息密文，所述数字身份信息密文由审批终端根据所述注册用户的个人信息加密生成；
第一处理模块，用于响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至所述用户终端，以便所述用户终端对所述数 字身份信息密文进行解密以获取数字身份信息明文；
第二处理模块，用于响应于验证终端发送的数字身份信息获取请求，将所述目标用户的所述数字身份信息密文发送至所述验证终端，以便所述验证终端判断所述数字身份信息密文与所述用户终端提交的数字身份信息明文是否匹配。
可选地，所述数字身份认证装置还包括：
生成模块，用于在用户注册后生成所述注册用户的加密公钥和用户私钥；
发送模块，用于将所述用户私钥发送至所述用户终端，以便由所述用户终端利用所述用户私钥解密生成所述数字身份信息明文；
所述存储模块还用于存储所述加密公钥，以便由所述审批终端利用查询获取的所述加密公钥根据所述注册用户的个人信息加密生成所述数字身份信息密文。
可选地，所述数字身份信息密文包括第一加密消息和第二加密消息，所述第一加密消息包括第一密文，所述第二加密消息包括第二密文；所述第一密文由所述审批终端利用生成的随机密钥对所述个人信息进行加密而生成；所述第二密文由所述审批终端利用所述加密公钥对所述随机密钥进行加密而生成。
可选地，所述第一密文具体由所述审批终端利用所述随机密钥对由所述个人信息和生成的随机salt值构成的散列值进行加密而生成。
可选地，所述第一加密消息还包括由所述审批终端利用哈希算法对所述散列值进行加密而生成的第三密文。
可选地，所述第一加密消息还包括由所述审批终端利用审批终端密钥对所述第一密文和所述第三密文进行签名而生成的第一签名值；所述第二加密消息还包括由所述审批终端利用所述审批终端密钥对所述第二密文进行签名而生成的第二签名值。
本申请还提供了另一种数字身份认证方法，应用于验证终端，包括：
接收用户终端发送的数字身份验证请求和数字身份信息明文；所述数字身份信息明文由所述用户终端对在区块链平台中查询获取的目标用户的数字身份信息密文解密生成，所述区块链平台中存储有审批终端生成的各注册用户的数字身份信息密文；
向所述区块链平台发送数字身份信息获取请求；
接收所述区块链平台发送的所述目标用户的所述数字身份信息密文；
判断所述数字身份信息密文与所述用户终端提交的所述数字身份信息明文是否匹配。
本申请还提供了另一种数字身份认证装置，应用于验证终端，包括：
第一接收模块，用于接收用户终端发送的数字身份验证请求和数字身份信息明文；所述数字身份信息明文由所述用户终端对在区块链平台中查询获取的目标用户的数字身份信息密文解密生成，所述区块链平台中存储有审批终端生成的各注册用户的数字身份信息密文；
请求模块，用于向所述区块链平台发送数字身份信息获取请求；
第二接收模块，接收所述区块链平台发送的所述目标用户的所述数字身份信息密文；
判断模块，用于判断所述数字身份信息密文与所述用户终端提交的所述数字身份信息明文是否匹配。
可选地，所述用户终端提交的所述数字身份信息明文包括：
由所述用户终端在利用所述用户私钥对所述数字身份信息密文中的所述第二密文解密生成所述随机密钥后，利用所述随机密钥对所述数字身份信息密文中的所述第一密文解密生成的所述散列值；
所述判断模块包括：
哈希计算单元，用于利用哈希算法对所述用户终端提交的所述散列值加密生成第三验证密文；
哈希判断单元，用于判断所述第三验证密文与所述数字身份信息密文中的所述第三密文是否一致；若否，则判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文不匹配。
可选地，所述判断模块还包括：
签名单元，用于在判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文匹配后，利用验证终端公钥对所述数字身份信息密文中的所述第一密文和所述第三密文进行签名以生成第一签名验证值；
签名判断单元，用于判断所述第一签名验证值与所述数字身份信息密文中 的所述第一签名值是否一致；若是，则判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文匹配；若否，则判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文不匹配。
为实现上述目的，本发明进一步提供了一种数字身份认证系统，包括区块链平台、与所述区块链平台连接的审批终端和验证终端；其中，所述审批终端用于根据注册用户的个人信息加密生成数字身份信息密文，并发送至所述区块链平台进行存储；所述区块链平台用于响应于用户终端发送的数字身份获取请求，将目标用户的数字身份信息密文发送至所述用户终端，以便所述用户终端对所述数字身份信息密文进行解密以获取数字身份信息明文；所述验证终端用于响应于所述用户终端发送的数字身份认证请求，判断从所述区块链平台查询获取的所述数字身份信息密文与所述用户终端提交的所述数字身份信息明文是否匹配。
为实现上述目的，本发明进一步提供了一种计算机可读存储介质，所述计算机可读存储介质上存储有数字身份认证程序，所述数字身份认证程序可被一个或者多个处理器执行，以实现如上所述的任一种数字身份认证方法。
为实现上述目的，本发明进一步提供了一种计算机程序产品，包括计算机指令，当其在计算机上运行时，使得计算机可以执行上述任一种数字身份认证方法。
本发明利用区块链平台预先存储注册用户的数字身份信息密文，数字身份信息密文由审批终端根据注册用户的个人信息加密生成；区块链平台通过响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至用户终端，以便用户终端对所述数字身份信息密文进行解密以获取数字身份信息明文；区块链平台通过响应于验证终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至验证终端，以便验证终端判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配。可见，本发明利用可用性较高的区块链平台进行数字身份信息的存储管理，可提供全天候不间断服务，及时响应于用户终端和验证终端的查询请求，令验证方对用户的数字身份验证工作不再受制于审批方的服务开放时间而得以顺利进行，从而有效提高数字身份认证工作的处理效率，减少对用户时间的占用，提高用户体验。
附图说明
为了更清楚地说明现有技术和本申请实施例中的技术方案，下面将对现有技术和本申请实施例描述中需要使用的附图作简要的介绍。当然，下面有关本申请实施例的附图描述的仅仅是本申请中的一部分实施例，对于本领域普通技术人员来说，在不付出创造性劳动的前提下，还可以根据提供的附图获得其他的附图，所获得的其他附图也属于本申请的保护范围。
图1为本发明中数字身份认证方法的应用场景示意图；
图2为本发明一实施例中数字身份认证方法的流程示意图；
图3为图2中审批终端加密生成数字身份信息密文的过程的细化流程示意图；
图4为图2中用户终端解密生成数字身份信息明文的过程的细化流程示意图；
图5为本发明一实施例中验证终端判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配的过程的细化流程示意图；
图6为本发明另一实施例中验证终端判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配的过程的细化流程示意图；
图7为本发明另一实施例中数字身份认证方法的流程示意图；
图8为本发明一实施例揭露的数字身份认证设备的内部结构示意图；
图9为本发明一实施例揭露的数字身份认证装置的内部结构示意图；
图10为本发明另一实施例揭露的数字身份认证装置的内部结构示意图。
本发明目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
具体实施方式
为了使本发明的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本发明进行进一步详细说明。应当理解，此处所描述的具体实施例仅用以解释本发明，并不用于限定本发明。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发 明保护的范围。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
需要说明的是，在本发明中涉及“第一”、“第二”等的描述仅用于描述目的，而不能理解为指示或暗示其相对重要性或者隐含指明所指示的技术特征的数量。由此，限定有“第一”、“第二”的特征可以明示或者隐含地包括至少一个该特征。另外，各个实施例之间的技术方案可以相互结合，但是必须是以本领域普通技术人员能够实现为基础，当技术方案的结合出现相互矛盾或无法实现时应当认为这种技术方案的结合不存在，也不在本发明要求的保护范围之内。
参照图1，图1为本发明中数字身份认证方法的应用场景示意图。
如图1所示，审批终端隶属于数字身份的审批方，用于向通过审核的用户签发数字身份；验证终端隶属于验证方，用于对用户进行数字身份认证；区块链平台，作为利用区块链技术进行数据存储管理的数据中心，用于存储审批终端所签发的用户的数字身份信息，并向用户终端和验证终端提供查询服务。
本发明提供的数字身份认证方法，应用于区块链平台，所述区块链平台预先存储有注册用户的数字身份信息密文，所述数字身份信息密文由审批终端根据注册用户的个人信息加密生成。参照图2，图2为本发明一实施例中数字身份认证方法的流程示意图。
在一实施例中，该方法包括：
S21：响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至用户终端，以便用户终端对数字身份信息密文进行解密以获取数字身份信息明文。
S22：响应于验证终端发送的数字身份信息获取请求，将目标用户的数字 身份信息密文发送至验证终端，以便验证终端判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配。
具体地，不同于现有技术，在本实施例所提供的数字身份认证方法中，审批终端为用户签发的数字身份信息具体存储在区块链平台中而非审批方的数据中心。本申请所提供的区块链平台作为独立于审批方、验证方、以及用户的数据存储中心，利用区块链技术对用户的数字身份信息进行安全存储、运维和管理，可提供安全、便捷、及时的信息查询服务，充当着数字身份认证过程的中间媒介和沟通桥梁。
其中，区块链是比特币的底层技术架构，在本质上是一种去中心化的分布式账本。区块链技术作为一种持续增长的、按序整理成区块的链式数据结构，通过网络中多个节点共同参与数据的计算和记录，并且互相验证其信息的有效性。将数据放在区块链平台上，可以解放出更多数据，使数据可以真正“流通”起来。
在本实施例中，用户可先在区块链平台进行注册，并向数字身份的审批方进行数字身份的申请。审批方对用户提交的个人信息(例如姓名、出生年月、户籍、照片等)进行审核，审核通过即同意签发数字身份信息后，审批终端根据用户的个人信息通过加密生成数字身份信息密文，并发送至区块链平台进行存储。容易理解的是，区块链平台会在用户注册时生成用户ID，以便依据用户ID对各个注册用户的数字身份信息密文分别进行存储和管理。当然，处于加强安全保障目的，可要求用户进行实名注册。
在用户使用区块链平台进行数字身份认证阶段，区块链平台在接收到来自用户终端的数字身份信息获取请求(携带有目标用户的用户ID)后，便可将该用户终端所请求的目标用户的数字身份信息密文发送至用户终端，以便用户终端通过解密获取目标用户对应的数字身份信息明文，从而将该数字身份信息明文递交至验证终端，并向验证终端请求进行数字身份认证。
验证终端在接收到用户终端发送的数字身份认证请求后，即可向区块链平台发送针对于目标用户的数字身份信息获取请求，以便同样获取区块链平台中存储的该目标用户的数字身份信息密文。由此，验证终端即可通过判断该数字身份信息密文与用户终端提交的数字身份信息明文是否匹配而对目标用户进 行数字身份认证。
本实施例利用区块链平台预先存储注册用户的数字身份信息密文，数字身份信息密文由审批终端根据注册用户的个人信息加密生成；区块链平台通过响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至用户终端，以便用户终端对数字身份信息密文进行解密以获取数字身份信息明文；区块链平台通过响应于验证终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至验证终端，以便验证终端判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配。
可见，本实施例利用可用性较高的区块链平台进行数字身份信息的存储管理，可提供全天候不间断服务，及时响应于用户终端和验证终端的查询请求，令验证方对用户的数字身份验证工作不再受制于审批方的服务开放时间而得以顺利进行，从而有效提高数字身份认证工作的处理效率，减少对用户时间的占用，提高用户体验。
此外，在上述有益效果的基础上，本实施例所提供的数字身份认证方法还具有其他额外的有益效果：由于现有技术中处理数字身份签发业务的审批方一般并不具备专业数据安全存储的技术或设备，所以由审批方运营的数据中心还面临着较大的安全漏洞问题；而本实施例所采用的区块链平台，不仅可以保障数据的真实、安全、可信，还可以在数据遭到破坏后，利用区块链技术的数据库应用平台灾备中间件进行迅速恢复，从而可有效保障数字身份信息的存储安全性。
本申请所提供的数字身份认证方法，在上述内容的基础上，作为一种优选实施例，区块链平台在用户注册后生成注册用户的加密公钥和用户私钥，以便由审批终端利用查询获取的加密公钥根据注册用户的个人信息加密生成数字身份信息密文，并由用户终端利用区块链平台发送的用户私钥解密生成数字身份信息明文。
在本实施例中，用户的数字身份信息密文具体是通过密钥进行加密的。在用户注册区块链平台时，区块链平台可针对各个注册用户分别生成一对密钥，包括加密公钥和用户私钥。其中，用户私钥发送至用户终端，由用户进行存储 管理；加密公钥可存储在公钥智能合约中，以便审批终端在审核通过了用户的数字身份申请后，通过查询公钥智能合约获取该加密公钥，并利用该加密公钥进行加密以生成该用户的数字身份信息密文。容易理解的是，各注册用户的加密公钥和用户私钥均是成对的匹配密钥，利用用户私钥可以对由加密公钥加密生成的数字身份信息密文进行解密。
在上述内容的基础上，本申请所提供的数字身份认证方法，作为一种优选实施例，数字身份信息密文包括第一加密消息和第二加密消息，第一加密消息包括第一密文，第二加密消息包括第二密文；
参照图3，图3为审批终端利用查询获取的加密公钥对注册用户的个人信息加密生成数字身份信息密文的过程的细化流程示意图：
S31：向区块链平台查询获取加密公钥pk。
S32：生成随机密钥s。
S33：利用随机密钥s对个人信息进行加密以生成第一密文。
S34：利用加密公钥pk对随机密钥s进行加密以生成第二密文。
在本实施例中，审批终端可具体利用从区块链平台获取的加密公钥pk以及随机生成的随机密钥s生成两个密文，以便实现双重加密。具体地，将用户的个人信息利用随机密钥s加密生成第一密文，而为了保护随机密钥s，可利用加密公钥pk将随机密钥加密生成第二密文，然后将包括了第一密文的第一加密消息与包括了第二密文的第二加密消息发送至区块链平台进行存储，从而进一步提高数字身份认证的安全可靠性，保障用户的个人认证信息不被窃取外泄。
在上述内容的基础上，优选地，S33中利用随机密钥对个人信息进行加密以生成第一密文包括：
生成随机salt值；对由个人信息plaintext和随机salt值构成的散列值进行加密以生成第一密文。
具体地，为了进一步提高加密后的数字身份信息的安全性和保密性，审批终端还可结合随机salt值进行加密。用plaintext||salt表示由个人信息plaintext和随机salt值构成的散列值，则第一密文即为Es(plaintext||salt)，第二密文即为Epk(s)。
在上述内容的基础上，优选地，第一加密消息还包括由审批终端利用哈希算法对散列值进行加密而生成的第三密文。
在本实施例中，为了提高加密数据的复杂度以提高安全性，审批终端还可利用哈希算法加密生成第三密文H(plaintext||salt)。
在上述内容的基础上，优选地，第一加密消息还包括由审批终端利用审批终端密钥对第一密文和第三密文进行签名而生成的第一签名值Signature1；第二加密消息还包括由审批终端利用审批终端密钥对第二密文进行签名而生成的第二签名值Signature2。
在本实施例中，审批终端还可以利用签名的方法对目标用户的数字身份信息进行加密，以进一步提高数据的安全性和保密性。由此，用Msg1表示第一加密消息，用Msg2表示第二加密消息，则：
Msg1＝Es(plaintext||salt)+H(plaintext||salt)+Signature1；
Msg2＝Epk(s)+Signature2。
在采用上述Msg1和Msg2作为数字身份信息密文的基础上，参照图4，图4为用户终端利用区块链平台发送的用户私钥解密生成数字身份信息明文的过程的细化流程示意图：
S41：利用用户私钥对数字身份信息密文中的第二密文Epk(s)解密生成随机密钥s。
S42：利用随机密钥s对数字身份信息密文中的第一密文Es(plaintext||salt)解密生成散列值plaintext||salt。
容易理解的是，解密即为加密的逆过程，用户终端可利用用户私钥先解密出随机密钥s，再利用随机密钥s解密出由目标用户的个人信息与随机salt值构成的散列值plaintext||salt，即所说的数字身份信息明文。
参照图5，图5为一实施例中验证终端判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配的过程的细化流程示意图：
S51：利用哈希算法对用户终端提交的散列值加密生成第三验证密文。
S52：判断第三验证密文与数字身份信息密文中的第三密文是否一致；若否，则进入S53。
S53：判定数字身份信息密文与用户终端提交的数字身份信息明文不匹配。
具体地，验证终端在比对区块链平台中存储的目标用户的数字身份信息密文与用户终端提交的数字身份信息明文(即散列值plaintext||salt)时，首先可同样利用哈希算法对散列值plaintext||salt加密以生成第三验证密文，若第三验证密文与数字身份信息密文中的第三密文不一致，则可判定数字身份认证失败。
参照图6，图6为本发明另一实施例中验证终端判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配的过程的细化流程示意图：
S61：利用哈希算法对用户终端提交的散列值加密生成第三验证密文。
S62：判断第三验证密文与数字身份信息密文中的第三密文是否一致；若否，则进入S63；若是，则进入S64。
S63：判定数字身份信息密文与用户终端提交的数字身份信息明文不匹配。
S64：利用验证终端公钥对数字身份信息密文中的第一密文和第三密文进行签名以生成第一签名验证值；进入S65。
S65：判断第一签名验证值与数字身份信息密文中的第一签名值是否一致；若是，则进入S66；若否，则进入S63。
S66：判定数字身份信息密文与用户终端提交的数字身份信息明文匹配。
在本实施例中，验证终端对用户终端提交的数字身份信息明文可进行两方面的匹配验证，即在图5中进行的哈希验证的基础上，再进行签名验证，以便进一步保障数据身份信息认证的可靠性。当通过哈希算法计算的第三验证密文与第三密文一致、且签名验证也通过时，可判定用户终端提交的数字身份信息明文与区块链平台中的数字身份信息密文相匹配，即认定该用户的数字身份认证成功。
相对应地，本申请还提供了一种应用于验证终端的数字身份认证方法，参照图7，包括：
S71：接收用户终端发送的数字身份验证请求和数字身份信息明文；数字身份信息明文由用户终端对在区块链平台中查询获取的目标用户的数字身份信息密文解密生成，区块链平台中存储有审批终端生成的各注册用户的数字身份信息密文。
S72：向区块链平台发送数字身份信息获取请求。
S73：接收区块链平台发送的目标用户的数字身份信息密文。
S74：判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配。
具体内容可参考前文所述的应用于区块链平台的数字身份认证方法，类似内容这里就不再赘述。
进一步地，参照图8，本申请还提供了一种数字身份认证设备8，该数字身份认证设备8可以包括存储器81、处理器82和总线83，存储器81上存储有可在处理器82上运行的数字身份认证程序，所述数字身份认证程序被处理器82执行时实现如上所述的任一种数字身份认证方法。
在本实施例中，数字身份认证设备8可以是PC(Personal Computer，个人电脑)，也可以是智能手机、平板电脑、掌上电脑、便携计算机、网络存储终端设备。数字身份认证设备8可以是组成CDN网络或者区块链网络的节点。
其中，存储器81至少包括一种类型的可读存储介质，所述可读存储介质包括闪存、硬盘、多媒体卡、卡型存储器(例如，SD或DX存储器等)、磁性存储器、磁盘、光盘等。存储器81在一些实施例中可以是数字身份认证设备8的内部存储单元，例如该数字身份认证设备8的硬盘。存储器81在另一些实施例中也可以是数字身份认证设备8的外部存储设备，例如数字身份认证设备8上配备的插接式硬盘，智能存储卡(Smart Media Card,SMC)，安全数字(Secure Digital,SD)卡，闪存卡(Flash Card)等。进一步地，存储器81还可以既包括数字身份认证设备8的内部存储单元也包括外部存储设备。存储器81不仅可以用于存储安装于数字身份认证设备8的应用软件及各类数据，例如数字身份认证程序的代码等，还可以用于暂时地存储已经输出或者将要输出的数据。
处理器82在一些实施例中可以是一中央处理器(Central Processing Unit,CPU)、控制器、微控制器、微处理器或其他数据处理芯片，用于运行存储器81中存储的程序代码或处理数据，例如执行数字身份认证程序等。
该总线83可以是外设部件互连标准(peripheral component interconnect，简 称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。该总线可以分为地址总线、数据总线、控制总线等。为便于表示，图8中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
进一步地，数字身份认证设备8还可以包括网络接口14，网络接口14可选的可以包括有线接口和/或无线接口(如WI-FI接口、蓝牙接口等)，通常用于在数字身份认证设备8与其他电子设备之间建立通信连接。
可选地，该数字身份认证设备8还可以包括用户接口，用户接口可以包括显示器(Display)、输入单元比如键盘(Keyboard)，可选的用户接口还可以包括标准的有线接口、无线接口。可选地，在一些实施例中，显示器可以是LED显示器、液晶显示器、触控式液晶显示器以及OLED(Organic Light-Emitting Diode，有机发光二极管)触摸器等。其中，显示器也可以适当的称为显示屏或显示单元，用于显示在数字身份认证设备8中处理的信息以及用于显示可视化的用户界面。
图8仅示出了具有组件81-83以及数字身份认证程序的数字身份认证设备8，本领域技术人员可以理解的是，图8示出的结构并不构成对数字身份认证设备8的限定，可以包括比图示更少或者更多的部件，或者组合某些部件，或者不同的部件布置。
进一步地，本申请还提供了一种数字身份认证装置，应用于区块链平台，参照图9，图9为本申请一实施例揭露的数字身份认证装置的内部结构示意图包括：
存储模块91，用于预先存储注册用户的数字身份信息密文，所述数字身份信息密文由审批终端根据所述注册用户的个人信息加密生成；
第一处理模块92，用于响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至所述用户终端，以便所述用户终端对所述数字身份信息密文进行解密以获取数字身份信息明文；
第二处理模块93，用于响应于所述验证终端发送的数字身份信息获取请求，将所述目标用户的所述数字身份信息密文发送至所述验证终端，以便所述验证终端判断所述数字身份信息密文与所述用户终端提交的数字身份信息明 文是否匹配。
可见，本实施例利用可用性较高的区块链平台进行数字身份信息的存储管理，可提供全天候不间断服务，及时响应于用户终端和验证终端的查询请求，令验证方对用户的数字身份验证工作不再受制于审批方的服务开放时间而得以顺利进行，从而有效提高数字身份认证工作的处理效率，减少对用户时间的占用，提高用户体验。
在上述内容的基础上，优选地，数字身份认证装置还包括：
生成模块，用于在用户注册后生成所述注册用户的加密公钥和用户私钥；
发送模块，用于将所述用户私钥发送至所述用户终端，以便由所述用户终端利用所述用户私钥解密生成所述数字身份信息明文；
所述存储模块还用于存储所述加密公钥，以便由所述审批终端利用查询获取的所述加密公钥根据所述注册用户的个人信息加密生成所述数字身份信息密文。
在上述内容的基础上，优选地，数字身份信息密文包括第一加密消息和第二加密消息，第一加密消息包括第一密文，第二加密消息包括第二密文；第一密文由审批终端利用生成的随机密钥对个人信息进行加密而生成；第二密文由审批终端利用加密公钥对随机密钥进行加密而生成。
在上述内容的基础上，优选地，第一密文具体由审批终端利用随机密钥对由个人信息和生成的随机salt值构成的散列值进行加密而生成。
在上述内容的基础上，优选地，第一加密消息还包括由审批终端利用哈希算法对散列值进行加密而生成的第三密文。
在上述内容的基础上，优选地，第一加密消息还包括由审批终端利用审批终端密钥对第一密文和第三密文进行签名而生成的第一签名值；第二加密消息还包括由审批终端利用审批终端密钥对第二密文进行签名而生成的第二签名值。
进一步地，本申请还提供了另一种数字身份认证装置，应用于区块链平台，参照图10，图10为本申请另一实施例揭露的数字身份认证装置的内部结构示意图，包括：
第一接收模块101，用于接收用户终端发送的数字身份验证请求和数字身份信息明文；数字身份信息明文由用户终端对在区块链平台中查询获取的目标用户的数字身份信息密文解密生成，区块链平台中存储有审批终端生成的各注册用户的数字身份信息密文；
请求模块102，用于向区块链平台发送数字身份信息获取请求；
第二接收模块103，接收区块链平台发送的目标用户的数字身份信息密文；
判断模块104，用于判断数字身份信息密文与用户终端提交的数字身份信息明文是否匹配。
可选地，用户终端提交的数字身份信息明文包括：
由用户终端在利用用户私钥对数字身份信息密文中的第二密文解密生成随机密钥后，利用随机密钥对数字身份信息密文中的第一密文解密生成的散列值；
判断模块104包括：
哈希计算单元，用于利用哈希算法对用户终端提交的散列值加密生成第三验证密文；
哈希判断单元，用于判断第三验证密文与数字身份信息密文中的第三密文是否一致；若否，则判定数字身份信息密文与用户终端提交的数字身份信息明文不匹配。
可选地，判断模块104还包括：
签名单元，用于在判定数字身份信息密文与用户终端提交的数字身份信息明文匹配后，利用验证终端公钥对数字身份信息密文中的第一密文和第三密文进行签名以生成第一签名验证值；
签名判断单元，用于判断第一签名验证值与数字身份信息密文中的第一签名值是否一致；若是，则判定数字身份信息密文与用户终端提交的数字身份信息明文匹配；若否，则判定数字身份信息密文与用户终端提交的数字身份信息明文不匹配。
进一步地，本申请还提供了一种数字身份认证系统，包括区块链平台、与区块链平台连接的审批终端和验证终端；其中，审批终端用于根据注册用户的 个人信息加密生成数字身份信息密文，并发送至区块链平台进行存储；区块链平台用于响应于用户终端发送的数字身份获取请求，将目标用户的数字身份信息密文发送至用户终端，以便用户终端对数字身份信息密文进行解密以获取数字身份信息明文；验证终端用于响应于用户终端发送的数字身份认证请求，判断从区块链平台查询获取的数字身份信息密文与用户终端提交的数字身份信息明文是否匹配。
进一步地，本申请还提供了一种计算机可读存储介质，所述计算机可读存储介质上存储有数字身份认证程序，所述数字身份认证程序可被一个或者多个处理器执行，以实现如上所述的任一种数字身份认证方法。
进一步地，本申请还提供了一种计算机程序产品，包括计算机指令，当其在计算机上运行时，使得计算机可以执行上述任一种数字身份认证方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的数字身份认证设备、系统和计算机可读存储介质的具体工作过程，可以参考 前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，设备和方法，可以通过其它的方式实现。例如，以上所描述的系统实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
需要说明的是，上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。并且本文中的术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、装置、物品或者方法不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、装置、 物品或者方法所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、装置、物品或者方法中还存在另外的相同要素。
以上仅为本发明的优选实施例，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。

Claims (13)

  1. 一种数字身份认证方法，其特征在于，应用于区块链平台，所述区块链平台预先存储有注册用户的数字身份信息密文，所述数字身份信息密文由审批终端根据所述注册用户的个人信息加密生成，所述数字身份认证方法包括：
    响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至所述用户终端，以便所述用户终端对所述数字身份信息密文进行解密以获取数字身份信息明文；
    响应于验证终端发送的数字身份信息获取请求，将所述目标用户的所述数字身份信息密文发送至所述验证终端，以便所述验证终端判断所述数字身份信息密文与所述用户终端提交的数字身份信息明文是否匹配。
  2. 根据权利要求1所述的数字身份认证方法，其特征在于，所述区块链平台在用户注册后生成注册用户的加密公钥和用户私钥，以便由所述审批终端利用查询获取的所述加密公钥根据所述注册用户的个人信息加密生成所述数字身份信息密文，并由所述用户终端利用所述区块链平台发送的所述用户私钥解密生成所述数字身份信息明文。
  3. 根据权利要求2所述的数字身份认证方法，其特征在于，所述数字身份信息密文包括第一加密消息和第二加密消息，所述第一加密消息包括第一密文，所述第二加密消息包括第二密文；
    所述审批终端利用查询获取的所述加密公钥对所述注册用户的个人信息加密生成所述数字身份信息密文包括：
    向所述区块链平台查询获取所述加密公钥；
    生成随机密钥；
    利用所述随机密钥对所述个人信息进行加密以生成所述第一密文；
    利用所述加密公钥对所述随机密钥进行加密以生成所述第二密文。
  4. 根据权利要求3所述的数字身份认证方法，其特征在于，所述利用所述随机密钥对所述个人信息进行加密以生成所述第一密文包括：
    生成随机salt值；
    对由所述个人信息和所述随机salt值构成的散列值进行加密以生成所述第一密文。
  5. 根据权利要求4所述的数字身份认证方法，其特征在于，所述第一加密消息还包括由所述审批终端利用哈希算法对所述散列值进行加密而生成的第三密文。
  6. 根据权利要求5所述的数字身份认证方法，其特征在于，所述第一加密消息还包括由所述审批终端利用审批终端密钥对所述第一密文和所述第三密文进行签名而生成的第一签名值；
    所述第二加密消息还包括由所述审批终端利用所述审批终端密钥对所述第二密文进行签名而生成的第二签名值。
  7. 根据权利要求6所述的数字身份认证方法，其特征在于，所述用户终端利用所述区块链平台发送的所述用户私钥解密生成所述数字身份信息明文包括：
    所述用户终端利用所述用户私钥对所述数字身份信息密文中的所述第二密文解密生成所述随机密钥；利用所述随机密钥对所述数字身份信息密文中的所述第一密文解密生成所述散列值；
    所述验证终端判断所述数字身份信息密文与所述用户终端提交的数字身份信息明文是否匹配包括：
    所述验证终端利用哈希算法对所述用户终端提交的所述散列值加密生成第三验证密文；判断所述第三验证密文与所述数字身份信息密文中的所述第三密文是否一致；若否，则判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文不匹配。
  8. 根据权利要求7所述的数字身份认证方法，其特征在于，在所述判断所述第三验证密文与所述数字身份信息密文中的所述第三密文是否一致之后，还包括：
    若是，则所述验证终端利用验证终端公钥对所述数字身份信息密文中的所述第一密文和所述第三密文进行签名以生成第一签名验证值；
    判断所述第一签名验证值与所述数字身份信息密文中的所述第一签名值是否一致；
    若是，则判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文匹配；
    若否，则判定所述数字身份信息密文与所述用户终端提交的数字身份信息明文不匹配。
  9. 一种数字身份认证方法，其特征在于，应用于验证终端，包括：
    接收用户终端发送的数字身份验证请求和数字身份信息明文；所述数字身份信息明文由所述用户终端对在区块链平台中查询获取的目标用户的数字身份信息密文解密生成，所述区块链平台中存储有审批终端生成的各注册用户的数字身份信息密文；
    向所述区块链平台发送数字身份信息获取请求；
    接收所述区块链平台发送的所述目标用户的所述数字身份信息密文；
    判断所述数字身份信息密文与所述用户终端提交的所述数字身份信息明文是否匹配。
  10. 一种数字身份认证设备，其特征在于，包括存储器、处理器和总线，所述存储器上存储有可在所述处理器上运行的数字身份认证程序，所述数字身份认证程序被所述处理器执行时实现如权利要求1至8任一项所述的数字身份认证方法。
  11. 一种数字身份认证装置，其特征在于，应用于区块链平台，包括：
    存储模块，用于预先存储注册用户的数字身份信息密文，所述数字身份信息密文由审批终端根据所述注册用户的个人信息加密生成；
    第一处理模块，用于响应于用户终端发送的数字身份信息获取请求，将目标用户的数字身份信息密文发送至所述用户终端，以便所述用户终端对所述数字身份信息密文进行解密以获取数字身份信息明文；
    第二处理模块，用于响应于验证终端发送的数字身份信息获取请求，将所述目标用户的所述数字身份信息密文发送至所述验证终端，以便所述验证终端判断所述数字身份信息密文与所述用户终端提交的数字身份信息明文是否匹配。
  12. 一种数字身份认证系统，其特征在于，包括区块链平台、与所述区块链平台连接的审批终端和验证终端；其中，所述审批终端用于根据注册用户的个人信息加密生成数字身份信息密文，并发送至所述区块链平台进行存储；所述区块链平台用于响应于用户终端发送的数字身份获取请求，将目标用户的数 字身份信息密文发送至所述用户终端，以便所述用户终端对所述数字身份信息密文进行解密以获取数字身份信息明文；所述验证终端用于响应于所述用户终端发送的数字身份认证请求，判断从所述区块链平台查询获取的所述数字身份信息密文与所述用户终端提交的所述数字身份信息明文是否匹配。
  13. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有数字身份认证程序，所述数字身份认证程序可被一个或者多个处理器执行，以实现如权利要求1至8任一项所述的数字身份认证方法。
PCT/CN2020/081807 2019-03-27 2020-03-27 一种数字身份认证方法、设备、装置、系统及存储介质 WO2020192773A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910239256.0A CN109862041B (zh) 2019-03-27 2019-03-27 一种数字身份认证方法、设备、装置、系统及存储介质
CN201910239256.0 2019-03-27

Publications (1)

Publication Number Publication Date
WO2020192773A1 true WO2020192773A1 (zh) 2020-10-01

Family

ID=66902220

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/081807 WO2020192773A1 (zh) 2019-03-27 2020-03-27 一种数字身份认证方法、设备、装置、系统及存储介质

Country Status (2)

Country Link
CN (1) CN109862041B (zh)
WO (1) WO2020192773A1 (zh)

Cited By (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112468493A (zh) * 2020-11-25 2021-03-09 上海电气风电集团股份有限公司 基于现场总线的数据传输方法、身份识别方法及系统
CN113111365A (zh) * 2021-04-22 2021-07-13 广州市人心网络科技有限公司 一种基于信封加密的在线心理咨询隐私数据保护方法、存储介质及系统
CN113158250A (zh) * 2021-04-29 2021-07-23 合肥工业大学 一种排除曾匹配司机的隐私保护网约车方法与系统
CN113536334A (zh) * 2021-06-09 2021-10-22 佛山市青松科技股份有限公司 授权校验方法、模块及系统
CN113779534A (zh) * 2021-09-02 2021-12-10 广州大白互联网科技有限公司 一种基于数字身份的个人信息提供方法和业务平台
CN114362997A (zh) * 2021-12-02 2022-04-15 国网浙江省电力有限公司金华供电公司 变电站智能设备的数据传输方法、装置、智能设备及介质
CN114389889A (zh) * 2022-01-20 2022-04-22 广东蓄能发电有限公司 基于区块链技术的文件全生命周期管理方法及装置
CN114629713A (zh) * 2022-03-25 2022-06-14 阿里云计算有限公司 身份验证方法、装置及系统
CN114844672A (zh) * 2022-03-22 2022-08-02 华为技术有限公司 一种应用可信身份的确认方法、管理单元及设备
CN114944937A (zh) * 2022-04-19 2022-08-26 网易（杭州）网络有限公司 分布式数字身份验证方法、系统、电子设备及存储介质
CN115345617A (zh) * 2022-10-19 2022-11-15 浙江毫微米科技有限公司 一种非同质化通证的生成方法及装置
CN115426185A (zh) * 2022-09-01 2022-12-02 中国联合网络通信集团有限公司 信息找回方法、装置和电子设备
CN115442123A (zh) * 2022-09-01 2022-12-06 中国联合网络通信集团有限公司 实名制认证方法、装置、电子设备及计算机可读介质
CN117010024A (zh) * 2023-10-07 2023-11-07 国网山东省电力公司滨州市滨城区供电公司 光伏发电结算方法、系统、终端及存储介质
CN117093545A (zh) * 2023-10-19 2023-11-21 广州卓腾科技有限公司 一种电动自行车证照数据存储与管理方法、系统及介质

Families Citing this family (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109862041B (zh) * 2019-03-27 2021-06-15 深圳市网心科技有限公司 一种数字身份认证方法、设备、装置、系统及存储介质
CN110233850B (zh) * 2019-06-20 2021-08-31 浪潮卓数大数据产业发展有限公司 基于联盟链的注册方法、应用服务器、用户端以及系统
CN111193761B (zh) * 2019-09-11 2021-09-28 腾讯科技（深圳）有限公司 一种文件传输方法、装置及可读存储介质
CN112543166B (zh) * 2019-09-20 2023-07-21 朗新数据科技有限公司 实名登录的方法及装置
CN111404692B (zh) * 2020-03-05 2023-04-07 湖南城市学院 一种基于大数据的区块链身份信息确认系统及确认方法
CN111695097A (zh) * 2020-05-29 2020-09-22 平安科技（深圳）有限公司 登录检验方法、装置及计算机可读存储介质
CN111723347B (zh) * 2020-06-01 2023-06-06 清华大学 身份认证方法、装置、电子设备及存储介质
CN111786795B (zh) * 2020-06-30 2023-08-22 北京泰尔英福科技有限公司 域名注册方法、域名监管方法、客户端及域名监管终端
CN111934882B (zh) * 2020-07-16 2022-05-20 平安国际智慧城市科技股份有限公司 基于区块链的身份认证方法、装置、电子设备及存储介质
CN113221189B (zh) * 2021-04-29 2022-05-03 华中科技大学 基于区块链的身份认证系统、认证方法、介质、终端
CN113569210A (zh) * 2021-07-09 2021-10-29 远光软件股份有限公司 分布式身份认证方法、设备访问方法及装置
CN113743939A (zh) * 2021-09-16 2021-12-03 中国银行股份有限公司 基于区块链的身份认证方法、装置及系统
CN114374522B (zh) * 2022-03-22 2022-06-28 杭州美创科技有限公司 一种可信设备认证方法、装置、计算机设备及存储介质
CN114389903B (zh) * 2022-03-24 2022-09-09 深圳百胜扬工业电子商务平台发展有限公司 一种数字身份信息加密和认证方法
CN114862388B (zh) * 2022-07-01 2022-11-29 浙江毫微米科技有限公司 基于数字钱包的身份管理方法、计算机设备和存储介质
CN115118441B (zh) * 2022-08-29 2022-11-04 中航信移动科技有限公司 一种基于区块链的身份验证系统
CN116071071B (zh) * 2023-03-22 2023-08-08 天聚地合(苏州)科技股份有限公司 基于区块链的数据要素交易方法、系统、存储介质及设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1587238A1 (fr) * 2004-04-16 2005-10-19 Sagem S.A. Procédé de vérification dans un terminal radio de l'authenticité de certificats numériques et système d'authentification
CN106302354A (zh) * 2015-06-05 2017-01-04 北京壹人壹本信息科技有限公司 一种身份认证方法和装置
CN107645382A (zh) * 2017-10-10 2018-01-30 飞天诚信科技股份有限公司 一种身份标识设备及其工作方法
CN108322447A (zh) * 2018-01-05 2018-07-24 中电长城网际系统应用有限公司 云环境下的数据共享方法及系统、终端和云服务器
CN108737394A (zh) * 2018-05-08 2018-11-02 腾讯科技（深圳）有限公司 离线验证系统、扫码设备和服务器
CN109862041A (zh) * 2019-03-27 2019-06-07 深圳市网心科技有限公司 一种数字身份认证方法、设备、装置、系统及存储介质

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107306183B (zh) * 2016-04-22 2021-12-21 索尼公司 客户端、服务端、方法和身份验证系统
US10243743B1 (en) * 2017-09-13 2019-03-26 Vijay K. Madisetti Tokens or crypto currency using smart contracts and blockchains
CN107181765A (zh) * 2017-07-25 2017-09-19 光载无限（北京）科技有限公司 基于区块链技术的网络数字身份认证方法
CN107579817A (zh) * 2017-09-12 2018-01-12 广州广电运通金融电子股份有限公司 基于区块链的用户身份验证方法、装置及系统
CN108111543B (zh) * 2018-02-06 2020-08-04 上海冲量网络科技有限公司 一种区块链上的数字身份识别系统
CN108805573B (zh) * 2018-04-21 2022-04-15 深圳市元征科技股份有限公司 一种信息验证方法、服务器及存储介质
CN109493058A (zh) * 2018-12-14 2019-03-19 深圳壹账通智能科技有限公司 一种基于区块链的身份识别方法及相关设备
CN109327481B (zh) * 2018-12-17 2021-12-14 北京信息科技大学 一种基于区块链的全网统一在线认证方法及系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1587238A1 (fr) * 2004-04-16 2005-10-19 Sagem S.A. Procédé de vérification dans un terminal radio de l'authenticité de certificats numériques et système d'authentification
CN106302354A (zh) * 2015-06-05 2017-01-04 北京壹人壹本信息科技有限公司 一种身份认证方法和装置
CN107645382A (zh) * 2017-10-10 2018-01-30 飞天诚信科技股份有限公司 一种身份标识设备及其工作方法
CN108322447A (zh) * 2018-01-05 2018-07-24 中电长城网际系统应用有限公司 云环境下的数据共享方法及系统、终端和云服务器
CN108737394A (zh) * 2018-05-08 2018-11-02 腾讯科技（深圳）有限公司 离线验证系统、扫码设备和服务器
CN109862041A (zh) * 2019-03-27 2019-06-07 深圳市网心科技有限公司 一种数字身份认证方法、设备、装置、系统及存储介质

Cited By (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112468493A (zh) * 2020-11-25 2021-03-09 上海电气风电集团股份有限公司 基于现场总线的数据传输方法、身份识别方法及系统
CN113111365A (zh) * 2021-04-22 2021-07-13 广州市人心网络科技有限公司 一种基于信封加密的在线心理咨询隐私数据保护方法、存储介质及系统
CN113111365B (zh) * 2021-04-22 2024-04-09 广州市人心网络科技有限公司 一种基于信封加密的在线心理咨询隐私数据保护方法、存储介质及系统
CN113158250B (zh) * 2021-04-29 2022-10-04 合肥工业大学 一种排除曾匹配司机的隐私保护网约车方法与系统
CN113158250A (zh) * 2021-04-29 2021-07-23 合肥工业大学 一种排除曾匹配司机的隐私保护网约车方法与系统
CN113536334A (zh) * 2021-06-09 2021-10-22 佛山市青松科技股份有限公司 授权校验方法、模块及系统
CN113779534A (zh) * 2021-09-02 2021-12-10 广州大白互联网科技有限公司 一种基于数字身份的个人信息提供方法和业务平台
CN113779534B (zh) * 2021-09-02 2024-02-23 广州大白互联网科技有限公司 一种基于数字身份的个人信息提供方法和业务平台
CN114362997A (zh) * 2021-12-02 2022-04-15 国网浙江省电力有限公司金华供电公司 变电站智能设备的数据传输方法、装置、智能设备及介质
CN114362997B (zh) * 2021-12-02 2024-03-19 国网浙江省电力有限公司金华供电公司 变电站智能设备的数据传输方法、装置、智能设备及介质
CN114389889A (zh) * 2022-01-20 2022-04-22 广东蓄能发电有限公司 基于区块链技术的文件全生命周期管理方法及装置
CN114389889B (zh) * 2022-01-20 2023-08-22 广东蓄能发电有限公司 基于区块链技术的文件全生命周期管理方法及装置
CN114844672A (zh) * 2022-03-22 2022-08-02 华为技术有限公司 一种应用可信身份的确认方法、管理单元及设备
CN114844672B (zh) * 2022-03-22 2023-08-22 华为技术有限公司 一种应用可信身份的确认方法、管理单元及设备
CN114629713A (zh) * 2022-03-25 2022-06-14 阿里云计算有限公司 身份验证方法、装置及系统
CN114944937A (zh) * 2022-04-19 2022-08-26 网易（杭州）网络有限公司 分布式数字身份验证方法、系统、电子设备及存储介质
CN114944937B (zh) * 2022-04-19 2024-04-09 网易（杭州）网络有限公司 分布式数字身份验证方法、系统、电子设备及存储介质
CN115426185A (zh) * 2022-09-01 2022-12-02 中国联合网络通信集团有限公司 信息找回方法、装置和电子设备
CN115442123A (zh) * 2022-09-01 2022-12-06 中国联合网络通信集团有限公司 实名制认证方法、装置、电子设备及计算机可读介质
CN115442123B (zh) * 2022-09-01 2024-04-30 中国联合网络通信集团有限公司 实名制认证方法、装置、电子设备及计算机可读介质
CN115345617A (zh) * 2022-10-19 2022-11-15 浙江毫微米科技有限公司 一种非同质化通证的生成方法及装置
CN117010024A (zh) * 2023-10-07 2023-11-07 国网山东省电力公司滨州市滨城区供电公司 光伏发电结算方法、系统、终端及存储介质
CN117010024B (zh) * 2023-10-07 2024-04-16 国网山东省电力公司滨州市滨城区供电公司 光伏发电结算方法、系统、终端及存储介质
CN117093545B (zh) * 2023-10-19 2024-01-26 广州卓腾科技有限公司 一种电动自行车证照数据存储与管理方法、系统及介质
CN117093545A (zh) * 2023-10-19 2023-11-21 广州卓腾科技有限公司 一种电动自行车证照数据存储与管理方法、系统及介质

Also Published As

Publication number Publication date
CN109862041A (zh) 2019-06-07
CN109862041B (zh) 2021-06-15

Similar Documents

Publication Publication Date Title
WO2020192773A1 (zh) 一种数字身份认证方法、设备、装置、系统及存储介质
WO2020191928A1 (zh) 一种数字身份认证方法、设备、装置、系统及存储介质
US11095629B2 (en) Retrieving access data for blockchain networks using highly available trusted execution environments
US11665147B2 (en) Blockchain systems and methods for user authentication
US20210367795A1 (en) Identity-Linked Authentication Through A User Certificate System
JP7181539B2 (ja) 利用者識別認証データを管理する方法および装置
CN110537346B (zh) 安全去中心化域名系统
WO2020062668A1 (zh) 一种身份认证方法、身份认证装置及计算机可读介质
WO2019233204A1 (zh) 密钥管理方法、装置、系统、存储介质和计算机设备
WO2019237570A1 (zh) 电子合同签署方法、装置及服务器
WO2017024934A1 (zh) 实现电子签章的方法、装置及签章服务器
WO2019109097A1 (en) Identity verification document request handling utilizing a user certificate system and user identity document repository
JP2023502346A (ja) 量子安全ネットワーキング
CN111147432B (zh) 具隐密性的kyc数据共享系统及其方法
WO2020215685A1 (zh) 基于区块链的信息处理、获取方法、装置、设备及介质
CN110597836A (zh) 基于区块链网络的信息查询请求响应方法及装置
WO2021098152A1 (zh) 基于区块链的数据处理方法、装置及计算机设备
US20150310441A1 (en) Transaction system method, electronic signature tool, and network bank server authentication
TWI734729B (zh) 實現電子簽章的方法、裝置及簽章伺服器
CN114268447B (zh) 一种文件传输方法、装置、电子设备和计算机可读介质
US11868457B2 (en) Device and method for authenticating user and obtaining user signature using user's biometrics
CN111770081A (zh) 基于角色认证的大数据机密文件访问方法
KR20220059509A (ko) 트랜잭션들의 분산형 저장을 위한 시스템 및 방법
TWI727474B (zh) 數位身分管理系統及方法
CN117544312A (zh) 一种基于属性加密的跨域数字签名方法及其相关设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20779861

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20779861

Country of ref document: EP

Kind code of ref document: A1