WO2021204068A1 - 可验证声明的存储 - Google Patents

可验证声明的存储 Download PDF

Info

Publication number
WO2021204068A1
WO2021204068A1 PCT/CN2021/085182 CN2021085182W WO2021204068A1 WO 2021204068 A1 WO2021204068 A1 WO 2021204068A1 CN 2021085182 W CN2021085182 W CN 2021085182W WO 2021204068 A1 WO2021204068 A1 WO 2021204068A1
Authority
WO
WIPO (PCT)
Prior art keywords
verifiable
storage
data warehouse
request
holder
Prior art date
Application number
PCT/CN2021/085182
Other languages
English (en)
French (fr)
Inventor
杨仁慧
Original Assignee
支付宝(杭州)信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 支付宝(杭州)信息技术有限公司 filed Critical 支付宝(杭州)信息技术有限公司
Publication of WO2021204068A1 publication Critical patent/WO2021204068A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • This application relates to the field of computer technology, in particular to the storage of verifiable claims.
  • DID Decentralized Identifier
  • Distributed digital identity is a digital identity certificate based on a distributed system.
  • Distributed digital identity technology is usually implemented based on the blockchain system.
  • the basic elements that constitute a distributed digital identity include at least distributed digital identity tags and distributed digital identity documents.
  • the distributed digital identity document does not include content related to the user's personal real information (such as the user's real name, address, mobile phone number, etc.). Therefore, when using distributed digital identity verification for identity verification, a verifiable claim (VC) is also needed.
  • VC verifiable claim
  • the verifiable statement here can be understood as a digital certificate issued by an authority with relevant qualifications based on the user's request.
  • a distributed digital identity can have multiple verifiable claims. For example, a verifiable statement proving that the distributed digital identity is employed in a company, a verifiable statement proving that the distributed digital identity is a doctoral degree, a verifiable statement proving that the distributed digital identity is the owner of a certain community, etc. . It can be seen that there is almost no upper limit on the number of verifiable claims that a distributed digital identity can correspond to.
  • the embodiments of the present application provide a method, device, and equipment for storing verifiable claims, which are used to store verifiable claims of distributed digital identity identifiers.
  • An embodiment of the specification provides a method for storing verifiable claims, including: a data warehouse for storing verifiable claims obtains a verifiable claim storage request; obtaining the distributed digital identity of the sender of the request; Distributed digital identity, to determine whether the sender has the right to use the data warehouse, and obtain the first judgment result; when the first judgment result indicates that the sender has the right to use the data warehouse,
  • the verifiable statement requested by the sender to be stored is stored in the database of the data warehouse.
  • An embodiment of this specification provides a method for storing a verifiable claim, including: obtaining a first storage request sent by a holder of a verifiable claim, and the first storage request is used to request the first device to hold the holder.
  • a party’s verifiable statement provides proxy storage services; obtains the holder’s distributed digital identity; according to the distributed digital identity, judges whether the holder has the right to use the proxy storage service, Obtain the first judgment result; when the first judgment result indicates that the holder has the right to use the proxy storage service, a second storage request is sent to the data warehouse for storing verifiable claims, and the second storage The request is used to request the data warehouse to store the verifiable statement of the holder in the database of the data warehouse.
  • An embodiment of this specification provides a method for storing verifiable claims, including: obtaining a first storage request sent by an issuer of a verifiable claim, and the first storage request is used to request that the first device respond to the issuer.
  • the issued verifiable statement provides proxy storage services; obtains the distributed digital identity of the issuer; determines whether the issuer has the authority to use the proxy storage service according to the distributed digital identity of the issuer, Obtain the first judgment result; when the first judgment result indicates that the issuer has the authority to use the proxy storage service, a second storage request is sent to the data warehouse for storing verifiable claims, the second storage request It is used to request the data warehouse to store the verifiable statement issued by the issuer in the database of the data warehouse.
  • the storage device for verifiable claims includes: a verifiable claim storage request acquisition module, which is used to store a data warehouse that stores verifiable claims to obtain a verifiable claim storage request; and a distributed digital identity acquisition module uses To obtain the distributed digital identity of the sender of the request; a first judgment module for judging whether the sender has the right to use the data warehouse according to the distributed digital identity to obtain a first judgment Result; a storage module for storing the verifiable statement requested by the sender for storage in the database of the data warehouse when the first judgment result indicates that the sender has the right to use the data warehouse.
  • a storage device with verifiable claims includes: a first storage request obtaining module, configured to obtain a first storage request sent by a holder of a verifiable claim, the first storage request being used for requesting
  • the first device provides a proxy storage service for the verifiable statement of the holder;
  • a distributed digital identity acquisition module is used to obtain the distributed digital identity of the holder;
  • a first judgment module is used to According to the distributed digital identity, it is judged whether the holder has the right to use the proxy storage service, and the first judgment result is obtained;
  • the second storage request sending module is used for when the first judgment result indicates all
  • the holder has the right to use the proxy storage service and sends a second storage request to the data warehouse for storing verifiable claims, and the second storage request is used to request the data warehouse to transfer the holder’s
  • the verifiable statement is stored in the database of the data warehouse.
  • An embodiment of the specification provides a storage device with a verifiable statement, including: a first storage request acquisition module, configured to obtain a first storage request sent by an issuer of a verifiable statement, and the first storage request is used to request
  • the first device provides a proxy storage service for the verifiable statement issued by the issuer;
  • the distributed digital identity acquisition module is used to obtain the distributed digital identity of the issuer;
  • the first judgment module is used to The distributed digital identity of the issuer determines whether the issuer has the authority to use the proxy storage service and obtains the first determination result;
  • the second storage request sending module is used for when the first determination result indicates that the The issuer has the right to use the proxy storage service, and sends a second storage request to the data warehouse for storing verifiable claims, and the second storage request is used to request the data warehouse to release the issuer’s
  • the verification statement is stored in the database of the data warehouse.
  • An embodiment of this specification provides a verifiable claim storage device, which includes at least one processor and a memory communicatively connected with the at least one processor.
  • the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can: control the acquisition of a data warehouse for storing verifiable statements Verifiable statement storage request; obtain the distributed digital identity of the sender of the request; determine whether the sender has the right to use the data warehouse according to the distributed digital identity, and obtain the first judgment result; When the first judgment result indicates that the sender has the right to use the data warehouse, store the verifiable statement requested by the sender for storage in the database of the data warehouse.
  • An embodiment of this specification provides a verifiable claim storage device, which includes at least one processor and a memory communicatively connected with the at least one processor.
  • the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor can: A storage request, the first storage request is used to request the first device to provide a proxy storage service for the verifiable claim of the holder; obtain the distributed digital identity of the holder; according to the distribution To determine whether the holder has the right to use the proxy storage service, and obtain a first judgment result; when the first judgment result indicates that the holder has the right to use the proxy storage service , Sending a second storage request to a data warehouse for storing verifiable claims, where the second storage request is used to request the data warehouse to store the verifiable claims of the holder in a database of the data warehouse.
  • An embodiment of this specification provides a verifiable claim storage device, which includes at least one processor and a memory communicatively connected with the at least one processor.
  • the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor can: Storage request, the first storage request is used to request the first device to provide a proxy storage service for the verifiable statement issued by the issuer; obtain the distributed digital identity of the issuer; according to the issuer’s Distributed digital identity to determine whether the issuer has the authority to use the proxy storage service, and obtain a first determination result; when the first determination result indicates that the issuer has the authority to use the proxy storage service, A second storage request is sent to a data warehouse for storing verifiable claims, where the second storage request is used to request the data warehouse to store the verifiable claims issued by the issuer in a database of the data warehouse.
  • a data warehouse for storing verifiable claims obtains a verifiable claim storage request, and then obtains the distributed digital identity of the sender of the storage request, according to Distributed digital identity, to determine whether the sender who sends a verifiable statement storage request has the right to use the data warehouse, when the sender has the right to use the data warehouse, store the verifiable statement requested by the sender to the data warehouse database . This completes the storage of the verifiable statement corresponding to the distributed digital identity.
  • Figure 1 is a schematic diagram of the application of a method for storing verifiable claims in an embodiment of this specification
  • FIG. 2 is a schematic flowchart of a method for storing verifiable claims provided in Embodiment 1 of this specification;
  • FIG. 3 is a schematic flow diagram of a method for storing verifiable claims sent by a holder in a method for storing verifiable claims provided in Embodiment 1 of this specification;
  • FIG. 4 is a schematic flowchart of a method for storing a verifiable statement sent by an issuer in a method for storing a verifiable statement provided in Embodiment 1 of this specification;
  • FIG. 5 is a schematic flowchart of a method for storing verifiable claims according to Embodiment 2 of this specification;
  • FIG. 6 is a schematic flow diagram of a method for storing verifiable claims provided by the DIS on behalf of the issuer in the storage method for verifiable claims provided by Embodiment 2 of this specification;
  • FIG. 7 is a schematic flowchart of a method for storing verifiable claims provided in Embodiment 3 of this specification;
  • FIG. 8 is a schematic flowchart of a method for storing a verifiable statement sent by a DIS proxy holder in a method for storing a verifiable statement provided in Embodiment 3 of this specification;
  • FIG. 9 is a schematic structural diagram of a storage device corresponding to the verifiable statement of FIG. 2 provided in this specification.
  • FIG. 10 is a schematic structural diagram of a storage device corresponding to the verifiable statement of FIG. 5 provided in this specification;
  • FIG. 11 is a schematic structural diagram of a storage device corresponding to the verifiable claim of FIG. 2 provided in this specification.
  • FIG. 1 is a schematic diagram of the application of a method for storing verifiable claims in an embodiment of this specification.
  • the client 101 may be a mobile terminal such as a mobile phone, or a device such as a desktop computer.
  • the user's account is logged on the client, and each account can correspond to a distributed digital identity 102.
  • a distributed digital identity can correspond to an individual user, or to a business, or to a company, and so on.
  • a distributed digital identity can also correspond to items in the physical world, for example, it can correspond to a device, or a ticket, and so on.
  • a verifiable statement can be understood as a statement about whether the identity identified by a distributed digital identity has a certain qualification.
  • a verifiable statement can be the data that records such a statement.
  • a distributed digital identity can have multiple verifiable claims 103.
  • the distributed digital identity can include a verifiable statement 1 used to prove that user A is over 18 years old, and it can be used to prove that user A’s property is greater than 1 million.
  • Verification statement 2 verifiable statement 3 used to prove that user A has the qualification to drive a motor vehicle, and so on.
  • the verifiable statement may be issued by an authority with relevant qualifications based on the user's request, and the issued verifiable statement has a unique correspondence with the distributed digital identity of the user applying for the verifiable statement.
  • the issuing agency of verifiable statement 1 may be a police station
  • the issuing agency of verifiable statement 2 may be a bank
  • the issuing agency of verifiable statement 3 may be a vehicle management office.
  • the data warehouse 104 can be used to store the verifiable statements 103 corresponding to the distributed digital identity.
  • Fig. 2 is a schematic flowchart of a method for storing verifiable claims provided by an embodiment of the specification.
  • the execution subject of a process can be a program or an application client loaded on an application server.
  • the execution subject of Embodiment 1 may be a data warehouse, and the data warehouse may be mounted on an application server or a client device.
  • the process can include the following steps:
  • Step 202 A data warehouse (Verifiable Claim Repository, VC Repo) for storing verifiable claims obtains a verifiable claim storage request.
  • VC Repo Very Claim Repository
  • VC Repo can be a data warehouse used to store verifiable claims, can store users' private data and verifiable claims, and has complete authorization control capabilities.
  • the role of VC Repo can include the storage and management of verifiable claims, the control of verifiable claims access rights, and the circulation of verifiable claims.
  • VC Repo can be understood as a logical concept, not a specific entity. In terms of quantity, VC Repo can be one or multiple; it can be deployed on one device or on multiple devices, which is not specifically limited in the embodiment of this specification.
  • the verifiable claim storage request may specifically include the identity information of the sender who sent the verifiable claim storage request, such as the distributed digital identity of the sender; the signature information of the verifiable claim, etc. may also be included.
  • Step 204 Obtain the distributed digital identity of the sender of the request.
  • Distributed digital identity is a globally unique verifiable identity information that does not require a registration agency.
  • the distributed digital identity of a user may include all the identity information of the user, and the distributed digital identity of a company may include all the identity information of the company.
  • the sender may indicate the device corresponding to the sender that sends the verifiable claim storage request to the VC Repo.
  • the "sender" is directly used for discussion.
  • the sender may be the holder of the verifiable claim, the issuer of the verifiable claim, or the device that provides proxy storage of the verifiable claim service in the distributed digital identity service system.
  • the sender can send a verifiable claim storage request to VC Repo and wait for VC Repo to verify.
  • Step 206 According to the distributed digital identity, it is judged whether the sender has the right to use the data warehouse, and a first judgment result is obtained.
  • the usage rights mentioned here may mean that the sender has registered in advance or that the device corresponding to the sender belongs to the authorized device corresponding to VC Repo.
  • Step 208 When the first judgment result indicates that the sender has the right to use the data warehouse, store the verifiable statement requested by the sender for storage in the database of the data warehouse.
  • the verifiable claims can be stored in the VC Repo database. Specifically, only when the sender who sends the verifiable claim storage request has the VC Repo usage rights, can the verifiable claim storage request be stored. The verification statement is stored in the VC Repo database.
  • the method in the above embodiment 1 is used to store the verifiable statement of the verifiable statement.
  • Repo obtains the verifiable statement storage request, and then obtains the distributed digital identity of the sender of the storage request, and judges according to the distributed digital identity Whether the sender who sends a verifiable statement storage request has the right to use VC Repo, when the sender has the right to use VC Repo, store the verifiable statement requested by the sender to store the VC Repo database to complete the distributed digital
  • the verifiable statement corresponding to the identity is stored.
  • Method 1 Determine whether the sender has the right to use VC Repo by judging whether the sender is a registered party of VC Repo.
  • the judging whether the sender has the right to use the VC Repo may specifically include: querying whether the distributed digital identity exists in a set of registered distributed digital identities.
  • the registered distributed digital identity set can be a data table or database with storage function, and the registration information corresponding to the registered device can be stored in the data table or database.
  • Method 2 By verifying the declared signature information, it is judged whether the sender has the right to use VC Repo.
  • the determining whether the sender has the right to use the data warehouse may specifically include: obtaining the signature information contained in the verifiable statement storage request; obtaining the public key corresponding to the distributed digital identity; The public key verifies the signature information.
  • the sender can sign the verifiable statement.
  • the asymmetric encryption algorithm can be used for signing, and different types can be selected according to actual application scenarios.
  • the asymmetric encryption algorithm signs the verifiable statement.
  • Asymmetric encryption algorithms generally require two keys: a public key (publickey, public key for short) and a private key (privatekey, private key for short). If the data is encrypted with the public key, only the corresponding private key can be used to decrypt it; accordingly, if the data is encrypted with the private key, then only the corresponding public key can be used to decrypt the data.
  • the private key can be used to encrypt the verification statement, and then the corresponding public key can be used to decrypt it.
  • the corresponding public key can be determined according to the sender’s distributed digital identity, and the public key is used to verify the signature information. If the sender’s distributed digital identity The public key corresponding to the identifier can decrypt the signature, and it can be considered that the sender has the right to use VC Repo.
  • VC Repo when VC Repo receives a verifiable claim storage request sent by the sender, it can use different methods to determine whether the sender has the right to use the VC Repo, which can ensure that the verifiable claim can be accurately stored in the corresponding VC Repo. In the database.
  • the sender can be the holder of the verifiable claim, or the issuer of the verifiable claim, or it can be a proxy to store verifiable claims in the distributed digital identity.
  • Service equipment Specifically, the sender may be the first device logged into the first account of the holder of the verifiable claim, may be the second device in the distributed digital identity service system that provides the service of proxy storage of verifiable claims, or It is the third device logged into the second account of the issuer with the verifiable claim.
  • first, second, third in the above “first device, second device, and third device” and the “first, second” in “first account, second account” have no special meaning , Is only used to distinguish different sender devices.
  • the holder can refer to the device that holds the verifiable claim
  • the issuer can refer to the device that issues the verifiable claim.
  • the data warehouse can specifically include the following methods when obtaining a verifiable claim storage request:
  • the obtaining of the verifiable claim storage request may specifically include: obtaining the verifiable claim storage request sent by the first device; and the first account of the holder of the verifiable claim is logged on the first device.
  • the obtaining of a verifiable claim storage request may specifically include: obtaining a verifiable claim storage request sent by a second device; the second device is a device that provides a service for proxy storage of verifiable claims in a distributed digital identity service system.
  • the obtaining of the verifiable claim storage request may specifically include: obtaining the verifiable claim storage request sent by the third device; and the second account of the issuer of the verifiable claim is logged on the third device.
  • the sender is the second device that provides the service of proxy storage of verifiable claims in the distributed digital identity service system
  • the mentioned second device can be obtained through the device of the holder of the verifiable claim Verifiable claim, that is, the verifiable invention in the second device may be obtained from the holder of the verifiable claim.
  • the device that provides the service of proxy storage of verifiable claims is also known as the device of the distributed digital identity service (Decentralized Identifier Service, DIS for short).
  • the DIS can act as an agent for the decentralized identity service.
  • the information storage service sent by each device can be represented.
  • the storage service of verifiable claims sent by the holder can be represented, and the storage service of verifiable claims sent by the publisher can also be represented.
  • the sender is the second device or the third device
  • the DIS and the corresponding device of the issuer need to check whether the holder has VC Repo information before storing the requested storage verifiable statement in the VC Repo database.
  • Use authority to judge can include:
  • the storing the verifiable statement requested by the sender to be stored in the database of the data warehouse specifically includes: when the second judgment result indicates that the holder of the verifiable statement has the right to use the data warehouse To store the verifiable statement requested by the sender to be stored in the database of the data warehouse.
  • the verifiable claim in the DIS or the issuer can be obtained from the holder of the verifiable claim, but in order to determine that the verifiable claim has the right to store, it is necessary to judge whether the holder has the right to use VC Repo In addition, VC Repo will also judge whether the DIS or the issuer has the right to use it.
  • the specific process may include the interaction process between the holder, the issuing party, the DIS and the data warehouse of the verifiable claim.
  • FIG. 3 is a schematic flowchart of a method for storing a verifiable statement sent by a holder in a method for storing a verifiable statement provided in Embodiment 1 of the specification.
  • Step 302 The data warehouse obtains the verifiable claim storage request sent by the holder.
  • Step 304 Determine whether the holder has the right to use the data warehouse.
  • Step 306 When it is determined that the holder has the right to use the data warehouse, store the verifiable statement requested by the holder for storage in the database of the data warehouse.
  • FIG. 4 is a schematic flowchart of a method for storing a verifiable statement sent by an issuer in a method for storing a verifiable statement provided in Embodiment 1 of the specification.
  • the specific process for storing the verifiable claim can be:
  • Step 402 The data warehouse obtains the verifiable claim storage request sent by the issuer.
  • Step 404 Determine whether the issuer has the right to use the data warehouse.
  • Step 406 When it is determined that the issuer has the right to use the data warehouse, store the verifiable statement requested by the issuer to be stored in the database of the data warehouse.
  • the specific process for implementing verifiable claim storage can be: the data warehouse obtains the verifiable claim storage request sent by DIS ; Determine whether the DIS has the right to use the data warehouse; when it is determined that the DIS has the right to use the data warehouse, store the verifiable statement requested by the DIS to the database of the data warehouse.
  • FIG. 5 is a schematic flowchart of a method for storing verifiable claims provided in Embodiment 2 of this specification.
  • the execution subject of a process can be a program or an application client loaded on an application server. Specifically, it may be a device used to provide a decentralized identification proxy service. In this embodiment, the execution subject may be the first device used to provide a proxy storage service for verifiable claims, that is, DIS.
  • the process can include the following steps:
  • Step 502 Obtain a first storage request sent by a holder of a verifiable claim, where the first storage request is used to request the first device to provide a proxy storage service for the verifiable claim of the holder.
  • the first device here may be a device corresponding to the DIS.
  • the holder does not directly request the data warehouse to store the verifiable statement, but instead uses the DIS as an agent to send the verifiable statement that needs to be stored to the data warehouse for storage.
  • the first storage request is a storage request sent to the DIS by the holder of the verifiable claim, and the DIS is requested to provide proxy storage services for the verifiable claim.
  • Step 504 Obtain the distributed digital identity of the holder.
  • the distributed digital identity here refers to the identity of the holder's device.
  • Step 506 According to the distributed digital identity, it is judged whether the holder has the right to use the proxy storage service, and the first judgment result is obtained.
  • the DIS can verify whether the holder has the right to use the proxy storage service.
  • Step 508 When the first judgment result indicates that the holder has the right to use the proxy storage service, a second storage request is sent to the data warehouse for storing verifiable claims, and the second storage request is used for The data warehouse is requested to store the verifiable statement of the holder in the database of the data warehouse.
  • DIS can send a storage request to the data warehouse, requesting the data warehouse to store the holder’s verifiable statement in the database of the data warehouse.
  • the method in the above-mentioned embodiment 2 is used for the data warehouse storing verifiable claims to obtain the verifiable claim storage request, and then obtain the distributed digital identity of the sender of the storage request. According to the distributed digital identity, determine whether to send Verify that the sender of the statement storage request has the right to use the data warehouse. When the sender has the right to use the data warehouse, store the verifiable statement requested by the sender for storage in the database of the data warehouse to complete the distributed digital identity The verifiable statement corresponding to the identification is stored.
  • the method may further include: searching for a target data warehouse for which the holder has usage rights from the distributed digital identity document;
  • the sending the second storage request to the data warehouse for storing verifiable claims may specifically include: sending the second storage request to the target data warehouse.
  • the distributed digital identity document can be used to store the relevant information of the distributed digital identity.
  • the document can include the distributed digital identity corresponding to each device, the identity and name of the data warehouse corresponding to each distributed digital identity, and the key of the corresponding device (for example: the distributed digital identity document contains information about The public key of this distributed digital identity), any public credentials that the owner of the identity information wants to disclose, and the network address that can interact with this identity information, etc.
  • the owner of the identity information can query or manage these distributed digital identity documents by obtaining the relevant private key.
  • Distributed digital identity documents are stored on the blockchain, signed using an asymmetric encryption algorithm, the private key is used for encryption, and the public key is required for decryption and verification.
  • all verifiable claims corresponding to distributed digital identities can be stored in a database corresponding to a data warehouse, or in databases in different data warehouses.
  • the corresponding relationship between each distributed digital identity and each data warehouse can be established and stored in the distributed digital identity document. From the distributed digital identity document, the target data for which the holder has the right to use can be found Warehouse and send a storage request to the target data warehouse.
  • the target data warehouse before sending the second storage request to the target data warehouse, it may further include: searching for the key of the holder from the distributed digital identity document; and using the secret Key to generate signature information; generate a second storage request containing the signature information.
  • the key corresponding to the holder can be found from the distributed digital identity document, and the signature information can be generated according to the key, and the storage request of the signature information can be generated.
  • the specific process can include the interaction process between the verifiable claim holder, issuer, DIS, and data warehouse.
  • FIG. 6 is a schematic flow diagram of a verifiable claim storage method sent by the DIS on behalf of the issuer, which is a verifiable claim storage method provided by an embodiment of the specification.
  • Step 602 The holder sends a first storage request to the DIS, where the first storage request is used to request the first device to provide a proxy storage service for the verifiable claim of the holder;
  • Step 604 The DIS judges whether the holder has the right to use the proxy storage service
  • Step 606 When it is determined that the holder has the authority to use the proxy storage service, use the holder's key to generate signature information;
  • Step 608 DIS sends a second storage request containing the signature information to the target data warehouse for which the holder has the right to use, and requests the target data warehouse to store the verifiable statement of the holder in the corresponding database;
  • Step 610 Store the verifiable statement of the holder in the database of the data warehouse.
  • FIG. 7 is a schematic flowchart of a method for storing verifiable claims according to Embodiment 3 of this specification.
  • the execution subject of a process can be a program or an application client loaded on an application server. Specifically, it may be a device used to provide a decentralized identification proxy service. In this embodiment, the execution subject may be the first device used to provide a proxy storage service for verifiable claims, that is, DIS.
  • the process can include the following steps:
  • Step 702 Obtain a first storage request sent by an issuer of a verifiable statement, where the first storage request is used to request the first device to provide a proxy storage service for the verifiable statement issued by the issuer.
  • the execution subject in this embodiment is the same as the execution subject in Embodiment 2.
  • the first storage request in this embodiment may be a storage request sent to DIS by the issuer of the verifiable statement, requesting the DIS to provide proxy storage for the verifiable statement. service.
  • Step 704 Obtain the distributed digital identity of the issuer.
  • Step 706 According to the distributed digital identity of the issuer, determine whether the issuer has the authority to use the proxy storage service, and obtain a first determination result.
  • Step 708 When the first judgment result indicates that the issuer has the permission to use the proxy storage service, a second storage request is sent to the data warehouse for storing verifiable claims, and the second storage request is used to request
  • the data warehouse stores the verifiable statement issued by the issuer in the database of the data warehouse.
  • DIS can send a storage request to the data warehouse, requesting the data warehouse to store the verifiable claim of the issuer in the database of the data warehouse.
  • the data warehouse Before sending the second storage request to the data warehouse for storing verifiable claims, it may further include: searching for a target data warehouse for which the publisher has usage rights from the distributed digital identity document of the publisher;
  • the sending the second storage request to the data warehouse for storing verifiable claims may specifically include: sending the second storage request to the target data warehouse.
  • the issuer Before the obtaining the first storage request sent by the issuer of the verifiable claim, it may further include: obtaining a first authorization request sent by the holder of the verifiable claim; the first authorization request is used to authorize the verifiable claim
  • the issuer has the authority to store the verifiable statement of the holder; obtains the distributed digital identity of the holder; judges the holder based on the distributed digital identity of the holder Whether the party has the right to use the first device, the second judgment result is obtained; when the second judgment result indicates that the holder has the right to use the first device, send a second authorization to the data warehouse Request; the second authorization request is used to request that the issuer be granted the right to store the verifiable statement of the holder in the data warehouse.
  • Embodiment 3 The specific implementation principle of this embodiment is the same as that of Embodiment 2, except that in Embodiment 3, the DIS agent is requested to store the verifiable statement of the issuer to the data warehouse in the database of the data warehouse.
  • the storage of verifiable claims can be implemented by the system that provides proxy services in DIS, which can simplify the operation of the client device.
  • the user terminal only needs to interact with the DIS during the stored procedure for the verifiable claim, and does not need to directly interact with the data warehouse.
  • the verifiable claim sent by the issuer comes from the holder of the verifiable claim.
  • the DIS requests the data warehouse to grant the issuer the right to store the verifiable statement of the holder in the data warehouse.
  • the specific process can include the interaction process between the verifiable claim holder, issuer, DIS, and data warehouse.
  • FIG. 8 is a schematic flowchart of a method for storing a verifiable statement sent by a DIS proxy holder in a method for storing a verifiable statement provided by an embodiment of the specification.
  • Step 802 The holder sends its first authorization request to the DIS, requesting that the authorized issuer has the right to store the holder's verifiable statement;
  • Step 804 DIS determines whether the holder has the right to use the proxy storage service that provides verifiable claims;
  • Step 806 When it is determined that the holder has the authority to use the proxy storage service, send a second authorization request to the data warehouse, requesting that the issuer be granted the authority to store the generated verifiable statement in the data warehouse;
  • Step 808 The holder applies for the issuer to issue a verifiable statement
  • Step 810 Issue a verifiable statement to DIS
  • Step 812 DIS generates a verifiable statement. It should be noted that the issuer issued a verifiable statement, and the specific data content that the verifiable statement needs to be stored can be generated by the DIS.
  • Step 814 DIS sends a storage request with a verifiable claim to the data warehouse
  • Step 816 The data warehouse judges whether the DIS has the right to use the data warehouse
  • Step 818 When it is determined that the DIS has the right to use the data warehouse, store the verifiable statement generated by the DIS in the database of the data warehouse.
  • Embodiment 1 of the above method also provides a device corresponding to Embodiment 1 of the above method.
  • FIG. 9 is a schematic structural diagram of a storage device corresponding to the verifiable statement of FIG. 2 provided in this specification. As shown in Figure 9, the device may include:
  • a verifiable statement storage request acquisition module 902 which is used to obtain a verifiable statement storage request from a data warehouse that stores a verifiable statement;
  • the distributed digital identity acquisition module 904 is used to obtain the distributed digital identity of the sender of the request;
  • the first judgment module 906 is used to judge whether the sender has all the information according to the distributed digital identity. State the use authority of the data warehouse, and obtain the first judgment result;
  • the storage module 908 is configured to store the verifiable statement requested by the sender for storage in the database of the data warehouse when the first judgment result indicates that the sender has the right to use the data warehouse.
  • the first judgment module 906 may specifically include: a query unit configured to query whether the distributed digital identity is in the registered distributed digital identity set.
  • the first judgment module 906 may specifically include: a signature information acquiring unit, configured to acquire the signature information included in the verifiable statement storage request; and a public key acquiring unit, configured to acquire the distributed digital The public key corresponding to the identity; the verification unit is used to verify the signature information by using the public key.
  • a signature information acquiring unit configured to acquire the signature information included in the verifiable statement storage request
  • a public key acquiring unit configured to acquire the distributed digital The public key corresponding to the identity
  • the verification unit is used to verify the signature information by using the public key.
  • the verifiable claim storage request obtaining module may specifically include: a verifiable claim storage request first obtaining unit, configured to obtain a verifiable claim storage request sent by the first device; the first device is logged in with The first account of the holder of the verifiable claim.
  • the verifiable claim storage request obtaining module 902 may specifically include: a verifiable claim storage request second obtaining unit, configured to obtain a verifiable claim storage request sent by a second device; the second device is a distributed A device that provides services for proxy storage of verifiable claims in the integrated digital identity service system.
  • the verifiable claim storage request obtaining module 902 may specifically include: a verifiable claim storage request third obtaining unit, configured to obtain a verifiable claim storage request sent by a third device; logging in to the third device The second account of the issuer with the verifiable statement.
  • the device may further include: a second judgment module, configured to judge the holder of the verifiable claim when the first judgment result indicates that the sender has the right to use the data warehouse
  • the second judgment result is obtained as to whether it has the usage authority of the data warehouse.
  • the storage module specifically includes: a storage unit for storing the verifiable statement requested by the sender when the second judgment result indicates that the holder of the verifiable claim has the right to use the data warehouse
  • the database stored in the data warehouse.
  • Embodiment 2 of the above method also provides a device corresponding to Embodiment 2 of the above method.
  • FIG. 10 is a schematic structural diagram of a storage device corresponding to the verifiable statement of FIG. 5 provided in this specification;
  • the device includes:
  • the first storage request obtaining module 1002 is configured to obtain the first storage request sent by the holder of the verifiable claim, and the first storage request is used to request the first device to provide the verifiable claim from the holder. Proxy storage service;
  • the distributed digital identity acquisition module 1004 is used to acquire the distributed digital identity of the holder
  • the first judgment module 1006 is configured to judge whether the holder has the permission to use the proxy storage service according to the distributed digital identity, and obtain a first judgment result;
  • the second storage request sending module 1008 is configured to send a second storage request to the data warehouse for storing verifiable claims when the first judgment result indicates that the holder has the right to use the proxy storage service, to The data warehouse is requested to store the verifiable statement of the holder in the database of the data warehouse.
  • the device may further include a target data warehouse searching module, which is used to find a target data warehouse for which the holder has usage rights from the distributed digital identity document.
  • the second storage request sending module 1008 specifically includes: a second storage request sending unit, configured to send the second storage request to the target data warehouse.
  • the device may further include: a key search module, which is used to search for the key of the holder from the distributed digital identity document; a signature information generation module, which is used to use the key Generate signature information; a second storage request generation module for generating a second storage request containing the signature information.
  • a key search module which is used to search for the key of the holder from the distributed digital identity document
  • a signature information generation module which is used to use the key Generate signature information
  • a second storage request generation module for generating a second storage request containing the signature information.
  • the embodiment of this specification also provides a device corresponding to Embodiment 3 of the above method, and the device includes:
  • the first storage request obtaining module is used to obtain the first storage request sent by the issuer of the verifiable statement, and the first storage request is used to request the first device to provide proxy storage for the verifiable statement issued by the issuer service;
  • the distributed digital identity acquisition module is used to acquire the distributed digital identity of the issuer
  • the first judgment module is configured to judge whether the publisher has the use authority of the proxy storage service according to the distributed digital identity of the publisher, and obtain the first judgment result;
  • the second storage request sending module is configured to send a second storage request to the data warehouse for storing verifiable claims when the first judgment result indicates that the issuer has the right to use the proxy storage service, so as to request the
  • the data warehouse stores the verifiable statement issued by the issuer in the database of the data warehouse.
  • the device may further include a target data warehouse searching module, which is used to search for a target data warehouse for which the publisher has usage rights from the distributed digital identity document of the publisher.
  • the second storage request sending module may specifically include: a second storage request sending unit configured to send the second storage request to the target data warehouse.
  • the device may further include: a first authorization request obtaining module, configured to obtain a first authorization request sent by a holder of a verifiable claim, and the first authorization request is used to authorize the verifiable claim
  • the issuing party has the authority to store the verifiable statement of the holder;
  • the distributed digital identity acquisition module is used to obtain the distributed digital identity of the holder;
  • the second judgment module is used to The distributed digital identity of the holder determines whether the holder has the right to use the first device to obtain a second judgment result;
  • a second authorization request sending module is used to determine whether the holder has the second judgment result It means that the holder has the right to use the first device, and sends a second authorization request to the data warehouse;
  • the second authorization request is used to request the issuer to grant the holder’s verifiable Declare the permission to store to the data warehouse.
  • the embodiment of this specification also provides a device corresponding to the method in the foregoing embodiment 1.
  • FIG. 11 is a schematic structural diagram of a storage device corresponding to the verifiable claim of FIG. 2 provided in this specification.
  • the device 1100 may include at least one processor 1110 and a memory 1130 communicatively connected with the at least one processor.
  • the memory 1130 stores storage that can be executed by the at least one processor 1110.
  • the instructions may enable the at least one processor 1110 to: control the data warehouse for storing verifiable claims to obtain a verifiable claim storage request; obtain the distributed digital identity of the sender of the request ; According to the distributed digital identity, it is determined whether the sender has the right to use the data warehouse, and the first judgment result is obtained; when the first judgment result indicates that the sender has the use of the data warehouse Permission to store the verifiable statement requested by the sender to be stored in the database of the data warehouse.
  • the embodiment of this specification also provides a device corresponding to the method in the foregoing embodiment 1.
  • the device may include at least one processor and a memory communicatively connected with the at least one processor.
  • the memory is stored to be executable by the at least one processor.
  • the instructions may enable the at least one processor to: obtain a first storage request sent by the holder of the verifiable claim, the first storage request being used to request the first device to access the The verifiable statement of the holder provides proxy storage services; obtains the distributed digital identity of the holder; determines whether the holder has the use of the proxy storage service according to the distributed digital identity Permission to obtain the first judgment result; when the first judgment result indicates that the holder has the right to use the proxy storage service, a second storage request is sent to the data warehouse for storing verifiable claims, and the first The second storage request is used to request the data warehouse to store the verifiable statement of the holder in the database of the data warehouse.
  • the embodiment of this specification also provides a device corresponding to the method in the foregoing embodiment 1.
  • the device may include at least one processor and a memory communicatively connected with the at least one processor.
  • the memory is stored to be executable by the at least one processor.
  • the instruction may enable the at least one processor to: obtain the first storage request sent by the issuer of the verifiable statement, and the first storage request is used to request the first device to The verifiable statement issued by the issuer provides proxy storage services; obtains the distributed digital identity of the issuer; determines whether the issuer has the use of the proxy storage service according to the distributed digital identity of the issuer Permission, the first judgment result is obtained; when the first judgment result indicates that the issuer has the permission to use the proxy storage service, a second storage request is sent to the data warehouse for storing verifiable claims, and the second The storage request is used to request the data warehouse to store the verifiable statement issued by the issuer in the database of the data warehouse.
  • the improvement of a technology can be clearly distinguished between hardware improvements (for example, improvements in circuit structures such as diodes, transistors, switches, etc.) or software improvements (improvements in method flow).
  • hardware improvements for example, improvements in circuit structures such as diodes, transistors, switches, etc.
  • software improvements improvements in method flow.
  • the improvement of many methods and processes of today can be regarded as a direct improvement of the hardware circuit structure.
  • Designers almost always get the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be realized by the hardware entity module.
  • a programmable logic device for example, a Field Programmable Gate Array (Field Programmable Gate Array, FPGA)
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • HDL Hardware Description Language
  • ABEL Advanced Boolean Expression Language
  • AHDL Altera Hardware Description Language
  • HDCal JHDL
  • Lava Lava
  • Lola MyHDL
  • PALASM RHDL
  • VHDL Very-High-Speed Integrated Circuit Hardware Description Language
  • Verilog Verilog
  • the controller can be implemented in any suitable manner.
  • the controller can take the form of, for example, a microprocessor or a processor and a computer-readable medium storing computer-readable program codes (such as software or firmware) executable by the (micro)processor. , Logic gates, switches, application specific integrated circuits (ASICs), programmable logic controllers and embedded microcontrollers. Examples of controllers include but are not limited to the following microcontrollers: ARC625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicon Labs C8051F320, the memory controller can also be implemented as part of the memory control logic.
  • controllers in addition to implementing the controller in a purely computer-readable program code manner, it is completely possible to program the method steps to make the controller use logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded logic.
  • the same function can be realized in the form of a microcontroller or the like. Therefore, such a controller can be regarded as a hardware component, and the devices included in it for realizing various functions can also be regarded as a structure within the hardware component. Or even, a device for realizing various functions can be regarded as both a software module for realizing the method and a structure within a hardware component.
  • a typical implementation device is a computer.
  • the computer may be, for example, a personal computer, a laptop computer, a cell phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or Any combination of these devices.
  • the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • the computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-permanent memory in computer readable media, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer readable media.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash memory
  • Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology.
  • the information can be computer-readable instructions, data structures, program modules, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cartridges, magnetic tape storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.
  • This application may be described in the general context of computer-executable instructions executed by a computer, such as a program module.
  • program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types.
  • This application can also be practiced in distributed computing environments. In these distributed computing environments, tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

Abstract

本说明书实施例公开了一种可验证声明的存储方法、装置及设备。方案包括：用于存储可验证声明的数据仓库获取可验证声明存储请求，并获取该请求的发送方的分布式数字身份标识，根据发送方的分布式数字身份标识可以判断发送方是否具有数据仓库的使用权限；如果发送方具有数据仓库的使用权限，就可以将发送方请求存储的可验证声明存储至数据仓库的数据库。

Description

可验证声明的存储 技术领域
本申请涉及计算机技术领域，尤其涉及可验证声明的存储。
背景技术
最初，数字身份认证是中心化的。中心化身份系统的本质是中央集权化的权威机构掌握着身份数据。围绕数据进行的认证、授权等过程都由中心化的机构来决定。数字身份不是由用户自己控制的。另一方面，不同的中心化网站上各自有一套身份系统，所以用户在每个网站都需要重新注册一个账户。不同网站的身份系统(及账户对应的数据)之间是不互通的。综上所述，中心化身份主要的问题至少有以下两个，一是用户并不能够在真正意义上拥有自己的身份，二是身份无法互通。
为了解决上述问题，分布式数字身份(Decentralized Identifier，DID)的技术概念被提出。分布式数字身份，顾名思义，是基于分布式系统实现的一种数字化的身份凭证。分布式数字身份技术通常是基于区块链系统实现的。构成一个分布式数字身份的基础元素，至少包括分布式数字身份标识和分布式数字身份文档。
分布式数字身份文档中不包括与用户的个人真实信息相关的内容(比如用户的真实姓名、地址、手机号等)。因此，采用分布式数字身份验证进行身份验证时，还需要用到可验证声明(Verifiable Claim，VC)。
这里的可验证声明，可以理解为具有相关资质的权威机构基于用户的请求而颁发的数字凭证。一个分布式数字身份可以具有对应的多个可验证声明。例如，证明该分布式数字身份在某公司就职的可验证声明，证明该分布式数字身份的学历为博士毕业的可验证声明，证明该分布式数字身份是某小区的业主的可验证声明等等。可以看出，一个分布式数字身份可以对应的可验证声明的数量几乎是没有上限的。
此时，对于可验证声明的存储与管理就成为亟待解决的技术问题。
发明内容
有鉴于此，本申请实施例提供了一种可验证声明的存储方法、装置及设备，用于对分布式数字身份标识的可验证声明进行存储。
为解决上述技术问题，本说明书实施例是这样实现的：
本说明书实施例提供的一种可验证声明的存储方法，包括：用于存储可验证声明的数据仓库获取可验证声明存储请求；获取所述请求的发送方的分布式数字身份标识；根据所述分布式数字身份标识，判断所述发送方是否具有所述数据仓库的使用权限，得到第一判断结果；当所述第一判断结果表示所述发送方具有所述数据仓库的使用权限，将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库。
本说明书实施例提供的一种可验证声明的存储方法，包括：获取可验证声明的持有方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述持有方的可验证声明提供代理存储服务；获取所述持有方的分布式数字身份标识；根据所述分布式数字身份标识，判断所述持有方是否具有所述代理存储服务的使用权限，得到第一判断结果；当所述第一判断结果表示所述持有方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述持有方的可验证声明存储至所述数据仓库的数据库。
本说明书实施例提供的一种可验证声明的存储方法，包括：获取可验证声明的发布方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述发布方发布的可验证声明提供代理存储服务；获取所述发布方的分布式数字身份标识；根据所述发布方的分布式数字身份标识，判断所述发布方是否具有所述代理存储服务的使用权限，得到第一判断结果；当所述第一判断结果表示所述发布方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述发布方的发布可验证声明存储至所述数据仓库的数据库。
本说明书实施例提供的一种可验证声明的存储装置，包括：可验证声明存储请求获取模块，用于存储可验证声明的数据仓库获取可验证声明存储请求；分布式数字身份标识获取模块，用于获取所述请求的发送方的分布式数字身份标识；第一判断模块，用于根据所述分布式数字身份标识，判断所述发送方是否具有所述数据仓库的使用权限，得到第一判断结果；存储模块，用于当所述第一判断结果表示所述发送方具有所述数据仓库的使用权限，将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库。
本说明书实施例提供的一种可验证声明的存储装置，包括：第一存储请求获取模块，用于获取可验证声明的持有方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述持有方的可验证声明提供代理存储服务；分布式数字身份标识获取模块，用于获取所述持有方的分布式数字身份标识；第一判断模块，用于根据所述分布式数字 身份标识，判断所述持有方是否具有所述代理存储服务的使用权限，得到第一判断结果；第二存储请求发送模块，用于当所述第一判断结果表示所述持有方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述持有方的可验证声明存储至所述数据仓库的数据库。
本说明书实施例提供的一种可验证声明的存储装置，包括：第一存储请求获取模块，用于获取可验证声明的发布方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述发布方发布的可验证声明提供代理存储服务；分布式数字身份标识获取模块，用于获取所述发布方的分布式数字身份标识；第一判断模块，用于根据所述发布方的分布式数字身份标识，判断所述发布方是否具有所述代理存储服务的使用权限，得到第一判断结果；第二存储请求发送模块，用于当所述第一判断结果表示所述发布方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述发布方的发布可验证声明存储至所述数据仓库的数据库。
本说明书实施例提供的一种可验证声明存储设备，包括至少一个处理器以及与所述至少一个处理器通信连接的存储器。所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够：控制用于存储可验证声明的数据仓库获取可验证声明存储请求；获取所述请求的发送方的分布式数字身份标识；根据所述分布式数字身份标识，判断所述发送方是否具有所述数据仓库的使用权限，得到第一判断结果；当所述第一判断结果表示所述发送方具有所述数据仓库的使用权限，将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库。
本说明书实施例提供的一种可验证声明存储设备，包括至少一个处理器以及与所述至少一个处理器通信连接的存储器。所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够：获取可验证声明的持有方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述持有方的可验证声明提供代理存储服务；获取所述持有方的分布式数字身份标识；根据所述分布式数字身份标识，判断所述持有方是否具有所述代理存储服务的使用权限，得到第一判断结果；当所述第一判断结果表示所述持有方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述持有方的可验证声明存储至所述数据仓库的数据库。
本说明书实施例提供的一种可验证声明存储设备，包括至少一个处理器以及与所述 至少一个处理器通信连接的存储器。所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够：获取可验证声明的发布方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述发布方发布的可验证声明提供代理存储服务；获取所述发布方的分布式数字身份标识；根据所述发布方的分布式数字身份标识，判断所述发布方是否具有所述代理存储服务的使用权限，得到第一判断结果；当所述第一判断结果表示所述发布方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述发布方的发布可验证声明存储至所述数据仓库的数据库。
本说明书实施例采用的上述至少一个技术方案能够达到以下有益效果：用于存储可验证声明的数据仓库获取可验证声明存储请求，然后再获取该存储请求的发送方的分布式数字身份标识，根据分布式数字身份标识，判断发送可验证声明存储请求的发送方是否具有数据仓库的使用权限，当发送方具有数据仓库的使用权限时，将发送方请求存储的可验证声明存储至数据仓库的数据库。从而完成对分布式数字身份标识对应的可验证声明进行存储。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为本说明书实施例中一种可验证声明的存储方法的应用示意图；
图2为本说明书实施例1提供的一种可验证声明的存储方法的流程示意图；
图3为本说明书实施例1提供的一种可验证声明的存储方法中持有方发送的可验证声明存储方法的流程示意图；
图4为本说明书实施例1提供的一种可验证声明的存储方法中发布方发送的可验证声明存储方法的流程示意图；
图5为本说明书实施例2提供的一种可验证声明的存储方法的流程示意图；
图6为本说明书实施例2提供的一种可验证声明的存储方法DIS代理发布方发送的可验证声明存储方法的流程示意图；
图7为本说明书实施例3提供的一种可验证声明的存储方法的流程示意图；
图8为本说明书实施例3提供的一种可验证声明的存储方法中DIS代理持有方发送的可验证声明的存储方法的流程示意图；
图9为本说明书提供的对应于图2的一种可验证声明的存储装置的结构示意图；
图10为本说明书提供的对应于图5的一种可验证声明的存储装置的结构示意图；
图11为本说明书提供的对应于图2的一种可验证声明的存储设备的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合本申请具体实施例及相应的附图对本申请技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
以下结合附图，详细说明本申请各实施例提供的技术方案。
图1为本说明书实施例中一种可验证声明的存储方法的应用示意图。如图1所示，客户端101可以是手机等移动终端，也可以是台式电脑等设备。客户端上登录有用户的账号，每个账号可以对应于一个分布式数字身份标识102。实际应用中：一个分布式数字身份标识可以对应于一个个人用户，或者对应于一个商家，或者对应于一个公司等等。一个分布式数字身份标识也可以与物理世界的物品相对应，例如，可以对应一个设备，或者一张票据等等。
可验证声明可以理解为对于一个分布式数字身份标识所标识的身份是否具有某种资质的声明。具体到数据层面，可验证声明可以是记录这种声明的数据。
一个分布式数字身份可以具有多个可验证声明103。比如：对于用户A使用的一个分布式数字身份来说，这个分布式数字身份标识可以包含用于证明用户A年满18周岁的可验证声明1，用于证明用户A的财产大于100万的可验证声明2，用于证明用户A具有机动车辆驾驶资格的可验证声明3等等。实际应用中，可验证声明可以是由具有相关资质的权威机构基于用户的请求而颁发的，颁发的可验证声明与申请该可验证声明的用户的分布式数字身份具有唯一的对应关系。例如，在前面的三个具体例子中，可验证声明1的颁发机构可以是派出所，可验证声明2的颁发机构可以是银行，可验证声明3的颁发机构可以是车辆管理所。
实际应用中，用户A也即一个分布式数字身份标识对应的可验证声明可以有很多(n 个)。此时，众多的可验证声明需要进行统一存储和管理，因此，可以采用数据仓库104来存储分布式数字身份标识对应的可验证声明103。
具体地，可以采用以下方法步骤对本方案进行说明：
图2为本说明书实施例提供的一种可验证声明的存储方法的流程示意图。从程序角度而言，流程的执行主体可以为搭载于应用服务器的程序或应用客户端。具体地，实施例1的执行主体可以是数据仓库，该数据仓库可以搭载于应用服务器或客户端设备。
如图2所示，该流程可以包括以下步骤：
步骤202：用于存储可验证声明的数据仓库(Verifiable Claim Repository，VC Repo)获取可验证声明存储请求。
需要说明的是，VC Repo可以是用于存储可验证声明的数据仓库，可以保存用户的私有数据和可验证声明，并且具备完备的授权控制能力。VC Repo的作用可以包括可验证声明的存储与管理、可验证声明访问权限控制以及可验证声明流转等。
VC Repo可以理解为一种逻辑概念，并不是具体实体。在数量上，VC Repo可以是一个，也可以是多个；可以部署在一个设备上，也可以部署在多个设备上，本说明书实施例对此不做具体限定。
可验证声明存储请求中具体可以包括发送可验证声明存储请求的发送方的身份标识信息，比如：发送方的分布式数字身份标识；还可以包括可验证声明的签名信息等等。
VC Repo存储可验证声明时，可以先获取可验证声明存储请求。
步骤204：获取所述请求的发送方的分布式数字身份标识。
分布式数字身份标识是一个无需注册机构的全球唯一的可验证身份信息。一个用户的分布式数字身份标识可以包含该用户所有的身份标识信息，一个公司的分布式数字身份标识可以包含该公司所有的身份标识信息。
在可验证声明的保存场景中，发送方可以表示向VC Repo发送可验证声明存储请求的发送方对应的设备，在本说明书实施例中为了论述方便，直接采用“发送方”来进行论述。
在本说明书实施例中，发送方可以是可验证声明的持有方，也可以是可验证声明的发布方，还可以是分布式数字身份标识服务系统中提供代理存储可验证声明服务的设备。发送方可以向VC Repo发送可验证声明存储请求，等待VC Repo进行验证。
步骤206：根据所述分布式数字身份标识，判断所述发送方是否具有所述数据仓库的使用权限，得到第一判断结果。
在实际应用中，只有具备VC Repo的使用权限，才能将对应的可验证声明存储到VC Repo的数据库中。在具体判断时，可以根据获取到的可验证声明请求中的发送方的分布式数字身份标识进行判断。
其中，这里提到的使用权限可以表示发送方提前注册过或者发送方对应的设备属于VC Repo对应的授权设备。
步骤208：当所述第一判断结果表示所述发送方具有所述数据仓库的使用权限，将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库。
在具体存储可验证声明时，可以将可验证声明存储在VC Repo的数据库中，具体地，只有当发送可验证声明存储请求的发送方具有VC Repo使用权限时，才能将发送发请求存储的可验证声明存储到VC Repo的数据库中。
上述实施例1中的方法，用于存储可验证声明的可验证声明Repo获取可验证声明存储请求，然后再获取该存储请求的发送方的分布式数字身份标识，根据分布式数字身份标识，判断发送可验证声明存储请求的发送方是否具有VC Repo的使用权限，当发送方具有VC Repo的使用权限时，将发送方请求存储的可验证声明存储至VC Repo的数据库，从而完成对分布式数字身份标识对应的可验证声明进行存储。
本说明书实施例还提供了该方法的一些具体实施方案，下面基于图2进行说明。
图2中的方法，在判断发送方是否具备数据仓库的使用权限时，具体可以采用以下方法：
方法一、通过判断发送方是否属于VC Repo的注册方，来判断发送方是否具有VC Repo的使用权限。
所述判断所述发送方是否具有所述VC Repo的使用权限，具体可以包括：查询所述分布式数字身份标识是否存在于已注册的分布式数字身份标识集合中。
在实际应用中，已注册的分布式数字身份标识集合可以是具有存储功能的数据表或数据库，注册过的设备对应的注册信息都可以存储在该数据表或数据库中。在判断发送方是否具有VC Repo的使用权限时，可以查询发送方的分布式数字身份标识是否存在于已注册的分布式数字身份标识集合中，如果存在，可以认为该发送方属于已注册设备， 具备VC Repo的使用权限。
方法二、通过验证可验证声明的签名信息，判断发送方是否具有VC Repo的使用权限。
所述判断所述发送方是否具有所述数据仓库的使用权限，具体可以包括：获取所述可验证声明存储请求中包含的签名信息；获取所述分布式数字身份标识对应的公钥；采用所述公钥对所述签名信息进行验证。
发送方在向VC Repo发送可验证声明存储请求时，可以对可验证声明进行签名，具体地，对可验证声明进行签名时，可以选用非对称加密算法进行签名，可以根据实际应用场景选用不同的非对称加密算法对可验证声明进行签名。
非对称加密算法一般需要两个密钥:公开密钥(publickey，简称公钥)和私有密钥(privatekey，简称私钥)。如果用公钥对数据进行加密，只有用对应的私钥才能解密；相应地，如果用私钥对数据进行加密，那么只有用对应的公钥才能解密。在上述方法中，可以采用私钥对验证声明进行加密，然后采用对应的公钥进行解密。具体地，由于可验证声明请求中包含有签名信息，根据发送方的分布式数字身份标识可以确定对应的公钥，采用该公钥对所述签名信息进行验证，如果发送方的分布式数字身份标识对应的公钥能够对签名进行解密，可以认为发送方具有VC Repo的使用权限。
通过上述方法，VC Repo在收到发送方发送的可验证声明存储请求时，可以采用不同的方法判断发送方是否具有VC Repo的使用权限，可以保证可验证声明能够准确存储到对应的VC Repo的数据库中。
在对图2中的方法步骤204中，提到发送方可以是可验证声明的持有方，也可以是可验证声明的发布方，还可以是分布式数字身份中提供代理存储可验证声明的服务的设备。具体地，发送方可以是登录有可验证声明的持有方的第一账户的第一设备，可以是分布式数字身份标识服务系统中提供代理存储可验证声明的服务的第二设备，还可以是登录有可验证声明的发布方的第二账户的第三设备。
上述“第一设备、第二设备、第三设备”中的“第一、第二、第三”及“第一账户、第二账户”中的“第一、第二”并没有特殊的含义，只是用于区分不同的发送方设备。
持有方可以表示持有可验证声明的设备，发布方可以表示发布可验证声明的设备。
对于不同的发送方，数据仓库在获取可验证声明存储请求时，具体可以包括以下方法：
所述获取可验证声明存储请求，具体可以包括：获取第一设备发送的可验证声明存储请求；所述第一设备上登录有所述可验证声明的持有方的第一账户。
所述获取可验证声明存储请求，具体可以包括：获取第二设备发送的可验证声明存储请求；所述第二设备是分布式数字身份标识服务系统中提供代理存储可验证声明的服务的设备。
所述获取可验证声明存储请求，具体可以包括：获取第三设备发送的可验证声明存储请求；所述第三设备上登录有所述可验证声明的发布方的第二账户。
需要说明的是，当发送方为分布式数字身份标识服务系统中提供代理存储可验证声明的服务的第二设备时，提到的第二设备可以通过可验证声明的持有方的设备获取到可验证声明，即第二设备中的可验证发明可以是从可验证声明的持有方获得的。
在分布式数字身份标识服务系统中，提供代理存储可验证声明的服务的设备也称为分布式数字身份标识代理服务(Decentralized Identifier Service，简称DIS)的设备，DIS可以代理去中心化标识服务，具体地，可以代理各个设备发送的信息存储服务，在本说明书实施例中，可以代理持有方发送的可验证声明的存储服务，也可以代理发布方发送的可验证声明的存储服务。
进一步地，当发送方为第二设备或第三设备时，由于DIS以及发布方对应的设备在将请求存储的可验证声明存储至VC Repo的数据库之前，需要对持有方是否具有VC Repo的使用权限进行判断。具体地，可以包括：
当所述第一判断结果表示所述发送方具有所述数据仓库的使用权限，判断所述可验证声明的持有方是否具有所述数据仓库的使用权限，得到第二判断结果；
所述将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库，具体包括：当所述第二判断结果表示所述可验证声明的持有方具有所述数据仓库的使用权限，将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库。
在实际应用中，DIS或发布方中的可验证声明可以从可验证声明的持有方获得，但是为了确定可验证声明具有存储的权限，需要对持有方是否具有VC Repo的使用权限进行判断，除此之外，VC Repo还会对DIS或发布方是否具有使用权限也进行判断。
上述实施例1中提供的可验证声明的存储方法可以具体通过以下流程进行实现：
具体的流程可包括可验证声明的持有方、发布方、DIS及数据仓库之间的交互流程。
图3为本说明书实施例1提供的一种可验证声明存储方法中持有方发送的可验证声明存储方法的流程示意图。
如图3所示，当发送方为可验证声明的持有方时，具体实现可验证声明存储的流程可以为：
步骤302：数据仓库获取持有方发送的可验证声明存储请求。
步骤304：判断持有方是否具有数据仓库的使用权限。
步骤306：当确定持有方具有数据仓库的使用权限时，将持有方请求存储的可验证声明存储至数据仓库的数据库。
图4为本说明书实施例1提供的一种可验证声明存储方法中发布方发送的可验证声明存储方法的流程示意图。
如图4所示，当发送方为可验证声明的发布方时，具体实现可验证声明存储的流程可以为：
步骤402：数据仓库获取发布方发送的可验证声明存储请求。
步骤404：判断发布方是否具有数据仓库的使用权限。
步骤406：当确定发布方具有数据仓库的使用权限时，将发布方请求存储的可验证声明存储至数据仓库的数据库。
当发送方为分布式数字身份标识服务系统中提供代理存储可验证声明的服务的设备(简称DIS)时，具体实现可验证声明存储的流程可以为：数据仓库获取DIS发送的可验证声明存储请求；判断DIS是否具有数据仓库的使用权限；当确定DIS具有数据仓库的使用权限时，将DIS请求存储的可验证声明存储至数据仓库的数据库。
需要说明的是，当DIS与数据仓库的运营方是同一机构时，也可以不再对DIS是否具有数据仓库的使用权限进行判断。
图5为本说明书实施例2提供的一种可验证声明的存储方法的流程示意图。从程序角度而言，流程的执行主体可以为搭载于应用服务器的程序或应用客户端。具体地，可以是用于提供去中心化标识的代理服务的设备。在本实施例中，执行主体可以是用于提供可验证声明的代理存储服务的第一设备，即DIS。
如图5所示，该流程可以包括以下步骤：
步骤502：获取可验证声明的持有方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述持有方的可验证声明提供代理存储服务。
这里的第一设备可以是DIS对应的设备，持有方不直接请求数据仓库存储可验证声明，而是通过DIS进行代理，将需要存储的可验证声明发送到数据仓库中进行存储。
第一存储请求是可验证声明的持有方向DIS发送的存储请求，请求DIS对可验证声明提供代理存储服务。
步骤504：获取所述持有方的分布式数字身份标识。
这里的分布式数字身份标识指的是持有方的设备的身份标识。
步骤506：根据所述分布式数字身份标识，判断所述持有方是否具有所述代理存储服务的使用权限，得到第一判断结果。
持有方向DIS发送第一存储请求之后，DIS可以对持有方是否具有代理存储业务的使用权限进行验证。
步骤508：当所述第一判断结果表示所述持有方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述持有方的可验证声明存储至所述数据仓库的数据库。
如果持有方具有代理存储服务的使用权限，DIS可以向数据仓库发送存储请求，请求数据仓库将持有方的可验证声明存储到数据仓库的数据库中。
上述实施例2中的方法，用于存储可验证声明的数据仓库获取可验证声明存储请求，然后再获取该存储请求的发送方的分布式数字身份标识，根据分布式数字身份标识，判断发送可验证声明存储请求的发送方是否具有数据仓库的使用权限，当发送方具有数据仓库的使用权限时，将发送方请求存储的可验证声明存储到数据仓库的数据库中，从而完成对分布式数字身份标识对应的可验证声明进行存储。
所述向用于存储可验证声明的数据仓库发送第二存储请求之前，还可以包括：从所述分布式数字身份文档中，查找所述持有方具有使用权限的目标数据仓库；
所述向用于存储可验证声明的数据仓库发送第二存储请求，具体可以包括：向所述目标数据仓库发送所述第二存储请求。
需要说明的是，分布式数字身份文档可以用来存储分布式数字身份标识的相关信息。该文档中可以包括各设备对应的分布式数字身份标识、每个分布式数字身份标识 对应的数据仓库的标识和名称、对应的设备的密钥(比如：该分布式数字身份文档中包含有关于这个分布式数字身份的公钥)，身份信息所有者想要公开的任何公共的凭证以及能够跟这个身份信息进行交互的网络地址等等。身份信息的所有者可以通过获取相关的私钥来查询或管理这些分布式数字身份文档。
分布式数字身份文档存储在区块链上，签名时采用的是非对称加密算法，私钥用来加密，解密验证时需要公钥。
在实际应用中，所有的分布式数字身份对应的可验证声明都可以存储在一个数据仓库对应的数据库中，也可以存储在不同的数据仓库的数据库中。在具体场景中，可以建立每一个分布式数字身份标识与各个数据仓库的对应关系，存储在分布式数字身份文档中，从分布式数字身份文档中，可以查找持有方具有使用权限的目标数据仓库，并向目标数据仓库发送存储请求。
因此，在实际应用中，向所述目标数据仓库发送所述第二存储请求之前，还可以包括：从所述分布式数字身份文档中，查找所述持有方的密钥；采用所述密钥生成签名信息；生成包含所述签名信息的第二存储请求。
从分布式数字身份文档中可以查找持有方对应的密钥，根据密钥生成签名信息，可以生成签名信息的存储请求。
上述实施例2中提供的可验证声明的存储方法可以具体通过以下流程进行实现：
具体的流程可以包括可验证声明的持有方、发布方、DIS以及数据仓库之间的交互流程。
图6为本说明书实施例提供的一种可验证声明存储方法DIS代理发布方发送的可验证声明存储方法的流程示意图。
如图6所示，当请求DIS提供可验证声明的代理存储服务的对象为可验证声明的持有方时，具体实现可验证声明存储的流程可以为：
步骤602：持有方向DIS发送第一存储请求，所述第一存储请求用于请求所述第一设备对所述持有方的可验证声明提供代理存储服务；
步骤604：DIS判断所述持有方是否具有代理存储服务的使用权限；
步骤606：当确定持有方具有代理存储服务的使用权限时，使用持有方的密钥生成签名信息；
步骤608：DIS向持有方具有使用权限的目标数据仓库发送包含签名信息的第二存储请求，请求目标数据仓库将持有方的可验证声明存储到对应的数据库中；
步骤610：将持有方的可验证声明存储到数据仓库的数据库中。
图7为本说明书实施例3提供的一种可验证声明的存储方法的流程示意图。从程序角度而言，流程的执行主体可以为搭载于应用服务器的程序或应用客户端。具体地，可以是用于提供去中心化标识的代理服务的设备。在本实施例中，执行主体可以是用于提供可验证声明的代理存储服务的第一设备，即DIS。
如图7所示，该流程可以包括以下步骤：
步骤702：获取可验证声明的发布方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述发布方发布的可验证声明提供代理存储服务。
该实施例中的执行主体与实施例2中的执行主体相同，该实施例中的第一存储请求可以是可验证声明的发布方向DIS发送的存储请求，请求DIS对该可验证声明提供代理存储服务。
步骤704：获取所述发布方的分布式数字身份标识。
步骤706：根据所述发布方的分布式数字身份标识，判断所述发布方是否具有所述代理存储服务的使用权限，得到第一判断结果。
步骤708：当所述第一判断结果表示所述发布方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述发布方的发布可验证声明存储至所述数据仓库的数据库。
如果可验证声明的发布方具有代理存储服务的使用权限，DIS可以向数据仓库发送存储请求，请求数据仓库将发布方的可验证声明存储到数据仓库的数据库中。
所述向用于存储可验证声明的数据仓库发送第二存储请求之前，还可以包括：从所述发布方的分布式数字身份文档中，查找所述发布方具有使用权限的目标数据仓库；
所述向用于存储可验证声明的数据仓库发送第二存储请求，具体可以包括：向所述目标数据仓库发送所述第二存储请求。
所述获取可验证声明的发布方发送的第一存储请求之前，还可以包括：获取可验证声明的持有方发送的第一授权请求；所述第一授权请求用于授权所述可验证声明的发布方具有将所述持有方的可验证声明进行存储的权限；获取所述持有方的分布式数字 身份标识；根据所述持有方的分布式数字身份标识，判断所述持有方是否具有所述第一设备的使用权限，得到第二判断结果；当所述第二判断结果表示所述持有方具有所述第一设备的使用权限，向所述数据仓库发送第二授权请求；所述第二授权请求用于请求授予所述发布方将所述持有方的可验证声明存储至所述数据仓库的权限。
该实施例的具体实现原理与实施例2相同，区别在于，实施例3中请求DIS代理向数据仓库将发布方的可验证声明存储至所述数据仓库的数据库中。
实施例2和实施例3中的方法，对于可验证声明的存储可通过DIS这中提供代理服务的系统实现，可简化用户端设备的操作。例如，对于DIS的用户，用户终端在对于可验证声明的存储过程中，只需要与DIS交互就可以，可不必与数据仓库直接交互。
发布方发送的可验证声明来自于可验证声明的持有方。在判定发布方具有DIS的使用权限时，DIS向数据仓库请求授予发布方将持有方的可验证声明存储至所述数据仓库的权限。
上述实施例3中提供的可验证声明的存储方法可以具体通过以下流程进行实现：
具体的流程可以包括可验证声明的持有方、发布方、DIS以及数据仓库之间的交互流程。
图8为本说明书实施例提供的一种可验证声明存储方法中DIS代理持有方发送的可验证声明的存储方法的流程示意图。
如图8所示，当请求DIS提供可验证声明的代理存储服务的对象为可验证声明的持有方时，具体实现可验证声明存储的流程可以为：
步骤802：持有方向DIS发送其第一授权请求，请求授权发布方具有将持有方的可验证声明进行存储的权限；
步骤804：DIS判断持有方是否具有提供可验证声明的代理存储服务的使用权限；
步骤806：当确定持有方具有代理存储服务的使用权限时，向数据仓库发送第二授权请求，请求授予所述发布方将生成的可验证声明存储至所述数据仓库的权限；
步骤808：持有方申请发布方颁发可验证声明；
步骤810：发布方向DIS发布可验证声明；
步骤812：DIS生成可验证声明。需要说明的是，发布方颁发的是一个可验证声明，该可验证声明需要存储的具体数据内容可以由DIS生成。
步骤814：DIS向数据仓库发送可验证声明的存储请求；
步骤816：数据仓库判断DIS是否具有数据仓库的使用权限；
步骤818：当确定DIS具有数据仓库的使用权限时，将DIS生成的可验证声明存储到数据仓库的数据库中。
基于同样的思路，本说明书实施例还提供了上述方法的实施例1对应的装置。
图9为本说明书提供的对应于图2的一种可验证声明的存储装置的结构示意图。如图9所示，该装置可以包括：
可验证声明存储请求获取模块902，用于存储可验证声明的数据仓库获取可验证声明存储请求；
分布式数字身份标识获取模块904，用于获取所述请求的发送方的分布式数字身份标识；第一判断模块906，用于根据所述分布式数字身份标识，判断所述发送方是否具有所述数据仓库的使用权限，得到第一判断结果；
存储模块908，用于当所述第一判断结果表示所述发送方具有所述数据仓库的使用权限，将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库。
可选的，所述第一判断模块906，具体可以包括：查询单元，用于查询所述分布式数字身份标识是否存在于已注册的分布式数字身份标识集合中。
可选的，所述第一判断模块906，具体可以包括：签名信息获取单元，用于获取所述可验证声明存储请求中包含的签名信息；公钥获取单元，用于获取所述分布式数字身份标识对应的公钥；验证单元，用于采用所述公钥对所述签名信息进行验证。
可选的，所述可验证声明存储请求获取模块，具体可以包括：可验证声明存储请求第一获取单元，用于获取第一设备发送的可验证声明存储请求；所述第一设备上登录有所述可验证声明的持有方的第一账户。
可选的，所述可验证声明存储请求获取模块902，具体可以包括：可验证声明存储请求第二获取单元，用于获取第二设备发送的可验证声明存储请求；所述第二设备是分布式数字身份标识服务系统中提供代理存储可验证声明的服务的设备。
可选的，所述可验证声明存储请求获取模块902，具体可以包括：可验证声明存储请求第三获取单元，用于获取第三设备发送的可验证声明存储请求；所述第三设备上登录有所述可验证声明的发布方的第二账户。
可选的，所述装置，还可以包括：第二判断模块，用于当所述第一判断结果表示所述发送方具有所述数据仓库的使用权限，判断所述可验证声明的持有方是否具有所述数据仓库的使用权限，得到第二判断结果。所述存储模块，具体包括：存储单元，用于当所述第二判断结果表示所述可验证声明的持有方具有所述数据仓库的使用权限，将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库。
基于同样的思路，本说明书实施例还提供了上述方法的实施例2对应的装置。
图10为本说明书提供的对应于图5的一种可验证声明的存储装置的结构示意图；
如图10所示，所述装置包括：
第一存储请求获取模块1002，用于获取可验证声明的持有方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述持有方的可验证声明提供代理存储服务；
分布式数字身份标识获取模块1004，用于获取所述持有方的分布式数字身份标识；
第一判断模块1006，用于根据所述分布式数字身份标识，判断所述持有方是否具有所述代理存储服务的使用权限，得到第一判断结果；
第二存储请求发送模块1008，用于当所述第一判断结果表示所述持有方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，以请求所述数据仓库将所述持有方的可验证声明存储至所述数据仓库的数据库。
可选的，所述装置还可包括目标数据仓库查找模块，用于从所述分布式数字身份文档中，查找所述持有方具有使用权限的目标数据仓库。第二存储请求发送模块1008，具体包括：第二存储请求发送单元，用于向所述目标数据仓库发送所述第二存储请求。
可选的，所述装置还可以包括：密钥查找模块，用于从所述分布式数字身份文档中，查找所述持有方的密钥；签名信息生成模块，用于采用所述密钥生成签名信息；第二存储请求生成模块，用于生成包含所述签名信息的第二存储请求。
基于同样的思路，本说明书实施例还提供了上述方法的实施例3对应的装置，所述装置包括：
第一存储请求获取模块，用于获取可验证声明的发布方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述发布方发布的可验证声明提供代理存储服务；
分布式数字身份标识获取模块，用于获取所述发布方的分布式数字身份标识；
第一判断模块，用于根据所述发布方的分布式数字身份标识，判断所述发布方是否具有 所述代理存储服务的使用权限，得到第一判断结果；
第二存储请求发送模块，用于当所述第一判断结果表示所述发布方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，以请求所述数据仓库将所述发布方的发布可验证声明存储至所述数据仓库的数据库。
可选的，所述装置还可以包括目标数据仓库查找模块，用于从所述发布方的分布式数字身份文档中，查找所述发布方具有使用权限的目标数据仓库。所述第二存储请求发送模块，具体可以包括：第二存储请求发送单元，用于向所述目标数据仓库发送所述第二存储请求。
可选的，所述装置还可以包括：第一授权请求获取模块，用于获取可验证声明的持有方发送的第一授权请求，所述第一授权请求用于授权所述可验证声明的发布方具有将所述持有方的可验证声明进行存储的权限；分布式数字身份标识获取模块，用于获取所述持有方的分布式数字身份标识；第二判断模块，用于根据所述持有方的分布式数字身份标识，判断所述持有方是否具有所述第一设备的使用权限，得到第二判断结果；第二授权请求发送模块，用于当所述第二判断结果表示所述持有方具有所述第一设备的使用权限，向所述数据仓库发送第二授权请求；所述第二授权请求用于请求授予所述发布方将所述持有方的可验证声明存储至所述数据仓库的权限。
基于同样的思路，本说明书实施例还提供了上述实施例1中的方法对应的设备。
图11为本说明书提供的对应于图2的一种可验证声明的存储设备的结构示意图。如图11所示，设备1100可以包括至少一个处理器1110以及与所述至少一个处理器通信连接的存储器1130。所述存储器1130存储有可被所述至少一个处理器1110执行。
对应于实施例1，所述指令可以使所述至少一个处理器1110能够：控制用于存储可验证声明的数据仓库获取可验证声明存储请求；获取所述请求的发送方的分布式数字身份标识；根据所述分布式数字身份标识，判断所述发送方是否具有所述数据仓库的使用权限，得到第一判断结果；当所述第一判断结果表示所述发送方具有所述数据仓库的使用权限，将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库。
基于同样的思路，本说明书实施例还提供了上述实施例1中的方法对应的设备，设备可以包括至少一个处理器以及与所述至少一个处理器通信连接的存储器。所述存储器存储有可被所述至少一个处理器执行。
对应于实施例2，所述指令可以使所述至少一个处理器能够：获取可验证声明的 持有方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述持有方的可验证声明提供代理存储服务；获取所述持有方的分布式数字身份标识；根据所述分布式数字身份标识，判断所述持有方是否具有所述代理存储服务的使用权限，得到第一判断结果；当所述第一判断结果表示所述持有方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述持有方的可验证声明存储至所述数据仓库的数据库。
基于同样的思路，本说明书实施例还提供了上述实施例1中的方法对应的设备，设备可以包括至少一个处理器以及与所述至少一个处理器通信连接的存储器。所述存储器存储有可被所述至少一个处理器执行。
对应于实施例3，所述指令可以使所述至少一个处理器能够：获取可验证声明的发布方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述发布方发布的可验证声明提供代理存储服务；获取所述发布方的分布式数字身份标识；根据所述发布方的分布式数字身份标识，判断所述发布方是否具有所述代理存储服务的使用权限，得到第一判断结果；当所述第一判断结果表示所述发布方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述发布方的发布可验证声明存储至所述数据仓库的数据库。
在20世纪90年代，对于一个技术的改进可以很明显地区分是硬件上的改进(例如，对二极管、晶体管、开关等电路结构的改进)还是软件上的改进(对于方法流程的改进)。然而，随着技术的发展，当今的很多方法流程的改进已经可以视为硬件电路结构的直接改进。设计人员几乎都通过将改进的方法流程编程到硬件电路中来得到相应的硬件电路结构。因此，不能说一个方法流程的改进就不能用硬件实体模块来实现。例如，可编程逻辑器件(Programmable Logic Device,PLD)(例如现场可编程门阵列(Field Programmable Gate Array，FPGA))就是这样一种集成电路，其逻辑功能由用户对器件编程来确定。由设计人员自行编程来把一个数字系统“集成”在一片PLD上，而不需要请芯片制造厂商来设计和制作专用的集成电路芯片。而且，如今，取代手工地制作集成电路芯片，这种编程也多半改用“逻辑编译器(logic compiler)”软件来实现，它与程序开发撰写时所用的软件编译器相类似，而要编译之前的原始代码也得用特定的编程语言来撰写，此称之为硬件描述语言(Hardware Description Language，HDL)，而HDL也并非仅有一种，而是有许多种，如ABEL(Advanced Boolean Expression Language)、AHDL(Altera Hardware Description Language)、Confluence、CUPL(Cornell University  Programming Language)、HDCal、JHDL(Java Hardware Description Language)、Lava、Lola、MyHDL、PALASM、RHDL(Ruby Hardware Description Language)等，目前最普遍使用的是VHDL(Very-High-Speed Integrated Circuit Hardware Description Language)与Verilog。本领域技术人员也应该清楚，只需要将方法流程用上述几种硬件描述语言稍作逻辑编程并编程到集成电路中，就可以很容易得到实现该逻辑方法流程的硬件电路。
控制器可以按任何适当的方式实现，例如，控制器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑控制器和嵌入微控制器的形式，控制器的例子包括但不限于以下微控制器：ARC 625D、Atmel AT91SAM、Microchip PIC18F26K20以及Silicone Labs C8051F320，存储器控制器还可以被实现为存储器的控制逻辑的一部分。本领域技术人员也知道，除了以纯计算机可读程序代码方式实现控制器以外，完全可通过将方法步骤进行逻辑编程来使得控制器以逻辑门、开关、专用集成电路、可编程逻辑控制器和嵌入微控制器等的形式来实现相同功能。因此这种控制器可以被认为是一种硬件部件，而对其内包括的用于实现各种功能的装置也可视为硬件部件内的结构。或者甚至，可将用于实现各种功能的装置视为既可以是实现方法的软件模块又可以是硬件部件内的结构。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机。具体的，计算机例如可以为个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任何设备的组合。
为了描述的方便，描述以上装置时以功能分为各种单元分别描述。当然，在实施本申请时可以把各单元的功能在同一个或多个软件和/或硬件中实现。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中 的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带式磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且 还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
本申请可以在由计算机执行的计算机可执行指令的一般上下文中描述，例如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本申请，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (29)

  1. 一种可验证声明的存储方法，包括：
    用于存储可验证声明的数据仓库获取可验证声明存储请求；
    获取所述请求的发送方的分布式数字身份标识；
    根据所述分布式数字身份标识，判断所述发送方是否具有所述数据仓库的使用权限，得到第一判断结果；
    当所述第一判断结果表示所述发送方具有所述数据仓库的使用权限，将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库。
  2. 根据权利要求1所述的方法，所述判断所述发送方是否具有所述数据仓库的使用权限，具体包括：
    查询所述分布式数字身份标识是否存在于已注册的分布式数字身份标识集合中。
  3. 根据权利要求1所述的方法，所述判断所述发送方是否具有所述数据仓库的使用权限，具体包括：
    获取所述可验证声明存储请求中包含的签名信息；
    获取所述分布式数字身份标识对应的公钥；
    采用所述公钥对所述签名信息进行验证。
  4. 根据权利要求1所述的方法，所述获取可验证声明存储请求，具体包括：
    获取第一设备发送的可验证声明存储请求；所述第一设备上登录有所述可验证声明的持有方的第一账户。
  5. 根据权利要求1所述的方法，所述获取可验证声明存储请求，具体包括：
    获取第二设备发送的可验证声明存储请求，所述第二设备是分布式数字身份标识服务系统中提供代理存储可验证声明的服务的设备。
  6. 根据权利要求1所述的方法，所述获取可验证声明存储请求，具体包括：
    获取第三设备发送的可验证声明存储请求，所述第三设备上登录有所述可验证声明的发布方的第二账户。
  7. 根据权利要求5或6所述的方法，所述将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库之前，还包括：
    当所述第一判断结果表示所述发送方具有所述数据仓库的使用权限，判断所述可验证声明的持有方是否具有所述数据仓库的使用权限，得到第二判断结果；
    所述将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库，具体包括：
    当所述第二判断结果表示所述可验证声明的持有方具有所述数据仓库的使用权限， 将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库。
  8. 一种可验证声明的存储方法，包括：
    获取可验证声明的持有方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述持有方的可验证声明提供代理存储服务；
    获取所述持有方的分布式数字身份标识；
    根据所述分布式数字身份标识，判断所述持有方是否具有所述代理存储服务的使用权限，得到第一判断结果；
    当所述第一判断结果表示所述持有方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述持有方的可验证声明存储至所述数据仓库的数据库。
  9. 根据权利要求8所述的方法，所述向用于存储可验证声明的数据仓库发送第二存储请求之前，还包括：
    从所述分布式数字身份文档中，查找所述持有方具有使用权限的目标数据仓库；
    所述向用于存储可验证声明的数据仓库发送第二存储请求，具体包括：
    向所述目标数据仓库发送所述第二存储请求。
  10. 根据权利要求9所述的方法，所述向所述目标数据仓库发送所述第二存储请求之前，还包括：
    从所述分布式数字身份文档中，查找所述持有方的密钥；
    采用所述密钥生成签名信息；
    生成包含所述签名信息的第二存储请求。
  11. 一种可验证声明的存储方法，包括：
    获取可验证声明的发布方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述发布方发布的可验证声明提供代理存储服务；
    获取所述发布方的分布式数字身份标识；
    根据所述发布方的分布式数字身份标识，判断所述发布方是否具有所述代理存储服务的使用权限，得到第一判断结果；
    当所述第一判断结果表示所述发布方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述发布方的发布可验证声明存储至所述数据仓库的数据库。
  12. 根据权利要求11所述的方法，所述向用于存储可验证声明的数据仓库发送第二存储请求之前，还包括：
    从所述发布方的分布式数字身份文档中，查找所述发布方具有使用权限的目标数据仓库；
    所述向用于存储可验证声明的数据仓库发送第二存储请求，具体包括：
    向所述目标数据仓库发送所述第二存储请求。
  13. 根据权利要求12所述的方法，所述获取可验证声明的发布方发送的第一存储请求之前，还包括：
    获取可验证声明的持有方发送的第一授权请求；所述第一授权请求用于授权所述可验证声明的发布方具有将所述持有方的可验证声明进行存储的权限；
    获取所述持有方的分布式数字身份标识；
    根据所述持有方的分布式数字身份标识，判断所述持有方是否具有所述第一设备的使用权限，得到第二判断结果；
    当所述第二判断结果表示所述持有方具有所述第一设备的使用权限，向所述数据仓库发送第二授权请求；所述第二授权请求用于请求授予所述发布方将所述持有方的可验证声明存储至所述数据仓库的权限。
  14. 一种可验证声明的存储装置，包括：
    可验证声明存储请求获取模块，用于存储可验证声明的数据仓库获取可验证声明存储请求；
    分布式数字身份标识获取模块，用于获取所述请求的发送方的分布式数字身份标识；
    第一判断模块，用于根据所述分布式数字身份标识，判断所述发送方是否具有所述数据仓库的使用权限，得到第一判断结果；
    存储模块，用于当所述第一判断结果表示所述发送方具有所述数据仓库的使用权限，将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库。
  15. 根据权利要求14所述的装置，所述第一判断模块，具体包括：
    查询单元，用于查询所述分布式数字身份标识是否存在于已注册的分布式数字身份标识集合中。
  16. 根据权利要求14所述的装置，所述第一判断模块，具体包括：
    签名信息获取单元，用于获取所述可验证声明存储请求中包含的签名信息；
    公钥获取单元，用于获取所述分布式数字身份标识对应的公钥；
    验证单元，用于采用所述公钥对所述签名信息进行验证。
  17. 根据权利要求14所述的装置，所述可验证声明存储请求获取模块，具体包括：
    可验证声明存储请求第一获取单元，用于获取第一设备发送的可验证声明存储请求； 所述第一设备上登录有所述可验证声明的持有方的第一账户。
  18. 根据权利要求14所述的装置，所述可验证声明存储请求获取模块，具体包括：
    可验证声明存储请求第二获取单元，用于获取第二设备发送的可验证声明存储请求；所述第二设备是分布式数字身份标识服务系统中提供代理存储可验证声明的服务的设备。
  19. 根据权利要求14所述的装置，所述可验证声明存储请求获取模块，具体包括：
    可验证声明存储请求第三获取单元，用于获取第三设备发送的可验证声明存储请求；所述第三设备上登录有所述可验证声明的发布方的第二账户。
  20. 根据权利要求18或19所述的装置，所述装置，还包括：
    第二判断模块，用于当所述第一判断结果表示所述发送方具有所述数据仓库的使用权限，判断所述可验证声明的持有方是否具有所述数据仓库的使用权限，得到第二判断结果；
    所述存储模块，具体包括：
    存储单元，用于当所述第二判断结果表示所述可验证声明的持有方具有所述数据仓库的使用权限，将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库。
  21. 一种可验证声明的存储装置，包括：
    第一存储请求获取模块，用于获取可验证声明的持有方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述持有方的可验证声明提供代理存储服务；
    分布式数字身份标识获取模块，用于获取所述持有方的分布式数字身份标识；
    第一判断模块，用于根据所述分布式数字身份标识，判断所述持有方是否具有所述代理存储服务的使用权限，得到第一判断结果；
    第二存储请求发送模块，用于当所述第一判断结果表示所述持有方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述持有方的可验证声明存储至所述数据仓库的数据库。
  22. 根据权利要求21所述的装置，所述装置，还包括：
    目标数据仓库查找模块，用于从所述分布式数字身份文档中，查找所述持有方具有使用权限的目标数据仓库；
    第二存储请求发送模块，具体包括：
    第二存储请求发送单元，用于向所述目标数据仓库发送所述第二存储请求。
  23. 根据权利要求21所述的装置，所述装置，还包括：
    密钥查找模块，用于从所述分布式数字身份文档中，查找所述持有方的密钥；
    签名信息生成模块，用于采用所述密钥生成签名信息；
    第二存储请求生成模块，用于生成包含所述签名信息的第二存储请求。
  24. 一种可验证声明的存储装置，包括：
    第一存储请求获取模块，用于获取可验证声明的发布方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述发布方发布的可验证声明提供代理存储服务；
    分布式数字身份标识获取模块，用于获取所述发布方的分布式数字身份标识；
    第一判断模块，用于根据所述发布方的分布式数字身份标识，判断所述发布方是否具有所述代理存储服务的使用权限，得到第一判断结果；
    第二存储请求发送模块，用于当所述第一判断结果表示所述发布方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述发布方的发布可验证声明存储至所述数据仓库的数据库。
  25. 根据权利要求24所述的装置，所述装置，还包括：
    目标数据仓库查找模块，用于从所述发布方的分布式数字身份文档中，查找所述发布方具有使用权限的目标数据仓库；
    所述第二存储请求发送模块，具体包括：
    第二存储请求发送单元，用于向所述目标数据仓库发送所述第二存储请求。
  26. 根据权利要求25所述的装置，所述装置，还包括：
    第一授权请求获取模块，用于获取可验证声明的持有方发送的第一授权请求；所述第一授权请求用于授权所述可验证声明的发布方具有将所述持有方的可验证声明进行存储的权限；
    分布式数字身份标识获取模块，用于获取所述持有方的分布式数字身份标识；
    第二判断模块，用于根据所述持有方的分布式数字身份标识，判断所述持有方是否具有所述第一设备的使用权限，得到第二判断结果；
    第二授权请求发送模块，用于当所述第二判断结果表示所述持有方具有所述第一设备的使用权限，向所述数据仓库发送第二授权请求；所述第二授权请求用于请求授予所述发布方将所述持有方的可验证声明存储至所述数据仓库的权限。
  27. 一种可验证声明的存储设备，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够：
    控制用于存储可验证声明的数据仓库获取可验证声明存储请求；
    获取所述请求的发送方的分布式数字身份标识；
    根据所述分布式数字身份标识，判断所述发送方是否具有所述数据仓库的使用权限，得到第一判断结果；
    当所述第一判断结果表示所述发送方具有所述数据仓库的使用权限，将所述发送方请求存储的可验证声明存储至所述数据仓库的数据库。
  28. 一种可验证声明的存储设备，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够：
    获取可验证声明的持有方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述持有方的可验证声明提供代理存储服务；
    获取所述持有方的分布式数字身份标识；
    根据所述分布式数字身份标识，判断所述持有方是否具有所述代理存储服务的使用权限，得到第一判断结果；
    当所述第一判断结果表示所述持有方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述持有方的可验证声明存储至所述数据仓库的数据库。
  29. 一种可验证声明的存储设备，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够：
    获取可验证声明的发布方发送的第一存储请求，所述第一存储请求用于请求所述第一设备对所述发布方发布的可验证声明提供代理存储服务；
    获取所述发布方的分布式数字身份标识；
    根据所述发布方的分布式数字身份标识，判断所述发布方是否具有所述代理存储服 务的使用权限，得到第一判断结果；
    当所述第一判断结果表示所述发布方具有所述代理存储服务的使用权限，向用于存储可验证声明的数据仓库发送第二存储请求，所述第二存储请求用于请求所述数据仓库将所述发布方的发布可验证声明存储至所述数据仓库的数据库。
PCT/CN2021/085182 2020-04-10 2021-04-02 可验证声明的存储 WO2021204068A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010277236.5A CN111191268B (zh) 2020-04-10 2020-04-10 一种可验证声明的存储方法、装置及设备
CN202010277236.5 2020-04-10

Publications (1)

Publication Number Publication Date
WO2021204068A1 true WO2021204068A1 (zh) 2021-10-14

Family

ID=70708709

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/085182 WO2021204068A1 (zh) 2020-04-10 2021-04-02 可验证声明的存储

Country Status (2)

Country Link
CN (1) CN111191268B (zh)
WO (1) WO2021204068A1 (zh)

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111191268B (zh) * 2020-04-10 2020-08-07 支付宝(杭州)信息技术有限公司 一种可验证声明的存储方法、装置及设备
CN112612849A (zh) 2020-07-24 2021-04-06 支付宝(杭州)信息技术有限公司 一种数据处理方法、装置、设备及介质
CN112866235B (zh) 2020-08-28 2023-03-24 支付宝(杭州)信息技术有限公司 一种数据处理方法、装置及设备
CN111815420B (zh) 2020-08-28 2021-07-06 支付宝(杭州)信息技术有限公司 一种基于可信资产数据的匹配方法、装置及设备
CN111814172A (zh) 2020-08-28 2020-10-23 支付宝(杭州)信息技术有限公司 一种数据授权信息的获取方法、装置及设备
CN111741036B (zh) 2020-08-28 2020-12-18 支付宝(杭州)信息技术有限公司 一种可信数据传输方法、装置及设备
CN111814195B (zh) 2020-09-04 2021-05-25 支付宝(杭州)信息技术有限公司 一种基于可信硬件的数据管理方法、装置及设备
CN111814196B (zh) * 2020-09-04 2021-01-05 支付宝(杭州)信息技术有限公司 一种数据处理方法、装置及设备
CN115033919A (zh) 2020-09-04 2022-09-09 支付宝(杭州)信息技术有限公司 一种基于可信设备的数据获取方法、装置及设备
CN113255005A (zh) 2020-09-15 2021-08-13 支付宝(杭州)信息技术有限公司 一种基于区块链的数据资产流转方法、装置及设备
CN111930846B (zh) 2020-09-15 2021-02-23 支付宝(杭州)信息技术有限公司 一种数据处理方法、装置及设备
CN111932426B (zh) 2020-09-15 2021-01-26 支付宝(杭州)信息技术有限公司 一种基于可信硬件的身份管理方法、装置及设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106997368A (zh) * 2016-01-26 2017-08-01 中兴通讯股份有限公司 一种数据仓库中的数据保护方法及装置
CN109493082A (zh) * 2018-09-25 2019-03-19 西安纸贵互联网科技有限公司 一种农产品区块链溯源方法及装置
US20190228406A1 (en) * 2018-01-22 2019-07-25 Microsoft Technology Licensing, Llc Generating or managing linked decentralized identifiers
CN110795501A (zh) * 2019-10-11 2020-02-14 支付宝(杭州)信息技术有限公司 基于区块链的可验证声明的创建方法、装置、设备及系统
CN111191268A (zh) * 2020-04-10 2020-05-22 支付宝(杭州)信息技术有限公司 一种可验证声明的存储方法、装置及设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106997368A (zh) * 2016-01-26 2017-08-01 中兴通讯股份有限公司 一种数据仓库中的数据保护方法及装置
US20190228406A1 (en) * 2018-01-22 2019-07-25 Microsoft Technology Licensing, Llc Generating or managing linked decentralized identifiers
CN109493082A (zh) * 2018-09-25 2019-03-19 西安纸贵互联网科技有限公司 一种农产品区块链溯源方法及装置
CN110795501A (zh) * 2019-10-11 2020-02-14 支付宝(杭州)信息技术有限公司 基于区块链的可验证声明的创建方法、装置、设备及系统
CN111191268A (zh) * 2020-04-10 2020-05-22 支付宝(杭州)信息技术有限公司 一种可验证声明的存储方法、装置及设备

Also Published As

Publication number Publication date
CN111191268B (zh) 2020-08-07
CN111191268A (zh) 2020-05-22

Similar Documents

Publication Publication Date Title
WO2021204068A1 (zh) 可验证声明的存储
US11228425B2 (en) Data storage method, data query method and apparatuses
WO2021209041A1 (zh) 基于可验证声明的授权处理
US11386191B2 (en) Trusted hardware-based identity management methods, apparatuses, and devices
WO2021239104A1 (zh) 基于区块链的业务处理
US20190020480A1 (en) Establishing trust in an attribute authentication system
TW202023225A (zh) 基於區塊鏈的發票取用方法和裝置、電子設備
TW201917666A (zh) 資料審計的方法及裝置
TW202020774A (zh) 租賃業務的處理方法、裝置、系統及設備
CN111193597B (zh) 一种可验证声明的传输方法、装置、设备及系统
EP3964995B1 (en) Data processing methods, apparatuses, and devices
CN111814195B (zh) 一种基于可信硬件的数据管理方法、装置及设备
WO2021204067A1 (zh) 可验证声明的转发、获取
CN110222531A (zh) 一种访问数据库的方法、系统及设备
WO2023207086A1 (zh) 一种基于区块链的用户数据流转方法、装置及设备
CN111814172A (zh) 一种数据授权信息的获取方法、装置及设备
CN112861102B (zh) 基于区块链对电子文件的处理方法和系统
CN115758418A (zh) 一种基于区块链网络的数据管理方法、装置及设备
CN116962061A (zh) 一种基于区块链的用户身份核验方法、装置及设备
CN114626944A (zh) 一种业务处理方法及装置
CN116455657A (zh) 服务提供方法、装置、设备及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21785133

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21785133

Country of ref document: EP

Kind code of ref document: A1