WO2021209041A1 - 基于可验证声明的授权处理 - Google Patents

基于可验证声明的授权处理 Download PDF

Info

Publication number
WO2021209041A1
WO2021209041A1 PCT/CN2021/087789 CN2021087789W WO2021209041A1 WO 2021209041 A1 WO2021209041 A1 WO 2021209041A1 CN 2021087789 W CN2021087789 W CN 2021087789W WO 2021209041 A1 WO2021209041 A1 WO 2021209041A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
user
authorization
verifiable statement
verifiable
Prior art date
Application number
PCT/CN2021/087789
Other languages
English (en)
French (fr)
Inventor
孙善禄
杨仁慧
刘佳伟
Original Assignee
支付宝(杭州)信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 支付宝(杭州)信息技术有限公司 filed Critical 支付宝(杭州)信息技术有限公司
Publication of WO2021209041A1 publication Critical patent/WO2021209041A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources

Definitions

  • This document relates to the field of data processing technology, especially to the authorization processing based on verifiable claims.
  • Digital identity information such as DID (full English name: Decentralized Identifiers, full Chinese name: distributed identity) is a decentralized verifiable digital identifier.
  • DID can identify the identity of individuals, organizations, etc., but since DID does not contain real information about individuals, organizations, such as names, home addresses, etc., users usually associate DID with a verifiable statement (full English name: Verifiable Credential, (Referred to as VC) combined to prove information such as age, educational background, and certain permissions possessed through a verifiable statement.
  • Verifiable Credential Referred to as VC
  • VC verifiable Credential
  • the content that needs to be certified is different, and different users need to be granted access rights to verifiable claims. Therefore, how to effectively make verifiable claims is an issue that attracts users' attention.
  • One or more embodiments of this specification provide an authorization processing method based on a verifiable statement, which is applied to a first server corresponding to a first user.
  • the method includes receiving an authorization request sent by a first user.
  • the authorization request is used to request that the second user be granted access to the first verifiable statement of the first user.
  • the authorization request includes authorization information.
  • the authorization information is generated based on the public key corresponding to the first verifiable statement and the first digital identity information of the second user.
  • authorization record information is generated.
  • the authorization record information is stored in the first blockchain, and authorization success information is sent to the first user.
  • One or more embodiments of this specification provide an authorization processing method based on a verifiable statement, which is applied to the second server.
  • the method includes receiving a key acquisition request sent by a first user.
  • the key acquisition request includes the first digital identity information of the second user.
  • the obtained public key is sent to the first user, so that the first user grants the second user the access right to the first verifiable statement of the first user based on the public key.
  • One or more embodiments of this specification provide an authorization processing device based on a verifiable statement, which is applied to a first server corresponding to a first user.
  • the device includes a receiving module, which receives the authorization request sent by the first user. Wherein, the authorization request is used to request that the second user be granted access to the first verifiable statement of the first user.
  • the authorization request includes authorization information.
  • the authorization information is generated based on the public key corresponding to the first verifiable statement and the first digital identity information of the second user.
  • the device also includes a generating module, which generates authorization record information according to the authorization information and the first identification information of the first verifiable statement.
  • the device also includes a sending module, which saves the authorization record information in the first blockchain and sends authorization success information to the first user.
  • One or more embodiments of this specification provide an authorization processing device based on a verifiable statement, which is applied to a second server.
  • the device includes a receiving module, which receives the key acquisition request sent by the first user. Wherein, the key acquisition request includes the first digital identity information of the second user.
  • the device also includes a first obtaining module, which obtains the public key corresponding to the first digital identity information from the second blockchain.
  • the device also includes a sending module, which sends the obtained public key to the first user, so that the first user grants the second user the first user's first user based on the public key. The claimed access rights can be verified.
  • the system includes a first client of a first user, a first server and a second server corresponding to the first client.
  • the first client responds to the authorization operation of the first user granting the second user to the first user’s first verifiable statement of access, and according to the first digital identity information of the second user,
  • the second server sends a key acquisition request; receives the public key corresponding to the first digital identity information sent by the second server; generates authorization information according to the public key and the first verifiable statement , Sending an authorization request to the first server according to the authorization information.
  • the first server receives the authorization request; generates authorization record information according to the authorization information and the first identification information of the first verifiable statement; saves the authorization record information in the first blockchain ; Send authorization success information to the first client.
  • the second server receives the key acquisition request; acquires the public key corresponding to the first digital identity information from the second blockchain; sends the acquired public key to the first client .
  • the device includes a processor.
  • the device also includes a memory arranged to store computer-executable instructions.
  • the computer-executable instructions receive an authorization request sent by the first user when executed.
  • the authorization request is used to request that the second user be granted access to the first verifiable statement of the first user.
  • the authorization request includes authorization information.
  • the authorization information is generated based on the public key corresponding to the first verifiable statement and the first digital identity information of the second user. According to the authorization information and the first identification information of the first verifiable statement, authorization record information is generated.
  • the authorization record information is stored in the first blockchain, and authorization success information is sent to the first user.
  • the device includes a processor.
  • the device also includes a memory arranged to store computer-executable instructions.
  • the computer-executable instruction When executed, it receives a key acquisition request sent by the first user.
  • the key acquisition request includes the first digital identity information of the second user.
  • the obtained public key is sent to the first user, so that the first user grants the second user the access right to the first verifiable statement of the first user based on the public key.
  • the storage medium is used to store computer-executable instructions.
  • the computer-executable instructions receive an authorization request sent by the first user when executed.
  • the authorization request is used to request that the second user be granted access to the first verifiable statement of the first user.
  • the authorization request includes authorization information.
  • the authorization information is generated based on the public key corresponding to the first verifiable statement and the first digital identity information of the second user. According to the authorization information and the first identification information of the first verifiable statement, authorization record information is generated. Save the authorization record information in the first blockchain, and send authorization success information to the first user
  • One or more embodiments of this specification provide a storage medium.
  • the storage medium is used to store computer-executable instructions.
  • the computer-executable instruction When executed, it receives a key acquisition request sent by the first user.
  • the key acquisition request includes the first digital identity information of the second user.
  • the obtained public key is sent to the first user, so that the first user grants the second user the access right to the first verifiable statement of the first user based on the public key.
  • Figure 1 is a schematic diagram of the first scenario of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification;
  • FIG. 2 is a schematic diagram of a second scenario of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification;
  • Fig. 3 is a schematic diagram of the first flow of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification;
  • FIG. 4 is a schematic diagram of the second flow of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification;
  • FIG. 5 is a schematic diagram of a third process of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification;
  • FIG. 6 is a schematic diagram of the fourth flow of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification;
  • FIG. 7 is a schematic diagram of the fifth flow of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification.
  • FIG. 8 is a schematic diagram of the sixth flow of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification.
  • FIG. 9 is a schematic diagram of the first flow of a state change method based on a verifiable statement provided by one or more embodiments of this specification;
  • FIG. 10 is a schematic diagram of the second flow of a state change method based on a verifiable statement provided by one or more embodiments of this specification;
  • FIG. 11 is a schematic diagram of a seventh flow of an authorization processing method based on a verifiable statement provided by one or more embodiments of this specification;
  • FIG. 12 is a schematic diagram of the eighth flow of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification;
  • FIG. 13 is a schematic diagram of a ninth flow chart of an authorization processing method based on a verifiable statement provided by one or more embodiments of this specification;
  • FIG. 14 is a schematic diagram of the tenth flow of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification;
  • 15 is a schematic diagram of the eleventh process of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification;
  • 16 is a schematic diagram of a twelfth flow of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification;
  • FIG. 17 is a schematic diagram of the thirteenth process of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification;
  • FIG. 18 is a fourteenth flowchart of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification.
  • Figure 19 is a fifteenth flow diagram of a verifiable statement-based authorization processing method provided by one or more embodiments of this specification.
  • 20 is a schematic diagram of the first module composition of a verifiable statement-based authorization processing device provided by one or more embodiments of this specification;
  • FIG. 21 is a schematic diagram of a second type of module composition of an authorization processing device based on a verifiable statement provided by one or more embodiments of this specification;
  • 22 is a schematic diagram of the first composition of a verifiable statement-based authorization processing system provided by one or more embodiments of this specification;
  • FIG. 23 is a schematic diagram of the second composition of a verifiable statement-based authorization processing system provided by one or more embodiments of this specification;
  • FIG. 24 is a schematic structural diagram of an authorization processing device based on a verifiable statement provided by one or more embodiments of this specification.
  • Fig. 1 is a schematic diagram of an application scenario of an authorization processing method based on verifiable claims provided by one or more embodiments of this specification.
  • the scenario includes: a first client of a first user, and a first user The corresponding first server, the first blockchain corresponding to the first server, the second server, and the second blockchain corresponding to the second server.
  • the first server provides services such as the storage of verifiable claims, authorization management, and state management;
  • the second server provides services such as the creation of digital identity information and the issuance of verifiable claims;
  • the verifiable claims are stored in the first blockchain Declared authorization record information, access record information, status change record information, etc.;
  • the second blockchain saves the creation record information of digital identity information, the issuance record information of verifiable claims, etc.
  • the first client and the second client can be mobile phones, tablet computers, desktop computers, portable notebook computers, etc. (only mobile phones are shown in Figure 1);
  • the first server and the second server can be independent servers, or It can be a server cluster composed of multiple servers.
  • the first server is a node in the first blockchain
  • the second server is a node in the second blockchain.
  • the first user operates his first client to apply for the second digital identity information and the first verifiable statement from the second server in advance, and saves the applied first verifiable statement to the first server; 2.
  • the user operates his second client in advance to apply for the first digital identity information and the public-private key pair corresponding to the first digital identity information from the second server.
  • the first user When the first user needs to grant the second user access to the first verifiable statement, the first user first operates the first client to send a key acquisition request to the second server, and the second server according to the key acquisition request includes Obtain the corresponding public key from the second blockchain, and send the obtained public key to the first client; the first client generates authorization based on the first verifiable statement and the obtained public key Information, send an authorization request to the first server according to the authorization information; the first server generates authorization record information according to the authorization information and the first identification information of the first verifiable statement; the first server saves the authorization record information to the first In the blockchain, the authorization success message is sent to the first client; the first client displays the authorization success message.
  • the first server may not be a node in the first blockchain
  • the second server may not be a node in the second blockchain
  • the application scenario also includes: The first blockchain node connected to the first blockchain and the second blockchain node connected to the second blockchain; when the second server receives the key acquisition request sent by the first client, the key The acquisition request is sent to the second blockchain node, so that the second blockchain node obtains the corresponding public key from the second blockchain, and sends the obtained public key to the second server, and the second server will The received public key is sent to the first client; and, after generating the authorization record information, the first server sends the authorization record information to the first blockchain node, so that the first blockchain node sends the authorization record information Save to the first blockchain.
  • the first client obtains the public key corresponding to the first digital identity information of the second user from the second server, and produces authorization information based on the obtained public key and the first verifiable statement, thereby producing authorization information based on the authorization information
  • Send an authorization request to the first server so that the first server saves the authorization record information in the first blockchain; not only realizes the access authorization of verifiable statement, but also satisfies the user granting to other users in different business scenarios
  • the authorization requirements for the access rights of verifiable claims and by storing the authorization record information in the blockchain, the validity of the authorization is ensured, and the authorization records can be traced back and the granted access rights can be effectively verified.
  • Fig. 3 is a schematic flow chart of a method for authorization processing based on verifiable claims provided by one or more embodiments of this specification.
  • the method in Fig. 3 can be executed by the first server in Fig. 1, as shown in Fig. 3, The method includes the following steps:
  • Step S102 Receive an authorization request sent by the first user, where the authorization request is used to request that the second user be granted access to the first verifiable statement of the first user; the authorization request includes authorization information, and the authorization information is based on the first verifiable statement.
  • the verification statement and the public key corresponding to the first digital identity information of the second user are generated.
  • the first client in response to the authorization operation of the first user, the first client generates the public key corresponding to the first digital identity information of the second user obtained in advance from the second server according to the first verifiable statement to be authorized
  • the authorization information sends an authorization request to the corresponding first server according to the authorization information; the first server receives the authorization request sent by the first client.
  • the authorization request may also include the first identification information of the first verifiable statement, the first digital identity information of the first user, etc.; the generation process of the authorization information will be described in detail later.
  • Step S104 Generate authorization record information according to the authorization information and the first identification information of the first verifiable statement.
  • the authorization information, the first identification information of the first verifiable statement, and the first digital identity information of the second user are associated records, and the recorded information is determined as the authorization record information.
  • Step S106 Save the authorization record information in the first blockchain, and send authorization success information to the first user.
  • the first server When receiving the authorization request sent by the first client, the first server generates authorization record information according to the authorization information in the authorization request, and saves the authorization record information in the first blockchain.
  • the authorization information is generated based on the first verifiable statement and the public key corresponding to the first digital identity information of the second user obtained in advance from the second server.
  • the authorization request may also include second signature data obtained by using the private key corresponding to the second digital identity information of the first user to sign the specified information; accordingly, step S104 may be It includes: obtaining the public key corresponding to the second digital identity information, and if the second signature data is verified according to the obtained public key, then generating the authorization record information according to the authorization information and the first identification information of the first verifiable statement.
  • obtaining the public key corresponding to the second digital identity information may include: sending a key obtaining request to the second server according to the second digital identity information, so that the second server can query the second number from the second blockchain The public key corresponding to the identity information; or, the first server sends a key acquisition request to the first client, so that the first client sends the key acquisition request to the second server, and when the first client receives When the second server sends the public key, the received public key is sent to the first server.
  • the second user can access the first verifiable statement.
  • the first user and the second user correspond to the same first server, for example, the first user and the second user belong to the same alliance chain.
  • the second user requests to access the first verifiable statement by sending a first access request to the first server.
  • the method further includes: step S108, receiving a first access request with a verifiable statement sent by the second user.
  • the first access request includes first digital identity information and first identification information.
  • the first user can privately inform the second user of the first identification information of the first verifiable statement; or, the first user operates the first client to send the first identification information of the first verifiable statement to the first user.
  • the second client of the second user; or, the first server sends authorization prompt information to the second client according to the first identification information, so that the second user can access the first verifiable statement according to the first identification information.
  • the second client is operated.
  • the second client responds to the access operation of the second user according to the first digital identity information and first identification information of the second user, etc., Send the first access request to the first server.
  • Step S110 according to the first digital identity information and the first identification information, query the associated authorization record information from the first blockchain, and send the first verifiable statement in the queried authorization record information to the second user.
  • step S102 includes the following step S102-2, receiving an authorization request sent by the first user, the authorization request is used to request the second user to be granted access to the first verifiable statement of the first user, the authorization request Including authorization information, the authorization information including the ciphertext of the first verifiable statement and the ciphertext of the first key; the ciphertext of the first verifiable statement is obtained by encrypting the first verifiable statement according to the first key; The ciphertext of the first key is obtained by encrypting the first key according to the public key corresponding to the first digital identity of the second user.
  • step S110 includes the following step S110-2, according to the first digital identity information and the first identification information, query the associated authorization record information from the first blockchain, and
  • the ciphertext of the first verifiable statement and the ciphertext of the first key in the queried authorization record information are sent to the second user, so that the second user can pair the first cipher text according to the private key corresponding to the first digital identity information.
  • the ciphertext of the key is decrypted to obtain the first key
  • the ciphertext of the first verifiable statement is decrypted according to the first key to obtain the first verifiable statement.
  • the first verifiable statement is encrypted by using envelope encryption, so that only the second user who has been granted access can decrypt the ciphertext of the first key to obtain the first key, so that according to the first key
  • the ciphertext of the first verifiable statement is decrypted to obtain the first verifiable statement, which effectively ensures the privacy of the first verifiable statement.
  • the first access request may further include: first signature data obtained by signing specified data according to the private key corresponding to the first digital identity information.
  • step S108 may include the following step S108-2, receiving a first access request with a verifiable statement sent by a second user; wherein, the first access request includes first digital identity information, first identification information, and The private key corresponding to the first digital identity information is the first signature data obtained by signing specified data.
  • step S110 includes the following steps S110-4 and S110-6.
  • Step S110-4 Obtain the public key corresponding to the first digital identity information.
  • the process of obtaining the public key corresponding to the first digital identity information is similar to the foregoing process of obtaining the public key corresponding to the second digital identity information, which can be referred to the foregoing related description, and will not be repeated here.
  • Step S110-6 Use the obtained public key to verify the first signature data. If the verification is passed, query the associated authorization record information from the first blockchain based on the first digital identity information and the first identification information, and Send the first verifiable statement in the queried authorization record information to the second user.
  • the private key corresponding to the first digital identity information is only held by the second user, by verifying the first signature data, it can effectively prevent others from impersonating the second user to perform the access operation of the first verification statement.
  • the first server may save the access record information of the first verifiable claim to the first blockchain.
  • the method further includes: step S109, recording the receiving time of the first access request.
  • step S110 it further includes: step S112, according to the first identification information, the first digital identity information, and the receiving time, generate the first verifiable statement of the access record information, and save the access record information in the first block Chain.
  • the second user realizes the access of the first verifiable statement through data communication with the first server.
  • the first user can also correspond to a different first server with the second user.
  • the first user is a user of the first consortium chain
  • the second user is a user of the second consortium chain.
  • the first consortium chain and the second consortium chain different.
  • the second user does not have the authority to perform data communication with the first server, and accesses the first verifiable statement through the second server.
  • the method further includes:
  • Step S114 Receive an authorization information acquisition request sent by the second server; where the acquisition request includes the first digital identity information and the first identification information;
  • Step S116 If the associated authorization record information is queried from the first blockchain according to the first digital identity information and the first identification information, the authorization information in the authorization record information is sent to the second server;
  • the second server stores the authorization information in the second block chain, and when receiving the third access request of the verifiable statement sent by the second user, it will store the first verifiable information in the second block chain. The statement is sent to the second user.
  • the first server sends the authorization success information to the first user
  • the first user sends a data migration request to the second server
  • the second server sends the data migration request according to the first digital identity information and the first digital identity information included in the data migration request.
  • the first identification information of the verifiable statement is sent to the first server corresponding to the first user to obtain the authorization information request
  • the authorization information sent by the first server is received, the authorization information is saved to the second blockchain
  • the first verifiable statement in the authorization information stored in the second blockchain is sent to the second user.
  • the second server obtains the authorization information from the first server corresponding to the first user based on the data migration request of the first user and saves it in the first server.
  • the second user performs data communication with the second server to achieve access to the first verifiable statement.
  • the second server provides a verifiable claim issuance service.
  • it further includes: receiving the first verifiable claim sent by the second server, and saving the first verifiable claim;
  • the first verifiable statement is generated by the second server based on the application request for the verifiable statement sent by the first user.
  • saving the first verifiable statement can be saved in the first blockchain or in a local database.
  • the first user can also access its first verifiable statement.
  • it may further include: receiving a second access request for the verifiable statement sent by the first user, where the second The access request includes the first identification information; the first verifiable statement corresponding to the stored first identification information is obtained, and the obtained first verifiable statement is sent to the first user.
  • the method further includes: according to the first identification information, the second digital identity of the first user Information, the receiving time of the second access request, etc., generate access record information, and save the access record information in the first blockchain.
  • the method further includes:
  • Step S202 Receive a processing request for a verifiable statement sent by the first user.
  • the processing request is used to request any one of cancellation processing, freezing processing, and unfreezing processing of the first verifiable statement, and includes the first identification information of the first verifiable statement, and the processing request may also include processing type information.
  • Step S204 If it is determined that the first verifiable statement meets the preset processing condition, the state information of the first verifiable statement is changed according to the processing request.
  • step S204 includes: acquiring the state information of the current state of the first verifiable statement, and if the acquired state information matches the state information associated with the preset processing type information, determining that the first verifiable statement conforms to the predetermined state information.
  • the verifiable claim obtains the status information of the current state of the verifiable claim and the processing frequency of the first verifiable claim by the first user within a preset time period. If the obtained status information is related to the preset processing type information If the associated state information matches and the processing frequency is less than the preset frequency, it is determined that the first verifiable statement meets the preset processing conditions.
  • obtaining the status information of the current state of the first verifiable claim includes: querying the last associated change record information from the first blockchain according to the first identification information of the first verifiable claim, and the changes from the query The state information of the current state of the first verifiable statement is obtained from the record information.
  • obtaining the processing frequency of the first verifiable statement by the first user within a preset time period includes: according to the first statement identifier and the first query time corresponding to the preset time period, querying the timestamp from the blockchain at Within the first query time, the target change record information associated with the first claim identifier, count the number of target status change record information, and determine the combined statistics as the first user’s verification of the first verifiable claim within the preset period of time Processing frequency.
  • the preset duration and preset frequency can be set according to actual needs; as an example, the preset duration is 30 minutes, and the current time is 09:25 on October 25, 2019, and the corresponding first The query time is from 08:55 on October 25, 2019 to 09:25 on October 25, 2019.
  • step S204 may further include: sending an identity verification request to the first client, so that the first client can collect the identity verification information of the first user; if According to the identity verification information sent by the first client, the identity verification of the first user is passed, it is determined that the first verifiable statement meets the preset processing conditions, and the state information of the first verifiable statement is changed according to the processing request.
  • the identity verification information may be biometric information, such as any one or more of human face, fingerprint, iris, etc.
  • the first server matches the identity verification information sent by the first client with the identity information of the user stored in the designated database. If the matching is successful, it is determined that the identity verification of the first user is passed, and if the matching fails, it is determined The authentication of the first user fails, and the request failure result is sent to the first client.
  • the designated database may be the database of the first server. When the first user registers the first client, the identity verification information of the first user is collected by the first client and stored in the database, which has legitimacy and validity.
  • the designated database may also be a database of a designated institution.
  • the designated institution is a trusted third-party institution with authority and legitimacy.
  • the user's identity information is stored in its database, and the user's identity verification information can be verified by accessing the database.
  • the designated agency is, for example, the Public Security Bureau.
  • the identity verification information may also be verification information in the form of a verification code.
  • the first server matches the verification code returned by the first client with the verification code stored in itself. If the matching is successful, it determines that the identity verification of the first user is passed, and if the matching fails, it determines that the verification code for the first user is passed.
  • the identity verification fails, and the request failure result information is sent to the first client, so that the first client displays the request failure result information.
  • Step S206 Generate change record information according to the first identification information and the changed state information, and save the change record information in the first blockchain.
  • the first statement identifier, the changed status information, the processing type information, and the processing time are associated and recorded, and the recorded information is used as the change record information; the change record information is stored in the first blockchain.
  • the first user can also query historical change records.
  • it can also include:
  • Step S208 Receive a change record query request sent by the first user, where the change record query request includes the first identification information and the second query time.
  • the second query time is the time period information to be queried.
  • Step S210 according to the first identification information and the second query time, query the corresponding change record information from the second blockchain.
  • Step S212 Generate a query result according to the queried change record information, and send the query result to the first user.
  • the first user can send a processing request to the corresponding first server as needed to request freezing, revocation, and unfreezing of the first verifiable statement, which not only realizes the effective management of the verifiable statement, but also Moreover, the risk of others embezzling the first verifiable statement is avoided; by saving the change record information in the first blockchain, the effective traceability and query of the change record is realized.
  • the first server is not a node in the first blockchain, in the above steps, when it is necessary to obtain data from the first blockchain and save the data to the first blockchain, the corresponding first Blockchain node execution.
  • the first server may generate authorization record information according to the authorization information in the authorization request, and save the authorization record information in the first blockchain.
  • the authorization information is generated based on the first verifiable statement and the public key corresponding to the first digital identity information of the second user obtained in advance from the second server.
  • one or more embodiments of this specification also provide another verifiable statement-based authorization processing method.
  • One or more embodiments of the specification provide a schematic flowchart of another authorization processing method based on verifiable claims.
  • the method in FIG. 11 can be executed by the second server in FIG. 1; as shown in FIG. 11, the method includes The following steps:
  • Step S302 Receive a key acquisition request sent by the first user, where the key acquisition request includes the first digital identity information of the second user;
  • Step S304 Obtain the public key corresponding to the first digital identity information from the second blockchain;
  • Step S306 Send the obtained public key to the first user, so that the first user grants the second user the access right to the first verifiable statement of the first user based on the received public key.
  • the second server When the second server receives the key acquisition request sent by the first user, it can obtain the corresponding public key from the second blockchain and send it to the first user, so that the first user can grant the second user based on the public key.
  • the user's access authority to the first user's first verifiable claim In this way, the access authorization of verifiable claims is realized, and the authorization requirements of users for granting access rights to verifiable claims to other users in different business scenarios are met.
  • step S304 includes the following step S304-2, according to the first digital identity information, query the associated first document from the second blockchain, and obtain the public key from the query first document .
  • the second user can access the first verifiable statement. Specifically, when the first user and the second user correspond to the same first server, the second user first obtains the access address of the first server from the second server, and performs data communication with the first server according to the access address. Access the first verifiable statement.
  • step S306 it further includes:
  • Step S308 Receive an address query request sent by the second user; where the address query request includes the first digital identity information of the second user;
  • Step S310 query the associated first document from the second blockchain according to the first digital identity information, and obtain the access address of the first server from the first document;
  • Step S312 Send the obtained access address to the second user, so that the second user sends a first access request with a verifiable statement to the first server according to the access address to request access to the first verifiable statement.
  • the corresponding access address is obtained and sent to the second user, so that the second user can send the first verifiable statement to the corresponding first server according to the access address. Access request to achieve the access of the first verifiable claim.
  • the first verifiable statement can be realized through the second server Access.
  • the following steps S314 to S318 are further included.
  • Step S314 Obtain the authorization information of the access authority from the first server corresponding to the first user; wherein the authorization information is sent by the first user to the first server, so that the first server saves the authorization record information according to the authorization information To the first blockchain; the authorization information is generated based on the public key corresponding to the first digital identity information of the second user and the first verifiable statement.
  • step S314 may include: step S314-2, if a data migration request sent by the first user is received, according to the first digital identity information and the first verifiable statement included in the data migration request
  • the first identification information sends an authorization information acquisition request to the first server corresponding to the first user; so that the first server acquires the associated information from the first blockchain according to the first digital identity information and the first identification information Authorize the record information, and return the authorization information in the authorization record information; step S314-4, receive the authorization information sent by the first server.
  • the first user When the first user receives the authorization success information sent by the first server, it sends a data migration request to the second server according to the first digital identity information and the first identification information, so that the second server corresponds to the first user
  • the first server sends an authorization information acquisition request to migrate the authorization information from the first blockchain to the second blockchain, and the second user sends a third access request to the second server to access the first Verifiable claims.
  • Step S316 save the authorization information in the second blockchain.
  • the second server obtains authorization information from the first server based on the data migration request of the first user, so that the authorization information is migrated from the first blockchain To the second blockchain, so that the second user can communicate with the second server, so as to realize the access of the first verifiable statement.
  • step S314 may include the following steps S314-6: obtaining authorization information for access rights from the first server corresponding to the first user, and the authorization information is sent by the first user to the first server, so that the first The server saves the authorization record information in the first blockchain according to the authorization information.
  • the authorization information includes the ciphertext of the first verifiable statement and the ciphertext of the first key; the ciphertext of the first verifiable statement is obtained by encrypting the first verifiable statement according to the first key; the first key The ciphertext of is obtained by encrypting the first key according to the public key corresponding to the first digital identity.
  • step S318 includes the following step S318-2: when receiving the third access request of the verifiable statement sent by the second user, the first among the authorization information stored in the second blockchain A ciphertext of the verifiable statement and the ciphertext of the first key are sent to the second user, so that the second user decrypts the ciphertext of the first key according to the private key corresponding to the first digital identity information to obtain the first A key, and decrypt the ciphertext of the first verifiable statement according to the first key to obtain the first verifiable statement.
  • step S316 may include the following steps S316-2 and S316-4:
  • Step S316-2 Generate a second verifiable statement based on the authorization information, and store the second verifiable statement in association with the second identification information of the second verifiable statement in the second blockchain.
  • the second verifiable statement can also be The first digital identity information of the second user is included to indicate that the second user has the access right to the first verifiable statement of the authorization information.
  • Step S316-4 Send second identification information to the second user, so that the second user sends a third access request according to the second identification information.
  • step S318 includes the following steps S318-4 and S318-6:
  • Step S318-4 when receiving the third access request of the verifiable claim sent by the second user, obtain the second verifiable claim associated and stored from the second blockchain according to the second identification information in the third access request .
  • step S318-6 the authorization information is obtained from the second verifiable statement, and if it is determined that the current time does not exceed the expiration time in the authorization information, the first verifiable statement in the authorization information is sent to the second user.
  • the expiration time is the effective expiration time of the access authority granted to the second user designated by the first user. When the expiration time is reached, the granted access authority becomes invalid.
  • the first verifiable statement in the authorization information included in the second verifiable statement is sent to the first The second user realizes the access of the second user to the first verifiable statement.
  • step S316 may further include the following steps S316-6 to S316-10:
  • Step S316-6 Generate a third verifiable statement based on the first digital identity information.
  • the third verifiable statement is used to prove that the second user has the access right to the first verifiable statement in the authorization information, and the third verifiable statement may also include a field that characterizes the access right.
  • step S316-8 the authorization information, the third verifiable statement, and the third identification information of the third verifiable statement are associated and stored in the second blockchain.
  • Step S316-10 Send third identification information to the second user, so that the second user sends a third access request according to the third identification information.
  • step S318 may include the following steps S318-8 and S318-10:
  • Step S318-8 when receiving a third access request with a verifiable claim sent by the second user, obtain the authorization information and third identification information stored in association with the second blockchain according to the third identification information in the third access request. Verifiable statement;
  • Step S318-10 If it is determined that the first digital identity information in the third access request matches the first digital identity information in the third verifiable statement, and the current time does not exceed the expiration time in the authorization information, then the authorization information is The first verifiable statement of is sent to the second user.
  • the third verifiable statement is generated to prove that the second user has the access authority of the first verifiable statement, and when the third access request is received, the first digital identity information in the third access request is combined with the third The first digital identity information in the verifiable statement is matched to verify the identity of the second user, thereby realizing the access of the second user to the first verifiable statement.
  • the first verifiable statement in the authorization information may also include: identification information according to the second verifiable statement or the third verifiable statement, the first digital identity information, The time when the third access request is received, etc., generate the access record information of the first verifiable statement; save the access record information in the second blockchain.
  • the second server provides a verifiable claim issuance service.
  • the second server may also include:
  • Step S300-2 Receive an application request for a verifiable statement sent by the first user, where the application request includes application information and storage information.
  • the storage information is used to characterize the storage location of the first verifiable claim.
  • the first user can save the first verifiable statement to the corresponding first server as needed; he can also choose to keep it by himself so that the second server will send the generated first verifiable statement to the second customer of the second user end.
  • Step S300-4 Generate a first verifiable statement based on the application information.
  • Step S300-6 according to the storage information, send the generated first verifiable statement to the corresponding first server, so that the first server saves the first verifiable statement.
  • step S300-4 it may further include: generating the issuance record information of the verifiable claim based on the first identification information of the first verifiable claim, the second digital identity information of the first user, etc.; and saving the issuance record information to the second verifiable claim.
  • generating the issuance record information of the verifiable claim based on the first identification information of the first verifiable claim, the second digital identity information of the first user, etc.
  • saving the issuance record information to the second verifiable claim In the blockchain.
  • the second server can also receive an application request for digital identity information sent by the first user or the second user, and generate corresponding digital identity information, as well as documents and public and private keys corresponding to the digital identity information. Yes, send the digital identity information and private key to the corresponding user, save the generated public key in the generated document, and save the generated document and digital identity information in the second blockchain.
  • the second server When the second server receives the key acquisition request sent by the first user, it obtains the corresponding public key from the second blockchain and sends it to the first user, so that the first user can grant the second user based on the public key Access to the first verifiable claim of the first user. In this way, the access authorization of verifiable claims is realized, and the authorization requirements of users for granting access rights to verifiable claims to other users in different business scenarios are met.
  • FIGS. 3 to 10 Corresponding to the authorization processing method based on the verifiable statement described in FIGS. 3 to 10, based on the same technical concept, one or more embodiments of this specification also provide an authorization processing device based on the verifiable statement.
  • Figure 20 is a schematic diagram of the module composition of a verifiable statement-based authorization processing device provided by one or more embodiments of this specification. The device is used to execute the verifiable statement-based authorization processing method described in Figures 3 to 10, such as As shown in Figure 20, the device includes:
  • a receiving module 401 which receives an authorization request sent by a first user, where the authorization request is used to request that the second user be granted access to the first verifiable statement of the first user; the authorization request includes authorization Information, the authorization information is generated based on the public key corresponding to the first verifiable statement and the first digital identity information of the second user;
  • a generating module 402 which generates authorization record information according to the authorization information and the first identification information of the first verifiable statement;
  • the sending module 403 saves the authorization record information in the first blockchain, and sends authorization success information to the first user.
  • One or more embodiments of this specification provide an authorization processing device based on a verifiable statement.
  • receiving an authorization request sent by a first user it generates authorization record information according to the authorization information in the authorization request, and saves the authorization record information to In the first blockchain; wherein, the authorization information is generated based on the first verifiable statement and the public key corresponding to the first digital identity information of the second user obtained in advance from the second server.
  • the authorization record information is saved in the blockchain, that is, This ensures the validity of authorization, and enables the traceability of authorization records and the effective verification of granted access rights.
  • the second user and the first user correspond to the same first server;
  • the authorization record information further includes: the first digital identity information;
  • the device further includes: a first query module.
  • the receiving module 401 after the sending module 403 sends the authorization success information to the first user, receives a first access request with a verifiable statement sent by the second user, where the first access request includes the The first digital identity information and the first identification information;
  • the first query module based on the first digital identity information and the first identification information, query the first blockchain for the associated Authorization record information, sending the first verifiable statement in the queried authorization record information to the second user.
  • the authorization information includes: the ciphertext of the first verifiable claim and the ciphertext of the first key; wherein the ciphertext of the first verifiable claim is based on the first key pair
  • the first verifiable statement is obtained by encryption processing; the ciphertext of the first key is obtained by encrypting the first key according to the public key;
  • the first query module sends the ciphertext of the first verifiable statement and the ciphertext of the first key in the queried authorization record information to the second user, so that the second user
  • the user decrypts the cipher text of the first key according to the private key corresponding to the first digital identity information to obtain the first key, and performs verification on the first key according to the first key
  • the ciphertext of the statement is decrypted to obtain the first verifiable statement.
  • the first access request further includes: first signature data obtained by signing specified data according to the private key corresponding to the first digital identity information.
  • the first query module obtains the public key corresponding to the first digital identity information; and uses the obtained public key to verify the first signature data, and if the verification passes, then according to the first
  • the digital identity information and the first identification information are used to query the associated authorization record information from the first blockchain.
  • the device further includes: a recording module and a first generating module.
  • the recording module records the receiving time of the first access request after the receiving module 401 receives the first access request sent by the second user with a verifiable statement; the first generating module records the time when the first access request is received; After the first query module sends the first verifiable statement in the queried authorization record information to the second user, according to the first identification information, the first digital identity information and the received At time, the access record information of the first verifiable statement is generated, and the access record information is stored in the first blockchain.
  • the second user and the first user correspond to a different first server; the authorization record information further includes the first digital identity information; the device further includes a second query module.
  • the receiving module 401 receives the authorization information acquisition request sent by the second server after the authorization record information is stored in the first blockchain by the first generation module; wherein, the acquisition request Including the first digital identity information and the first identification information; the second query module, if based on the first digital identity information and the first identification information, query from the first blockchain To the associated authorization record information, the authorization information in the authorization record information is sent to the second server; so that the second server saves the authorization information in the second blockchain , And upon receiving the third access request of the verifiable statement sent by the second user, the first verifiable statement in the authorization information stored in the second blockchain is sent to the first Two users.
  • the device further includes a change module and a second generation module.
  • the receiving module 401 also receives a processing request for a verifiable statement sent by the first user; wherein the processing request is used to request that the first verifiable statement be revoked, frozen, or unfreed.
  • the processing request includes the first identification information; the change module, if it is determined that the first verifiable statement meets the preset processing conditions, change the first verifiable statement according to the processing request.
  • the declared state information; the second generation module generates change record information based on the first identification information and the changed state information; saves the change record information in the first blockchain.
  • the processing request further includes processing type information.
  • the change module obtains the state information of the current state of the first verifiable statement, and if the obtained state information matches the state information associated with the preset processing type information, determine the first A verifiable statement meets the preset processing conditions; or, obtain the state information of the current state of the verifiable statement and the processing frequency of the first user on the first verifiable statement within a preset period of time, if The acquired status information matches the preset status information associated with the processing type information, and the processing frequency is less than the preset frequency, then it is determined that the first verifiable statement meets the preset processing conditions.
  • the device further includes a storage module.
  • the receiving module 401 before receiving the authorization request sent by the first user, also receives the first verifiable statement sent by the second server, where the first verifiable statement indicates that the second server is based on the first verifiable statement.
  • An application request for a verifiable statement sent by a user is generated; the saving module saves the first verifiable statement.
  • the device further includes an acquisition module.
  • the receiving module 401 receives, after the saving module saves the first verifiable statement, a second access request of the verifiable statement sent by the first user, wherein the second access request includes the first verifiable statement.
  • An identification information the acquiring module acquires the first verifiable statement corresponding to the stored first identification information; the sending module 403 sends the acquired first verifiable statement to the first user.
  • One or more embodiments of this specification provide an authorization processing device based on a verifiable statement.
  • receiving an authorization request sent by a first user it generates authorization record information according to the authorization information in the authorization request, and saves the authorization record information to In the first blockchain; wherein, the authorization information is generated based on the first verifiable statement and the public key corresponding to the first digital identity information of the second user obtained in advance from the second server.
  • the authorization record information is saved in the blockchain, that is, This ensures the validity of authorization, and enables the traceability of authorization records and the effective verification of granted access rights.
  • the embodiment of the authorization processing device based on the verifiable statement in this specification is based on the same inventive concept as the embodiment of the authorization processing method based on the verifiable statement in this specification. Therefore, the specific implementation of this embodiment can refer to the aforementioned corresponding The implementation of the authorization processing method of the verification statement will not be repeated here.
  • FIG. 21 is a schematic diagram of the module composition of another verifiable statement-based authorization processing device provided by one or more embodiments of this specification.
  • the device is used to execute the verifiable statement-based authorization processing method described in Figures 11 to 19, As shown in Figure 21, the device includes:
  • the receiving module 501 receives a key acquisition request sent by a first user, where the key acquisition request includes the first digital identity information of the second user;
  • the first obtaining module 502 obtains the public key corresponding to the first digital identity information from the second blockchain;
  • the sending module 503 sends the obtained public key to the first user, so that the first user grants the second user the first verifiable statement of the first user based on the public key access permission.
  • One or more embodiments of this specification provide an authorization processing device based on a verifiable statement.
  • the corresponding public key is obtained from the second blockchain and sent to the first User, so that the first user can grant the second user the access right to the first verifiable statement of the first user based on the public key.
  • the access authorization of the verifiable claim is realized, and the authorization requirement of the user to grant access rights to the verifiable claim to other users in different business scenarios is satisfied.
  • the first obtaining module 502 searches for the associated first document from the second blockchain according to the first digital identity information; and obtains the first document obtained from the search Public key.
  • the first user and the second user correspond to the same first server, and the first server is used to store and manage verifiable claims.
  • the device also includes a second acquisition module.
  • the receiving module 501 after the sending module 503 sends the obtained public key to the first user, receives an address query request sent by the second user, where the address query request includes the second user The user’s first digital identity information; the second acquisition module queries the second blockchain for the associated first document according to the first digital identity information, and acquires the first document from the first document An access address of the server; sending the acquired access address to the second user, so that the second user sends a verifiable statement of the first access request to the first server according to the access address To request access to the first verifiable statement.
  • the first user and the second user correspond to different first server ends, and the first server end is used to store and manage verifiable statements;
  • the device further includes a third acquiring module and a saving module .
  • the third obtaining module after the sending module 503 sends the obtained public key to the first user, obtains the authorization of the access right from the first server corresponding to the first user Information; wherein the authorization information is sent by the first user to the first server, so that the first server saves the authorization record information in the first blockchain according to the authorization information;
  • the authorization information is generated based on the public key and the first verifiable statement;
  • the storage module stores the authorization information in the second blockchain;
  • the sending module 503 is used in the When receiving the third access request of the verifiable statement sent by the second user, the receiving module 501 sends the first verifiable statement in the authorization information to the second user.
  • the third obtaining module receives the data migration request sent by the first user, it will be based on the information of the first digital identity information and the first verifiable statement included in the data migration request.
  • First identification information sending a request for obtaining the authorization information to a first server corresponding to the first user; so that the first server can use the first digital identity information and the first identification information, Obtain the associated authorization record information from the first blockchain, and return the authorization information in the authorization record information; and, receive the authorization information sent by the first server.
  • the authorization information includes: the ciphertext of the first verifiable claim and the ciphertext of the first key; wherein the ciphertext of the first verifiable claim is based on the first key pair
  • the first verifiable statement is obtained by encryption processing; the cipher text of the first key is obtained by encrypting the first key according to the public key; the sending module 503 converts the The ciphertext of the first verifiable statement and the ciphertext of the first key are sent to the second user, so that the second user can pair the first user according to the private key corresponding to the first digital identity information.
  • the ciphertext of a key is decrypted to obtain the first key, and the ciphertext of the first verifiable statement is decrypted according to the first key to obtain the first verifiable statement.
  • the authorization information further includes the expiration time of the access authority; the storage module generates a second verifiable statement according to the authorization information; and combines the second verifiable statement with the second verifiable statement.
  • the second identification information of the verifiable statement is associated and stored in the second blockchain; the second identification information is sent to the second user, so that the second user sends the second identification information according to the second identification information.
  • the authorization information further includes the expiration time of the access authority; the storage module generates a third verifiable statement based on the first digital identity information; wherein, the third verifiable statement is used for Prove that the second user has the access authority to the first verifiable statement in the authorization information; and, combine the authorization information, the third verifiable statement, and the third verifiable statement of the Three identification information is associated and stored in the second blockchain; the third identification information is sent to the second user, so that the second user sends the third access request according to the third identification information
  • the device further includes a generating module; the receiving module 501, before receiving the key acquisition request sent by the first user, receives a verifiable claim application request sent by the first user; wherein, the The application request includes application information and storage information; the generating module generates the first verifiable statement based on the application information; and, based on the storage information, sends the generated first verifiable statement to the corresponding So that the first server saves the first verifiable statement.
  • the receiving module 501 before receiving the key acquisition request sent by the first user, receives a verifiable claim application request sent by the first user; wherein, the The application request includes application information and storage information; the generating module generates the first verifiable statement based on the application information; and, based on the storage information, sends the generated first verifiable statement to the corresponding So that the first server saves the first verifiable statement.
  • One or more embodiments of this specification provide an authorization processing device based on a verifiable statement.
  • the corresponding public key is obtained from the second blockchain and sent to the first User, so that the first user can grant the second user the access right to the first verifiable statement of the first user based on the public key.
  • the access authorization of the verifiable claim is realized, and the authorization requirement of the user to grant access rights to the verifiable claim to other users in different business scenarios is satisfied.
  • the embodiment of the authorization processing device based on the verifiable statement in this specification is based on the same inventive concept as the embodiment of the authorization processing method based on the verifiable statement in this specification. Therefore, the specific implementation of this embodiment can refer to the aforementioned corresponding The implementation of the authorization processing method of the verification statement will not be repeated here.
  • FIG. 22 is a schematic diagram of the composition of an authorization processing system based on verifiable claims provided by one or more embodiments of this specification. As shown in FIG. 22, the system includes: a first client 601 of a first user, and the first client 601 of the first user A first server 602 and a second server 603 corresponding to a client 601;
  • the first client 601 responds to the authorization operation of the first user granting the second user to the first user’s first verifiable statement of access, according to the first digital identity information of the second user , Send a key acquisition request to the second server 603; receive the public key corresponding to the first digital identity information sent by the second server 603; according to the public key and the first verifiable Declare that authorization information is generated, and send an authorization request to the first server 602 according to the authorization information;
  • the first server 602 receives the authorization request, generates authorization record information according to the authorization information and the first identification information of the first verifiable statement; saves the authorization record information in the first block In the chain, send authorization success information to the first client 601;
  • the second server 603 receives the key acquisition request, acquires the public key corresponding to the first digital identity information from the second blockchain; sends the acquired public key to the first Client 601.
  • the first client 601 encrypts the first verifiable statement according to the designated first key to obtain the ciphertext of the first verifiable statement;
  • the first key is encrypted to obtain the cipher text of the first key;
  • the authorization information is generated according to the cipher text of the first verifiable statement and the cipher text of the first key.
  • the system further includes a second client 604 of the second user.
  • the second client 604 when the first user and the second user correspond to the same first server, in response to the access operation of the verifiable claim of the second user, send a message to the second server 603 Sending an address query request, receiving the access address of the first server 602 sent by the second server 603, and sending a verifiable statement of the first access request to the first server 602 according to the access address; And, when the second user and the first user correspond to a different first server, in response to the access operation of the second user's verifiable statement, send a verifiable statement to the second server 603 The third access request.
  • the first client obtains the public key corresponding to the first digital identity information of the second user from the second server, and based on the obtained public key
  • the key and the first verifiable statement produce authorization information, so that the authorization request is sent to the first server based on the authorization information, so that the first server saves the authorization record information in the first blockchain; not only the verifiable statement is realized
  • the access authorization meets the authorization requirements for users to grant other users access to verifiable claims in different business scenarios; and by storing the authorization record information in the blockchain, the validity of the authorization is ensured and the The authorization record can be traced back, and the granted access authority can be effectively verified.
  • the embodiment of the authorization processing system based on the verifiable statement in this specification is based on the same inventive concept as the embodiment of the authorization processing method based on the verifiable statement in this specification. Therefore, the specific implementation of this embodiment can refer to the aforementioned corresponding The implementation of the authorization processing method of the verification statement will not be repeated here.
  • FIG. 24 is a schematic structural diagram of an authorization processing device based on a verifiable statement provided in one or more embodiments of this specification.
  • authorization processing devices based on verifiable claims can have relatively large differences due to differences in configuration or performance, and may include one or more processors 701 and memory 702, and the memory 702 may store one or one The above stores applications or data. Among them, the memory 702 may be short-term storage or persistent storage.
  • the application program stored in the memory 702 may include one or more modules (not shown in the figure), and each module may include a series of computer-executable instructions in the authorization processing device based on a verifiable statement.
  • the processor 701 may be configured to communicate with the memory 702, and execute a series of computer-executable instructions in the memory 702 on an authorization processing device based on a verifiable statement.
  • the authorization processing device based on the verifiable statement may also include one or more power supplies 703, one or more wired or wireless network interfaces 704, one or more input and output interfaces 705, one or more keyboards 706, and the like.
  • the authorization processing device based on the verifiable statement includes a memory and one or more programs, wherein one or more programs are stored in the memory, and the one or more programs may include one or more programs.
  • the above modules, and each module may include a series of computer-executable instructions in the authorization processing device based on the verifiable statement, and configured to be executed by one or more processors.
  • the one or more programs are included for performing the following Computer executable instructions: receiving an authorization request sent by a first user, where the authorization request is used to request that the second user be granted access to the first verifiable statement of the first user; the authorization request includes authorization Information, the authorization information is generated based on the public key corresponding to the first verifiable statement and the first digital identity information of the second user; according to the authorization information and the first verifiable statement of the first user
  • the identification information is used to generate authorization record information; the authorization record information is stored in the first blockchain, and the authorization success information is sent to the first user.
  • One or more embodiments of this specification provide an authorization processing device based on a verifiable statement.
  • receiving an authorization request sent by a first user it generates authorization record information according to the authorization information in the authorization request, and saves the authorization record information to In the first blockchain; wherein, the authorization information is generated based on the first verifiable statement and the public key corresponding to the first digital identity information of the second user obtained in advance from the second server.
  • the authorization record information is saved in the blockchain, that is, This ensures the validity of authorization, and enables the traceability of authorization records and the effective verification of granted access rights.
  • the authorization record information further includes: the first digital identity information.
  • the method further includes: receiving a first access request with a verifiable statement sent by the second user; wherein the first access request includes the first digital identity information And the first identification information; according to the first digital identity information and the first identification information, the associated authorization record information is queried from the first blockchain, and the queried authorization record The first verifiable statement in the information is sent to the second user.
  • the authorization information includes: the ciphertext of the first verifiable statement and the ciphertext of the first key; wherein, the ciphertext of the first verifiable statement Is obtained by encrypting the first verifiable statement according to the first key; the ciphertext of the first key is obtained by encrypting the first key according to the public key.
  • the sending the first verifiable statement in the queried authorization record information to the second user includes: sending the secret of the first verifiable statement in the queried authorization record information
  • the ciphertext of the first key and the ciphertext of the first key are sent to the second user, so that the second user decrypts the ciphertext of the first key according to the private key corresponding to the first digital identity information Obtain the first key, and decrypt the ciphertext of the first verifiable statement according to the first key to obtain the first verifiable statement.
  • the first access request further includes: first signature data obtained by signing specified data according to the private key corresponding to the first digital identity information.
  • the querying the associated authorization record information from the first blockchain according to the first digital identity information and the first identification information includes: obtaining the public information corresponding to the first digital identity information Key; use the obtained public key to verify the first signature data, if the verification is passed, query from the first blockchain according to the first digital identity information and the first identification information The associated authorization record information.
  • the method further includes: recording the receiving time of the first access request.
  • the method further includes: according to the first identification information, the first digital identity information, and the At the time of receiving, generate the access record information of the first verifiable statement; save the access record information in the first blockchain.
  • the authorization record information further includes: the first digital identity information.
  • the authorization record information After storing the authorization record information in the first blockchain, it further includes: receiving the authorization information acquisition request sent by the second server; wherein the acquisition request includes the first digital identity information And the first identification information; if the associated authorization record information is queried from the first blockchain according to the first digital identity information and the first identification information, then the authorization record The authorization information in the information is sent to the second server; so that the second server saves the authorization information in the second blockchain, and after receiving the verifiable statement sent by the second user Sending the first verifiable statement in the authorization information stored in the second blockchain to the second user in the third access request.
  • the method further includes: receiving a processing request for a verifiable statement sent by the first user; wherein, the processing request is used to request a verification of the first verifiable statement. Declare any one of cancellation processing, freezing processing, and unfreezing processing; the processing request includes the first identification information; if it is determined that the first verifiable statement meets the preset processing conditions, then according to the processing request Change the state information of the first verifiable statement; generate change record information according to the first identification information and the changed state information; save the change record information in the first blockchain.
  • the processing request further includes processing type information.
  • the determining that the first verifiable statement meets a preset processing condition includes: acquiring state information of the current state of the first verifiable statement, if the acquired state information is consistent with the preset processing type If the state information associated with the information matches, it is determined that the first verifiable statement meets the preset processing conditions; or, the state information of the current state of the verifiable statement and the preset duration of the first user.
  • the method further includes: receiving the first verifiable statement sent by the second server, and the first verifiable statement Generated by the second server based on an application request for a verifiable statement sent by the first user; save the first verifiable statement.
  • the method further includes: receiving a second access request for the verifiable statement sent by the first user, wherein the first 2.
  • the access request includes the first identification information; obtains the first verifiable statement corresponding to the stored first identification information; and sends the obtained first verifiable statement to the first user.
  • One or more embodiments of this specification provide an authorization processing device based on a verifiable statement, upon receiving an authorization request sent by a first client, it generates authorization record information according to the authorization information in the authorization request, and saves the authorization record information To the first blockchain; where the authorization information is generated based on the first verifiable statement and the public key corresponding to the first digital identity information of the second user obtained in advance from the second server.
  • the authorization processing device based on the verifiable statement includes a memory and one or more programs, wherein one or more programs are stored in the memory, and the one or more programs may include one or more programs. More than one module, and each module may include a series of computer-executable instructions in the authorization processing device based on the verifiable statement, and is configured to be executed by one or more processors.
  • the following computer executable instructions receive a key acquisition request sent by a first user, where the key acquisition request includes the first digital identity information of the second user; and acquire the first digital identity from the second blockchain
  • the public key corresponding to the information is sent to the first user, so that the first user grants the second user the first permission for the first user based on the public key Verify the claimed access rights.
  • the authorization processing device upon receiving the key acquisition request sent by the first user, obtains the corresponding public key from the second blockchain and sends it to the first user. User, so that the first user can grant the second user the access right to the first verifiable statement of the first user based on the public key.
  • the access authorization of the verifiable claim is realized, and the authorization requirement of the user to grant access rights to the verifiable claim to other users in different business scenarios is satisfied.
  • the obtaining the public key corresponding to the first digital identity information from the second blockchain includes: according to the first digital identity information, from the The associated first document is queried in the second blockchain; the public key is obtained from the queried first document.
  • the method further includes: receiving an address query request sent by the second user; wherein the address query request includes the first digital identity information of the second user Query the associated first document from the second blockchain according to the first digital identity information; obtain the access address of the first server from the first document; send the obtained access address To the second user, so that the second user sends a first access request with a verifiable statement to the first server according to the access address to request access to the first verifiable statement.
  • the method further includes: obtaining authorization information of the access authority from the first server corresponding to the first user; wherein, the authorization information Sent by the first user to the first server, so that the first server saves the authorization record information in the first blockchain according to the authorization information; the authorization information is based on the public Key and the first verifiable statement; save the authorization information in the second blockchain; and, upon receiving the third access request of the verifiable statement sent by the second user, send The first verifiable statement in the authorization information is sent to the second user.
  • the obtaining the authorization information of the access authority from the first server corresponding to the first user includes: if a message sent by the first user is received Data migration request, according to the first digital identity information included in the data migration request and the first identification information of the first verifiable statement, the authorization is sent to the first server corresponding to the first user Information acquisition request; so that the first server obtains the associated authorization record information from the first blockchain according to the first digital identity information and the first identification information, and returns the authorization Record the authorization information in the information; receive the authorization information sent by the first server.
  • the authorization information includes: the ciphertext of the first verifiable statement and the ciphertext of the first key; wherein, the ciphertext of the first verifiable statement Is obtained by encrypting the first verifiable statement according to the first key; the ciphertext of the first key is obtained by encrypting the first key according to the public key.
  • the sending the first verifiable statement in the authorization information to the second user includes: sending the cipher text of the first verifiable statement and the cipher text of the first key to the The second user, so that the second user decrypts the ciphertext of the first key according to the private key corresponding to the first digital identity information to obtain the first key, and according to the The first key decrypts the ciphertext of the first verifiable statement to obtain the first verifiable statement.
  • the authorization information further includes the expiration time of the access authority.
  • the storing the authorization information in the second blockchain includes: generating a second verifiable statement according to the authorization information; and combining the second verifiable statement and the second verifiable statement 2.
  • the identification information is associated and stored in the second blockchain; the second identification information is sent to the second user, so that the second user sends the third access request according to the second identification information .
  • the sending the first verifiable statement in the authorization information to the second user includes: according to the second identification information in the third access request, from the second blockchain Obtain the second verifiable statement stored in association; obtain the authorization information from the second verifiable statement; if it is determined that the current time does not exceed the deadline in the authorization information, then the authorization The first verifiable statement in the message is sent to the second user.
  • the authorization information further includes the expiration time of the access authority.
  • the storing the authorization information in the second blockchain includes: generating a third verifiable statement according to the first digital identity information; wherein, the third verifiable statement is used to prove the The second user has the access right to the first verifiable statement in the authorization information; the authorization information, the third verifiable statement, and the third identification information of the third verifiable statement are associated and stored To the second blockchain; sending the third identification information to the second user, so that the second user sends the third access request according to the third identification information.
  • the sending the first verifiable statement in the authorization information to the second user includes: according to the third identification information in the third access request, from the second blockchain Obtain the authorization information and the third verifiable statement stored in association; if it is determined that the first digital identity information in the third access request matches the first digital identity information in the third verifiable statement, And the current time does not exceed the deadline in the authorization information, then the first verifiable statement in the authorization information is sent to the second user.
  • the method further includes: receiving an application request for a verifiable statement sent by the first user; wherein, the application The request includes application information and storage information; according to the application information, the first verifiable statement is generated; according to the storage information, the generated first verifiable statement is sent to the corresponding first server, so that The first server saves the first verifiable statement.
  • the authorization processing device upon receiving the key acquisition request sent by the first user, obtains the corresponding public key from the second blockchain and sends it to the first user. User, so that the first user can grant the second user the access right to the first verifiable statement of the first user based on the public key.
  • the access authorization of the verifiable claim is realized, and the authorization requirement of the user to grant access rights to the verifiable claim to other users in different business scenarios is satisfied.
  • the embodiment of the authorization processing device based on the verifiable statement in this specification is based on the same inventive concept as the embodiment of the authorization processing method based on the verifiable statement in this specification. Therefore, the specific implementation of this embodiment can refer to the corresponding The implementation of the authorization processing method of the verification statement will not be repeated here.
  • one or more embodiments of this specification also provide a storage medium for storing computer executable instructions, a specific implementation
  • the storage medium may be a U disk, an optical disk, a hard disk, etc.
  • the computer executable instructions stored in the storage medium are executed by the processor, the following process can be realized: receiving an authorization request sent by a first user, wherein the The authorization request is used to request that the second user be granted access to the first verifiable statement of the first user; the authorization request includes authorization information based on the first verifiable statement and the first verifiable statement.
  • the public key corresponding to the first digital identity information of the user is generated; the authorization record information is generated according to the authorization information and the first identification information of the first verifiable statement; the authorization record information is saved to the first In the blockchain, the authorization success message is sent to the first user.
  • the authorization record information is generated according to the authorization information in the authorization request, And save the authorization record information in the first blockchain; where the authorization information is generated based on the first verifiable statement and the public key corresponding to the first digital identity information of the second user obtained in advance from the second server.
  • the authorization record information further includes: the first digital identity information.
  • After sending the authorization success information to the first user it further includes: receiving a first access request with a verifiable statement sent by the second user, where the first access request includes the first digital identity information and the first access request.
  • the first identification information according to the first digital identity information and the first identification information, the associated authorization record information is queried from the first blockchain, and the queried authorization record information The first verifiable statement of is sent to the second user.
  • the authorization information includes: the ciphertext of the first verifiable statement and the ciphertext of the first key, and the first verifiable statement
  • the ciphertext of the verification statement is obtained by encrypting the first verifiable statement based on the first key; the ciphertext of the first key is obtained by performing the first key based on the public key Encrypted.
  • the sending the first verifiable statement in the queried authorization record information to the second user includes: sending the secret of the first verifiable statement in the queried authorization record information
  • the ciphertext of the first key and the ciphertext of the first key are sent to the second user, so that the second user decrypts the ciphertext of the first key according to the private key corresponding to the first digital identity information Obtain the first key, and decrypt the ciphertext of the first verifiable statement according to the first key to obtain the first verifiable statement.
  • the first access request further includes: signature processing on designated data according to the private key corresponding to the first digital identity information The first signature data.
  • querying the associated authorization record information from the first blockchain includes: obtaining a public key corresponding to the first digital identity information; Use the obtained public key to verify the first signature data, and if the verification is passed, query the associated data from the first blockchain based on the first digital identity information and the first identification information The authorization record information.
  • the method further includes: recording the first access request Time of reception.
  • the method further includes: according to the first identification information, the first digital identity information, and the receiving time , Generate the access record information of the first verifiable statement; save the access record information in the first blockchain.
  • the authorization record information further includes the first Digital identity information.
  • the authorization record information After storing the authorization record information in the first blockchain, it further includes: receiving the authorization information acquisition request sent by the second server; wherein the acquisition request includes the first digital identity information And the first identification information; if the associated authorization record information is queried from the first blockchain according to the first digital identity information and the first identification information, then the authorization record The authorization information in the information is sent to the second server; so that the second server saves the authorization information in the second blockchain, and after receiving the verifiable statement sent by the second user Sending the first verifiable statement in the authorization information stored in the second blockchain to the second user in the third access request.
  • the method further includes: receiving a processing request for a verifiable statement sent by the first user, and the processing request is used for requesting The first verifiable statement is subjected to any one of cancellation processing, freezing processing, and unfreezing processing, and the processing request includes the first identification information; if it is determined that the first verifiable statement meets the preset processing conditions, then Change the state information of the first verifiable statement according to the processing request; generate change record information based on the first identification information and the changed state information; save the change record information to the first block Chain.
  • the processing request further includes processing type information.
  • the determining that the first verifiable statement meets a preset processing condition includes: acquiring state information of the current state of the first verifiable statement, if the acquired state information is consistent with the preset processing type If the state information associated with the information matches, it is determined that the first verifiable statement meets the preset processing conditions; or, the state information of the current state of the verifiable statement and the preset duration of the first user.
  • the method further includes: receiving the first verifiable statement sent by the second server; The first verifiable statement is generated by the second server based on an application request for a verifiable statement sent by the first user; the first verifiable statement is saved.
  • the method further includes: receiving a second access to the verifiable statement sent by the first user Request, wherein the second access request includes the first identification information; obtains the first verifiable statement corresponding to the stored first identification information; sends the obtained first verifiable statement to all Mentioned first user.
  • the authorization record information is generated according to the authorization information in the authorization request, and
  • the authorization record information is stored in the first blockchain; where the authorization information is generated based on the first verifiable statement and the public key corresponding to the first digital identity information of the second user obtained in advance from the second server.
  • the storage medium may be a U disk, an optical disk, a hard disk, etc.
  • the computer executable instructions stored in the storage medium can realize the following process when being executed by the processor: receiving the key sent by the first user An acquisition request, wherein the key acquisition request includes the first digital identity information of the second user; the public key corresponding to the first digital identity information is acquired from the second blockchain; and the public key to be acquired Sent to the first user, so that the first user grants the second user the access right to the first verifiable statement of the first user based on the public key.
  • the processor When the computer-executable instructions stored in the storage medium provided by one or more embodiments of this specification are executed by the processor, when the key acquisition request sent by the first user is received, the corresponding public is obtained from the second blockchain. The key is sent to the first user, so that the first user can grant the second user access to the first verifiable statement of the first user based on the public key. As a result, the access authorization of the verifiable claim is realized, and the authorization requirement of the user to grant access rights to the verifiable claim to other users in different business scenarios is satisfied.
  • the obtaining the public key corresponding to the first digital identity information from the second blockchain includes: according to the first For digital identity information, query the associated first document from the second blockchain; obtain the public key from the first document that is queried.
  • the method further includes: receiving an address query request sent by the second user, where the address query request includes the first digital identity information of the second user Query the associated first document from the second blockchain according to the first digital identity information; obtain the access address of the first server from the first document; send the obtained access address To the second user, so that the second user sends a first access request with a verifiable statement to the first server according to the access address to request access to the first verifiable statement.
  • the method further includes: obtaining authorization information of the access authority from the first server corresponding to the first user; wherein, the authorization information Sent by the first user to the first server, so that the first server saves the authorization record information in the first blockchain according to the authorization information; the authorization information is based on the public Key and the first verifiable statement; save the authorization information in the second blockchain; and, upon receiving the third access request of the verifiable statement sent by the second user, send The first verifiable statement in the authorization information is sent to the second user.
  • the obtaining the authorization information of the access authority from the first server corresponding to the first user includes: According to the data migration request sent by the first user, according to the first digital identity information included in the data migration request and the first identification information of the first verifiable statement, send the data migration request to the first user corresponding to the first user.
  • a server sends a request for obtaining the authorization information; so that the first server obtains the associated authorization record from the first blockchain according to the first digital identity information and the first identification information Information, and return the authorization information in the authorization record information; receive the authorization information sent by the first server.
  • the authorization information includes the ciphertext of the first verifiable statement and the ciphertext of the first key, and the first verifiable
  • the ciphertext of the statement is obtained by encrypting the first verifiable statement according to the first key; the ciphertext of the first key is obtained by encrypting the first key according to the public key Resulted from processing.
  • the sending the first verifiable statement in the authorization information to the second user includes: sending the cipher text of the first verifiable statement and the cipher text of the first key to the The second user, so that the second user decrypts the ciphertext of the first key according to the private key corresponding to the first digital identity information to obtain the first key, and according to the The first key decrypts the ciphertext of the first verifiable statement to obtain the first verifiable statement.
  • the authorization information further includes the expiration time of the access authority; and the storing the authorization information in the second blockchain Including: generating a second verifiable statement according to the authorization information; associating and saving the second verifiable statement and the second identification information of the second verifiable statement in the second blockchain; The second user sends the second identification information, so that the second user sends the third access request according to the second identification information.
  • the sending the first verifiable statement in the authorization information to the second user includes: according to the second identification information in the third access request, from the second blockchain Obtain the second verifiable statement stored in association; obtain the authorization information from the second verifiable statement; if it is determined that the current time does not exceed the deadline in the authorization information, then the authorization The first verifiable statement in the message is sent to the second user.
  • the authorization information further includes the expiration time of the access authority; the authorization information is stored in the second blockchain,
  • the method includes: generating a third verifiable statement based on the first digital identity information, the third verifiable statement being used to prove that the second user has access to the first verifiable statement in the authorization information Authority; store the authorization information, the third verifiable statement, and the third identification information of the third verifiable statement in association with the second blockchain; send the first user to the second user Three identification information, so that the second user sends the third access request according to the third identification information.
  • Sending the first verifiable statement in the authorization information to the second user includes: obtaining from the second blockchain according to the third identification information in the third access request The authorization information stored in association with the third verifiable statement; if it is determined that the first digital identity information in the third access request matches the first digital identity information in the third verifiable statement, and the current When the time does not exceed the deadline in the authorization information, the first verifiable statement in the authorization information is sent to the second user.
  • the method further includes: receiving an application for a verifiable statement sent by the first user Request, the application request includes application information and storage information; according to the application information, the first verifiable statement is generated; according to the storage information, the generated first verifiable statement is sent to the corresponding first The server, so that the first server saves the first verifiable statement.
  • the processor When the computer-executable instructions stored in the storage medium provided by one or more embodiments of this specification are executed by the processor, when the key acquisition request sent by the first user is received, the corresponding public is obtained from the second blockchain. The key is sent to the first user, so that the first user can grant the second user access to the first verifiable statement of the first user based on the public key. As a result, the access authorization of the verifiable claim is realized, and the authorization requirement of the user to grant access rights to the verifiable claim to other users in different business scenarios is satisfied.
  • the improvement of a technology can be clearly distinguished between hardware improvements (for example, improvements in circuit structures such as diodes, transistors, switches, etc.) and software improvements (improvements in method flow).
  • hardware improvements for example, improvements in circuit structures such as diodes, transistors, switches, etc.
  • software improvements improvements in method flow
  • the improvement of many methods and processes of today can be regarded as a direct improvement of the hardware circuit structure.
  • Designers almost always get the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be realized by the hardware entity module.
  • a programmable logic device Programmable Logic Device, PLD
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • HDL Hardware Description Language
  • ABEL Advanced Boolean Expression Language
  • AHDL Altera Hardware Description Language
  • HDCal JHDL
  • Lava Lava
  • Lola MyHDL
  • PALASM RHDL
  • VHDL Very-High-Speed Integrated Circuit Hardware Description Language
  • Verilog Verilog
  • the controller can be implemented in any suitable manner.
  • the controller can take the form of, for example, a microprocessor or a processor and a computer-readable medium storing computer-readable program codes (such as software or firmware) executable by the (micro)processor. , Logic gates, switches, application specific integrated circuits (ASICs), programmable logic controllers and embedded microcontrollers. Examples of controllers include but are not limited to the following microcontrollers: ARC625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicon Labs C8051F320, the memory controller can also be implemented as part of the memory control logic.
  • controllers in addition to implementing the controller in a purely computer-readable program code manner, it is completely possible to program the method steps to make the controller use logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded logic.
  • the same function can be realized in the form of a microcontroller or the like. Therefore, such a controller can be regarded as a hardware component, and the devices included in it for realizing various functions can also be regarded as a structure within the hardware component. Or even, a device for realizing various functions can be regarded as both a software module for realizing the method and a structure within a hardware component.
  • a typical implementation device is a computer.
  • the computer may be, for example, a personal computer, a laptop computer, a cell phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or Any combination of these devices.
  • one or more embodiments of this specification can be provided as a method, a system, or a computer program product. Therefore, one or more embodiments of this specification may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • the computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-permanent memory in computer readable media, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer readable media.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash memory
  • Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology.
  • the information can be computer-readable instructions, data structures, program modules, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.
  • One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules.
  • program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types.
  • One or more embodiments of this specification can also be practiced in distributed computing environments. In these distributed computing environments, tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Storage Device Security (AREA)

Abstract

本说明书实施例提供了一种基于可验证声明的授权处理方法、装置、设备及系统，其中方法包括：第一服务端接收第一用户发送的授权请求，其中，授权请求用于请求为第二用户授予对所述第一用户的第一可验证声明的访问权限；授权请求包括基于第一可验证声明和第二用户的第一数字身份信息所对应的公钥所生成的授权信息；根据授权信息和第一可验证声明的第一标识信息，生成授权记录信息；将授权记录信息保存至第一区块链中，向第一用户发送授权成功信息。

Description

基于可验证声明的授权处理 技术领域
本文件涉及数据处理技术领域，尤其涉及基于可验证声明的授权处理。
背景技术
数字身份信息，如DID(英文全称：Decentralized Identifiers，中文全称：分布式身份标识)，是一种去中心化的可验证的数字标识符。DID可以标识个体的身份、组织的身份等，但由于DID中并没有个体、组织等的真实信息，如姓名、家庭住址等信息，因此用户通常将DID与可验证声明(英文全称：Verifiable Credential，简称VC)相结合，通过可验证声明来证明如年龄、学历、拥有的某些权限等信息。通常的，在不同的场景中往往需要证明的内容不同，并需要授予不同的用户对可验证声明的访问权限，因此如何有效的进行可验证声明是访问授权是备受用户关注的问题。
发明内容
本说明书一个或多个实施例提供了一种基于可验证声明的授权处理方法，应用于第一用户对应的第一服务端。该方法包括接收第一用户发送的授权请求。其中，所述授权请求用于请求为第二用户授予对所述第一用户的第一可验证声明的访问权限。所述授权请求包括授权信息。所述授权信息基于所述第一可验证声明和所述第二用户的第一数字身份信息所对应的公钥所生成。根据所述授权信息和所述第一可验证声明的第一标识信息，生成授权记录信息。将所述授权记录信息保存至第一区块链中，向所述第一用户发送授权成功信息。
本说明书一个或多个实施例提供了一种基于可验证声明的授权处理方法，应用于第二服务端。该方法包括接收第一用户发送的密钥获取请求。其中，所述密钥获取请求包括第二用户的第一数字身份信息。从第二区块链中获取所述第一数字身份信息所对应的公钥。将获取的所述公钥发送给所述第一用户，以使所述第一用户基于所述公钥授予所述第二用户对所述第一用户的第一可验证声明的访问权限。
本说明书一个或多个实施例提供了一种基于可验证声明的授权处理装置，应用于第一用户对应的第一服务端。该装置包括接收模块，其接收第一用户发送的授权请求。其中，所述授权请求用于请求为第二用户授予对所述第一用户的第一可验证声明的访问权限。所述授权请求包括授权信息。所述授权信息基于所述第一可验证声明和所述第二用户的第一数字身份信息所对应的公钥所生成。该装置还包括生成模块，其根据所述授权信息和所述第一可验证声明的第一标识信息，生成授权记录信息。该装置还包括发送模块，其将所述授权记录信息保存至第一区块链中，向所述第一用户发送授权成功信息。
本说明书一个或多个实施例提供了一种基于可验证声明的授权处理装置，应用于第二服务端。该装置包括接收模块，其接收第一用户发送的密钥获取请求。其中，所述密钥获取请求包括第二用户的第一数字身份信息。该装置还包括第一获取模块，其从第二区块链中获取所述第一数字身份信息所对应的公钥。该装置还包括发送模块，其将获取的所述公钥发送给所述第一用户，以使所述第一用户基于所述公钥授予所述第二用户对所述第一用户的第一可验证声明的访问权限。
本说明书一个或多个实施例提供了一种基于可验证声明的授权处理系统。该系统包括第一用户的第一客户端、所述第一客户端对应的第一服务端、第二服务端。所述第一客户端响应于所述第一用户授予第二用户对所述第一用户的第一可验证声明的访问权 限的授权操作，根据所述第二用户的第一数字身份信息，向所述第二服务端发送密钥获取请求；接收所述第二服务端发送的所述第一数字身份信息所对应的公钥；根据所述公钥和所述第一可验证声明生成授权信息，根据所述授权信息向所述第一服务端发送授权请求。所述第一服务端接收所述授权请求；根据所述授权信息和所述第一可验证声明的第一标识信息，生成授权记录信息；将所述授权记录信息保存至第一区块链中；向所述第一客户端发送授权成功信息。所述第二服务端接收所述密钥获取请求；从第二区块链中获取所述第一数字身份信息所对应的公钥；将获取的所述公钥发送给所述第一客户端。
本说明书一个或多个实施例提供了一种基于可验证声明的授权处理设备。该设备包括处理器。该设备还包括被安排成存储计算机可执行指令的存储器。所述计算机可执行指令在被执行时接收第一用户发送的授权请求。其中，所述授权请求用于请求为第二用户授予对所述第一用户的第一可验证声明的访问权限。所述授权请求包括授权信息。所述授权信息基于所述第一可验证声明和所述第二用户的第一数字身份信息所对应的公钥所生成。根据所述授权信息和所述第一可验证声明的第一标识信息，生成授权记录信息。将所述授权记录信息保存至第一区块链中，向所述第一用户发送授权成功信息。
本说明书一个或多个实施例提供了一种基于可验证声明的授权处理设备。该设备包括处理器。该设备还包括被安排成存储计算机可执行指令的存储器。所述计算机可执行指令在被执行时接收第一用户发送的密钥获取请求。其中，所述密钥获取请求包括第二用户的第一数字身份信息。从第二区块链中获取所述第一数字身份信息所对应的公钥。将获取的所述公钥发送给所述第一用户，以使所述第一用户基于所述公钥授予所述第二用户对所述第一用户的第一可验证声明的访问权限。
本说明书一个或多个实施例提供了一种存储介质。该存储介质用于存储计算机可执行指令。所述计算机可执行指令在被执行时接收第一用户发送的授权请求。其中，所述授权请求用于请求为第二用户授予对所述第一用户的第一可验证声明的访问权限。所述授权请求包括授权信息。所述授权信息基于所述第一可验证声明和所述第二用户的第一数字身份信息所对应的公钥所生成。根据所述授权信息和所述第一可验证声明的第一标识信息，生成授权记录信息。将所述授权记录信息保存至第一区块链中，向所述第一用户发送授权成功信息
本说明书一个或多个实施例提供了一种存储介质。该存储介质用于存储计算机可执行指令。所述计算机可执行指令在被执行时接收第一用户发送的密钥获取请求。其中，所述密钥获取请求包括第二用户的第一数字身份信息。从第二区块链中获取所述第一数字身份信息所对应的公钥。将获取的所述公钥发送给所述第一用户，以使所述第一用户基于所述公钥授予所述第二用户对所述第一用户的第一可验证声明的访问权限。
附图说明
为了更清楚地说明本说明书一个或多个实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本说明书中记载的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第一种场景示意图；
图2为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第二种场景示意图；
图3为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第 一种流程示意图；
图4为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第二种流程示意图；
图5为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第三种流程示意图；
图6为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第四种流程示意图；
图7为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第五种流程示意图；
图8为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第六种流程示意图；
图9为本说明书一个或多个实施例提供的一种基于可验证声明的状态变更方法的第一种流程示意图；
图10为本说明书一个或多个实施例提供的一种基于可验证声明的状态变更方法的第二种流程示意图；
图11为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第七种流程示意图；
图12为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第八种流程示意图；
图13为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第九种流程示意图；
图14为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第十种流程示意图；
图15为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第十一种流程示意图；
图16为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第十二种流程示意图；
图17为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第十三种流程示意图；
图18为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第十四种流程示意图；
图19为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的第十五种流程示意图；
图20为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理装置的第一种模块组成示意图；
图21为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理装置的第二种模块组成示意图；
图22为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理系统的第一种组成示意图；
图23为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理系统的第二种组成示意图；
图24为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理设备的结构示意图。
具体实施方式
为了使本技术领域的人员更好地理解本说明书一个或多个实施例中的技术方案，下面将结合本说明书一个或多个实施例中的附图，对本说明书一个或多个实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本说明书的一部分实施例，而不是全部的实施例。基于本说明书一个或多个实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都应当属于本文件的保护范围。
图1为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的应用场景示意图，如图1所示，该场景包括：第一用户的第一客户端、第一用户对应的第一服务端、第一服务端所对应的第一区块链、第二服务端以及第二服务端所对应的第二区块链。其中，第一服务端提供可验证声明的存储、授权管理、状态管理的等服务；第二服务端提供数字身份信息的创建、可验证声明的颁发等服务；第一区块链中保存可验证声明的授权记录信息、访问记录信息、状态变更记录信息等；第二区块链保存数字身份信息的创建记录信息、可验证声明的颁发记录信息等。第一客户端和第二客户端可以为手机、平板电脑、台式计算机、便携笔记本式计算机等(图1中仅示出手机)；第一服务端和第二服务端可以是独立的服务器，也可以是由多个服务器组成的服务器集群。
可选地，第一服务端是第一区块链中的节点、第二服务端是第二区块链中的节点。与之对应的，第一用户预先操作其第一客户端从第二服务端申请第二数字身份信息和第一可验证声明，并将申请的第一可验证声明保存至第一服务端；第二用户预先操作其第二客户端从第二服务端申请第一数字身份信息、第一数字身份信息所对应的公私钥对。当第一用户需要授予第二用户对第一可验证声明的访问权限时，第一用户首先操作第一客户端向第二服务端发送密钥获取请求，第二服务端根据密钥获取请求包括的第一数字身份信息，从第二区块链中获取对应的公钥，并将获取的公钥发送给第一客户端；第一客户端根据第一可验证声明和获取的公钥生成授权信息，根据授权信息向第一服务端发送授权请求；第一服务端根据授权信息和第一可验证声明的第一标识信息，生成授权记录信息；第一服务端将授权记录信息保存至第一区块链中，并向第一客户端发送授权成功信息；第一客户端展示授权成功信息。
进一步的，如图2所示，第一服务端还可以不是第一区块链中的节点，第二服务端也可以不是第二区块链中的节点；相应的，应用场景还包括：接入第一区块链的第一区块链节点和接入第二区块链的第二区块链节点；当第二服务端接收到第一客户端发送的密钥获取请求，将密钥获取请求发送给第二区块链节点，以使第二区块链节点从第二区块链中获取对应的公钥，并将获取的公钥发送给第二服务端，第二服务端将接收到的公钥发送给第一客户端；以及，第一服务端在生成授权记录信息之后，将授权记录信息发送给第一区块链节点，以使第一区块链节点将授权记录信息保存至第一区块链中。
由此，第一客户端通过从第二服务端获取第二用户的第一数字身份信息所对应的公钥，并基于获取的公钥和第一可验证声明生产授权信息，从而根据该授权信息向第一服务端发送授权请求，以使第一服务端将授权记录信息保存至第一区块链中；不仅实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求；而且通过将授权记录信息保存至区块链中，即确保了授权的有效性，又使得授权记录可追溯、授予的访问权限能够得以有效验证。
基于上述应用场景架构，本说明书一个或多个实施例提供了一种基于可验证声明的授权处理方法。图3为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理方法的流程示意图，图3中的方法能够由图1中的第一服务端执行，如图3所示，该方法包括以下步骤：
步骤S102，接收第一用户发送的授权请求，其中，授权请求用于请求为第二用户授予对第一用户的第一可验证声明的访问权限；授权请求包括授权信息，授权信息基于第一可验证声明和第二用户的第一数字身份信息所对应的公钥所生成。
具体的，第一客户端响应于第一用户的授权操作，根据待授权的第一可验证声明、预先从第二服务端获取的第二用户的第一数字身份信息所对应的公钥，生成授权信息，根据授权信息向对应的第一服务端发送授权请求；第一服务端接收第一客户端发送的授权请求。其中，授权请求还可以包括第一可验证声明的第一标识信息、第一用户的第一数字身份信息等；授权信息的生成过程，在后文中进行详述。
步骤S104，根据授权信息和第一可验证声明的第一标识信息，生成授权记录信息。
具体的，将授权信息、第一可验证声明的第一标识信息、第二用户的第一数字身份信息等关联记录，并将记录的信息确定为授权记录信息。
步骤S106，将授权记录信息保存至第一区块链中，向第一用户发送授权成功信息。
第一服务端在接收到第一客户端发送的授权请求时，根据授权请求中的授权信息生成授权记录信息，并将授权记录信息保存至第一区块链中。授权信息基于第一可验证声明以及预先从第二服务端获取的第二用户的第一数字身份信息所对应的公钥所生成。由此，不仅实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求；而且通过将授权记录信息保存至区块链中，即确保了授权的有效性，又使得授权记录可追溯、授予的访问权限能够得以有效验证。
为了避免他人冒充第一用户进行授权操作，授权请求还可以包括采用第一用户的第二数字身份信息所对应的私钥对指定信息进行签名处理所得的第二签名数据；相应的，步骤S104可以包括：获取第二数字身份信息所对应的公钥，若根据获取的公钥对第二签名数据验证通过，则根据授权信息和第一可验证声明的第一标识信息，生成授权记录信息。
其中，获取第二数字身份信息所对应的公钥可以包括：根据第二数字身份信息向第二服务端发送密钥获取请求，以使第二服务端从第二区块链中查询第二数字身份信息所对应的公钥；或者，第一服务端向第一客户端发送密钥获取请求，以使第一客户端将密钥获取请求发送给第二服务端，当第一客户端接收到第二服务端发送的公钥时，将接收到的公钥发送给第一服务端。
由于第二数字身份信息所对应的私钥仅有第一用户持有，因此，通过对第二签名数据进行验证，有效的避免了他们冒充第一用户进行授权操作的风险。
在第一用户授权了第二用户对第一可验证声明的访问权限之后，第二用户即可访问第一可验证声明。具体的，第一用户与第二用户对应相同的第一服务端，例如，第一用户与第二用户归属于同一联盟链。此时，第二用户通过向第一服务端发送第一访问请求以请求访问第一可验证声明。与之对应的，如图4所示，步骤S106之后还包括：步骤S108，接收第二用户发送的可验证声明的第一访问请求。其中，第一访问请求包括第一数字身份信息和第一标识信息。
在授权成功之后，第一用户可私下将第一可验证声明的第一标识信息告知第二用户；或者，第一用户操作第一客户端将第一可验证声明的第一标识信息发送给第二用户的第 二客户端；或者，第一服务端根据第一标识信息向第二客户端发送授权提示信息，以使第二用户根据第一标识信息访问第一可验证声明。当第二用户需要访问第一可验证声明时，操作其第二客户端，第二客户端响应于第二用户的访问操作，根据第二用户的第一数字身份信息和第一标识信息等，向第一服务端发送第一访问请求。
步骤S110，根据第一数字身份信息和第一标识信息，从第一区块链中查询关联的授权记录信息，将查询到的授权记录信息中的第一可验证声明发送给第二用户。
为了确保未被授予访问权限的用户不能访问第一可验证声明，可采用信封加密的方式对第一可验证声明进行加密处理。如图5所示，步骤S102包括以下步骤S102-2，接收第一用户发送的授权请求，授权请求用于请求为第二用户授予对第一用户的第一可验证声明的访问权限，授权请求包括授权信息，授权信息包括第一可验证声明的密文和第一密钥的密文；第一可验证声明的密文是根据第一密钥对第一可验证声明进行加密处理而得；第一密钥的密文是根据第二用户的第一数字身份所对应的公钥对第一密钥进行加密处理而得。
与步骤S102-2对应的，如图5所示，步骤S110包括以下步骤S110-2，根据第一数字身份信息和第一标识信息，从第一区块链中查询关联的授权记录信息，将查询到的授权记录信息中的第一可验证声明的密文和第一密钥的密文发送给第二用户，以使第二用户根据第一数字身份信息所对应的私钥对第一密钥的密文进行解密处理得到第一密钥，并根据第一密钥对第一可验证声明的密文进行解密处理得到第一可验证声明。
通过采用信封加密的方式对第一可验证声明进行加密，使得只有被授予了访问权限的第二用户可对第一密钥的密文进行解密处理得到第一密钥，从而根据第一密钥对第一可验证声明的密文进行解密处理得到第一可验证声明，有效确保了第一可验证声明的隐私性。
为了对第二用户的身份进行有效验证，第一访问请求还可包括：根据第一数字身份信息所对应的私钥对指定数据进行签名处理所得的第一签名数据。如图6所示，步骤S108可包括以下步骤S108-2，接收第二用户发送的可验证声明的第一访问请求；其中，第一访问请求包括第一数字身份信息、第一标识信息和根据第一数字身份信息所对应的私钥对指定数据进行签名处理所得的第一签名数据。
与之对应的，如图6所示，步骤S110包括以下步骤S110-4和步骤S110-6。
步骤S110-4，获取第一数字身份信息所对应的公钥。其中，获取第一数字身份信息所对应的公钥的过程，与前述获取第二数字身份信息所对应的公钥的过程相似，可参见前述相关描述，这里不再赘述。
步骤S110-6，采用获取的公钥对第一签名数据进行验证，若验证通过，则根据第一数字身份信息和第一标识信息，从第一区块链中查询关联的授权记录信息，并将查询到的授权记录信息中的第一可验证声明发送给第二用户。
由于第一数字身份信息所对应的私钥仅有第二用户持有，因此通过对第一签名数据进行验证，能够有效的避免他人冒充第二用户进行第一验证声明的访问操作。
为了确保第一可验证声明的访问记录可追溯，第一服务端可将第一可验证声明的访问记录信息保存至第一区块链中。如图7所示，步骤S108之后，还包括：步骤S109，记录第一访问请求的接收时间。
与之对应的，步骤S110之后还包括：步骤S112，根据第一标识信息、第一数字身份信息和接收时间，生成第一可验证声明的访问记录信息，将访问记录信息保存至第一区块链中。
以上为第一用户与第二用户对应相同的第一服务端时，第二用户通过与第一服务端进行数据通信，实现了第一可验证声明的访问。第一用户还可与第二用户对应不同的第一服务端，例如，第一用户是第一联盟链的用户，第二用户时第二联盟链的用户，第一联盟链与第二联盟链不同。此时，第二用户没有与第一服务端进行数据通信的权限，并通过第二服务端进行第一可验证声明的访问。如图8所示，步骤S106之后，还包括：
步骤S114，接收第二服务端发送的授权信息的获取请求；其中，获取请求包括第一数字身份信息和第一标识信息；
步骤S116，若根据第一数字身份信息和第一标识信息，从第一区块链中查询到关联的授权记录信息，则将授权记录信息中的授权信息发送给第二服务端；以使第二服务端将授权信息保存在第二区块链中，并在接收到第二用户发送的可验证声明的第三访问请求时，将第二区块链保存的授权信息中的第一可验证声明发送给第二用户。
具体而言，当第一服务端向第一用户发送授权成功信息之后，第一用户向第二服务端发送数据迁移请求；第二服务端根据数据迁移请求包括的第一数字身份信息和第一可验证声明的第一标识信息，向第一用户对应的第一服务端发送授权信息的获取请求，并在接收到第一服务端发送的授权信息时，将授权信息保存至第二区块链中，以在接收到第二用户发送的可验证声明的第三访问请求时，将第二区块链保存的授权信息中的第一可验证声明发送给第二用户。
由此，当第一用户与第二用户对应不同的第一服务端时，第二服务端基于第一用户的数据迁移请求，从第一用户对应的第一服务端获取授权信息并保存在第二区块链中；第二用户与第二服务端进行数据通信以实现对第一可验证声明的访问。
进一步的，如前所述，第二服务端提供可验证声明的颁发服务，相应的，步骤S102之前，还包括：接收第二服务端发送的第一可验证声明，保存第一可验证声明；其中，第一可验证声明为第二服务端基于第一用户发送的可验证声明的申请请求所生成。
其中，保存第一可验证声明可为保存至第一区块链中，还可保存至本地数据库中。
进一步的，第一用户还可以访问其第一可验证声明，相应的，保存第一可验证声明之后，还可以包括：接收第一用户发送的可验证声明的第二访问请求，其中，第二访问请求包括第一标识信息；获取保存的第一标识信息所对应第一可验证声明，将获取的第一可验证声明发送给第一用户。
可选地，为了使第一可验证声明的访问记录可追溯，在将获取的第一可验证声明发送给第一用户之后，还包括：根据第一标识信息、第一用户的第二数字身份信息、第二访问请求的接收时间等，生成访问记录信息，将访问记录信息保存至第一区块链中。
当用户在某个时段不需要使用其可验证声明时，为了避免他人盗用其可验证声明，用户还有对可验证声明进行冻结、撤销等处理需求，以变更可验证声明的状态。基于此，第一服务端还可基于第一用户的处理请求，对第一可验证声明的状态进行相应的变更处理，如图9所示，方法还包括：
步骤S202，接收第一用户发送的可验证声明的处理请求。其中，处理请求用于请求对第一可验证声明进行撤销处理、冻结处理、解除冻结处理中的任意一个，包括第一可验证声明的第一标识信息，处理请求还可包括处理类型信息。
步骤S204，若确定第一可验证声明符合预设的处理条件，则根据处理请求变更第一可验证声明的状态信息。
根据不同的处理类型所要求的可验证声明所处状态的不同，可预先设定处理类型信息与状态信息的关联关系，如表征撤销处理的处理类型信息1关联的状态信息为有效、 临时性失效，表征冻结处理的处理类型信息2关联的状态信息为有效，表征解除冻结处理的处理类型信息3关联的状态信息为临时性失效。相应的，步骤S204包括：获取第一可验证声明当前所处状态的状态信息，若获取的状态信息与预设的处理类型信息所关联的状态信息相匹配，则确定第一可验证声明符合预设的处理条件；或者，获取可验证声明当前所处状态的状态信息和第一用户在预设时长内对第一可验证声明的处理频次，若获取的状态信息与预设的处理类型信息所关联的状态信息相匹配、且处理频次小于预设频次，则确定第一可验证声明符合预设的处理条件。
其中，获取第一可验证声明当前所处状态的状态信息，包括：根据第一可验证声明的第一标识信息从第一区块链中查询关联的最后一条变更记录信息，从查询到的变更记录信息中获取第一可验证声明当前所处状态的状态信息。
进一步的，获取第一用户在预设时长内对第一可验证声明的处理频次，包括：根据第一声明标识和预设时长所对应的第一查询时间，从区块链中查询时间戳位于第一查询时间之内的、第一声明标识所关联的目标变更记录信息，统计目标状态变更记录信息的数量，将并统计数量确定为第一用户在预设时长内对于第一可验证声明的处理频次。其中，预设时长和预设频率均可以在实际应用中根据需要自行设定；作为示例，预设时长为30分钟，当前时间为2019年10月25日09时25分，则对应的第一查询时间为2019年10月25日08时55分-2019年10月25日09时25分。
为了避免他人冒充第一用户对第一可验证声明进行冻结等处理，步骤S204还可包括：发送身份验证请求给第一客户端，以使第一客户端采集第一用户的身份验证信息；若根据第一客户端发送的身份验证信息对第一用户的身份验证通过，则确定第一可验证声明符合预设的处理条件，根据处理请求变更第一可验证声明的状态信息。
其中，身份验证信息可为生物特征信息，如人脸、指纹、虹膜等中的任意一个或多个。对应的，第一服务端将第一客户端发送的身份验证信息与指定数据库存储的用户的身份信息进行匹配，若匹配成功，则确定对第一用户的身份验证通过，若匹配失败，则确定对第一用户的身份验证失败，发送请求失败结果给第一客户端。其中，指定数据库可为第一服务端的数据库。在第一用户注册第一客户端时，通过第一客户端采集第一用户的身份验证信息并保存至该数据库中，其具有合法性和有效性。指定数据库还可为指定机构的数据库。指定机构为可信的第三方机构，具有权威性和合法性，其数据库中存储有用户的身份信息，通过访问该数据库，以对用户的身份验证信息进行验证。指定机构例如为公安局。进一步的，当第一可验证声明所涉及内容的安全级别较低时，如证明第一用户具有某慈善活动的参与权限，身份验证信息还可为验证码形式的验证信息。对应的，第一服务端将第一客户端返回的验证码与自身存储的验证码进行匹配，若匹配成功，则确定对第一用户的身份验证通过，若匹配失败，则确定对第一用户的身份验证失败，发送请求失败结果信息给第一客户端，以使第一客户端展示请求失败结果信息。
步骤S206，根据第一标识信息和变更后的状态信息，生成变更记录信息，将变更记录信息保存至第一区块链中。
具体的，将第一声明标识、变更后的状态信息、处理类型信息和处理时间等进行关联记录，并将记录的信息作为变更记录信息；将变更记录信息保存至第一区块链中。
进一步的，第一用户还可以查询历史的变更记录，相应的，如图10所示，步骤S206之后还可以包括：
步骤S208，接收第一用户发送的变更记录查询请求，其中，变更记录查询请求包括第一标识信息和第二查询时间。其中，第二查询时间为待查询的时间段信息。
步骤S210，根据第一标识信息和第二查询时间，从第二区块链中查询对应的变更记 录信息。
步骤S212，根据查询到的变更记录信息生成查询结果，将查询结果发送给第一用户。
由此，第一用户可根据需要向对应的第一服务端发送处理请求，以请求对第一可验证声明进行冻结处理、撤销处理、解除冻结处理等，不仅实现了可验证声明的有效管理，而且避免了他人盗用第一可验证声明的风险；通过将变更记录信息保存至第一区块链中，实现了变更记录的有效追溯和查询。
当第一服务端不是第一区块链中的节点时，上述各步骤中当需要从第一区块链中获取数据以及将数据保存至第一区块链时，均可通过对应的第一区块链节点执行。
第一服务端在接收到第一客户端发送的授权请求时，可根据授权请求中的授权信息生成授权记录信息，并将授权记录信息保存至第一区块链中。授权信息基于第一可验证声明以及预先从第二服务端获取的第二用户的第一数字身份信息所对应的公钥所生成。由此，不仅实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求；而且通过将授权记录信息保存至区块链中，即确保了授权的有效性，又使得授权记录可追溯、授予的访问权限能够得以有效验证。
对应上述图3至图10描述的基于可验证声明的授权处理方法，基于相同的技术构思，本说明书一个或多个实施例还提供另一种基于可验证声明的授权处理方法，图11为本说明书一个或多个实施例提供的另一种基于可验证声明的授权处理方法的流程示意图，图11中的方法能够由图1中的第二服务端执行；如图11所示，该方法包括以下步骤：
步骤S302，接收第一用户发送的密钥获取请求，其中，密钥获取请求包括第二用户的第一数字身份信息；
步骤S304，从第二区块链中获取第一数字身份信息所对应的公钥；
步骤S306，将获取的公钥发送给第一用户，以使第一用户基于接收到的公钥授予第二用户对第一用户的第一可验证声明的访问权限。
第二服务端在接收到第一用户发送的密钥获取请求时，可从第二区块链中获取相应的公钥并发送给第一用户，使得第一用户可基于该公钥授予第二用户对第一用户的第一可验证声明的访问权限。由此，实现了可验证声明的访问授权，满足用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求。
为了实现对第二用户授予对第一可验证声明的访问权限，第二用户预先从第二服务端申请第一数字身份信息以及与第一数字身份信息对应的公私钥对，且其中的公钥保存在第一数字身份信息所对应的第一文档中。相应的，如图12所示，步骤S304包括以下步骤S304-2，根据第一数字身份信息，从第二区块链中查询关联的第一文档，从查询到的第一文档中获取公钥。
在第一用户授予第二用户访问权限成功之后，第二用户即可访问第一可验证声明。具体的，当第一用户与第二用户对应相同的第一服务端时，第二用户首先从第二服务端获取第一服务端的访问地址，并根据访问地址与第一服务端进行数据通信以访问第一可验证声明。与之对应的，如图13所示，步骤S306之后，还包括：
步骤S308，接收第二用户发送的地址查询请求；其中，地址查询请求包括第二用户的第一数字身份信息；
步骤S310，根据第一数字身份信息从第二区块链中查询关联的第一文档，从第一文档中获取第一服务端的访问地址；
步骤S312，将获取的访问地址发送给第二用户，以使第二用户根据访问地址，向第 一服务端发送可验证声明的第一访问请求，以请求访问第一可验证声明。
由此，在接收到第二用户发送的地址访问请求时，获取相应的访问地址并发送给第二用户，使得第二用户可根据访问地址向对应的第一服务端发送可验证声明的第一访问请求，以实现第一可验证声明的访问。
当第一用户和第二用户对应不同的第一服务端时，即第二用户没有与第一用户所对应的第一服务端的通信权限时，可通过第二服务端实现对第一可验证声明的访问。具体的，如图14所示，步骤S306之后还包括以下步骤S314至步骤S318。
步骤S314，从第一用户对应的第一服务端获取访问权限的授权信息；其中，授权信息由第一用户发送给第一服务端，以使第一服务端根据授权信息，将授权记录信息保存至第一区块链中；授权信息基于第二用户的第一数字身份信息所对应的公钥和第一可验证声明所生成。
具体的，如图15所示，步骤S314可以包括：步骤S314-2，若接收到第一用户发送的数据迁移请求，则根据数据迁移请求包括的第一数字身份信息和第一可验证声明的第一标识信息，向第一用户对应的第一服务端发送授权信息的获取请求；以使第一服务端根据第一数字身份信息和第一标识信息，从第一区块链中获取关联的授权记录信息，并返回授权记录信息中的授权信息；步骤S314-4，接收第一服务端发送的授权信息。
当第一用户接收到第一服务端发送的授权成功信息时，根据第一数字身份信息和第一标识信息，向第二服务端发送数据迁移请求，以使第二服务端向第一用户对应的第一服务端发送授权信息的获取请求，以将授权信息从第一区块链中迁移至第二区块链，并使第二用户向第二服务端发送第三访问请求以访问第一可验证声明。
步骤S316，将授权信息保存至第二区块链中。
步骤S318，接收到第二用户发送的可验证声明的第三访问请求时，将第二区块链保存的授权信息中的第一可验证声明发送给第二用户。
当第一用户与第二用户对应不同的第一服务端时，第二服务端基于第一用户的数据迁移请求，从第一服务端获取授权信息，从而授权信息从第一区块链中迁移至第二区块链，使得第二用户可与第二服务端进行数据通信，从而实现第一可验证声明的访问。
为了确保第一可验证声明的隐私性，可采用信封加密的方式对第一可验证声明进行加密处理。如图16所示，步骤S314可以包括以下步骤S314-6：从第一用户对应的第一服务端获取访问权限的授权信息，授权信息由第一用户发送给第一服务端，以使第一服务端根据授权信息，将授权记录信息保存至第一区块链中。授权信息包括第一可验证声明的密文和第一密钥的密文；第一可验证声明的密文是根据第一密钥对第一可验证声明进行加密处理而得；第一密钥的密文是根据第一数字身份所对应的公钥对第一密钥进行加密处理而得。
与之对应的，如图16所示，步骤S318包括以下步骤S318-2：接收到第二用户发送的可验证声明的第三访问请求时，将第二区块链保存的授权信息中的第一可验证声明的密文和第一密钥的密文发送给第二用户，以使第二用户根据第一数字身份信息所对应的私钥对第一密钥的密文进行解密处理得到第一密钥，并根据第一密钥对第一可验证声明的密文进行解密处理得到第一可验证声明。
为了证明第二用户拥有对第一可验证声明的访问权限，第二服务端在获取到授权信息之后，还可生成可验证声明，以证明第二用户有权限访问授权信息中的第一可验证声明。如图17所示，步骤S316可以包括以下步骤S316-2和步骤S316-4：
步骤S316-2，根据授权信息生成第二可验证声明，将第二可验证声明和第二可验 证声明的第二标识信息关联保存至第二区块链中，第二可验证声明中还可以包括第二用户的第一数字身份信息等，以表征第二用户对授权信息的第一可验证声明具有访问权限。
步骤S316-4，向第二用户发送第二标识信息，以使第二用户根据第二标识信息发送第三访问请求。
与之对应的，如图17所示，步骤S318包括以下步骤S318-4和步骤S318-6：
步骤S318-4，接收到第二用户发送的可验证声明的第三访问请求时，根据第三访问请求中的第二标识信息，从第二区块链中获取关联保存的第二可验证声明。
步骤S318-6，从第二可验证声明中获取授权信息，若确定当前时间未超过授权信息中的截止时间，则将授权信息中的第一可验证声明发送给第二用户。其中，截止时间为第一用户指定的授予第二用户的访问权限的有效截止时间，当到达该截止时间时，授予的访问权限失效。
由此，通过生成包括授权信息的第二可验证声明，并在接收到第二用户发送的第三访问请求时，将第二可验证声明包括的授权信息中的第一可验证声明发送给第二用户，实现了第二用户对第一可验证声明的访问。
进一步的，如图18所示，步骤S316还可包括以下步骤S316-6至步骤S316-10：
步骤S316-6，根据第一数字身份信息，生成第三可验证声明。其中，第三可验证声明用于证明第二用户具有对授权信息中的第一可验证声明的访问权限，第三可验证声明还可以包括表征具有访问权限的字段等。
步骤S316-8，将授权信息、第三可验证声明和第三可验证声明的第三标识信息关联保存至第二区块链中。
步骤S316-10，向第二用户发送第三标识信息，以使第二用户根据第三标识信息发送第三访问请求。
与之对应的，如图18所示，步骤S318可以包括以下步骤S318-8和步骤S318-10：
步骤S318-8，接收到第二用户发送的可验证声明的第三访问请求时，根据第三访问请求中的第三标识信息，从第二区块链中获取关联保存的授权信息和第三可验证声明；
步骤S318-10，若确定第三访问请求中的第一数字身份信息与第三可验证声明中的第一数字身份信息匹配、且当前时间未超过授权信息中的截止时间，则将授权信息中的第一可验证声明发送给第二用户。
由此，通过生成第三可验证声明以证明第二用户具有第一可验证声明的访问权限，并在接收到第三访问请求时，将第三访问请求中的第一数字身份信息与第三可验证声明中的第一数字身份信息进行匹配，以对第二用户的身份进行验证，从而实现了第二用户对于第一可验证声明的访问。
为了使访问记录可追溯，将授权信息中的第一可验证声明发送给第二用户之后，还可包括：根据第二可验证声明或第三可验证声明的标识信息、第一数字身份信息、第三访问请求的接收时间等，生成第一可验证声明的访问记录信息；将访问记录信息保存至第二区块链中。
如前所述，第二服务端提供可验证声明的颁发服务，相应的，如图19所示，步骤S302之前还可以包括：
步骤S300-2，接收第一用户发送的可验证声明的申请请求，申请请求包括申请信息和存储信息。存储信息用于表征第一可验证声明的存储位置。第一用户可根据需要 将第一可验证声明保存至对应的第一服务端；还可以选择自行保管，以使第二服务端将生成的第一可验证声明发送给第二用户的第二客户端。
步骤S300-4，根据申请信息，生成第一可验证声明。
步骤S300-6，根据存储信息，将生成的第一可验证声明发送给对应的第一服务端，以使第一服务端保存第一可验证声明。
步骤S300-4之后，还可包括：根据第一可验证声明的第一标识信息、第一用户的第二数字身份信息等，生成可验证声明的颁发记录信息；将颁发记录信息保存至第二区块链中。
在上述任一实施例的基础上，第二服务端还可接收第一用户或第二用户发送的数字身份信息的申请请求，生成相应的数字身份信息，以及数字身份信息对应的文档和公私钥对，将数字身份信息和私钥发送给对应的用户，并将生成公钥保存至生成的文档中，将生成的文档与数字身份信息对应保存至第二区块链中。
当第二服务端不是第二区块链中的节点时，上述各步骤中当需要从第二区块链中获取数据以及将数据保存至第二区块链时，均可通过对应的第二区块链节点执行。
第二服务端在接收到第一用户发送的密钥获取请求时，从第二区块链中获取相应的公钥并发送给第一用户，使得第一用户可基于该公钥授予第二用户对第一用户的第一可验证声明的访问权限。由此，实现了可验证声明的访问授权，满足用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求。
对应上述图3至图10描述的基于可验证声明的授权处理方法，基于相同的技术构思，本说明书一个或多个实施例还提供一种基于可验证声明的授权处理装置。图20为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理装置的模块组成示意图，该装置用于执行图3至图10描述的基于可验证声明的授权处理方法，如图20所示，该装置包括：
接收模块401，其接收第一用户发送的授权请求，其中，所述授权请求用于请求为第二用户授予对所述第一用户的第一可验证声明的访问权限；所述授权请求包括授权信息，所述授权信息基于所述第一可验证声明和所述第二用户的第一数字身份信息所对应的公钥所生成；
生成模块402，其根据所述授权信息和所述第一可验证声明的第一标识信息，生成授权记录信息；
发送模块403，其将所述授权记录信息保存至第一区块链中，向所述第一用户发送授权成功信息。
本说明书一个或多个实施例提供的基于可验证声明的授权处理装置，在接收到第一用户发送的授权请求时，根据授权请求中的授权信息生成授权记录信息，并将授权记录信息保存至第一区块链中；其中，授权信息基于第一可验证声明以及预先从第二服务端获取的第二用户的第一数字身份信息所对应的公钥所生成。由此，不仅实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求；而且通过将授权记录信息保存至区块链中，即确保了授权的有效性，又使得授权记录可追溯、授予的访问权限能够得以有效验证。
可选地，所述第二用户与所述第一用户对应相同的第一服务端；所述授权记录信息还包括：所述第一数字身份信息；所述装置还包括：第一查询模块。所述接收模块401，在所述发送模块403向所述第一用户发送授权成功信息之后，接收所述第二用户发送的可验证声明的第一访问请求，所述第一访问请求包括所述第一数字身份信息和所 述第一标识信息；所述第一查询模块，根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询关联的所述授权记录信息，将查询到的所述授权记录信息中的所述第一可验证声明发送给所述第二用户。
可选地，所述授权信息包括：所述第一可验证声明的密文和第一密钥的密文；其中，所述第一可验证声明的密文是根据所述第一密钥对所述第一可验证声明进行加密处理而得；所述第一密钥的密文是根据所述公钥对所述第一密钥进行加密处理而得；
所述第一查询模块，将查询到的所述授权记录信息中的所述第一可验证声明的密文和第一密钥的密文发送给所述第二用户，以使所述第二用户根据所述第一数字身份信息所对应的私钥对所述第一密钥的密文进行解密处理得到所述第一密钥，并根据所述第一密钥对所述第一可验证声明的密文进行解密处理得到所述第一可验证声明。
可选地，所述第一访问请求还包括：根据所述第一数字身份信息所对应的私钥对指定数据进行签名处理所得的第一签名数据。所述第一查询模块，获取所述第一数字身份信息所对应的公钥；以及，采用获取的所述公钥对所述第一签名数据进行验证，若验证通过，则根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询关联的所述授权记录信息。
可选地，所述装置还包括：记录模块和第一生成模块。所述记录模块，在所述接收模块401接收所述第二用户发送的可验证声明的第一访问请求之后，记录所述第一访问请求的接收时间；所述第一生成模块，在所述第一查询模块将查询到的所述授权记录信息中的所述第一可验证声明发送给所述第二用户之后，根据所述第一标识信息、所述第一数字身份信息和所述接收时间，生成所述第一可验证声明的访问记录信息，将所述访问记录信息保存至所述第一区块链中。
可选地，所述第二用户与所述第一用户对应不同的第一服务端；所述授权记录信息还包括所述第一数字身份信息；所述装置还包括第二查询模块。所述接收模块401，在所述第一生成模块将所述授权记录信息保存至第一区块链中之后，接收第二服务端发送的所述授权信息的获取请求；其中，所述获取请求包括所述第一数字身份信息和所述第一标识信息；所述第二查询模块，若根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询到关联的所述授权记录信息，则将所述授权记录信息中的授权信息发送给所述第二服务端；以使所述第二服务端将所述授权信息保存在第二区块链中，并在接收到所述第二用户发送的可验证声明的第三访问请求时，将所述第二区块链保存的所述授权信息中的所述第一可验证声明发送给所述第二用户。
可选地，所述装置还包括变更模块和第二生成模块。所述接收模块401，还接收所述第一用户发送的可验证声明的处理请求；其中，所述处理请求用于请求对所述第一可验证声明进行撤销处理、冻结处理、解除冻结处理中的任意一个；所述处理请求包括所述第一标识信息；所述变更模块，若确定所述第一可验证声明符合预设的处理条件，则根据所述处理请求变更所述第一可验证声明的状态信息；所述第二生成模块，根据所述第一标识信息和变更后的所述状态信息，生成变更记录信息；将所述变更记录信息保存至第一区块链中。
可选地，所述处理请求还包括处理类型信息。所述变更模块，获取所述第一可验证声明当前所处状态的状态信息，若获取的所述状态信息与预设的所述处理类型信息所关联的状态信息相匹配，则确定所述第一可验证声明符合预设的处理条件；或者，获取所述可验证声明当前所处状态的状态信息和所述第一用户在预设时长内对所述第一可验证声明的处理频次，若获取的所述状态信息与预设的所述处理类型信息所关联的状态信息相匹配、且所述处理频次小于预设频次，则确定所述第一可验证声明符合预设的处理条件。
可选地，所述装置还包括保存模块。所述接收模块401，接收第一用户发送的授权请求之前，还接收第二服务端发送的所述第一可验证声明，所述第一可验证声明为所述第二服务端基于所述第一用户发送的可验证声明的申请请求所生成；所述保存模块，保存所述第一可验证声明。
可选地，所述装置还包括获取模块。所述接收模块401，在所述保存模块保存所述第一可验证声明之后，接收所述第一用户发送的可验证声明的第二访问请求，其中，所述第二访问请求包括所述第一标识信息；所述获取模块，获取保存的所述第一标识信息所对应所述第一可验证声明；所述发送模块403，将获取的所述第一可验证声明发送给所述第一用户。
本说明书一个或多个实施例提供的基于可验证声明的授权处理装置，在接收到第一用户发送的授权请求时，根据授权请求中的授权信息生成授权记录信息，并将授权记录信息保存至第一区块链中；其中，授权信息基于第一可验证声明以及预先从第二服务端获取的第二用户的第一数字身份信息所对应的公钥所生成。由此，不仅实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求；而且通过将授权记录信息保存至区块链中，即确保了授权的有效性，又使得授权记录可追溯、授予的访问权限能够得以有效验证。
本说明书中关于基于可验证声明的授权处理装置的实施例与本说明书中关于基于可验证声明的授权处理方法的实施例基于同一发明构思，因此该实施例的具体实施可以参见前述对应的基于可验证声明的授权处理方法的实施，重复之处不再赘述。
进一步的，对应上述图11至图19描述的基于可验证声明的授权处理方法，基于相同的技术构思，本说明书一个或多个实施例还提供另一种基于可验证声明的授权处理装置。图21为本说明书一个或多个实施例提供的另一种基于可验证声明的授权处理装置的模块组成示意图，该装置用于执行图11至图19描述的基于可验证声明的授权处理方法，如图21所示，该装置包括：
接收模块501，接收第一用户发送的密钥获取请求，其中，所述密钥获取请求包括第二用户的第一数字身份信息；
第一获取模块502，从第二区块链中获取所述第一数字身份信息所对应的公钥；
发送模块503，将获取的所述公钥发送给所述第一用户，以使所述第一用户基于所述公钥授予所述第二用户对所述第一用户的第一可验证声明的访问权限。
本说明书一个或多个实施例提供的基于可验证声明的授权处理装置，在接收到第一用户发送的密钥获取请求时，从第二区块链中获取相应的公钥并发送给第一用户，使得第一用户可基于该公钥授予第二用户对第一用户的第一可验证声明的访问权限。由此，实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求。
可选地，所述第一获取模块502，根据所述第一数字身份信息，从所述第二区块链中查询关联的第一文档；以及，从查询到的所述第一文档中获取公钥。
可选地，所述第一用户和所述第二用户对应相同的第一服务端，所述第一服务端用于存储并管理可验证声明。所述装置还包括第二获取模块。所述接收模块501，在所述发送模块503将获取的所述公钥发送给所述第一用户之后，接收所述第二用户发送的地址查询请求，所述地址查询请求包括所述第二用户的第一数字身份信息；所述第二获取模块，根据所述第一数字身份信息从所述第二区块链中查询关联的第一文档，从所述第一文档中获取所述第一服务端的访问地址；将获取的所述访问地址发送给所述第二 用户，以使所述第二用户根据所述访问地址，向所述第一服务端发送可验证声明的第一访问请求，以请求访问所述第一可验证声明。
可选地，所述第一用户和所述第二用户对应不同的第一服务端，所述第一服务端用于存储并管理可验证声明；所述装置还包括第三获取模块和保存模块。所述第三获取模块，在所述发送模块503将获取的所述公钥发送给所述第一用户之后，从所述第一用户对应的所述第一服务端获取所述访问权限的授权信息；其中，所述授权信息由所述第一用户发送给所述第一服务端，以使所述第一服务端根据所述授权信息，将授权记录信息保存至第一区块链中；所述授权信息基于所述公钥和所述第一可验证声明所生成；所述保存模块，将所述授权信息保存至所述第二区块链中；所述发送模块503，在所述接收模块501接收到所述第二用户发送的可验证声明的第三访问请求时，将所述授权信息中的所述第一可验证声明发送给所述第二用户。
可选地，所述第三获取模块，若接收到所述第一用户发送的数据迁移请求，则根据所述数据迁移请求包括的所述第一数字身份信息和所述第一可验证声明的第一标识信息，向所述第一用户对应的第一服务端发送所述授权信息的获取请求；以使所述第一服务端根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中获取关联的授权记录信息，并返回所述授权记录信息中的授权信息；以及，接收所述第一服务端发送的所述授权信息。
可选地，所述授权信息包括：所述第一可验证声明的密文和第一密钥的密文；其中，所述第一可验证声明的密文是根据所述第一密钥对所述第一可验证声明进行加密处理而得；所述第一密钥的密文是根据所述公钥对所述第一密钥进行加密处理而得；所述发送模块503，将所述第一可验证声明的密文和所述第一密钥的密文发送给所述第二用户，以使所述第二用户根据所述第一数字身份信息所对应的私钥对所述第一密钥的密文进行解密处理得到所述第一密钥，并根据所述第一密钥对所述第一可验证声明的密文进行解密处理得到所述第一可验证声明。
可选地，所述授权信息还包括所述访问权限的截止时间；所述保存模块，根据所述授权信息生成第二可验证声明；以及，将所述第二可验证声明和所述第二可验证声明的第二标识信息关联保存至所述第二区块链中；向所述第二用户发送所述第二标识信息，以使所述第二用户根据所述第二标识信息发送所述第三访问请求；所述发送模块503，根据所述第三访问请求中的所述第二标识信息，从所述第二区块链中获取关联保存的所述第二可验证声明；以及，从所述第二可验证声明中获取所述授权信息；若确定当前时间未超过所述授权信息中的所述截止时间，则将所述授权信息中的第一可验证声明发送给所述第二用户。
可选地，所述授权信息还包括所述访问权限的截止时间；所述保存模块，根据所述第一数字身份信息，生成第三可验证声明；其中，所述第三可验证声明用于证明所述第二用户具有对所述授权信息中的所述第一可验证声明的访问权限；以及，将所述授权信息、所述第三可验证声明和所述第三可验证声明的第三标识信息关联保存至所述第二区块链中；向所述第二用户发送所述第三标识信息，以使所述第二用户根据所述第三标识信息发送所述第三访问请求；所述发送模块503，根据所述第三访问请求中的所述第三标识信息，从所述第二区块链中获取关联保存的所述授权信息和所述第三可验证声明；以及，若确定所述第三访问请求中的第一数字身份信息与所述第三可验证声明中的第一数字身份信息匹配、且当前时间未超过所述授权信息中的所述截止时间，则将所述授权信息中的第一可验证声明发送给所述第二用户。
可选地，所述装置还包括生成模块；所述接收模块501，在接收第一用户发送的密钥获取请求之前，接收所述第一用户发送的可验证声明的申请请求；其中，所述申请 请求包括申请信息和存储信息；所述生成模块，根据所述申请信息，生成所述第一可验证声明；以及，根据所述存储信息，将生成的所述第一可验证声明发送给对应的第一服务端，以使所述第一服务端保存所述第一可验证声明。
本说明书一个或多个实施例提供的基于可验证声明的授权处理装置，在接收到第一用户发送的密钥获取请求时，从第二区块链中获取相应的公钥并发送给第一用户，使得第一用户可基于该公钥授予第二用户对第一用户的第一可验证声明的访问权限。由此，实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求。
本说明书中关于基于可验证声明的授权处理装置的实施例与本说明书中关于基于可验证声明的授权处理方法的实施例基于同一发明构思，因此该实施例的具体实施可以参见前述对应的基于可验证声明的授权处理方法的实施，重复之处不再赘述。
进一步的，对应上述描述的基于可验证声明的授权处理方法，基于相同的技术构思，本说明书一个或多个实施例还提供一种基于可验证声明的授权处理系统。图22为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理系统的组成示意图，如图22所示，该系统包括：第一用户的第一客户端601、所述第一客户端601对应的第一服务端602、第二服务端603；
所述第一客户端601，响应于所述第一用户授予第二用户对所述第一用户的第一可验证声明的访问权限的授权操作，根据所述第二用户的第一数字身份信息，向所述第二服务端603发送密钥获取请求；接收所述第二服务端603发送的所述第一数字身份信息所对应的公钥；根据所述公钥和所述第一可验证声明生成授权信息，根据所述授权信息向所述第一服务端602发送授权请求；
所述第一服务端602，接收所述授权请求，根据所述授权信息和所述第一可验证声明的第一标识信息，生成授权记录信息；将所述授权记录信息保存至第一区块链中，向所述第一客户端601发送授权成功信息；
所述第二服务端603，接收所述密钥获取请求，从第二区块链中获取所述第一数字身份信息所对应的公钥；将获取的所述公钥发送给所述第一客户端601。
可选地，所述第一客户端601，根据指定的第一密钥对所述第一可验证声明进行加密处理，得到所述第一可验证声明的密文；根据所述公钥对所述第一密钥进行加密处理，得到所述第一密钥的密文；根据所述第一可验证声明的密文和所述第一密钥的密文，生成所述授权信息。
可选地，如图23所示，该系统还包括第二用户的第二客户端604。第二客户端604，在所述第一用户与所述第二用户对应相同的第一服务端时，响应于所述第二用户的可验证声明的访问操作，向所述第二服务端603发送地址查询请求，接收所述第二服务端603发送的所述第一服务端602的访问地址，根据所述访问地址，向所述第一服务端602发送可验证声明的第一访问请求；以及，在所述第二用户与所述第一用户对应不同的第一服务端时，响应于所述第二用户的可验证声明的访问操作，向所述第二服务端603发送可验证声明的第三访问请求。
本说明书一个或多个实施例提供的基于可验证声明的授权处理系统，第一客户端通过从第二服务端获取第二用户的第一数字身份信息所对应的公钥，并基于获取的公钥和第一可验证声明生产授权信息，从而根据该授权信息向第一服务端发送授权请求，以使第一服务端将授权记录信息保存至第一区块链中；不仅实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求；而且通过将授权记录信息保存至区块链中，即确保了授权的有效性，又使得授权记录可 追溯、授予的访问权限能够得以有效验证。
本说明书中关于基于可验证声明的授权处理系统的实施例与本说明书中关于基于可验证声明的授权处理方法的实施例基于同一发明构思，因此该实施例的具体实施可以参见前述对应的基于可验证声明的授权处理方法的实施，重复之处不再赘述。
进一步地，对应上述描述的基于可验证声明的授权处理方法，基于相同的技术构思，本说明书一个或多个实施例还提供一种基于可验证声明的授权处理设备，该设备用于执行上述的基于可验证声明的授权处理方法，图24为本说明书一个或多个实施例提供的一种基于可验证声明的授权处理设备的结构示意图。
如图24所示，基于可验证声明的授权处理设备可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上的处理器701和存储器702，存储器702中可以存储有一个或一个以上存储应用程序或数据。其中，存储器702可以是短暂存储或持久存储。存储在存储器702的应用程序可以包括一个或一个以上模块(图示未示出)，每个模块可以包括基于可验证声明的授权处理设备中的一系列计算机可执行指令。更进一步地，处理器701可以设置为与存储器702通信，在基于可验证声明的授权处理设备上执行存储器702中的一系列计算机可执行指令。基于可验证声明的授权处理设备还可以包括一个或一个以上电源703，一个或一个以上有线或无线网络接口704，一个或一个以上输入输出接口705，一个或一个以上键盘706等。
在一个具体的实施例中，基于可验证声明的授权处理设备包括有存储器，以及一个或一个以上的程序，其中一个或者一个以上程序存储于存储器中，且一个或者一个以上程序可以包括一个或一个以上模块，且每个模块可以包括对基于可验证声明的授权处理设备中的一系列计算机可执行指令，且经配置以由一个或者一个以上处理器执行该一个或者一个以上程序包含用于进行以下计算机可执行指令：接收第一用户发送的授权请求，其中，所述授权请求用于请求为第二用户授予对所述第一用户的第一可验证声明的访问权限；所述授权请求包括授权信息，所述授权信息基于所述第一可验证声明和所述第二用户的第一数字身份信息所对应的公钥所生成；根据所述授权信息和所述第一可验证声明的第一标识信息，生成授权记录信息；将所述授权记录信息保存至第一区块链中，向所述第一用户发送授权成功信息。
本说明书一个或多个实施例提供的基于可验证声明的授权处理设备，在接收到第一用户发送的授权请求时，根据授权请求中的授权信息生成授权记录信息，并将授权记录信息保存至第一区块链中；其中，授权信息基于第一可验证声明以及预先从第二服务端获取的第二用户的第一数字身份信息所对应的公钥所生成。由此，不仅实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求；而且通过将授权记录信息保存至区块链中，即确保了授权的有效性，又使得授权记录可追溯、授予的访问权限能够得以有效验证。
可选地，计算机可执行指令在被执行时，所述第二用户与所述第一用户对应相同的第一服务端；所述授权记录信息还包括：所述第一数字身份信息。所述向所述第一用户发送授权成功信息之后，还包括：接收所述第二用户发送的可验证声明的第一访问请求；其中，所述第一访问请求包括所述第一数字身份信息和所述第一标识信息；根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询关联的所述授权记录信息，将查询到的所述授权记录信息中的所述第一可验证声明发送给所述第二用户。
可选地，计算机可执行指令在被执行时，所述授权信息包括：所述第一可验证声明的密文和第一密钥的密文；其中，所述第一可验证声明的密文是根据所述第一密钥对所述第一可验证声明进行加密处理而得；所述第一密钥的密文是根据所述公钥对所述第一密钥进行加密处理而得。所述将查询到的所述授权记录信息中的所述第一可验证声 明发送给所述第二用户，包括：将查询到的所述授权记录信息中的所述第一可验证声明的密文和第一密钥的密文发送给所述第二用户，以使所述第二用户根据所述第一数字身份信息所对应的私钥对所述第一密钥的密文进行解密处理得到所述第一密钥，并根据所述第一密钥对所述第一可验证声明的密文进行解密处理得到所述第一可验证声明。
可选地，计算机可执行指令在被执行时，所述第一访问请求还包括：根据所述第一数字身份信息所对应的私钥对指定数据进行签名处理所得的第一签名数据。所述根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询关联的所述授权记录信息，包括：获取所述第一数字身份信息所对应的公钥；采用获取的所述公钥对所述第一签名数据进行验证，若验证通过，则根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询关联的所述授权记录信息。
可选地，计算机可执行指令在被执行时，所述接收所述第二用户发送的可验证声明的第一访问请求之后，还包括：记录所述第一访问请求的接收时间。所述将查询到的所述授权记录信息中的所述第一可验证声明发送给所述第二用户之后，还包括：根据所述第一标识信息、所述第一数字身份信息和所述接收时间，生成所述第一可验证声明的访问记录信息；将所述访问记录信息保存至所述第一区块链中。
可选地，计算机可执行指令在被执行时，所述第二用户与所述第一用户对应不同的第一服务端；所述授权记录信息还包括：所述第一数字身份信息。所述将所述授权记录信息保存至第一区块链中之后，还包括：接收第二服务端发送的所述授权信息的获取请求；其中，所述获取请求包括所述第一数字身份信息和所述第一标识信息；若根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询到关联的所述授权记录信息，则将所述授权记录信息中的授权信息发送给所述第二服务端；以使所述第二服务端将所述授权信息保存在第二区块链中，并在接收到所述第二用户发送的可验证声明的第三访问请求时，将所述第二区块链保存的所述授权信息中的所述第一可验证声明发送给所述第二用户。
可选地，计算机可执行指令在被执行时，所述方法还包括：接收所述第一用户发送的可验证声明的处理请求；其中，所述处理请求用于请求对所述第一可验证声明进行撤销处理、冻结处理、解除冻结处理中的任意一个；所述处理请求包括所述第一标识信息；若确定所述第一可验证声明符合预设的处理条件，则根据所述处理请求变更所述第一可验证声明的状态信息；根据所述第一标识信息和变更后的所述状态信息，生成变更记录信息；将所述变更记录信息保存至第一区块链中。
可选地，计算机可执行指令在被执行时，所述处理请求还包括处理类型信息。所述确定所述第一可验证声明符合预设的处理条件，包括：获取所述第一可验证声明当前所处状态的状态信息，若获取的所述状态信息与预设的所述处理类型信息所关联的状态信息相匹配，则确定所述第一可验证声明符合预设的处理条件；或者，获取所述可验证声明当前所处状态的状态信息和所述第一用户在预设时长内对所述第一可验证声明的处理频次，若获取的所述状态信息与预设的所述处理类型信息所关联的状态信息相匹配、且所述处理频次小于预设频次，则确定所述第一可验证声明符合预设的处理条件。
可选地，计算机可执行指令在被执行时，所述接收第一用户发送的授权请求之前，还包括：接收第二服务端发送的所述第一可验证声明，所述第一可验证声明为所述第二服务端基于所述第一用户发送的可验证声明的申请请求所生成；保存所述第一可验证声明。
可选地，计算机可执行指令在被执行时，所述保存所述第一可验证声明之后，还包括：接收所述第一用户发送的可验证声明的第二访问请求，其中，所述第二访问请求包括所述第一标识信息；获取保存的所述第一标识信息所对应所述第一可验证声明； 将获取的所述第一可验证声明发送给所述第一用户。
本说明书一个或多个实施例提供的基于可验证声明的授权处理设备，在接收到第一客户端发送的授权请求时，根据授权请求中的授权信息生成授权记录信息，并将授权记录信息保存至第一区块链中；其中，授权信息基于第一可验证声明以及预先从第二服务端获取的第二用户的第一数字身份信息所对应的公钥所生成。由此，不仅实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求；而且通过将授权记录信息保存至区块链中，即确保了授权的有效性，又使得授权记录可追溯、授予的访问权限能够得以有效验证。
在另一个具体的实施例中，基于可验证声明的授权处理设备包括有存储器，以及一个或一个以上的程序，其中一个或者一个以上程序存储于存储器中，且一个或者一个以上程序可以包括一个或一个以上模块，且每个模块可以包括对基于可验证声明的授权处理设备中的一系列计算机可执行指令，且经配置以由一个或者一个以上处理器执行该一个或者一个以上程序包含用于进行以下计算机可执行指令：接收第一用户发送的密钥获取请求，其中，所述密钥获取请求包括第二用户的第一数字身份信息；从第二区块链中获取所述第一数字身份信息所对应的公钥；将获取的所述公钥发送给所述第一用户，以使所述第一用户基于所述公钥授予所述第二用户对所述第一用户的第一可验证声明的访问权限。
本说明书一个或多个实施例提供的基于可验证声明的授权处理设备，在接收到第一用户发送的密钥获取请求时，从第二区块链中获取相应的公钥并发送给第一用户，使得第一用户可基于该公钥授予第二用户对第一用户的第一可验证声明的访问权限。由此，实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求。
可选地，计算机可执行指令在被执行时，所述从第二区块链中获取所述第一数字身份信息所对应的公钥，包括：根据所述第一数字身份信息，从所述第二区块链中查询关联的第一文档；从查询到的所述第一文档中获取公钥。
可选地，计算机可执行指令在被执行时，所述第一用户和所述第二用户对应相同的第一服务端，所述第一服务端用于存储并管理可验证声明。将获取的所述公钥发送给所述第一用户之后，还包括：接收所述第二用户发送的地址查询请求；其中，所述地址查询请求包括所述第二用户的第一数字身份信息；根据所述第一数字身份信息从所述第二区块链中查询关联的第一文档；从所述第一文档中获取所述第一服务端的访问地址；将获取的所述访问地址发送给所述第二用户，以使所述第二用户根据所述访问地址，向所述第一服务端发送可验证声明的第一访问请求，以请求访问所述第一可验证声明。
可选地，计算机可执行指令在被执行时，所述第一用户和所述第二用户对应不同的第一服务端；其中，所述第一服务端用于存储并管理可验证声明。所述将获取的所述公钥发送给所述第一用户之后，还包括：从所述第一用户对应的所述第一服务端获取所述访问权限的授权信息；其中，所述授权信息由所述第一用户发送给所述第一服务端，以使所述第一服务端根据所述授权信息，将授权记录信息保存至第一区块链中；所述授权信息基于所述公钥和所述第一可验证声明所生成；将所述授权信息保存至所述第二区块链中；以及，接收到所述第二用户发送的可验证声明的第三访问请求时，将所述授权信息中的所述第一可验证声明发送给所述第二用户。
可选地，计算机可执行指令在被执行时，所述从所述第一用户对应的所述第一服务端获取所述访问权限的授权信息，包括：若接收到所述第一用户发送的数据迁移请求，则根据所述数据迁移请求包括的所述第一数字身份信息和所述第一可验证声明的第一标识信息，向所述第一用户对应的第一服务端发送所述授权信息的获取请求；以使所 述第一服务端根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中获取关联的授权记录信息，并返回所述授权记录信息中的授权信息；接收所述第一服务端发送的所述授权信息。
可选地，计算机可执行指令在被执行时，所述授权信息包括：所述第一可验证声明的密文和第一密钥的密文；其中，所述第一可验证声明的密文是根据所述第一密钥对所述第一可验证声明进行加密处理而得；所述第一密钥的密文是根据所述公钥对所述第一密钥进行加密处理而得。所述将所述授权信息中的所述第一可验证声明发送给所述第二用户，包括：将所述第一可验证声明的密文和所述第一密钥的密文发送给所述第二用户，以使所述第二用户根据所述第一数字身份信息所对应的私钥对所述第一密钥的密文进行解密处理得到所述第一密钥，并根据所述第一密钥对所述第一可验证声明的密文进行解密处理得到所述第一可验证声明。
可选地，计算机可执行指令在被执行时，所述授权信息还包括所述访问权限的截止时间。所述将所述授权信息保存至所述第二区块链中，包括：根据所述授权信息生成第二可验证声明；将所述第二可验证声明和所述第二可验证声明的第二标识信息关联保存至所述第二区块链中；向所述第二用户发送所述第二标识信息，以使所述第二用户根据所述第二标识信息发送所述第三访问请求。所述将所述授权信息中的所述第一可验证声明发送给所述第二用户，包括：根据所述第三访问请求中的所述第二标识信息，从所述第二区块链中获取关联保存的所述第二可验证声明；从所述第二可验证声明中获取所述授权信息；若确定当前时间未超过所述授权信息中的所述截止时间，则将所述授权信息中的第一可验证声明发送给所述第二用户。
可选地，计算机可执行指令在被执行时，所述授权信息还包括所述访问权限的截止时间。所述将所述授权信息保存至所述第二区块链中，包括：根据所述第一数字身份信息，生成第三可验证声明；其中，所述第三可验证声明用于证明所述第二用户具有对所述授权信息中的所述第一可验证声明的访问权限；将所述授权信息、所述第三可验证声明和所述第三可验证声明的第三标识信息关联保存至所述第二区块链中；向所述第二用户发送所述第三标识信息，以使所述第二用户根据所述第三标识信息发送所述第三访问请求。所述将所述授权信息中的所述第一可验证声明发送给所述第二用户，包括：根据所述第三访问请求中的所述第三标识信息，从所述第二区块链中获取关联保存的所述授权信息和所述第三可验证声明；若确定所述第三访问请求中的第一数字身份信息与所述第三可验证声明中的第一数字身份信息匹配、且当前时间未超过所述授权信息中的所述截止时间，则将所述授权信息中的第一可验证声明发送给所述第二用户。
可选地，计算机可执行指令在被执行时，所述接收第一用户发送的密钥获取请求之前，还包括：接收所述第一用户发送的可验证声明的申请请求；其中，所述申请请求包括申请信息和存储信息；根据所述申请信息，生成所述第一可验证声明；根据所述存储信息，将生成的所述第一可验证声明发送给对应的第一服务端，以使所述第一服务端保存所述第一可验证声明。
本说明书一个或多个实施例提供的基于可验证声明的授权处理设备，在接收到第一用户发送的密钥获取请求时，从第二区块链中获取相应的公钥并发送给第一用户，使得第一用户可基于该公钥授予第二用户对第一用户的第一可验证声明的访问权限。由此，实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求。
本说明书中关于基于可验证声明的授权处理设备的实施例与本说明书中关于基于可验证声明的授权处理方法的实施例基于同一发明构思，因此该实施例的具体实施可以参见前述对应的基于可验证声明的授权处理方法的实施，重复之处不再赘述。
进一步地，对应上述描述的基于可验证声明的授权处理方法，基于相同的技术构思，本说明书一个或多个实施例还提供了一种存储介质，用于存储计算机可执行指令，一个具体的实施例中，该存储介质可以为U盘、光盘、硬盘等，该存储介质存储的计算机可执行指令在被处理器执行时，能实现以下流程：接收第一用户发送的授权请求，其中，所述授权请求用于请求为第二用户授予对所述第一用户的第一可验证声明的访问权限；所述授权请求包括授权信息，所述授权信息基于所述第一可验证声明和所述第二用户的第一数字身份信息所对应的公钥所生成；根据所述授权信息和所述第一可验证声明的第一标识信息，生成授权记录信息；将所述授权记录信息保存至第一区块链中，向所述第一用户发送授权成功信息。
本说明书一个或多个实施例提供的存储介质存储的计算机可执行指令在被处理器执行时，在接收到第一客户端发送的授权请求时，根据授权请求中的授权信息生成授权记录信息，并将授权记录信息保存至第一区块链中；其中，授权信息基于第一可验证声明以及预先从第二服务端获取的第二用户的第一数字身份信息所对应的公钥所生成。由此，不仅实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求；而且通过将授权记录信息保存至区块链中，即确保了授权的有效性，又使得授权记录可追溯、授予的访问权限能够得以有效验证。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，述第二用户与所述第一用户对应相同的第一服务端。所述授权记录信息还包括：所述第一数字身份信息。所述向所述第一用户发送授权成功信息之后，还包括：接收所述第二用户发送的可验证声明的第一访问请求，所述第一访问请求包括所述第一数字身份信息和所述第一标识信息；根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询关联的所述授权记录信息，将查询到的所述授权记录信息中的所述第一可验证声明发送给所述第二用户。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述授权信息包括：所述第一可验证声明的密文和第一密钥的密文，所述第一可验证声明的密文是根据所述第一密钥对所述第一可验证声明进行加密处理而得；所述第一密钥的密文是根据所述公钥对所述第一密钥进行加密处理而得。所述将查询到的所述授权记录信息中的所述第一可验证声明发送给所述第二用户，包括：将查询到的所述授权记录信息中的所述第一可验证声明的密文和第一密钥的密文发送给所述第二用户，以使所述第二用户根据所述第一数字身份信息所对应的私钥对所述第一密钥的密文进行解密处理得到所述第一密钥，并根据所述第一密钥对所述第一可验证声明的密文进行解密处理得到所述第一可验证声明。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述第一访问请求还包括：根据所述第一数字身份信息所对应的私钥对指定数据进行签名处理所得的第一签名数据。根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询关联的所述授权记录信息，包括：获取所述第一数字身份信息所对应的公钥；采用获取的所述公钥对所述第一签名数据进行验证，若验证通过，则根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询关联的所述授权记录信息。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述接收所述第二用户发送的可验证声明的第一访问请求之后，还包括：记录所述第一访问请求的接收时间。将查询到的所述授权记录信息中的所述第一可验证声明发送给所述第二用户之后，还包括：根据所述第一标识信息、所述第一数字身份信息和所述接收时间，生成所述第一可验证声明的访问记录信息；将所述访问记录信息保存至所述第一区块链中。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述第二用 户与所述第一用户对应不同的第一服务端；所述授权记录信息还包括所述第一数字身份信息。所述将所述授权记录信息保存至第一区块链中之后，还包括：接收第二服务端发送的所述授权信息的获取请求；其中，所述获取请求包括所述第一数字身份信息和所述第一标识信息；若根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询到关联的所述授权记录信息，则将所述授权记录信息中的授权信息发送给所述第二服务端；以使所述第二服务端将所述授权信息保存在第二区块链中，并在接收到所述第二用户发送的可验证声明的第三访问请求时，将所述第二区块链保存的所述授权信息中的所述第一可验证声明发送给所述第二用户。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述方法还包括：接收所述第一用户发送的可验证声明的处理请求，所述处理请求用于请求对所述第一可验证声明进行撤销处理、冻结处理、解除冻结处理中的任意一个，所述处理请求包括所述第一标识信息；若确定所述第一可验证声明符合预设的处理条件，则根据所述处理请求变更所述第一可验证声明的状态信息；根据所述第一标识信息和变更后的所述状态信息，生成变更记录信息；将所述变更记录信息保存至第一区块链中。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述处理请求还包括处理类型信息。所述确定所述第一可验证声明符合预设的处理条件，包括：获取所述第一可验证声明当前所处状态的状态信息，若获取的所述状态信息与预设的所述处理类型信息所关联的状态信息相匹配，则确定所述第一可验证声明符合预设的处理条件；或者，获取所述可验证声明当前所处状态的状态信息和所述第一用户在预设时长内对所述第一可验证声明的处理频次，若获取的所述状态信息与预设的所述处理类型信息所关联的状态信息相匹配、且所述处理频次小于预设频次，则确定所述第一可验证声明符合预设的处理条件。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述接收第一用户发送的授权请求之前，还包括：接收第二服务端发送的所述第一可验证声明，所述第一可验证声明为所述第二服务端基于所述第一用户发送的可验证声明的申请请求所生成；保存所述第一可验证声明。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述保存所述第一可验证声明之后，还包括：接收所述第一用户发送的可验证声明的第二访问请求，其中，所述第二访问请求包括所述第一标识信息；获取保存的所述第一标识信息所对应所述第一可验证声明；将获取的所述第一可验证声明发送给所述第一用户。
本说明书一个或多个实施例提供的存储介质存储的计算机可执行指令在被处理器执行时，在接收到第一用户发送的授权请求时，根据授权请求中的授权信息生成授权记录信息，并将授权记录信息保存至第一区块链中；其中，授权信息基于第一可验证声明以及预先从第二服务端获取的第二用户的第一数字身份信息所对应的公钥所生成。由此，不仅实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求；而且通过将授权记录信息保存至区块链中，即确保了授权的有效性，又使得授权记录可追溯、授予的访问权限能够得以有效验证。
另一个具体的实施例中，该存储介质可以为U盘、光盘、硬盘等，该存储介质存储的计算机可执行指令在被处理器执行时，能实现以下流程：接收第一用户发送的密钥获取请求，其中，所述密钥获取请求包括第二用户的第一数字身份信息；从第二区块链中获取所述第一数字身份信息所对应的公钥；将获取的所述公钥发送给所述第一用户，以使所述第一用户基于所述公钥授予所述第二用户对所述第一用户的第一可验证声明的访问权限。
本说明书一个或多个实施例提供的存储介质存储的计算机可执行指令在被处理 器执行时，在接收到第一用户发送的密钥获取请求时，从第二区块链中获取相应的公钥并发送给第一用户，使得第一用户可基于该公钥授予第二用户对第一用户的第一可验证声明的访问权限。由此，实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述从第二区块链中获取所述第一数字身份信息所对应的公钥，包括：根据所述第一数字身份信息，从所述第二区块链中查询关联的第一文档；从查询到的所述第一文档中获取公钥。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述第一用户和所述第二用户对应相同的第一服务端；其中，所述第一服务端用于存储并管理可验证声明。所述将获取的所述公钥发送给所述第一用户之后，还包括：接收所述第二用户发送的地址查询请求，所述地址查询请求包括所述第二用户的第一数字身份信息；根据所述第一数字身份信息从所述第二区块链中查询关联的第一文档；从所述第一文档中获取所述第一服务端的访问地址；将获取的所述访问地址发送给所述第二用户，以使所述第二用户根据所述访问地址，向所述第一服务端发送可验证声明的第一访问请求，以请求访问所述第一可验证声明。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述第一用户和所述第二用户对应不同的第一服务端；其中，所述第一服务端用于存储并管理可验证声明。所述将获取的所述公钥发送给所述第一用户之后，还包括：从所述第一用户对应的所述第一服务端获取所述访问权限的授权信息；其中，所述授权信息由所述第一用户发送给所述第一服务端，以使所述第一服务端根据所述授权信息，将授权记录信息保存至第一区块链中；所述授权信息基于所述公钥和所述第一可验证声明所生成；将所述授权信息保存至所述第二区块链中；以及，接收到所述第二用户发送的可验证声明的第三访问请求时，将所述授权信息中的所述第一可验证声明发送给所述第二用户。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述从所述第一用户对应的所述第一服务端获取所述访问权限的授权信息，包括：若接收到所述第一用户发送的数据迁移请求，则根据所述数据迁移请求包括的所述第一数字身份信息和所述第一可验证声明的第一标识信息，向所述第一用户对应的第一服务端发送所述授权信息的获取请求；以使所述第一服务端根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中获取关联的授权记录信息，并返回所述授权记录信息中的授权信息；接收所述第一服务端发送的所述授权信息。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述授权信息包括所述第一可验证声明的密文和第一密钥的密文，所述第一可验证声明的密文是根据所述第一密钥对所述第一可验证声明进行加密处理而得；所述第一密钥的密文是根据所述公钥对所述第一密钥进行加密处理而得。所述将所述授权信息中的所述第一可验证声明发送给所述第二用户，包括：将所述第一可验证声明的密文和所述第一密钥的密文发送给所述第二用户，以使所述第二用户根据所述第一数字身份信息所对应的私钥对所述第一密钥的密文进行解密处理得到所述第一密钥，并根据所述第一密钥对所述第一可验证声明的密文进行解密处理得到所述第一可验证声明。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述授权信息还包括所述访问权限的截止时间；所述将所述授权信息保存至所述第二区块链中，包括：根据所述授权信息生成第二可验证声明；将所述第二可验证声明和所述第二可验证声明的第二标识信息关联保存至所述第二区块链中；向所述第二用户发送所述第二标识信息，以使所述第二用户根据所述第二标识信息发送所述第三访问请求。所述将所述授权信息中的所述第一可验证声明发送给所述第二用户，包括：根据所述第三访问请求中 的所述第二标识信息，从所述第二区块链中获取关联保存的所述第二可验证声明；从所述第二可验证声明中获取所述授权信息；若确定当前时间未超过所述授权信息中的所述截止时间，则将所述授权信息中的第一可验证声明发送给所述第二用户。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述授权信息还包括所述访问权限的截止时间；将所述授权信息保存至所述第二区块链中，包括：根据所述第一数字身份信息，生成第三可验证声明，所述第三可验证声明用于证明所述第二用户具有对所述授权信息中的所述第一可验证声明的访问权限；将所述授权信息、所述第三可验证声明和所述第三可验证声明的第三标识信息关联保存至所述第二区块链中；向所述第二用户发送所述第三标识信息，以使所述第二用户根据所述第三标识信息发送所述第三访问请求。将所述授权信息中的所述第一可验证声明发送给所述第二用户，包括：根据所述第三访问请求中的所述第三标识信息，从所述第二区块链中获取关联保存的所述授权信息和所述第三可验证声明；若确定所述第三访问请求中的第一数字身份信息与所述第三可验证声明中的第一数字身份信息匹配、且当前时间未超过所述授权信息中的所述截止时间，则将所述授权信息中的第一可验证声明发送给所述第二用户。
可选地，该存储介质存储的计算机可执行指令在被处理器执行时，所述接收第一用户发送的密钥获取请求之前，还包括：接收所述第一用户发送的可验证声明的申请请求，所述申请请求包括申请信息和存储信息；根据所述申请信息，生成所述第一可验证声明；根据所述存储信息，将生成的所述第一可验证声明发送给对应的第一服务端，以使所述第一服务端保存所述第一可验证声明。
本说明书一个或多个实施例提供的存储介质存储的计算机可执行指令在被处理器执行时，在接收到第一用户发送的密钥获取请求时，从第二区块链中获取相应的公钥并发送给第一用户，使得第一用户可基于该公钥授予第二用户对第一用户的第一可验证声明的访问权限。由此，实现了可验证声明的访问授权，满足了用户在不同业务场景中对其他用户授予对可验证声明的访问权限的授权需求。
需要说明的是，本说明书中关于存储介质的实施例与本说明书中关于基于可验证声明的授权处理方法的实施例基于同一发明构思，因此该实施例的具体实施可以参见前述对应的基于可验证声明的授权处理方法的实施，重复之处不再赘述。
上述对本说明书特定实施例进行了描述。其它实施例在所附权利要求书的范围内。在一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
在20世纪30年代，对于一个技术的改进可以很明显地区分是硬件上的改进(例如，对二极管、晶体管、开关等电路结构的改进)还是软件上的改进(对于方法流程的改进)。然而，随着技术的发展，当今的很多方法流程的改进已经可以视为硬件电路结构的直接改进。设计人员几乎都通过将改进的方法流程编程到硬件电路中来得到相应的硬件电路结构。因此，不能说一个方法流程的改进就不能用硬件实体模块来实现。例如，可编程逻辑器件(Programmable Logic Device，PLD)(例如现场可编程门阵列(Field Programmable Gate Array，FPGA))就是这样一种集成电路，其逻辑功能由用户对器件编程来确定。由设计人员自行编程来把一个数字系统“集成”在一片PLD上，而不需要请芯片制造厂商来设计和制作专用的集成电路芯片。而且，如今，取代手工地制作集成电路芯片，这种编程也多半改用“逻辑编译器(logic compiler)”软件来实现，它与程序开发撰写时所用的软件编译器相类似，而要编译之前的原始代码也得用特定的编程语言来撰写，此称之为硬件描述语言(Hardware Description Language，HDL)，而HDL也并 非仅有一种，而是有许多种，如ABEL(Advanced Boolean Expression Language)、AHDL(Altera Hardware Description Language)、Confluence、CUPL(Cornell University Programming Language)、HDCal、JHDL(Java Hardware Description Language)、Lava、Lola、MyHDL、PALASM、RHDL(Ruby Hardware Description Language)等，目前最普遍使用的是VHDL(Very-High-Speed Integrated Circuit Hardware Description Language)与Verilog。本领域技术人员也应该清楚，只需要将方法流程用上述几种硬件描述语言稍作逻辑编程并编程到集成电路中，就可以很容易得到实现该逻辑方法流程的硬件电路。
控制器可以按任何适当的方式实现，例如，控制器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑控制器和嵌入微控制器的形式，控制器的例子包括但不限于以下微控制器：ARC 625D、Atmel AT91SAM、Microchip PIC18F26K20以及Silicone Labs C8051F320，存储器控制器还可以被实现为存储器的控制逻辑的一部分。本领域技术人员也知道，除了以纯计算机可读程序代码方式实现控制器以外，完全可通过将方法步骤进行逻辑编程来使得控制器以逻辑门、开关、专用集成电路、可编程逻辑控制器和嵌入微控制器等的形式来实现相同功能。因此这种控制器可以被认为是一种硬件部件，而对其内包括的用于实现各种功能的装置也可以视为硬件部件内的结构。或者甚至，可以将用于实现各种功能的装置视为既可以是实现方法的软件模块又可是硬件部件内的结构。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机。具体的，计算机例如可以为个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任何设备的组合。
为了描述的方便，描述以上装置时以功能分为各种单元分别描述。当然，在实施本说明书实施例时可以把各单元的功能在同一个或多个软件和/或硬件中实现。
本领域内的技术人员应明白，本说明书一个或多个实施例可提供为方法、系统或计算机程序产品。因此，本说明书一个或多个实施例可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本说明书可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本说明书是参照根据本说明书实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或 方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
本说明书一个或多个实施例可以在由计算机执行的计算机可执行指令的一般上下文中描述，例如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本说明书的一个或多个实施例，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
以上所述仅为本文件的实施例而已，并不用于限制本文件。对于本领域技术人员来说，本文件可以有各种更改和变化。凡在本文件的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本文件的权利要求范围之内。

Claims (27)

  1. 一种基于可验证声明的授权处理方法，应用于第一用户对应的第一服务端，包括：
    接收第一用户发送的授权请求，其中，所述授权请求用于请求为第二用户授予对所述第一用户的第一可验证声明的访问权限；所述授权请求包括授权信息，所述授权信息基于所述第一可验证声明和所述第二用户的第一数字身份信息所对应的公钥所生成；
    根据所述授权信息和所述第一可验证声明的第一标识信息，生成授权记录信息；
    将所述授权记录信息保存至第一区块链中，向所述第一用户发送授权成功信息。
  2. 根据权利要求1所述的方法，所述第二用户与所述第一用户对应相同的第一服务端；所述授权记录信息还包括：所述第一数字身份信息；
    所述向所述第一用户发送授权成功信息之后，还包括：
    接收所述第二用户发送的可验证声明的第一访问请求；其中，所述第一访问请求包括所述第一数字身份信息和所述第一标识信息；
    根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询关联的所述授权记录信息，将查询到的所述授权记录信息中的所述第一可验证声明发送给所述第二用户。
  3. 根据权利要求2所述的方法，所述授权信息包括：所述第一可验证声明的密文和第一密钥的密文；其中，所述第一可验证声明的密文是根据所述第一密钥对所述第一可验证声明进行加密处理而得；所述第一密钥的密文是根据所述公钥对所述第一密钥进行加密处理而得；
    所述将查询到的所述授权记录信息中的所述第一可验证声明发送给所述第二用户，包括：
    将查询到的所述授权记录信息中的所述第一可验证声明的密文和第一密钥的密文发送给所述第二用户，以使所述第二用户根据所述第一数字身份信息所对应的私钥对所述第一密钥的密文进行解密处理得到所述第一密钥，并根据所述第一密钥对所述第一可验证声明的密文进行解密处理得到所述第一可验证声明。
  4. 根据权利要求2所述的方法，所述第一访问请求还包括：根据所述第一数字身份信息所对应的私钥对指定数据进行签名处理所得的第一签名数据；
    所述根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询关联的所述授权记录信息，包括：
    获取所述第一数字身份信息所对应的公钥；
    采用获取的所述公钥对所述第一签名数据进行验证，若验证通过，则根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询关联的所述授权记录信息。
  5. 根据权利要求2所述的方法，所述接收所述第二用户发送的可验证声明的第一访问请求之后，还包括：
    记录所述第一访问请求的接收时间；
    所述将查询到的所述授权记录信息中的所述第一可验证声明发送给所述第二用户之后，还包括：
    根据所述第一标识信息、所述第一数字身份信息和所述接收时间，生成所述第一可验证声明的访问记录信息；
    将所述访问记录信息保存至所述第一区块链中。
  6. 根据权利要求1所述的方法，所述第二用户与所述第一用户对应不同的第一服务端；所述授权记录信息还包括：所述第一数字身份信息；
    所述将所述授权记录信息保存至第一区块链中之后，还包括：
    接收第二服务端发送的所述授权信息的获取请求；其中，所述获取请求包括所述第一数字身份信息和所述第一标识信息；
    若根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中查询到关联的所述授权记录信息，则将所述授权记录信息中的授权信息发送给所述第二服务端；以使所述第二服务端将所述授权信息保存在第二区块链中，并在接收到所述第二用户发送的可验证声明的第三访问请求时，将所述第二区块链保存的所述授权信息中的所述第一可验证声明发送给所述第二用户。
  7. 根据权利要求1所述的方法，所述方法还包括：
    接收所述第一用户发送的可验证声明的处理请求；其中，所述处理请求用于请求对所述第一可验证声明进行撤销处理、冻结处理、解除冻结处理中的任意一个；所述处理请求包括所述第一标识信息；
    若确定所述第一可验证声明符合预设的处理条件，则根据所述处理请求变更所述第一可验证声明的状态信息；
    根据所述第一标识信息和变更后的所述状态信息，生成变更记录信息；
    将所述变更记录信息保存至第一区块链中。
  8. 根据权利要求7所述的方法，所述处理请求还包括：处理类型信息；
    所述确定所述第一可验证声明符合预设的处理条件，包括：
    获取所述第一可验证声明当前所处状态的状态信息，若获取的所述状态信息与预设的所述处理类型信息所关联的状态信息相匹配，则确定所述第一可验证声明符合预设的处理条件；或者，
    获取所述可验证声明当前所处状态的状态信息和所述第一用户在预设时长内对所述第一可验证声明的处理频次，若获取的所述状态信息与预设的所述处理类型信息所关联的状态信息相匹配、且所述处理频次小于预设频次，则确定所述第一可验证声明符合预设的处理条件。
  9. 根据权利要求1-8任一项所述的方法，所述接收第一用户发送的授权请求之前，还包括：
    接收第二服务端发送的所述第一可验证声明；其中，所述第一可验证声明为所述第二服务端基于所述第一用户发送的可验证声明的申请请求所生成；
    保存所述第一可验证声明。
  10. 根据权利要求9所述的方法，所述保存所述第一可验证声明之后，还包括：
    接收所述第一用户发送的可验证声明的第二访问请求，其中，所述第二访问请求包括所述第一标识信息；
    获取保存的所述第一标识信息所对应所述第一可验证声明；
    将获取的所述第一可验证声明发送给所述第一用户。
  11. 一种基于可验证声明的授权处理方法，应用于第二服务端，包括：
    接收第一用户发送的密钥获取请求，其中，所述密钥获取请求包括第二用户的第一数字身份信息；
    从第二区块链中获取所述第一数字身份信息所对应的公钥；
    将获取的所述公钥发送给所述第一用户，以使所述第一用户基于所述公钥授予所述第二用户对所述第一用户的第一可验证声明的访问权限。
  12. 根据权利要求11所述的方法，所述从第二区块链中获取所述第一数字身份信息所对应的公钥，包括：
    根据所述第一数字身份信息，从所述第二区块链中查询关联的第一文档；
    从查询到的所述第一文档中获取所述第一数字身份信息所对应的公钥。
  13. 根据权利要求11所述的方法，所述第一用户和所述第二用户对应相同的第一服务端；其中，所述第一服务端用于存储并管理可验证声明；
    所述将获取的所述公钥发送给所述第一用户之后，还包括：
    接收所述第二用户发送的地址查询请求；其中，所述地址查询请求包括所述第二用 户的第一数字身份信息；
    根据所述第一数字身份信息从所述第二区块链中查询关联的第一文档；
    从所述第一文档中获取所述第一服务端的访问地址；
    将获取的所述访问地址发送给所述第二用户，以使所述第二用户根据所述访问地址，向所述第一服务端发送可验证声明的第一访问请求，以请求访问所述第一可验证声明。
  14. 根据权利要求11所述的方法，所述第一用户和所述第二用户对应不同的第一服务端；其中，所述第一服务端用于存储并管理可验证声明；
    所述将获取的所述公钥发送给所述第一用户之后，还包括：
    从所述第一用户对应的所述第一服务端获取所述访问权限的授权信息；其中，所述授权信息由所述第一用户发送给所述第一服务端，以使所述第一服务端根据所述授权信息，将授权记录信息保存至第一区块链中；所述授权信息基于所述公钥和所述第一可验证声明所生成；
    将所述授权信息保存至所述第二区块链中；以及，
    接收到所述第二用户发送的可验证声明的第三访问请求时，将所述授权信息中的所述第一可验证声明发送给所述第二用户。
  15. 根据权利要求14所述的方法，所述从所述第一用户对应的所述第一服务端获取所述访问权限的授权信息，包括：
    若接收到所述第一用户发送的数据迁移请求，则根据所述数据迁移请求包括的所述第一数字身份信息和所述第一可验证声明的第一标识信息，向所述第一用户对应的第一服务端发送所述授权信息的获取请求；以使所述第一服务端根据所述第一数字身份信息和所述第一标识信息，从所述第一区块链中获取关联的授权记录信息，并返回所述授权记录信息中的授权信息；
    接收所述第一服务端发送的所述授权信息。
  16. 根据权利要求14所述的方法，所述授权信息包括：所述第一可验证声明的密文和第一密钥的密文；其中，所述第一可验证声明的密文是根据所述第一密钥对所述第一可验证声明进行加密处理而得；所述第一密钥的密文是根据所述公钥对所述第一密钥进行加密处理而得；
    所述将所述授权信息中的所述第一可验证声明发送给所述第二用户，包括：
    将所述第一可验证声明的密文和所述第一密钥的密文发送给所述第二用户，以使所述第二用户根据所述第一数字身份信息所对应的私钥对所述第一密钥的密文进行解密处理得到所述第一密钥，并根据所述第一密钥对所述第一可验证声明的密文进行解密处理得到所述第一可验证声明。
  17. 根据权利要求14所述的方法，所述授权信息还包括：所述访问权限的截止时间；
    所述将所述授权信息保存至所述第二区块链中，包括：
    根据所述授权信息生成第二可验证声明；
    将所述第二可验证声明和所述第二可验证声明的第二标识信息关联保存至所述第二区块链中；
    向所述第二用户发送所述第二标识信息，以使所述第二用户根据所述第二标识信息发送所述第三访问请求；
    所述将所述授权信息中的所述第一可验证声明发送给所述第二用户，包括：
    根据所述第三访问请求中的所述第二标识信息，从所述第二区块链中获取关联保存的所述第二可验证声明；
    从所述第二可验证声明中获取所述授权信息；
    若确定当前时间未超过所述授权信息中的所述截止时间，则将所述授权信息中的第一可验证声明发送给所述第二用户。
  18. 根据权利要求14所述的方法，所述授权信息还包括：所述访问权限的截止时间；
    所述将所述授权信息保存至所述第二区块链中，包括：
    根据所述第一数字身份信息，生成第三可验证声明；其中，所述第三可验证声明用于证明所述第二用户具有对所述授权信息中的所述第一可验证声明的访问权限；
    将所述授权信息、所述第三可验证声明和所述第三可验证声明的第三标识信息关联保存至所述第二区块链中；
    向所述第二用户发送所述第三标识信息，以使所述第二用户根据所述第三标识信息发送所述第三访问请求；
    所述将所述授权信息中的所述第一可验证声明发送给所述第二用户，包括：
    根据所述第三访问请求中的所述第三标识信息，从所述第二区块链中获取关联保存的所述授权信息和所述第三可验证声明；
    若确定所述第三访问请求中的第一数字身份信息与所述第三可验证声明中的第一数字身份信息匹配、且当前时间未超过所述授权信息中的所述截止时间，则将所述授权信息中的第一可验证声明发送给所述第二用户。
  19. 根据权利要求11-18任一项所述的方法，所述接收第一用户发送的密钥获取请求之前，还包括：
    接收所述第一用户发送的可验证声明的申请请求；其中，所述申请请求包括申请信息和存储信息；
    根据所述申请信息，生成所述第一可验证声明；
    根据所述存储信息，将生成的所述第一可验证声明发送给对应的第一服务端，以使所述第一服务端保存所述第一可验证声明。
  20. 一种基于可验证声明的授权处理装置，应用于第一用户对应的第一服务端，包括：
    接收模块，其接收第一用户发送的授权请求，其中，所述授权请求用于请求为第二用户授予对所述第一用户的第一可验证声明的访问权限；所述授权请求包括授权信息，所述授权信息基于所述第一可验证声明和所述第二用户的第一数字身份信息所对应的公钥所生成；
    生成模块，其根据所述授权信息和所述第一可验证声明的第一标识信息，生成授权记录信息；
    发送模块，其将所述授权记录信息保存至第一区块链中，向所述第一用户发送授权成功信息。
  21. 一种基于可验证声明的授权处理装置，应用于第二服务端，包括：
    接收模块，其接收第一用户发送的密钥获取请求，其中，所述密钥获取请求包括第二用户的第一数字身份信息；
    第一获取模块，其从第二区块链中获取所述第一数字身份信息所对应的公钥；
    发送模块，其将获取的所述公钥发送给所述第一用户，以使所述第一用户基于所述公钥授予所述第二用户对所述第一用户的第一可验证声明的访问权限。
  22. 一种基于可验证声明的授权处理系统，包括：第一用户的第一客户端、所述第一客户端对应的第一服务端、第二服务端；
    所述第一客户端，响应于所述第一用户授予第二用户对所述第一用户的第一可验证声明的访问权限的授权操作，根据所述第二用户的第一数字身份信息，向所述第二服务端发送密钥获取请求；接收所述第二服务端发送的所述第一数字身份信息所对应的公钥；根据所述公钥和所述第一可验证声明生成授权信息，根据所述授权信息向所述第一服务端发送授权请求；
    所述第一服务端，接收所述授权请求，根据所述授权信息和所述第一可验证声明的 第一标识信息，生成授权记录信息；将所述授权记录信息保存至第一区块链中，向所述第一客户端发送授权成功信息；
    所述第二服务端，接收所述密钥获取请求，从第二区块链中获取所述第一数字身份信息所对应的公钥；将获取的所述公钥发送给所述第一客户端。
  23. 根据权利要求22所述的系统，
    所述第一客户端，根据指定的第一密钥对所述第一可验证声明进行加密处理，得到所述第一可验证声明的密文；根据所述公钥对所述第一密钥进行加密处理，得到所述第一密钥的密文；根据所述第一可验证声明的密文和所述第一密钥的密文，生成所述授权信息。
  24. 一种基于可验证声明的授权处理设备，包括：
    处理器；以及，
    被安排成存储计算机可执行指令的存储器，所述计算机可执行指令在被执行时使所述处理器：
    接收第一用户发送的授权请求，其中，所述授权请求用于请求为第二用户授予对所述第一用户的第一可验证声明的访问权限；所述授权请求包括授权信息，所述授权信息基于所述第一可验证声明和所述第二用户的第一数字身份信息所对应的公钥所生成；
    根据所述授权信息和所述第一可验证声明的第一标识信息，生成授权记录信息；
    将所述授权记录信息保存至第一区块链中，向所述第一用户发送授权成功信息。
  25. 一种基于可验证声明的授权处理设备，包括：
    处理器；以及，
    被安排成存储计算机可执行指令的存储器，所述计算机可执行指令在被执行时使所述处理器：
    接收第一用户发送的密钥获取请求，其中，所述密钥获取请求包括第二用户的第一数字身份信息；
    从第二区块链中获取所述第一数字身份信息所对应的公钥；
    将获取的所述公钥发送给所述第一用户，以使所述第一用户基于所述公钥授予所述第二用户对所述第一用户的第一可验证声明的访问权限。
  26. 一种存储介质，用于存储计算机可执行指令，所述计算机可执行指令在被执行时实现以下流程：
    接收第一用户发送的授权请求，其中，所述授权请求用于请求为第二用户授予对所述第一用户的第一可验证声明的访问权限；所述授权请求包括授权信息，所述授权信息基于所述第一可验证声明和所述第二用户的第一数字身份信息所对应的公钥所生成；
    根据所述授权信息和所述第一可验证声明的第一标识信息，生成授权记录信息；
    将所述授权记录信息保存至第一区块链中，向所述第一用户发送授权成功信息。
  27. 一种存储介质，用于存储计算机可执行指令，所述计算机可执行指令在被执行时实现以下流程：
    接收第一用户发送的密钥获取请求，其中，所述密钥获取请求包括第二用户的第一数字身份信息；
    从第二区块链中获取所述第一数字身份信息所对应的公钥；
    将获取的所述公钥发送给所述第一用户，以使所述第一用户基于所述公钥授予所述第二用户对所述第一用户的第一可验证声明的访问权限。
PCT/CN2021/087789 2020-04-17 2021-04-16 基于可验证声明的授权处理 WO2021209041A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010305730.8 2020-04-17
CN202010305730.8A CN111431936B (zh) 2020-04-17 2020-04-17 基于可验证声明的授权处理方法、装置、设备、系统及存储介质

Publications (1)

Publication Number Publication Date
WO2021209041A1 true WO2021209041A1 (zh) 2021-10-21

Family

ID=71554261

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/087789 WO2021209041A1 (zh) 2020-04-17 2021-04-16 基于可验证声明的授权处理

Country Status (2)

Country Link
CN (1) CN111431936B (zh)
WO (1) WO2021209041A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113806809A (zh) * 2021-11-17 2021-12-17 北京溪塔科技有限公司 一种基于区块链的求职者信息披露方法及系统
CN114417287A (zh) * 2022-03-25 2022-04-29 阿里云计算有限公司 数据处理方法、系统、设备及存储介质
CN115102711A (zh) * 2022-05-09 2022-09-23 支付宝(杭州)信息技术有限公司 信息授权方法、装置以及系统

Families Citing this family (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111431936B (zh) * 2020-04-17 2021-09-21 支付宝(杭州)信息技术有限公司 基于可验证声明的授权处理方法、装置、设备、系统及存储介质
CN111901359B (zh) * 2020-08-07 2023-01-31 广州运通链达金服科技有限公司 资源账户授权方法、装置、系统、计算机设备和介质
CN111814198B (zh) * 2020-09-11 2021-03-23 支付宝(杭州)信息技术有限公司 一种基于区块链的用户隐私数据提供方法及装置
CN112184190B (zh) * 2020-09-21 2022-04-22 支付宝(杭州)信息技术有限公司 基于区块链的业务处理方法及装置
CN112291245B (zh) * 2020-10-30 2023-04-07 北京华弘集成电路设计有限责任公司 一种身份授权方法、装置、存储介质及设备
CN112311538B (zh) * 2020-10-30 2024-04-23 北京华弘集成电路设计有限责任公司 一种身份验证的方法、装置、存储介质及设备
KR102409822B1 (ko) * 2020-11-03 2022-06-20 (주)드림시큐리티 신원정보 검증 장치 및 방법
CN113420284B (zh) * 2020-11-20 2024-05-17 支付宝(杭州)信息技术有限公司 登录及用户登录相关业务的处理方法、装置和设备
CN112738253B (zh) * 2020-12-30 2023-04-25 北京百度网讯科技有限公司 基于区块链的数据处理方法、装置、设备及存储介质
CN112434348B (zh) * 2021-01-27 2021-04-20 支付宝(杭州)信息技术有限公司 数据的验证处理方法、装置及设备
CN112507370A (zh) * 2021-02-03 2021-03-16 支付宝(杭州)信息技术有限公司 一种基于区块链网络的电子证照核验方法
CN113472807B (zh) * 2021-02-22 2023-03-21 支付宝(杭州)信息技术有限公司 用户间的隐私通信方法和装置
CN112926092B (zh) * 2021-03-30 2024-07-02 支付宝(杭州)信息技术有限公司 保护隐私的身份信息存储、身份认证方法及装置
CN113162762B (zh) * 2021-04-16 2022-07-19 北京深思数盾科技股份有限公司 密钥授权方法、加密机、终端及存储介质
CN113312664B (zh) * 2021-06-01 2022-06-28 支付宝(杭州)信息技术有限公司 用户数据授权方法及用户数据授权系统
CN113282956B (zh) * 2021-06-03 2022-04-29 网易（杭州）网络有限公司 购房数据的处理方法、装置、系统及电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019101233A2 (en) * 2019-03-04 2019-05-31 Alibaba Group Holding Limited Property management system utilizing a blockchain network
CN110768967A (zh) * 2019-10-11 2020-02-07 支付宝(杭州)信息技术有限公司 业务授权方法、装置、设备及系统
CN110990804A (zh) * 2020-03-03 2020-04-10 支付宝(杭州)信息技术有限公司 资源访问方法、装置及设备
CN111431936A (zh) * 2020-04-17 2020-07-17 支付宝(杭州)信息技术有限公司 基于可验证声明的授权处理方法、装置、设备及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019101233A2 (en) * 2019-03-04 2019-05-31 Alibaba Group Holding Limited Property management system utilizing a blockchain network
CN110768967A (zh) * 2019-10-11 2020-02-07 支付宝(杭州)信息技术有限公司 业务授权方法、装置、设备及系统
CN110990804A (zh) * 2020-03-03 2020-04-10 支付宝(杭州)信息技术有限公司 资源访问方法、装置及设备
CN111680274A (zh) * 2020-03-03 2020-09-18 支付宝(杭州)信息技术有限公司 资源访问方法、装置及设备
CN111431936A (zh) * 2020-04-17 2020-07-17 支付宝(杭州)信息技术有限公司 基于可验证声明的授权处理方法、装置、设备及系统

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113806809A (zh) * 2021-11-17 2021-12-17 北京溪塔科技有限公司 一种基于区块链的求职者信息披露方法及系统
CN114417287A (zh) * 2022-03-25 2022-04-29 阿里云计算有限公司 数据处理方法、系统、设备及存储介质
CN115102711A (zh) * 2022-05-09 2022-09-23 支付宝(杭州)信息技术有限公司 信息授权方法、装置以及系统
CN115102711B (zh) * 2022-05-09 2024-01-02 支付宝(杭州)信息技术有限公司 信息授权方法、装置以及系统

Also Published As

Publication number Publication date
CN111431936A (zh) 2020-07-17
CN111431936B (zh) 2021-09-21
CN113973016A (zh) 2022-01-25

Similar Documents

Publication Publication Date Title
WO2021209041A1 (zh) 基于可验证声明的授权处理
CN112818380B (zh) 业务行为的回溯处理方法、装置、设备及系统
WO2021068636A1 (zh) 基于区块链的可验证声明的创建方法、装置、设备及系统
EP2731044B1 (en) Client computer for querying a database stored on a server via a network
WO2021204068A1 (zh) 可验证声明的存储
CN110768967B (zh) 业务授权方法、装置、设备、系统及存储介质
WO2021114872A1 (zh) 一种基于可验证声明的业务处理方法、装置及设备
US9558366B2 (en) Computer system for storing and retrieval of encrypted data items, client computer, computer program product and computer-implemented method
WO2017036190A1 (zh) 一种基于云计算平台的数据访问方法及用户终端
WO2014207554A2 (en) Method and apparatus for providing database access authorization
US11128457B2 (en) Cryptographic key generation using external entropy generation
WO2021204067A1 (zh) 可验证声明的转发、获取
CN111917711B (zh) 数据访问方法、装置、计算机设备和存储介质
CN115191104A (zh) 由去中心化标识符锚定的去中心化标识
US20200244441A1 (en) One-time password with unpredictable moving factor
CN114398623A (zh) 一种安全策略的确定方法
CN113973016B (zh) 基于可验证声明的授权处理方法、装置、设备及系统
CN111784550B (zh) 继承业务的处理方法、装置及设备
CN110365654B (zh) 数据传输控制方法、装置、电子设备和存储介质
CN116318981A (zh) 颁发可验证声明的方法和用户设备
CN116232741A (zh) 账户密钥设置方法、用户设备和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21787772

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21787772

Country of ref document: EP

Kind code of ref document: A1