WO2022160829A1 - 身份信息处理方法、设备及系统 - Google Patents

身份信息处理方法、设备及系统 Download PDF

Info

Publication number
WO2022160829A1
WO2022160829A1 PCT/CN2021/127425 CN2021127425W WO2022160829A1 WO 2022160829 A1 WO2022160829 A1 WO 2022160829A1 CN 2021127425 W CN2021127425 W CN 2021127425W WO 2022160829 A1 WO2022160829 A1 WO 2022160829A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
credential
target
verification
user information
Prior art date
Application number
PCT/CN2021/127425
Other languages
English (en)
French (fr)
Inventor
薛腾飞
周萌萌
张子怡
俞岳
Original Assignee
华为云计算技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为云计算技术有限公司 filed Critical 华为云计算技术有限公司
Priority to EP21922420.1A priority Critical patent/EP4270226A4/en
Publication of WO2022160829A1 publication Critical patent/WO2022160829A1/zh
Priority to US18/359,252 priority patent/US20230379155A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
    • G06Q50/10—Services
    • G06Q50/26—Government or public services
    • G06Q50/265—Personal security, identity or safety
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • G06F21/46—Structures or tools for the administration of authentication by designing passwords or checking the strength of passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/018—Certifying business or products
    • G06Q30/0185—Product, service or business identity fraud
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • G06Q30/0609—Buyer or seller confidence or verification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q2220/00—Business processing using cryptography

Definitions

  • the present application relates to the field of computer technology, and in particular, to a method, device and system for processing identity information.
  • Digital identity refers to identifying entities (eg, users or items) through data. Especially for users, the emergence of digital identities is profoundly changing the driving force and mode of economic and social development. Compared with traditional identities, digital identities will greatly improve social efficiency and maximize the release of user value, so that government agencies, service providers, users and other parties can benefit from it.
  • the Identity Provider uses the user information to generate a digital certificate matching the user when the user meets the issuance conditions, and distributes the digital certificate to the user.
  • the IDP can apply to the digital certificate to perform verification.
  • part of the user information in the user information corresponding to the digital credential obtained by the service provider may be private to the user (for example, whether married or not, educational background) and do not want to be exposed to unrelated persons.
  • a method, device and system for processing identity information are proposed, which can allow users to participate in customizing digital credentials that match specific scenarios, thereby avoiding privacy leakage.
  • an embodiment of the present application provides a method for processing identity information, the method comprising: a terminal device acquiring a first set corresponding to a plurality of first user information from a credential issuing device, wherein the first set It includes a first encrypted information set and a first credential information set, the first encrypted information set includes a plurality of first encrypted information corresponding to the plurality of first user information, and the first credential information set includes a plurality of pieces of first credential information after the issuance processing is performed on the plurality of pieces of first user information; the terminal device determines, based on the first encrypted information set and the first credential information set in the first set, to communicate with the user The target verification set corresponding to the target user information, wherein the target verification set includes the target user information in the plurality of first user information and the target corresponding to the target user information in the plurality of first credential information credential information; the terminal device provides the target verification set to the credential verification device.
  • the digital certificate of the distributed identity information verification system usually declares multiple identity information provided by each digital identity and encrypts the entire digital certificate. It cannot be issued separately for each identity information, and the user The data certificate cannot be processed. For example, only certain attribute declarations in the digital certificate are selected, which limits the user's usage scenarios. In addition, the digital certificate needs to be stored by the user and is easily lost.
  • the terminal device uses part of the information in the first set to generate a target verification set, which not only enables the terminal device to participate in customizing the target verification set, but also the target verification set corresponding to according to actual needs, so as to effectively protect user privacy.
  • the terminal device acquiring the first set corresponding to the plurality of first user information from the credential issuing device includes: the terminal device uses the information corresponding to the terminal device The first blockchain node of the device obtains the first set provided by the second blockchain node corresponding to the certificate issuing device.
  • distributed identity systems can generate their own decentralized identity information, and then use the public and private keys between them to encrypt/decrypt, while blockchain technology itself is the information of decentralization and blockchain technology. It cannot be tampered with. Therefore, the embodiments of the present application can use the blockchain technology to process the relevant data of each terminal and store the relevant data.
  • the terminal device acquiring the first set corresponding to the plurality of first user information from the credential issuing device includes: the terminal device making a data request; the credential The issuing device will obtain the first set from local or cloud storage in response to the data request made by the terminal device.
  • many terminals on the distributed identity system may not use blockchain technology, since these data (first set) acquired can be stored on non-blockchain nodes, for example, cloud storage, which may be applicable for more terminal devices.
  • the method further includes: acquiring, by the terminal device, a second set corresponding to multiple second user information, where the second set includes a second encrypted information set and a second credential information set, the second encrypted information set includes a plurality of second encrypted information corresponding to the plurality of second user information, and the second credential information set includes a plurality of second encrypted information
  • the user information executes a plurality of second credential information after the issuance process.
  • the terminal device may obtain more sets in addition to the first set, so as to select a suitable set according to business requirements in the future.
  • the method further includes: the terminal device determining a target with the user based on the second encrypted information set and the second credential information set in the second set A target verification set corresponding to user information, wherein the target verification set includes the target user information and target credential information corresponding to the target user information, wherein the target verification set includes: the plurality of second users target user information in the information and target credential information corresponding to the target user information in the plurality of second credential information.
  • the terminal device After obtaining the first set/second set sent by the certificate issuing device, the terminal device can select part or all of the first user information or the second user information to provide to the certificate verification terminal as required, which not only improves security but also enables Adapt to more business scenarios.
  • the terminal device determines, based on the first encrypted information set and the first credential information set in the first set, the target verification corresponding to the target user information of the user set, including: the terminal device, based on the first encrypted information set and the first credential information set in the first set and the second encrypted information set and the second credential information set in the second set, determines A target verification set corresponding to the target user information of the user, wherein the target verification set includes: target user information in the plurality of first user information and the plurality of second user information and the plurality of first user information credential information and target credential information corresponding to the target user information in the plurality of second credential information.
  • the terminal device may, as required, select some information from the first user information and the second user information as the certificate content of the digital certificate, It not only improves security but also adapts to more business scenarios.
  • the first set further includes first signature information obtained after the certificate issuing device collectively signs the plurality of first certificate information.
  • the certificate issuing terminal may include first signature information in the first set.
  • the method further includes: the terminal device provides the credential verification device with the first A set of credential information and the first signature information.
  • the credential verification terminal may perform a signature verification operation on the first signature information by using the first credential information set to determine whether the credential issuing device of the first credential information set is the target credential issuing device.
  • an embodiment of the present application provides an identity information processing method, which includes: a credential verification device receives a service request; the credential verification device obtains a target verification set from a terminal device, wherein the target verification set includes Target user information and target credential information corresponding to the service; the credential verification device verifies the target verification set, and provides credential verification information to the terminal device, wherein the credential verification information is used to indicate the target verification Whether the collection passes validation.
  • the credential verification device can only obtain the credential content required to be verified and verify the credential content, which not only effectively avoids the leakage of user information but also reduces the workload of the credential verification terminal.
  • the method further includes: acquiring, by the credential verification device, a first credential information set and first signature information from the terminal device, wherein the first credential information set includes Multiple pieces of first credential information, where the first signature information is information obtained after collectively signing the multiple pieces of first credential information.
  • the credential verification device may further determine whether the credential issuing device of the first credential information set is the target credential issuing device by performing a signature verification operation on the first signature information by using the first credential information set.
  • an embodiment of the present application provides a terminal device, including: a set acquisition unit, configured to acquire a first set corresponding to a plurality of first user information from a certificate issuing device, wherein the first set includes a first set of first user information.
  • the target verification set determination unit is configured to determine, based on the first encrypted information set and the first credential information set in the first set, the A target verification set corresponding to the target user information of the user, wherein the target verification set includes target user information in the plurality of first user information and target user information in the plurality of first credential information corresponding to the target user information target credential information; a target verification set providing unit, configured to provide the target verification set to the credential verification device.
  • the set obtaining unit is further configured to obtain a second set corresponding to a plurality of second user information, wherein the second set includes a second encrypted information set and a first set of encrypted information.
  • Two credential information sets the second encrypted information set includes a plurality of second encrypted information corresponding to the plurality of second user information, and the second credential information set includes a plurality of second user information A plurality of second credential information after the issuance process is performed.
  • the verification set determining unit is further configured to determine, based on the second encrypted information set and the second credential information set in the second set, a target user with the user A target verification set corresponding to the information, wherein the target verification set includes the target user information and target credential information corresponding to the target user information, wherein the target verification set includes: the plurality of second user information and the target credential information corresponding to the target user information in the plurality of second credential information.
  • the verification set determining unit is further configured to, based on the first encrypted information set and the first credential information set in the first set and the first set of credential information in the second set, Two sets of encrypted information and a second set of credential information, determine a target verification set corresponding to the target user information of the user, wherein the target verification set includes: the plurality of first user information and the plurality of second user information Target user information in the user information and target credential information corresponding to the target user information in the plurality of first credential information and the plurality of second credential information.
  • an embodiment of the present application provides a credential verification device, comprising: a receiving unit for receiving a service request; a target verification set acquisition unit for acquiring a target verification set from the terminal device, wherein the target verification set The verification set includes target user information and target credential information corresponding to the service; the credential verification information providing unit is used for verifying the target verification set and providing credential verification information to the terminal device, wherein the credential verification information is used for to indicate whether the target verification set passed the verification.
  • embodiments of the present application provide an identity information verification device, including: a processor; a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions when the first aspect is A method in any possible implementation manner of the first aspect, or a method in any possible implementation manner of the first aspect.
  • an embodiment of the present application provides a non-volatile computer-readable storage medium on which computer program instructions are stored, and when the computer program instructions are executed by a processor, any possible implementation of the first aspect is implemented A method in a manner, or a method in any possible implementation manner of the first aspect.
  • an embodiment of the present application provides a computer program product, where the computer program product includes instructions, and the instructions are used to instruct a server to execute the steps of the method in any possible implementation manner of the first aspect, or the first aspect.
  • the steps of the method in any possible implementation of an aspect.
  • an embodiment of the present application provides a method for processing identity information, the method is executed by a terminal device of a user, and the method includes: acquiring a first set generated by using a plurality of first user information from a credential issuing device , wherein the first set includes a first encrypted information set, a first credential information set and a first signature information, wherein the first encrypted information set includes a first public key to the plurality of first user information A plurality of first encrypted information to be encrypted, the first credential information set includes a plurality of first credential information after blinding processing is performed on the plurality of first user information, and the first signature information is for the plurality of first user information.
  • Information obtained after the first credential information is collectively signed; using the first set, a target verification set corresponding to the target user information is generated, wherein the target user information indicates the information requested by the credential verification device.
  • the target verification set is provided to the credential verification device.
  • the digital certificate of the distributed identity information verification system usually declares multiple identity information provided by each digital identity and encrypts the entire digital certificate. It cannot be issued separately for each identity information, and the user The data certificate cannot be processed. For example, only certain attribute declarations in the digital certificate are selected, which limits the user's usage scenarios. In addition, the digital certificate needs to be stored by the user and is easily lost.
  • the method can use the credential issuing device to issue all the identity information as a whole, and blindly process each identity information separately, so as to ensure that the first set has both the issuing subject and the issuing content. meet the issuance needs. Subsequently, after acquiring the first set from the certificate issuing device, the terminal device participates in customizing the target verification set corresponding to the target user information, so that the terminal user can participate in the generation of the digital certificate according to actual needs.
  • acquiring the first set generated by using the plurality of first user information from the certificate issuing device includes: using the first blockchain node corresponding to the terminal device, The first set is obtained from a second blockchain node corresponding to the credential issuing device.
  • distributed identity systems can generate their own decentralized identity information, and then use the public and private keys between them to encrypt/decrypt, while blockchain technology itself is the information of decentralization and blockchain technology. It cannot be tampered with. Therefore, in the embodiments of the present application, the relevant data of each terminal can be processed by using the blockchain technology and stored on the blockchain node corresponding to each terminal.
  • acquiring the first set generated by using the plurality of first user information from the credential issuing device includes: sending a request for the first set to the issuing end storage unit corresponding to the credential issuing device. A set of data requests; receiving the first set from the issuer storage unit.
  • many terminals on the distributed identity system may not use blockchain technology, since these data (first set) acquired can be stored on non-blockchain nodes, for example, cloud storage, which may be applicable for more terminal devices.
  • using the first set to generate a target verification set corresponding to target user information includes: using a first private key corresponding to a first public key to pair the multiple Decrypt the first encrypted credential to obtain the plurality of first user information; use the plurality of first user information to determine the target user information; use the plurality of first user information and the plurality of first user information
  • the corresponding relationship of the credential information is to determine the target credential information corresponding to the target user information; the target user information and the target credential information are determined as a target verification set.
  • the terminal device can select the first credential information corresponding to the target user information from among the plurality of first user information according to the target user information, so as to realize the generation of the target credential information only corresponding to the target user information.
  • the initiative of the terminal device can be used to avoid leaking irrelevant information.
  • the method further includes: acquiring a plurality of second user information corresponding to the user; a second set generated from the plurality of second user information, wherein the second set includes a second encrypted information set, a second credential information set, and a second signature information, wherein the second encrypted information set includes using the first encrypted information set A plurality of second encrypted information obtained by encrypting the plurality of second user information with three public keys, the second credential information set includes a plurality of second credentials obtained by performing blinding processing on the plurality of second user information information, and the second signature information is information obtained after collectively signing the plurality of second credential information.
  • the terminal device may also obtain a second set generated by the credential issuing device according to the plurality of second user information, that is to say, for the plurality of second user information, the method may use the credential issuing device to issue all of the second user information.
  • the identity information is issued as a whole, each identity information is individually blinded, so as to ensure that the first set satisfies the issuance needs in both the issuing subject and the issuing content.
  • the terminal device participates in customizing the second verification set corresponding to the target user information.
  • the credential issuing device for collectively issuing the plurality of second user information may be the same issuer as the credential issuing device for collectively issuing the plurality of first user information, or may be a different issuer terminal, which will greatly increase the usage scenarios of terminal equipment.
  • using the first set to generate a target verification set corresponding to target user information includes: using a first private key corresponding to a first public key to pair the multiple The first encryption certificate or the third private key corresponding to the third public key decrypts the plurality of second encryption certificates to obtain the plurality of first user information or the plurality of second user information; the plurality of first user information or the plurality of second user information, to determine the target user information; use the corresponding relationship between the plurality of first user information and the plurality of first credential information or use the plurality of first user information The corresponding relationship between the pieces of second user information and the plurality of second credential information is determined, and target credential information corresponding to the target user information is determined; the target user information and the target credential information are determined as a target verification set.
  • the terminal device can select part or all of the first user information or the second user information to provide to the credential verification terminal as required, which not only improves the Security and can adapt to more business scenarios.
  • using the first set to generate a target verification set corresponding to target user information includes: using a first private key corresponding to a first public key to pair the multiple The first encrypted credential and the third private key corresponding to the third public key are used to decrypt the plurality of second encrypted credentials to obtain the plurality of first user information and the plurality of second user information; the plurality of first user information and the plurality of second user information, to determine the target user information; use the corresponding relationship between the plurality of first user information and the plurality of first credential information and use the plurality of first user information The corresponding relationship between the pieces of second user information and the plurality of second credential information is determined, and target credential information corresponding to the target user information is determined; the target user information and the target credential information are determined as a target verification set.
  • the terminal device may, as required, select part of the information from the first user information and the second user information as the certificate content of the digital certificate, It not only improves security but also adapts to more business scenarios.
  • the method further includes: performing encryption on the target verification set by using the second public key provided by the credential issuing device to generate an encrypted target verification set.
  • the encrypted target verification set, the first credential information set and the first signature information are determined as the target credential set.
  • the content issued by the certificate issuing device is encrypted through the public-private key system, thereby improving confidentiality. Furthermore, in order to ensure that the credential verification device performs verification, the encrypted target verification set, the first credential information set and the first signature information can be used to determine the target credential set.
  • the method further includes: encrypting the plurality of first user information and storing the encrypted plurality of user information in the first blockchain on the node.
  • the use of blockchain technology to realize the storage of user information not only ensures the validity of the data, but also avoids a large number of verification operations.
  • the method further includes: invoking a first smart contract of the first blockchain node, and sending a credential issuance request to a second blockchain node corresponding to the credential issuance device .
  • various operations can be completed by using smart contracts in blockchain technology, and there is no need to save too much signature information in identity documents, reducing a lot of verification operations.
  • the method further includes: storing the target credential set in the first blockchain node, so that the third blockchain node corresponding to the credential verification device starts from the first blockchain node.
  • a blockchain node obtains the target credential set.
  • the use of blockchain technology to realize the storage of user information not only ensures the validity of the data, but also avoids a large number of verification operations.
  • an embodiment of the present application provides a method for processing identity information, the method being executed by a credential verification device, comprising: in response to receiving a service request from a user's terminal device, obtaining information from the terminal device with the relevant information.
  • the target credential set corresponding to the target user information in the service request wherein the target credential set includes an encrypted target verification set, a first credential information set and first signature information, wherein the target verification set includes target user information and target Credential information, the encrypted target verification set includes a set obtained after performing encryption on the target verification set with the second public key, and the first credential information set includes using the first public key to encrypt multiple user information of the user
  • the plurality of first encrypted information, the first signature information is information obtained after collectively signing the plurality of first credential information; and the credential verification information is provided to the terminal device.
  • the credential verification device may only verify the target credential set sent by the terminal device, and the target credential set not only includes the information for verifying the credential issuing device (a plurality of first credential information is collectively signed credential issuance device information and a plurality of first encrypted information for encrypting a plurality of first user information) and information for verifying the content of the certificate (target verification set), so as to meet the verification requirements of the certificate verification device.
  • the target credential set not only includes the information for verifying the credential issuing device (a plurality of first credential information is collectively signed credential issuance device information and a plurality of first encrypted information for encrypting a plurality of first user information) and information for verifying the content of the certificate (target verification set), so as to meet the verification requirements of the certificate verification device.
  • the method further includes: determining credential verification information for the user based on the target credential set.
  • the credential verification device may perform credential verification operations on the user according to the target credential set mentioned above, thereby determining credential verification information.
  • the credential verification information includes determining that the credential issuing device is a target credential issuing device and the credential information obtained based on the target credential set matches the target credential information.
  • the credential verification information may include a verification result of the credential issuance device and the credential issuance content.
  • determining the credential verification information for the user based on the target credential set includes: performing a signature verification operation on the first signature information by using the first credential information set, Determine whether the credential issuing device of the first credential information set is the target credential issuing device; decrypt the encrypted target verification set with the second private key corresponding to the second public key, and obtain the target user information and the target credential information; it is determined that the credential information generated by using the target user information matches the target credential information.
  • the method may include specific verification operations on the credential issuance device and the content of the credential issuance.
  • providing the credential verification information to the terminal device includes: encrypting the credential verification information and storing it in a third blockchain node and using a third area
  • the block chain node sends the encrypted credential verification information to the first block chain node of the user; or, encrypts the credential verification information and stores it on the verification end storage unit of the credential verification device and is stored in the verification end storage unit of the credential verification device. sent to the user's terminal device.
  • blockchain technology can be used to create, publish, update and query distributed digital identities, and on this basis, the on-chain storage function can be realized.
  • an embodiment of the present application provides a method for processing identity information.
  • the method is executed by a credential issuing device, and includes: generating a first set by using a plurality of first user information, wherein the first set includes A first encrypted information set, a first credential information set, and first signature information, wherein the first encrypted information set includes a plurality of first encrypted information encrypted by using a first public key to encrypt the plurality of user information, so
  • the first credential information set includes a plurality of first credential information obtained by performing blinding processing on the plurality of user information, and the first signature information is information obtained after collectively signing the plurality of first credential information;
  • the terminal device provides the first set.
  • the method can use the certificate issuing device to issue all the identity information as a whole, and perform blinding processing on each identity information separately, thereby ensuring that the first set meets the issuing requirements in both the issuing subject and the issuing content.
  • the credential issuing device is unaware of the use of digital credentials, further enhancing security.
  • the method further includes: acquiring multiple pieces of user information from a first blockchain node corresponding to the user, wherein the multiple pieces of user information are the same as the multiple pieces of user information. related to the first user information.
  • distributed identity systems can generate their own decentralized identity information, and then use the public and private keys between them to encrypt/decrypt, while blockchain technology itself is the information of decentralization and blockchain technology. It cannot be tampered with. Therefore, in the embodiments of the present application, the relevant data of each terminal can be processed by using the blockchain technology and stored on the blockchain node corresponding to each terminal.
  • providing the first set to the terminal device includes: encrypting the first set and storing the encrypted first set in a corresponding certificate issuing device or store the encrypted first set in the issuing side storage unit corresponding to the certificate issuing device, so that the terminal device can obtain the first set.
  • the credential issuing device may choose on-chain storage or off-chain storage according to actual needs.
  • an embodiment of the present application provides an identity information verification device, the device includes: a user information acquisition unit for identifying and acquiring a plurality of first user information corresponding to a user; a set acquisition unit for issuing a certificate from a certificate
  • the device obtains a first set generated by using the plurality of first user information, wherein the first set includes a first encrypted information set, a first credential information set and first signature information, wherein the first encrypted information
  • the set includes a plurality of first encrypted information encrypted by using a first public key to encrypt the plurality of first user information, and the first credential information set includes a plurality of first user information after performing blinding processing on the plurality of first user information.
  • the verification set generating unit may be configured to use the first set to generate a target verification corresponding to the target user information A collection, wherein the target user information indicates information requested by the credential verification device.
  • a verification set providing unit may provide the target verification set to the credential verification device.
  • an embodiment of the present application provides an identity information verification device
  • the identity information processing device includes: a credential set acquisition unit configured to, in response to receiving a service request from a user's terminal device, obtain an identity information from the terminal device. Acquire a target credential set corresponding to the target user information in the service request, wherein the target credential set includes an encrypted target verification set, a first credential information set and first signature information, wherein the target verification set includes a target user information and target credential information, the encrypted target verification set includes a set obtained after performing encryption on the target verification set using the second public key, and the first credential information set is a plurality of users including users using the first public key A plurality of first encrypted information whose information is encrypted, and the first signature information is the information obtained by collectively signing the plurality of first credential information; the credential verification information providing unit is used to provide the credential verification to the terminal device information.
  • an embodiment of the present application provides an identity information verification device
  • the identity information processing device includes: a user information acquisition unit can be used to acquire a plurality of user information corresponding to the user from the user's terminal device; a set generation unit for generating a first set by using the plurality of user information, wherein the first set includes a first encrypted information set, a first credential information set and a first signature information, wherein the first encrypted information set includes A plurality of first encrypted information encrypted by using a first public key to the plurality of user information, the first credential information set includes a plurality of first credential information after blinding processing is performed on the plurality of user information,
  • the first signature information is information obtained by collectively signing the plurality of first credential information; the first set is provided to the terminal device.
  • an embodiment of the present application provides an identity information verification device, comprising: a processor; a memory for storing instructions executable by the processor; wherein the processor is configured to implement when the instructions are executed.
  • the method in the seventh aspect and its possible implementations implements the eighth aspect and its possible implementations, or implements the ninth aspect and its possible implementations.
  • embodiments of the present application provide a non-volatile computer-readable storage medium on which computer program instructions are stored, characterized in that, when the computer program instructions are executed by a processor, the seventh aspect is implemented The method in the eighth aspect and the possible implementation manner thereof is implemented, or the method in the ninth aspect and the possible implementation manner thereof is implemented.
  • embodiments of the present application provide a computer program product, the computer program product includes instructions, and the instructions are used to instruct a server to execute the method in the seventh aspect and possible implementations thereof, the eighth aspect and the method in its possible implementations or the steps of the method in the ninth aspect and its possible implementations.
  • FIG. 1 shows a diagram of a centralized identity information verification system according to the related art
  • FIG. 2 shows a diagram of a distributed identity information verification system according to the related art
  • FIG. 3 shows a business processing diagram of an identity information processing system according to an embodiment of the present application
  • FIG. 4 shows a scene diagram of a blockchain-based distributed identity information verification system according to an embodiment of the present application
  • FIG. 5 shows a schematic structural diagram of a blockchain node according to an embodiment of the present application
  • FIG. 6 shows a system architecture diagram of a blockchain-based identity information processing system according to an embodiment of the present application
  • FIG. 7 shows a process flow diagram of a blockchain-based identity information processing system according to an embodiment of the present application.
  • FIG. 8 shows a block diagram of an identity information processing device according to an embodiment of the present application.
  • FIG. 9 shows a block diagram of an identity information processing device according to an embodiment of the present application.
  • FIG. 10 shows a block diagram of an identity information processing device according to an embodiment of the present application.
  • FIG. 11 shows a block diagram of a computing device according to an embodiment of the present application.
  • “/” may indicate that the objects associated before and after are an “or” relationship, for example, A/B may indicate A or B; “and/or” may be used to describe that there are three types of associated objects A relationship, for example, A and/or B, can mean that A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.
  • words such as “first” and “second” may be used to distinguish technical features with the same or similar functions. The words “first”, “second” and the like do not limit the quantity and execution order, and the words “first”, “second” and the like do not limit the difference.
  • words such as “exemplary” or “for example” are used to represent examples, illustrations or illustrations, and any embodiment or design solution described as “exemplary” or “for example” should not be construed are preferred or advantageous over other embodiments or designs.
  • the use of words such as “exemplary” or “such as” is intended to present the relevant concepts in a specific manner to facilitate understanding.
  • the centralized identity information verification system includes an IDP 101, service providers (service providers, SPs) 102 and 103 and a user 104, wherein the IDP 101 can provide the SPs 102 and 103 and the user 104 with Identity Services.
  • the IDP 101 may generate a digital credential for a user based on identity-related user information, which may include information such as age, education, occupation, and the like.
  • SPs 102 and 103 are providers of services, which may include related services in various fields such as education, medical care, banking, transportation, shopping, and the like.
  • the SP 102 can issue a digital credential to the IDP for the user 104, so the SP 102 is a credential issuing device.
  • the SP 103 is to verify the digital certificate issued by the SP 102 for the user 104. Therefore, the SP 103 is a certificate verification device.
  • step S110 the user 104, the SP 102, and the SP 103 may perform registration with the IDP 101, respectively.
  • the user 104, the SP 102 and the SP 103 may provide the respective user information to the IDP 101 to complete the registration operation at different points in time.
  • the user 104 applies to the SP 102 for a digital certificate.
  • the SP 102 issues a digital certificate to the user 101 and sends the digital certificate to the IDP 101.
  • IDP 101 verifies the identity of SP 102, and after the verification is passed, in step S140, receives the digital certificate issued by SP 102.
  • the IDP 101 may provide the digital credential to the user 104, and in step S150, the SP 102 may prompt the user 104 that the digital credential has been sent to it.
  • step S160 the user 104 can request the service from the SP 103 using the digital certificate.
  • the SP 103 obtains the digital certificate from the IDP 101 or the user 104, and at step S170, verifies the digital certificate. After the verification is passed, in step S180, the SP 103 provides the service to the user.
  • the digital credential management system provided by the exemplary embodiments of the present application adopts a distributed identity information verification system.
  • the distributed identity information verification system the following will describe the distributed identity information verification system with reference to FIG. 2 .
  • the distributed identity information verification system 200 includes SP 21, SP 22 and user 23.
  • the SP 21, the SP 22 and the user 23 can respectively generate their own decentralized identity information (decentralized identity, DID), wherein the DID can be a character string in a specific format for representing entities (including people, digital identities of machines, objects, etc.).
  • DID decentralized identity
  • a new identity type is designed in order to decouple from the centralized identity information verification system.
  • a DID can identify any subject (eg, person, organization, thing, data model, abstract entity, etc.).
  • step S220 the user 23 can apply to the SP 21 for a digital certificate, and the digital certificate refers to the certificate issued by the SP 21. Based on this, in step 230, the SP 21 can use the public key of the user 23 to encrypt the digital certificate, and send the encrypted digital certificate to the user 23.
  • the user 23 may receive its corresponding encrypted digital credential from the SP 21.
  • the user 23 can send the re-encrypted digital certificate to the SP 22.
  • the user 23 can use its own private key to decrypt the encrypted digital certificate and obtain the digital certificate, and then use the public key of the SP 22 to pair the encrypted digital certificate.
  • the digital certificate performs re-encryption to obtain the re-encrypted digital certificate.
  • the digital credential of the distributed identity information verification system 200 as shown in FIG. 2 usually makes a statement for a plurality of identity information provided by each DID and encrypts the entire digital credential. It is issued, and the user cannot process the data certificate. For example, only select some attribute declarations in the digital certificate, which limits the user's usage scenarios. In addition, the digital certificate needs to be stored by the user, which is easy to lose.
  • Users can apply to the company for a digital certificate issued by the company.
  • the user In order to obtain the digital certificate, the user needs to provide age information, unit position information, health information, and marriage and childbirth information.
  • the user After the user obtains the digital certificate issued by the company from the SP 21 using the distributed identity information verification system 200 as described in Figure 2, the user wants to participate in the education and training activities provided by the company for the manager level and above. In this scenario, the user only needs to send the unit position information in the digital certificate to the service provider providing education and training activities, but in the distributed identity system 200 shown in FIG.
  • the user cannot obtain information from the digital certificate Only the information related to the position information of the unit is extracted, and the digital certificate can only be provided to education and training activities, which leads to the user's age information, health information and marriage and childbirth information are also provided to education and training institutions, but these information users Probably not intended to be offered to educational training institutions. Users may refuse to participate in this educational and training activity due to privacy concerns.
  • FIG. 3 is a diagram illustrating a service processing of an identity information processing system according to an embodiment of the present application.
  • the identity information verification system includes a terminal device 31 , a certificate issuing device 32 and a certificate verification device 33 .
  • the terminal device 31 refers to a device with communication capability and processing capability.
  • the terminal device 31 corresponds to the user, that is, the user can operate the terminal device 31 .
  • the terminal device 31 may use the communication capability to provide various user information to the blockchain system, or may use the communication capability to issue various requests to the blockchain system.
  • the terminal device 31 may utilize processing capabilities to encrypt and/or decrypt relevant information, or alternatively, the terminal device 31 may utilize processing capabilities to determine credential information to be provided to the credential issuing device.
  • the utilized terminal device may be a terminal device (user equipment, UE), wherein the UE includes a handheld device, a vehicle-mounted device, a wearable device or a computing device with a wireless communication function.
  • the UE may be a mobile phone, a tablet computer, or a computer with a wireless transceiver function.
  • the terminal device may also be a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a wireless terminal in telemedicine, intelligent Wireless terminals in power grids, wireless terminals in smart cities, wireless terminals in smart homes, and so on.
  • VR virtual reality
  • AR augmented reality
  • the device for implementing the function of the terminal device may be the terminal device; it may also be a device capable of supporting the terminal device to realize the function, such as a chip system, and the device may be installed in the terminal or can be connected with the terminal device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the terminal device 31 can use the above-mentioned DID to apply to the blockchain for its corresponding blockchain node, which can be referred to as the first blockchain node in the following description.
  • the certificate issuing device 32 refers to an institution and/or device that can issue the information provided by the terminal device 31 .
  • the credential issuing device 31 may indicate a credential issuer that performs issuance of information provided by a user and/or a credential issuing device used by the credential issuer.
  • the credential issuing device 32 can be responsible for the authenticity and accuracy of the information provided by the terminal device 31 .
  • the certificate issuing device 32 may be a terminal of an authoritative organization, for example, the certificate issuing device may be a device used by a government agency that issues information on shops operated by users.
  • the certificate issuing device 32 may be a terminal device such as a mobile phone, a tablet computer, a desktop computer, a portable notebook computer, etc., or an independent server, or a server cluster composed of multiple servers.
  • the device for the function of the credential issuing device may be the credential issuing device 32; it may also be a device capable of supporting the credential issuing device to realize the function, such as a chip system, which can be installed in the terminal or can be matched with the credential issuing device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the certificate issuing device can use the above-mentioned DID to apply to the blockchain for a corresponding blockchain node, which can be referred to as the second blockchain node in the following description.
  • the credential verification device 33 refers to an institution and/or device that verifies the credential information provided by the terminal device 31 .
  • the credential verification device 33 may indicate a credential verifier and/or a credential verification device used by a credential verifier that performs verification operations on credential information provided by a user.
  • the service providing device needs to verify the user's user qualification to ensure that the user is qualified for the service.
  • the user can use the terminal device 31 to send the credential information to the credential verification device 33, and after the verification is passed, the credential verification device 33 can notify the service providing device to provide the user with the service.
  • the credential verification device 33 and the service providing device may be the same device or different devices, which are not limited in this application.
  • the credential verification device 33 may be a terminal device such as a mobile phone, a tablet computer, a desktop computer, a portable notebook computer, etc., or an independent server, or a server cluster composed of multiple servers.
  • the device for the function of the credential issuing device can be the credential verification device 33; it can also be a device capable of supporting the credential issuing device to realize the function, such as a chip system, which can be installed in the terminal or can be matched with the credential issuing device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the credential verification device 33 can apply to the blockchain for its corresponding blockchain node by using the above-mentioned DID, which can be referred to as the third blockchain node in the following description.
  • the terminal device 31 may collect a plurality of user information related to the user.
  • the terminal device 31 may provide the plurality of user information according to an existing credential template.
  • each credential has a fixed credential template, and the user can fill in the user information according to the credential template.
  • the user information may include identity information or attribute information used to indicate the user's identity, for example, the user information may include the user's age information, origin information, place of residence information, gender information, position information, education information, health status information Wait.
  • the user information may be used to generate subsequent credential information, but may not be displayed/present in the credential issued by the credential issuing terminal.
  • the user may fill in the user's itinerary information in the past month according to the voucher template, but this information is not used to generate the voucher, but is indispensable information for the voucher issuing terminal to generate the voucher.
  • the terminal device 31 may provide the user information according to the electronic form sent by the credential issuing device 32, or the terminal device 31 may provide the user information by using the first blockchain node corresponding thereto.
  • the terminal device 31 may send the user information to the credential issuing device 32 .
  • the terminal device 31 may provide the user information to the credential issuing device 32 using the blockchain technology.
  • the terminal device 31 can encrypt the user information obtained in step S3110 and store it in the user's first blockchain node.
  • the credential issuance device 32 receives the credential issuance request
  • the encrypted first user information provided by the first blockchain node can be extracted by the second blockchain node corresponding to the credential issuance device 32, and the encrypted first user information can be extracted from the encrypted first user information provided by the first blockchain node.
  • the user information is obtained.
  • step S3210 the certificate issuing device 32 may check the user information, and this time the check is to check the source of the user information and whether the user information satisfies the certificate to be issued.
  • step S3210 may use the blockchain technology to determine that the user information is provided by the terminal device 31 without tampering and the first user information is the most recently existing information.
  • the credential issuing device 32 may determine the plurality of first user information based on the user information, and perform an issuance process on the plurality of first user information to obtain a plurality of first credential information.
  • the user information provided by the terminal device 31 may be the same or different from the user information required to generate the digital certificate.
  • the certificate issuing device 32 may extract the user information from the user information according to actual needs. A plurality of first user information issued by the certificate is issued, and then the issuance process is performed on the first user information to obtain a plurality of first certificate information.
  • the issuing process of the credential issuing terminal can be realized by blinding process.
  • the blinded processing refers to uniquely mapping each user information into data of a fixed format according to a mapping rule. That is to say, the blinding process may have binding capability and hiding capability, wherein the binding capability means that the first user information uniquely corresponds to the first credential information, and the hiding capability means that an attacker cannot or is difficult to use the first credential information.
  • a credential information obtains the first user information.
  • the credential issuing device 32 may use any blinding processing method with binding capability and hiding capability to perform blinding processing on user information.
  • the credential issuance device 32 may perform blinding using a Pedersen commitment.
  • the credential issuing device 32 may operate the user information by using the blinding factor to obtain the first credential information, wherein the blinding factor may be public.
  • the blinding factor may be stored on the second blockchain node.
  • the credential issuing device 32 may collectively sign the plurality of first credential information acquired in step S3220 to acquire the first signature information.
  • an aggregate signature algorithm may be used to collectively sign a plurality of first credential information to obtain the first signature information.
  • the C-L (camenisch-lysyanskaya) signature algorithm may be used to sign the plurality of first credential information.
  • C-L signatures can be used in the scenarios of group signatures or aggregated signatures, which can improve the anonymity of signatures and reduce the computational complexity of signatures.
  • step S3240 the plurality of user information is encrypted by using the first public key of the terminal device to generate a plurality of first encrypted information.
  • the credential issuing terminal 32 can issue the information of each first user, so that the subsequent terminal device 31 can
  • the application scenario selects part of the information in the first credential information as the digital credential.
  • the credential issuing device 32 may determine to obtain the first encrypted information set and the first credential information set as the first set, and in step S3250, the credential issuing device 32 sends the first set to the terminal device.
  • the certificate issuing device 32 can encrypt the first set and store it on its corresponding second blockchain node for extraction and use by other nodes.
  • the credential issuing device 32 can also encrypt the first set and store it on the issuer storage unit corresponding to the credential issuing device.
  • the credential issuing device 32 can encrypt the first set. Afterwards, it is stored in local storage or remote storage (for example, cloud storage), and the storage address is stored on the second blockchain node in the form of a hash value.
  • the first set may further include the first signature information obtained in step S3230. That is, the first set includes the first encryption information set, the first credential information set and the first signature information.
  • the terminal device 31 may provide the certificate issuing device 32 with different user information according to multiple certificate templates, and apply for certificate information respectively by using the user information.
  • the credential issuing device 31 can also acquire a plurality of second user information corresponding to the user.
  • the terminal device 31 can provide the relevant department with the first user information required for issuing the work and residence permit according to the certificate template for applying for a work and residence permit, and obtain the credential information issued by the relevant department.
  • the terminal device 31 can apply for a single youth
  • the credential template provided by the same department provides the second user information required to issue a single youth certificate, and obtains the credential information issued by the same department.
  • the first user information and the second user information that need to be provided in these two cases may or may not have duplicate information.
  • the credential issuing device generates a second set generated by using the plurality of second user information according to steps S3210 to S3240, and the second set may include a second encrypted information set and a second credential information set.
  • the second set may also include second signature information.
  • the second encrypted information set is a plurality of second encrypted information encrypted by using a third public key to encrypt the plurality of second user information, wherein the third public key corresponds to the certificate issuing device, and the certificate issuing When the devices are the same, the third public key may be the same as or different from the first public key.
  • the terminal device 31 can also send the first user information and the second user information to different certificate issuing devices, and obtain different certificate information from different certificate issuing devices.
  • another credential issuing device may acquire multiple pieces of second user information corresponding to the user, and then generate a second set generated by using the multiple pieces of second user information as shown in steps S3210 to S3240, the The second set may include a second set of encryption information and a second set of credential information.
  • the second set may also include second signature information.
  • the second encrypted information set is a plurality of second encrypted information encrypted by using a third public key to encrypt the plurality of second user information, wherein the third public key corresponds to the certificate issuing device, and the certificate issuing When the devices are different, the third public key is not used for the first public key.
  • the terminal device 31 can provide the relevant department with the first user information required for issuing the work and residence permit according to the certificate template for applying for a work and residence permit, and at the same time, the terminal device 31 can provide the relevant department with the relevant department according to the certificate template for applying for tax reduction and exemption.
  • the second user information required for fee reduction and exemption, the two certificate issuing devices are different, therefore, they can use different public keys to encrypt the plurality of first user information and the plurality of second user information respectively.
  • the certificate issuing device 32 issues all the identity information as a whole, it performs blinding processing on each identity information separately, so as to ensure that the first set satisfies the issuance requirements in both the issuing subject and the issuing content.
  • the credential issuing device is unaware of the use of digital credentials, further enhancing security.
  • the terminal device 31 may acquire the first set.
  • the terminal device 31 may obtain the encrypted first set provided by the second blockchain node and decrypt the encrypted first set to obtain the first set.
  • the terminal device 31 may obtain a storage address for storing the encrypted first set from the second blockchain node, and extract the encrypted first set from the memory corresponding to the storage address, and The encrypted first set is decrypted to obtain the first set.
  • the terminal device 31 may determine the target user information requested by the credential verification device 33 .
  • the terminal device 31 may obtain the target user information requested by the credential verification device 33 after sending a credential verification request to the credential verification device 33 by using the blockchain technology.
  • step S3140 the terminal device 31 generates a target verification set corresponding to the target user information.
  • the terminal device 31 may not need to provide all the user information to the credential verification device 33 , or the user information provided according to a single credential template may not satisfy the user information required by the credential verification device 33 .
  • the terminal device 31 may also generate various required target verification sets according to the obtained multiple sets in combination.
  • the terminal device 31 decrypts the plurality of first encrypted credentials using the first private key corresponding to the first public key, and obtains the plurality of user information.
  • the first private key may be encrypted and stored on the first blockchain node.
  • the terminal device 31 can extract the target user information from the plurality of user information.
  • the following will describe the embodiment of generating the target verification set from the first set and the second set. It should be noted that, in the implementation, there may be more sets to generate the target verification set, which is not limited in this application.
  • step S3150 encryption is performed on the target verification set using the second public key provided by the credential verification device 33 to generate an encrypted target verification set.
  • the terminal device 31 may send a target credential set to the credential verification device 33, where the target credential set may include an encrypted target verification set.
  • the terminal device 31 can encrypt the target credential set and store it on its corresponding first blockchain node for extraction and use by other nodes.
  • the terminal device 31 can participate in the customization of the target verification set corresponding to the target user information after obtaining the first set from the certificate issuing device 32, so that the terminal user can participate in the generation of digital certificates according to actual needs, and effectively expand the user use scenarios to protect user privacy.
  • the target credential set may further include the first credential information set and the first credential information set.
  • the signature information that is, the target credential set includes the encrypted target verification set, the first credential information set, and the first signature information.
  • the terminal device 31 may further encrypt the target credential set and store it in a terminal device storage unit corresponding to the terminal device.
  • the terminal device 31 may encrypt the target credential set and store it in the terminal device storage unit.
  • Store in local storage or remote storage for example, cloud storage
  • the terminal device 31 can store the generated various data (for example, the first verification information, etc.) in the blockchain node, and can also be stored in the non-blockchain node, for example, can be stored in In local storage or remote storage (eg, cloud storage) of the end device.
  • the generated various data for example, the first verification information, etc.
  • the non-blockchain node for example, can be stored in In local storage or remote storage (eg, cloud storage) of the end device.
  • the terminal device 31 may determine the storage method according to the type of the credential information. For example, the terminal device 31 may store the authentication-type credential information on the corresponding blockchain node, wherein the authentication-type credential information refers to the credential that only needs the judgment result after judgment according to the needs, for example , whether he is a legal citizen, whether he is married, and whether he has children.
  • the terminal device stores professional credentials on non-blockchain nodes, where professional credentials refer to credentials that need to provide specific content, such as the user's ID photo, the user's fingerprint information, and the like.
  • the credential verification device 33 can acquire the target credential set.
  • the credential verification device 33 can use the blockchain technology to obtain the encrypted target credential set provided by the first blockchain node and decrypt the encrypted target credential set to obtain the target credential set.
  • the credential verification device 33 may use the blockchain technology to obtain the storage address provided by the first blockchain node for storing the encrypted first set, and extract the encrypted first set from the storage corresponding to the storage address. The encrypted target credential set is decrypted to obtain the target credential set.
  • the credential verification device 33 After obtaining the target credential set, the credential verification device 33 verifies the target verification set in step S3310 to determine credential verification information, wherein the credential verification information is used to indicate whether the target verification set passes the verification . In a possible implementation, the credential verification device 33 needs to verify the credential issuer and/or the credential content.
  • the credential verification device 33 needs to determine whether the credential issuing device is the target credential issuing device. For example, the credential issuing device needs to verify whether the credential issuing device is a credential issued by the first institution, that is, it needs to verify whether the credential issuing device 32 is the first institution. If the certificate issuing device 32 is the first institution, the verification is passed, and if it is not the first institution, the verification is not passed.
  • the credential verification device 33 also needs to determine whether the credential information acquired based on the target credential set matches the target credential information. For example, the credential verification device 33 needs to verify the user's educational information, therefore, the credential verification device 33 needs to determine whether the credential information extracted from the target credential set is the user's educational information.
  • the credential verification device 33 may also determine whether the credential information satisfies the service requirements. For example, the service requirement is that the user must have a high school education or above, and the user's education information extracted by the credential verification device 33 is a university degree. Therefore, the credential verification device 33 determines that the user meets the service requirement.
  • the credential verification device 33 may process the target credential set as follows:
  • (bb) decrypt the encrypted target verification set by using the second private key corresponding to the second public key, and obtain the target user information and the target credential information; determine the target user information generated by using the target user information Whether the credential information matches the target credential information.
  • the credential verification device 33 may perform operation aa or perform operation aa and operation bb according to the information included in the acquired target credential set.
  • the credential verification device 33 may perform operation bb, where the first credential information includes the target verification set, the first credential information set, and the first credential information set.
  • the credential verification device 33 can perform this operation aa and operation bb.
  • the credential verification device 33 may perform operation aa and then perform operation bb, perform operation aa after performing operation bb, or perform operation aa and operation bb at the same time, which is not limited in this application.
  • the credential verification device 33 may send the credential verification information to the terminal device 31 .
  • the credential verification device 33 can verify the above credential content, there is no need to expose unnecessary information, and encryption algorithms are used in the process of application, generation and storage, which further ensures security.
  • the credential verification device 33 may encrypt the credential verification information and store it in the third blockchain node, and use the third blockchain node to encrypt the encrypted The credential verification information is sent to the first blockchain node of the user.
  • the credential verification device 33 can encrypt the credential verification information and store it in the corresponding credential verification device 33 storage unit (eg cloud storage) and sent to the user's terminal device.
  • each blockchain node in the blockchain jointly maintains a shared transaction ledger, and the transaction ledger can record the corresponding device of each blockchain node, the public key of the device, and various operations performed, therefore
  • An identity information processing system using blockchain technology can reduce operations such as device authentication.
  • exemplary embodiments of the present application may include a blockchain-based identity information processing system.
  • scenario diagrams of a blockchain-based distributed identity information verification system will be described with reference to FIGS. 4 to 7 .
  • the distributed identity information verification system in this scenario includes a terminal device 410, a certificate issuing device 420, a certificate verification device 430, and a blockchain system including a blockchain (only the blockchain is shown in Figure 4). ).
  • the terminal device 410 , the certificate issuing device 420 , and the certificate verification device 430 can associate and record the created digital identity information and the corresponding public key in the transaction ledger of the blockchain, wherein the transaction ledger records Such as digital identity information and the corresponding public key, digital certificate creation record information, etc.
  • the terminal device 410, the certificate issuing device 420 and the certificate verification device 430 all apply to the blockchain for their corresponding blockchain nodes.
  • the terminal device 410 corresponds to the first blockchain node
  • the credential issuing device 420 corresponds to the second blockchain node
  • the credential verification device 430 corresponds to the third blockchain node.
  • the terminal device 410 sends a credential creation request to the credential issuing device 420 according to the acquired first digital identity information of the user and the user information of the credential to be created.
  • the terminal device 410 may apply for a credential from the blockchain system using the smart contract deployed on the first blockchain node.
  • the blockchain system After receiving the credential creation request, the blockchain system sends the credential creation request to the determined credential issuing device. As shown in FIG. 4, the blockchain system may transmit the credential creation request to the second blockchain node using blockchain technology.
  • Credential issuance device 420 may obtain the first set as described above.
  • the first set may include an encrypted target verification set, a first set of credential information, and first signature information. Then, the information is encrypted with the public key recorded on the transaction bill by the terminal device and stored on the first blockchain node, and the successfully stored information is sent to the terminal device 410 .
  • the identity information processing system may also store such information in local storage or remote storage (eg, cloud storage).
  • remote storage eg, cloud storage
  • the terminal device stores the address information of the remote memory processed by the hash algorithm on the first blockchain node, thus saving the data while ensuring data security. Data storage space on the blockchain.
  • the terminal device 410 acquires the corresponding first set by using the blockchain technology after acquiring the successfully stored information.
  • target credential information required by the credential verification device 530 may be obtained.
  • the user terminal 410 may generate a target credential set according to the target credential information. Then, use the public key of the credential verification device 530 to encrypt the target credential set and store the encrypted target credential set on the second blockchain node, and send the information that the storage is successful to the credential verification device 430 .
  • the identity information processing system may also store the information in a remote storage (for example, a cloud storage), and then store the address information of these remote storages using a hash algorithm to store the information in the second block On the chain node, this saves the data storage space on the blockchain while ensuring data security.
  • a remote storage for example, a cloud storage
  • the third blockchain node corresponding to the credential verification device 430 can extract the target credential set provided by the first blockchain node, and verify the target credential set to obtain credential verification information.
  • the credential verification device 430 can encrypt the credential verification information with the public key recorded on the transaction bill by the terminal device, and then upload the encrypted credential verification information to the third blockchain node.
  • digital identity information can be presented in various ways, such as DID (Decentralized Identity), etc.
  • DID can also be called distributed digital identity.
  • Digital certificates can also be presented in various ways, such as Verifiable Claims (VC).
  • the blockchain system is a distributed system, and the distributed system can be formed by connecting multiple nodes (computing devices of any form in the access network, such as servers and user terminals) through network communication.
  • Blockchain technology is formed by multiple nodes, and a peer-to-peer (P2P, Peer To Peer) network is formed between nodes.
  • P2P peer-to-peer
  • the P2P protocol is an application layer protocol running on top of the Transmission Control Protocol (TCP, Transmission Control Protocol) protocol.
  • TCP Transmission Control Protocol
  • TCP Transmission Control Protocol
  • any machine such as server and terminal can join to become a node, and nodes include hardware layer, middle layer, operating system layer and application layer.
  • each node in the blockchain technology includes: 1) Routing, a basic function that a node has to support communication between nodes.
  • nodes can also have the following functions: 2) Blockchain, including a series of blocks (Block) that are connected to each other in the chronological order of generation. Once a new block is added to the blockchain, it will not be repeated. Removed, the block records the record data submitted by the nodes in the blockchain technology, such as transaction data.
  • each block includes the hash value of the stored data record in this block (the hash value of this block) , and the hash value of the previous block, each block is connected by the hash value to form a blockchain (Blockchain).
  • the block may also include information such as a timestamp when the block was generated.
  • Blockchain essentially a decentralized database, is a series of data blocks that are associated with cryptographic methods. Each data block contains relevant information to verify the validity of its information (anti-counterfeiting) and generate the next block.
  • Smart contracts computerized agreements that can execute the terms of a contract, are implemented through code deployed on a shared ledger for execution when certain conditions are met, and the code is used to complete automated transactions according to actual business needs, such as querying The logistics status of the goods purchased by the buyer. After the buyer signs for the goods, the buyer's virtual resources are transferred to the merchant's address; of course, the smart contract is not limited to the execution of the contract used for the transaction, but also the execution of the received information. contract.
  • FIG. 6 shows a system architecture diagram of a blockchain-based identity information processing system according to an embodiment of the present application
  • FIG. 7 shows The processing flow chart of the blockchain-based identity information processing system under the system architecture given in Figure 6 is shown.
  • the terminal 610 may indicate various devices participating in credential processing using blockchain technology, including a user terminal, a credential issuance device, and a credential verification device.
  • the terminal 610 may have programs for realizing the respective functions.
  • the programs may be in the form of one or more software development kits (SDKs).
  • SDKs software development kits
  • the procedure may include code to generate a DID, submit the DID, and send a credential application to the credential issuing device and generate the target credential set mentioned above.
  • Terminal 620 refers to a third-party device that is not directly involved in credential processing.
  • terminal 620 may indicate a device that desires to view records of credential verification.
  • the terminal 620 can acquire DID information, credential information, etc. related to the verification through the program in the interpreter 640 .
  • the interpreter 640 may also provide the terminal 620 with the storage address of the memory 630 .
  • various data generated can be stored in the blockchain node or off-chain, for example, in local storage or remote in memory.
  • the authentication-type credential information can be stored on the corresponding blockchain node, wherein the authentication-type credential information refers to the credential that only needs the judgment result after judgment according to the needs, for example, whether it is a legal citizen , whether they are married, whether they have children.
  • the terminal device stores professional credentials on non-blockchain nodes, where professional credentials refer to credentials that need to provide specific content, such as the user's ID photo, the user's fingerprint information, and the like.
  • the distributed identity information processing system based on blockchain technology can not only generate certificates, issue certificates and verify certificates, but also open the viewing function and open viewing rights to terminals that need to view the processing records of the certificate.
  • different storage methods can be determined based on the type of document.
  • step S710 the terminal device 71 , the certificate issuing device 72 and the certificate verification device 73 can apply for their respective DIDs by using an application program.
  • the user can obtain the user's DID and the corresponding public and private keys by using a DID-related application according to the information provided as needed.
  • step S720 the terminal device 71, the certificate issuing device 72 and the certificate verification device 73 use the DID and the public key to send a request for applying for a new blockchain account to the blockchain system.
  • the terminal device 71, the credential issuing device 72, and the credential verification device 73 can obtain an indication from the blockchain system that a new blockchain account number has been generated.
  • the blockchain account can be associated with each blockchain address on the blockchain system. Thereby, the terminal device 71 , the certificate issuing device 72 and the certificate verification device 73 can obtain the corresponding blockchain nodes.
  • the terminal device 71 may use the first blockchain node to send a request for a certificate to the blockchain system.
  • the first blockchain node may use the pre-arranged first smart contract to issue a request for a credential.
  • the blockchain system can notify the second blockchain node of the credential issuing device 72 .
  • the credential issuing device 72 may collect the required user information according to the credential requested by the user.
  • the user information provided by the first blockchain node can be obtained by using the blockchain technology as required.
  • the terminal device 71 can obtain the public key corresponding to the certificate issuing device 72, and then encrypt the user information with the public key and provide it to the blockchain using the first blockchain node.
  • the certificate issuing device 72 can obtain the encrypted user information provided by the first blockchain node, and then decrypt the user information by using the private key of the certificate issuing device 72 to obtain the user information. Additionally, in implementations, the credential issuing device 72 may also obtain such user information using off-chain addresses stored on the blockchain.
  • the credential issuing device 72 may acquire the first set using the acquired user information according to the steps described above.
  • the obtained first set may be encrypted using the public key of the terminal device 71, and the encrypted first set may be uploaded to the blockchain by using the first blockchain node, or stored outside the chain.
  • the first set may be encrypted and stored on off-chain memory 74 .
  • the off-chain storage 74 may indicate the local storage of each terminal, and may also indicate the remote storage (for example, cloud storage) of each terminal, which is not limited in this application.
  • the terminal device 71 may use the first blockchain node to obtain the first set provided by the second blockchain node, or may obtain the first set provided by the second blockchain node, or may The storage address of the memory 74 obtains the first set stored in the off-chain memory 74 .
  • the terminal device 71 may determine the target credential set according to the credential required to be verified from the credential verification device in step S760.
  • the determined target credential set may be encrypted using the public key of the credential verification device 73 and stored on the blockchain using the third blockchain node, or stored off-chain, as shown in FIG. 7 , stored off-chain on memory 74.
  • the off-chain storage 74 may indicate the local storage of each terminal, and may also indicate the remote storage (for example, cloud storage) of each terminal, which is not limited in this application.
  • the blockchain system may notify the credential verification device to perform step S770 to obtain the target credential set. And follow the above steps to generate credential verification information based on the target credential set. And the certificate verification information is stored in the blockchain system according to the above steps.
  • the identity information processing device may include corresponding hardware structures and/or software modules for executing each function.
  • the embodiments of the present application can be implemented in hardware or a combination of hardware and computer software. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Experts may use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of the embodiments of the present application.
  • each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware, and can also be implemented in the form of software function modules. It should be noted that, the division of modules in the embodiments of the present application is schematic, and is only a logical function division, and there may be other division manners in actual implementation.
  • FIG. 8 shows a possible schematic structural diagram of the identity information processing device involved in the above embodiment.
  • the identity information processing device 800 may include a set acquisition unit 810, a target verification set determination unit 820, and a target verification set providing unit 830.
  • the set obtaining unit 810 is configured to obtain a first set corresponding to a plurality of first user information from the certificate issuing device, wherein the first set includes a first encrypted information set and a first credential information set, the first encrypted information
  • the collection includes a plurality of first encrypted information correspondingly encrypted for the plurality of first user information
  • the first credential information collection includes a plurality of first vouchers after the issuance process is performed on the plurality of first user information information.
  • the target verification set determining unit 820 is configured to determine a target verification set corresponding to the target user information of the user based on the first encryption information set and the first credential information set in the first set, wherein the target verification set Including target user information in the plurality of first user information and target credential information corresponding to the target user information in the plurality of first credential information.
  • the verification set providing unit 830 may be configured to provide the target verification set to the credential verification device.
  • the set obtaining unit 810 is further configured to obtain a second set corresponding to a plurality of second user information, wherein the second set includes a second encrypted information set and a second credential information set, the first The second encrypted information set includes a plurality of second encrypted information correspondingly encrypted by the plurality of second user information, and the second credential information set includes a plurality of second encrypted information obtained by performing the issuance process on the plurality of second user information.
  • Credential information is further configured to obtain a second set corresponding to a plurality of second user information, wherein the second set includes a second encrypted information set and a second credential information set, the first The second encrypted information set includes a plurality of second encrypted information correspondingly encrypted by the plurality of second user information, and the second credential information set includes a plurality of second encrypted information obtained by performing the issuance process on the plurality of second user information.
  • the verification set determining unit 830 is further configured to determine a target verification set corresponding to the target user information of the user based on the second encryption information set and the second credential information set in the second set, wherein , the target verification set includes the target user information and target credential information corresponding to the target user information, wherein the target verification set includes: target user information in the plurality of second user information and the target user information Target credential information corresponding to the target user information among the plurality of second credential information.
  • the verification set determining unit 830 is further configured to be based on the first encrypted information set and the first credential information set in the first set and the second encrypted information set and the second credential in the second set an information set, determining a target verification set corresponding to the target user information of the user, wherein the target verification set includes: target user information in the plurality of first user information and the plurality of second user information, and Target credential information corresponding to the target user information in the plurality of first credential information and the plurality of second credential information.
  • the identity information processing apparatus may indicate the identity information processing apparatus 900 described in FIG. 9 .
  • the identity information verification device may include a receiving device 910 , a target verification set acquisition unit 920 and a credential verification information providing unit 930 .
  • the receiving unit 910 is used for receiving a service request.
  • the target verification set obtaining unit 920 is configured to obtain a target verification set from the terminal device, wherein the target verification set includes target user information and target credential information corresponding to the service.
  • the credential verification information providing unit 930 is configured to verify the target verification set, and provide credential verification information to the terminal device, wherein the credential verification information is used to indicate whether the target verification set passes the verification.
  • the identity information processing apparatus may indicate the identity information processing apparatus 1000 described in FIG. 10 .
  • the identity information processing apparatus 1000 may include a set determining unit 1010 and a set providing unit 1020 .
  • the set determining unit 1010 is configured to determine a first set corresponding to a plurality of first user information, wherein the first set includes a first encrypted information set and a first credential information set, and the first encrypted information set includes The plurality of first encrypted information corresponding to the plurality of first user information are encrypted, and the first credential information set includes a plurality of first credential information obtained by performing issuance processing on the plurality of first user information.
  • the set providing unit 1020 provides the first set to the terminal device.
  • the identity information processing system of the exemplary embodiment of the present application may include the identity information processing apparatus 800 shown in FIG. 8 , the identity information processing apparatus 900 shown in FIG. 9 , and the identity information processing apparatus shown in FIG. 10 . 1000.
  • the identity information processing device 800 and its corresponding first blockchain node, the identity information processing device 900 and its corresponding second blockchain node, and/or the identity information processing device 1000 and The corresponding third blockchain node can all use the computing device as shown in FIG. 11 .
  • Computing device 1100 typically includes system memory 206 and one or more processors 204 .
  • Memory bus 208 may be used for communication between processor 204 and system memory 206 .
  • the processor 204 may be any type of process including, but not limited to, a microprocessor ( ⁇ P), a microcontroller ( ⁇ C), a digital information processor (DSP), or any combination thereof.
  • Processor 204 may include one or more levels of cache, such as L1 cache 210 and L2 cache 212 , processor core 214 , and registers 216 .
  • Exemplary processor cores 214 may include arithmetic logic units (ALUs), floating point units (FPUs), digital signal processing cores (DSP cores), or any combination thereof.
  • the example memory controller 218 may be used with the processor 204 , or in some implementations, the memory controller 218 may be an internal part of the processor 204 .
  • the processor 210 may run the identity information processing device provided by the embodiments of the present application, so that the user can participate in customizing a digital certificate matching a specific scenario, thereby avoiding privacy leakage.
  • the processor 210 may include different devices. For example, when a CPU and a GPU are integrated, the CPU and the GPU may cooperate to execute the identity information processing method provided by the embodiments of the present application. For example, some algorithms in the identity information processing method are executed by the CPU, and another part of the algorithms are executed by GPU execution for faster processing efficiency.
  • system memory 206 may be any type of memory including, but not limited to, volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof.
  • System memory 206 may include an operating system 220 , one or more programs 222 , and program data 224 .
  • programs 222 may be arranged to execute instructions on an operating system by one or more processors 204 using program data 224 .
  • the program 222 may include: the terminal device obtains and obtains multiple data from the certificate issuing device.
  • a first set corresponding to the first user information wherein the first set includes a first encrypted information set and a first credential information set, and the first encrypted information set includes mapping the plurality of first user information Encrypted multiple pieces of first encrypted information, the first credential information set includes multiple pieces of first credential information after issuing processing for the multiple first user information; the terminal device is based on the first set of information.
  • the first encryption information set and the first credential information set are determined, and the target verification set corresponding to the target user information of the user is determined, wherein the target verification set includes the target user information in the plurality of first user information and Target credential information corresponding to the target user information in the plurality of first credential information; the terminal device provides the credential verification device with the target verification set.
  • the program 222 may include: the credential verification device receives a service request; the credential verification device obtains a target verification set from the terminal device, wherein the target verification set includes the target user information and target credential information corresponding to the service; the credential verification device verifies the target verification set, and provides credential verification information to the terminal device, wherein the credential verification information is used to indicate the target verification set Whether to pass the verification.
  • the procedure 222 may include the credential issuance device determining a first set corresponding to the plurality of first user information, wherein the first set includes A first encrypted information set and a first credential information set, the first encrypted information set includes a plurality of first encrypted information corresponding to the plurality of first user information, and the first credential information set includes The plurality of first user information executes the plurality of first credential information after the issuance process; the credential issuing device provides the terminal device with the first set.
  • the type of the storage device 232 is not limited in this application.
  • the storage device 232 may be a storage area network device, or a storage device including a file system, such as a network-attached storage (Network Attached Storage). Attached Storage NAS) device.
  • Network Attached Storage Network Attached Storage
  • Attached Storage NAS Attached Storage
  • storage device 232 may include removable memory 232 and non-removable memory 238 .
  • the storage unit mentioned in this application refers to storage space distributed on a hard disk as a non-removable memory, wherein the hard disk may refer to various types of hard disks, such as Solid State Drive (SSD) or serial connection SCSI (Serial Attached SCSI, SAS) or Fibre Channel (Fiber Channel, FC) hard disk drive (Hard Disk Drive, HDD), where SCSI (Small Computer System Interface) is a small computer system interface, etc.,
  • SSD Solid State Drive
  • SAS Serial Attached SCSI
  • FC Fibre Channel
  • HDD Hard Disk Drive
  • the storage unit may indicate a piece of logical storage space distributed on the hard disk, that is, a logical unit (Logic Unit, LU), and the logical unit number (Logic Unit Number, LUN) Used to identify a logical unit that is SCSI addressable.
  • a storage device may partition a physical hard disk, and each partition may be accessed by a host as a storage unit (ie, a LUN) with a logical address.
  • Computing device 200 may also include an interface bus 240 that facilitates communication from various interface devices (eg, output device 242 , peripheral interface 244 , and communication device 246 ) to the base configuration via bus/interface controller 230 .
  • Example output devices 242 include graphics processing unit 248 and audio processing unit 250 . They may be configured to facilitate communication via one or more A/V ports 252 with various external devices such as displays or speakers.
  • Output device 242 may be a display for displaying images, video, and the like.
  • the display includes a display panel.
  • the display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (active-matrix organic light).
  • LED organic light-emitting diode
  • AMOLED organic light-emitting diode
  • FLED flexible light-emitting diode
  • Miniled MicroLed, Micro-oLed, quantum dot light-emitting diode (quantum dot light emitting diodes, QLED) and so on.
  • the display may include 1 or N display screens, where N is a positive integer greater than 1.
  • the display can be used to display information entered by or provided to the user as well as various graphical user interfaces (GUIs).
  • GUIs graphical user interfaces
  • the display may display photos, videos, web pages, or documents, and the like.
  • the display may display a graphical user interface.
  • the GUI includes a status bar, a hideable navigation bar, a time and weather widget, and an application icon, such as a browser icon.
  • the status bar includes operator name (eg China Mobile), mobile network (eg 4G), time and remaining battery.
  • the navigation bar includes a back button icon, a home button icon, and a forward button icon.
  • the status bar may further include a Bluetooth icon, a Wi-Fi icon, an external device icon, and the like.
  • the graphical user interface may further include a Dock bar, and the Dock bar may include commonly used application icons and the like.
  • the processor 210 detects a touch event of a user's finger (or a stylus, etc.) on an application icon, in response to the touch event, the processor 210 opens the user interface of the application corresponding to the application icon, and displays the user interface on the display.
  • the user interface of the application may display an electronic form to be filled by the user, wherein various user information may be included in the electronic form.
  • the display may be an integrated flexible display screen, or a spliced display screen composed of two rigid screens and a flexible screen located between the two rigid screens.
  • Example peripheral interfaces 244 may include serial interface controller 254 and parallel interface controller 256, which may be configured to facilitate communication via one or more I/O ports 258 and input devices such as keyboard, mouse, pen, etc. , voice input devices, touch input devices) or other peripherals (eg printers, scanners, etc.)
  • the example communication device 246 may include a network controller 260 that may be arranged to facilitate communication via one or more communication ports 264 with one or more other computing devices 262 over a network communication link.
  • a network communication link may be one example of a communication medium.
  • Communication media may typically embody computer readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.
  • a "modulated data signal" can be a signal of which one or more of its data sets or whose alterations can be made in such a way as to encode information in the signal.
  • communication media may include wired media, such as wired or leased line networks, and various wireless media, such as acoustic, radio frequency (RF), microwave, infrared (IR), or other wireless media.
  • RF radio frequency
  • IR infrared
  • the term computer readable medium as used herein may include both storage media and communication media.
  • Computing device 1100 can be implemented as a server, such as a file server, database server, application server, and WEB server, etc., or as part of a small-sized portable (or mobile) electronic device such as a cellular phone, a personal digital Assistants (PDAs), personal media player devices, wireless web browsing devices, personal headsets, application specific devices, or hybrid devices that may include any of the above.
  • Computing device 200 may also be implemented as a personal computer including desktop computer and notebook computer configurations.
  • the computing device 1100 may include more or less components than those shown in FIG. 11 , which are not limited in this embodiment of the present application.
  • the illustrated computing device 1100 is merely an example, and the computing device 1100 may have more or fewer components than shown, two or more components may be combined, or a different configuration of components may be present.
  • the various components shown in the figures may be implemented in hardware, software, or a combination of hardware and software, including one or more signal processing and/or application specific integrated circuits.
  • An embodiment of the present application provides an identity information processing device, including: a processor and a memory for storing instructions executable by the processor; wherein the processor is configured to implement the above method when executing the instructions.
  • Embodiments of the present application provide a non-volatile computer-readable storage medium on which computer program instructions are stored, and when the computer program instructions are executed by a processor, implement the above method.
  • Embodiments of the present application provide a computer program product, including computer-readable codes, or a non-volatile computer-readable storage medium carrying computer-readable codes, when the computer-readable codes are stored in a processor of an electronic device When running in the electronic device, the processor in the electronic device executes the above method.
  • a computer-readable storage medium may be a tangible device that can hold and store instructions for use by the instruction execution device.
  • the computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing.
  • Computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (Electrically Programmable Read-Only-Memory, EPROM or flash memory), static random access memory (Static Random-Access Memory, SRAM), portable compact disk read-only memory (Compact Disc Read-Only Memory, CD - ROM), Digital Video Disc (DVD), memory sticks, floppy disks, mechanically encoded devices, such as punch cards or raised structures in grooves on which instructions are stored, and any suitable combination of the foregoing .
  • RAM random access memory
  • ROM read only memory
  • EPROM erasable programmable read-only memory
  • EPROM Errically Programmable Read-Only-Memory
  • SRAM static random access memory
  • portable compact disk read-only memory Compact Disc Read-Only Memory
  • CD - ROM Compact Disc Read-Only Memory
  • DVD Digital Video Disc
  • memory sticks floppy disks
  • Computer readable program instructions or code described herein may be downloaded to various computing/processing devices from a computer readable storage medium, or to an external computer or external storage device over a network such as the Internet, a local area network, a wide area network and/or a wireless network.
  • the network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and/or edge servers.
  • a network adapter card or network interface in each computing/processing device receives computer-readable program instructions from a network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in each computing/processing device .
  • the computer program instructions used to perform the operations of the present application may be assembly instructions, Instruction Set Architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or in one or more source or object code written in any combination of programming languages, including object-oriented programming languages such as Smalltalk, C++, etc., and conventional procedural programming languages such as the "C" language or similar programming languages.
  • the computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server implement.
  • the remote computer may be connected to the user's computer through any kind of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or, may be connected to an external computer (eg, use an internet service provider to connect via the internet).
  • electronic circuits such as programmable logic circuits, Field-Programmable Gate Arrays (FPGA), or Programmable Logic Arrays (Programmable Logic Arrays), are personalized by utilizing state information of computer-readable program instructions.
  • Logic Array, PLA the electronic circuit can execute computer readable program instructions to implement various aspects of the present application.
  • These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer or other programmable data processing apparatus to produce a machine that causes the instructions when executed by the processor of the computer or other programmable data processing apparatus , resulting in means for implementing the functions/acts specified in one or more blocks of the flowchart and/or block diagrams.
  • These computer readable program instructions can also be stored in a computer readable storage medium, these instructions cause a computer, programmable data processing apparatus and/or other equipment to operate in a specific manner, so that the computer readable medium on which the instructions are stored includes An article of manufacture comprising instructions for implementing various aspects of the functions/acts specified in one or more blocks of the flowchart and/or block diagrams.
  • Computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other equipment to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other equipment to produce a computer-implemented process , thereby causing instructions executing on a computer, other programmable data processing apparatus, or other device to implement the functions/acts specified in one or more blocks of the flowcharts and/or block diagrams.
  • each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more functions for implementing the specified logical function(s) executable instructions.
  • the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved.
  • each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations can be implemented in hardware (eg, circuits or ASICs (Application) that perform the corresponding functions or actions. Specific Integrated Circuit, application-specific integrated circuit)), or can be implemented by a combination of hardware and software, such as firmware.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Business, Economics & Management (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • Bioethics (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Development Economics (AREA)
  • Finance (AREA)
  • Accounting & Taxation (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Databases & Information Systems (AREA)
  • Tourism & Hospitality (AREA)
  • Human Resources & Organizations (AREA)
  • Primary Health Care (AREA)
  • Data Mining & Analysis (AREA)
  • Educational Administration (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Storage Device Security (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本申请涉及一种身份信息处理方法、设备及系统，所述方法包括：终端设备从凭证签发设备获取与多个第一用户信息对应的第一加密信息集合和第一凭证信息集合，所述第一加密信息集合包括对所述多个第一用户信息进行对应加密后的多个第一加密信息，所述第一凭证信息集合包括对所述多个第一用户信息执行签发处理后的多个第一凭证信息；所述终端设备基于所述第一集合中的第一加密信息集合和第一凭证信息集合，确定与所述用户的目标用户信息对应的目标凭证信息和目标用户信息作为目标验证集合，所述终端设备向所述凭证验证设备提供所述目标验证集合。采用本申请，能够由用户参与定制与特定场景匹配的数字凭证。

Description

身份信息处理方法、设备及系统
本申请要求于2021年01月26日提交中国专利局、申请号为202110106249.0、发明名称为“身份信息处理方法、设备及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，尤其涉及一种身份信息处理方法、设备及系统。
背景技术
数字身份是指通过数据来标识实体(例如，用户或物品)。特别针对用户而言，数字身份的出现，正深刻改变着经济社会的发展动力和发展方式。与传统身份相比，数字身份将大幅度提高社会效率，最大化地释放用户价值，使得政府机构、服务提供方、用户等各方均可从中受益。
目前，相关技术可采用集中式身份信息验证系统对用户的数字身份信息进行验证。在该系统中，身份提供商(Identity Provider，IDP)在用户满足签发条件的情况下，利用用户信息生成与该用户匹配的数字凭证，并将该数字凭证分发给用户，在服务提供方需要对该用户的身份进行验证时，可向IDP申请对该数字凭证执行验证。在实施中，服务提供方所获取的数字凭证对应的用户信息中的部分用户信息对于用户而言可能是隐私(比如，是否婚否，学历情况)并且不希望被暴露给无关人员。
发明内容
有鉴于此，提出了一种身份信息处理方法、设备及系统，能够由用户参与定制与特定场景匹配的数字凭证，从而避免了隐私泄露。
第一方面，本申请的实施例提供了一种身份信息处理方法，所述方法包括：终端设备从凭证签发设备获取与多个第一用户信息对应的第一集合，其中，所述第一集合包括第一加密信息集合和第一凭证信息集合，所述第一加密信息集合包括对所述多个第一用户信息进行对应加密后的多个第一加密信息，所述第一凭证信息集合包括对所述多个第一用户信息执行签发处理后的多个第一凭证信息；所述终端设备基于所述第一集合中的第一加密信息集合和第一凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括所述多个第一用户信息中的目标用户信息以及所述多个第一凭证信息中与所述目标用户信息对应的目标凭证信息；所述终端设备向所述凭证验证设备提供所述目标验证集合。
在相关技术中，分布式身份信息验证系统的数字凭证通常针对每个数字身份提供的多个身份信息进行的声明并且针对整个数字凭证进行加密，无法做到针对每个身份信息分别签发，且用户无法对数据凭证进行处理，例如，仅选择数字凭证中的某些属性声明，这样就限制了用户的使用场景，此外，该数字凭证需要用户自己存储，容易丢失。
基于以上情况，所述终端设备从凭证签发设备获取到第一集合后，利用第一集合中的部分信息生成目标验证集合，不但使终端设备能够参与定制目标验证集合，而且所述目标验证集合对应于实际需求，从而有效保护用户隐私。
在第一方面的一种可能的实现方式中，所述终端设备从凭证签发设备获取与所述多个第 一用户信息对应的第一集合，包括：所述终端设备利用与所述终端设备对应的第一区块链节点，获取与凭证签发设备对应的第二区块链节点提供的所述第一集合。
在相关技术中，分布式身份系统可分别生成各自的去中心化身份信息后，利用彼此之间的公私钥进行加密/解密，而区块链技术本身就是去中心化而且区块链技术的信息是不可篡改，因此，本申请的实施例可利用区块链技术处理各个终端的相关数据和存储相关数据。
在第一方面的一种可能的实现方式中，所述终端设备从凭证签发设备获取与所述多个第一用户信息对应的第一集合，包括：所述终端设备提出数据请求；所述凭证签发设备将从本地或者云存储获取所述第一集合来响应所述终端设备提出的所述数据请求。
在实施中，分布式身份系统上的很多终端可能并没有使用区块链技术，因为可将获取的这些数据(第一集合)存储在非区块链节点上，例如，云存储器，这样可适用于更多的终端设备。
在第一方面的一种可能的实现方式中，所述方法还包括：所述终端设备获取与多个第二用户信息对应的第二集合，其中，所述第二集合包括第二加密信息集合和第二凭证信息集合，所述第二加密信息集合包括所述多个第二用户信息进行对应加密后的多个第二加密信息，所述第二凭证信息集合包括对所述多个第二用户信息执行签发处理后的多个第二凭证信息。
在实施中，所述终端设备可在获取到第一集合外还可获取到更多的集合，以便于后续根据业务需求，选择适合的集合。
在第一方面的一种可能的实现方式中，所述方法还包括：所述终端设备基于所述第二集合中的第二加密信息集合和第二凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括所述目标用户信息和与所述目标用户信息对应的目标凭证信息，其中，所述目标验证集合包括：所述多个第二用户信息中的目标用户信息以及所述多个第二凭证信息中与所述目标用户信息对应的目标凭证信息。
所述终端设备可在获取到凭证签发设备发送的第一集合/第二集合后，根据需要选择部分或全部第一用户信息或第二用户信息提供给凭证验证终端，不仅提高了安全性并且能够适应更多的业务场景。
在第一方面的一种可能的实现方式中，所述终端设备基于所述第一集合中的第一加密信息集合和第一凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，包括：所述终端设备基于所述第一集合中的第一加密信息集合和第一凭证信息集合以及所述第二集合中的第二加密信息集合和第二凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括：所述多个第一用户信息和所述多个第二用户信息中的目标用户信息以及所述多个第一凭证信息和所述多个第二凭证信息中与所述目标用户信息对应的目标凭证信息。
在实施中，所述终端设备可在获取到凭证签发设备发送的第一集合和第二集合后，根据需要，从第一用户信息和第二用户信息中选择部分信息作为数字凭证的凭证内容，不仅提高了安全性并且能够适应更多的业务场景。
在第一方面的一种可能的实现方式中，所述第一集合还包括所述凭证签发设备对所述多个第一凭证信息进行集体签名后获取的第一签名信息。
在实施中，所述凭证签发终端为了使凭证验证终端能够对验证主体进行验证，可在第一集合中包括第一签名信息。
在第一方面的一种可能的实现方式中，所述终端设备在向所述凭证验证设备提供所述目标验证集合后，还包括：所述终端设备向所述凭证验证设备提供所述第一凭证信息集合以及所述第一签名信息。
采用以上方式，所述凭证验证终端可通过利用第一凭证信息集合对所述第一签名信息执行验签操作，确定所述第一凭证信息集合的凭证签发设备是否为目标凭证签发设备。
第二方面，本申请的实施例提供了一种身份信息处理方法，所述包括：凭证验证设备接收服务请求；所述凭证验证设备从终端设备获取目标验证集合，其中，所述目标验证集合包括与服务对应的目标用户信息和目标凭证信息；所述凭证验证设备对所述目标验证集合进行验证，向所述终端设备提供凭证验证信息，其中，所述凭证验证信息用于指示所述目标验证集合是否通过验证。
采用以上方式，所述凭证验证设备可仅获取所需验证的凭证内容并对该凭证内容进行验证，不仅有效避免了用户信息的泄露而且减少了凭证验证终端的工作量。
在第二方面的一种可能的实现方式中，所述方法还包括：所述凭证验证设备从所述终端设备获取第一凭证信息集合和第一签名信息，其中，第一凭证信息集合是包括多个第一凭证信息，第一签名信息是对所述多个第一凭证信息进行集体签名后获取的信息。
在实施中，所述凭证验证设备还可通过利用第一凭证信息集合对所述第一签名信息执行验签操作，确定所述第一凭证信息集合的凭证签发设备是否为目标凭证签发设备。
第三方面，本申请的实施例提供一种终端设备，包括：集合获取单元，用于从凭证签发设备获取与多个第一用户信息对应的第一集合，其中，所述第一集合包括第一加密信息集合和第一凭证信息集合，所述第一加密信息集合包括对所述多个第一用户信息进行对应加密后的多个第一加密信息，所述第一凭证信息集合包括对所述多个第一用户信息执行签发处理后的多个第一凭证信息；目标验证集合确定单元，用于基于所述第一集合中的第一加密信息集合和第一凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括所述多个第一用户信息中的目标用户信息以及所述多个第一凭证信息中与所述目标用户信息对应的目标凭证信息；目标验证集合提供单元，用于向所述凭证验证设备提供所述目标验证集合。
在第三方面的一种可能的实现方式中，所述集合获取单元还用于获取与多个第二用户信息对应的第二集合，其中，所述第二集合包括第二加密信息集合和第二凭证信息集合，所述第二加密信息集合包括所述多个第二用户信息进行对应加密后的多个第二加密信息，所述第二凭证信息集合包括对所述多个第二用户信息执行签发处理后的多个第二凭证信息。
在第三方面的一种可能的实现方式中，所述验证集合确定单元还用于基于所述第二集合中的第二加密信息集合和第二凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括所述目标用户信息和与所述目标用户信息对应的目标凭证信息，其中，所述目标验证集合包括：所述多个第二用户信息中的目标用户信息以及所述多个第二凭证信息中与所述目标用户信息对应的目标凭证信息。
在第三方面的一种可能的实现方式中，所述验证集合确定单元还用于基于所述第一集合中的第一加密信息集合和第一凭证信息集合以及所述第二集合中的第二加密信息集合和第二凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括：所述多个第一用户信息和所述多个第二用户信息中的目标用户信息以及所述多个 第一凭证信息和所述多个第二凭证信息中与所述目标用户信息对应的目标凭证信息。
第四方面，本申请的实施例提供一种凭证验证设备，包括：接收单元，用于接收服务请求；目标验证集合获取单元，用于从所述终端设备获取目标验证集合，其中，所述目标验证集合包括与服务对应的目标用户信息和目标凭证信息；凭证验证信息提供单元，用于对所述目标验证集合进行验证，向所述终端设备提供凭证验证信息，其中，所述凭证验证信息用于指示所述目标验证集合是否通过验证。
第四方面，本申请的实施例提供一种身份信息验证设备，包括：处理器；用于存储处理器可执行指令的存储器；其中，所述处理器被配置为执行所述指令时第一方面的任一种可能的实现方式中的方法，或者第一方面的任一种可能的实现方式中的方法。
第五方面，本申请实施例提供一种非易失性计算机可读存储介质，其上存储有计算机程序指令，所述计算机程序指令被处理器执行时实现第一方面的任一种可能的实现方式中的方法，或者第一方面的任一种可能的实现方式中的方法。
第六方面，本申请实施例提供一种计算机程序产品，所述计算机程序产品包括指令，所述指令用于指示服务器执行第一方面的任一种可能的实现方式中的方法的步骤，或者第一方面的任一种可能的实现方式中的方法的步骤。
第七方面，本申请的实施例提供了一种身份信息处理方法，所述方法由用户的终端设备执行，所述方法包括：从凭证签发设备获取利用多个第一用户信息生成的第一集合，其中，所述第一集合包括第一加密信息集合、第一凭证信息集合以及第一签名信息，其中，所述第一加密信息集合包括利用第一公钥对所述多个第一用户信息进行加密的多个第一加密信息，所述第一凭证信息集合包括对所述多个第一用户信息执行盲化处理后的多个第一凭证信息，第一签名信息是对所述多个第一凭证信息进行集体签名后获取的信息；利用所述第一集合，生成与目标用户信息对应的目标验证集合，其中，所述目标用户信息指示凭证验证设备请求的信息。向所述凭证验证设备提供所述目标验证集合。
在相关技术中，分布式身份信息验证系统的数字凭证通常针对每个数字身份提供的多个身份信息进行的声明并且针对整个数字凭证进行加密，无法做到针对每个身份信息分别签发，且用户无法对数据凭证进行处理，例如，仅选择数字凭证中的某些属性声明，这样就限制了用户的使用场景，此外，该数字凭证需要用户自己存储，容易丢失。
基于以上情况，所述方法可利用凭证签发设备对全部的身份信息进行整体签发的情况下，对每个身份信息分别进行盲化处理，从而保证所述第一集合在签发主体与签发内容上均满足签发需要。随后，所述终端设备从凭证签发设备获取到第一集合后，参与定制与目标用户信息对应的目标验证集合，使得终端用户能够根据实际需求参与数字凭证的生成。
在第七方面的一种可能的实现方式中，从凭证签发设备获取利用所述多个第一用户信息生成的第一集合，包括：利用与所述终端设备对应的第一区块链节点，从与凭证签发设备对应的第二区块链节点上获取所述第一集合。
在相关技术中，分布式身份系统可分别生成各自的去中心化身份信息后，利用彼此之间的公私钥进行加密/解密，而区块链技术本身就是去中心化而且区块链技术的信息是不可篡改，因此，本申请的实施例可利用区块链技术处理各个终端的相关数据并存储在各个终端对应的区块链节点上。
在第七方面的一种可能的实现方式中，从凭证签发设备获取利用所述多个第一用户信息 生成的第一集合，包括：向所述凭证签发设备对应的签发端存储单元发送针对第一集合的数据请求；从所述签发端存储单元接收所述第一集合。
在实施中，分布式身份系统上的很多终端可能并没有使用区块链技术，因为可将获取的这些数据(第一集合)存储在非区块链节点上，例如，云存储器，这样可适用于更多的终端设备。
在第七方面的一种可能的实现方式中，利用所述第一集合，生成与目标用户信息对应的目标验证集合，包括：利用与第一公钥对应的第一私钥对所述多个第一加密凭证执行解密，获取所述多个第一用户信息；利用所述多个第一用户信息，确定所述目标用户信息；利用所述多个第一用户信息与所述多个第一凭证信息的对应关系，确定与所述目标用户信息对应的目标凭证信息；将所述目标用户信息以及所述目标凭证信息确定为目标验证集合。
在实施中，所述终端设备可根据目标用户信息，在多个第一用户信息中选择与该目标用户信息对应的第一凭证信息，实现了生成仅与所述目标用户信息对应的目标凭证信息。采用本实施例，可利用终端设备的能动性，避免泄露无关信息。
在第七方面的一种可能的实现方式中，利用所述第一集合，生成与目标用户信息对应的目标验证集合后，还包括：获取与用户对应的多个第二用户信息；获取利用所述多个第二用户信息生成的第二集合，其中，所述第二集合包括第二加密信息集合、第二凭证信息集合以及第二签名信息，其中，所述第二加密信息集合包括利用第三公钥对所述多个第二用户信息进行加密的多个第二加密信息，所述第二凭证信息集合包括对所述多个第二用户信息执行盲化处理后的多个第二凭证信息，第二签名信息是对所述多个第二凭证信息进行集体签名后获取的信息。
在实施中，所述终端设备还可获取凭证签发设备根据多个第二用户信息生成的第二集合，也就说，针对多个第二用户信息，所述方法可利用凭证签发设备对全部的身份信息进行整体签发的情况下，对每个身份信息分别进行盲化处理，从而保证所述第一集合在签发主体与签发内容上均满足签发需要。随后，所述终端设备从凭证签发设备获取到第二集合后，参与定制与目标用户信息对应的第二验证集合。
在实施中，对所述多个第二用户信息进行集体签发的凭证签发设备可以是与对所述多个第一用户信息进行集体签发的凭证签发设备相同的签发端，也可以是不同的签发端，这将大大增加终端设备的使用场景。
在第七方面的一种可能的实现方式中，利用所述第一集合，生成与目标用户信息对应的目标验证集合，包括：利用与第一公钥对应的第一私钥对所述多个第一加密凭证或所述第三公钥对应的第三私钥对所述多个第二加密凭证执行解密，获取所述多个第一用户信息或所述多个第二用户信息；利用所述多个第一用户信息或所述多个第二用户信息，确定所述目标用户信息；利用所述多个第一用户信息与所述多个第一凭证信息的对应关系或利用所述多个第二用户信息与所述多个第二凭证信息的对应关系，确定与所述目标用户信息对应的目标凭证信息；将所述目标用户信息以及所述目标凭证信息确定为目标验证集合。
在实施中，所述终端设备可在获取到凭证签发设备发送的第一集合/第二集合后，根据需要选择部分或全部第一用户信息或第二用户信息提供给凭证验证终端，不仅提高了安全性并且能够适应更多的业务场景。
在第七方面的一种可能的实现方式中，利用所述第一集合，生成与目标用户信息对应的 目标验证集合，包括：利用与第一公钥对应的第一私钥对所述多个第一加密凭证和利用于第三公钥对应的第三私钥对所述多个第二加密凭证执行解密，获取所述多个第一用户信息和所述多个第二用户信息；利用所述多个第一用户信息和所述多个第二用户信息，确定所述目标用户信息；利用所述多个第一用户信息与所述多个第一凭证信息的对应关系和利用所述多个第二用户信息与所述多个第二凭证信息的对应关系，确定与所述目标用户信息对应的目标凭证信息；将所述目标用户信息以及所述目标凭证信息确定为目标验证集合。
在实施中，所述终端设备可在获取到凭证签发设备发送的第一集合/第二集合后，根据需要，从第一用户信息和第二用户信息中选择部分信息作为数字凭证的凭证内容，不仅提高了安全性并且能够适应更多的业务场景。
在第七方面的一种可能的实现方式中，所述方法还包括：利用所述凭证签发设备提供的第二公钥对所述目标验证集合执行加密，生成加密的目标验证集合。将所述加密的目标验证集合、第一凭证信息集合以及第一签名信息确定为目标凭证集合。
通过公私钥体系对凭证签发设备签发的内容进行加密，从而提高保密性。更进一步地，为了保证凭证验证设备执行验证，可利用所述加密的目标验证集合、第一凭证信息集合以及第一签名信息确定目标凭证集合。
在第七方面的一种可能的实现方式中，所述方法还包括：对所述多个第一用户信息进行加密并将加密后的所述多个用户信息存储在所述第一区块链节点上。
在实施中，使用区块链技术实现对用户信息的存储，不仅保证了数据的有效性，而且避免了大量验证操作。
在第七方面的一种可能的实现方式中，所述方法还包括：调用所述第一区块链节点的第一智能合约，向凭证签发设备对应的第二区块链节点发送凭证签发请求。
在实施中，可利用区块链技术中的智能合约完成各种操作，并且无需在身份文档中保存过多的签名信息，减少了大量的验证操作。
在第七方面的一种可能的实现方式中，所述方法还包括：将目标凭证集合存储在所述第一区块链节点，使得所述凭证验证设备对应的第三区块链节点从第一区块链节点获取所述目标凭证集合。
在实施中，使用区块链技术实现对用户信息的存储，不仅保证了数据的有效性，而且避免了大量验证操作。
第八方面，本申请的实施例提供了一种身份信息处理方法，所述方法由凭证验证设备执行，包括：响应于接收到来自用户的终端设备的服务请求，从所述终端设备获取与所述服务请求中的目标用户信息对应的目标凭证集合，其中，所述目标凭证集合包括加密的目标验证集合、第一凭证信息集合以及第一签名信息，其中，目标验证集合包括目标用户信息和目标凭证信息，所述加密的目标验证集合包括利用第二公钥对所述目标验证集合执行加密后获取的集合，第一凭证信息集合是包括利用第一公钥对用户的多个用户信息进行加密的多个第一加密信息，第一签名信息是对所述多个第一凭证信息进行集体签名后获取的信息；向所述终端设备提供所述凭证验证信息。
在实施中，所述凭证验证设备可仅对终端设备发送的目标凭证集合进行验证，所述目标凭证集合不仅包括用于验证凭证签发设备的信息(多个第一凭证信息进行集体签名的凭证签发设备信息和对多个第一用户信息进行加密的多个第一加密信息)以及用于验证凭证内容的 信息(目标验证集合)，从而满足凭证验证设备的验证需要。
在第八方面的一种可能的实现方式中，所述方法还包括：基于所述目标凭证集合，确定针对所述用户的凭证验证信息。
在实施中，所述凭证验证设备可根据以上提到的目标凭证集合，实现对用户的凭证验证操作，从而确定凭证验证信息。
在第八方面的一种可能的实现方式中，所述凭证验证信息包括确定所述凭证签发设备为目标凭证签发设备并且基于目标凭证集合获取的凭证信息与所述目标凭证信息是匹配的。
在实施中，所述凭证验证信息可包括对凭证签发设备以及凭证签发内容的验证结果。
在第八方面的一种可能的实现方式中，基于所述目标凭证集合，确定针对所述用户的凭证验证信息包括：通过利用第一凭证信息集合对所述第一签名信息执行验签操作，确定所述第一凭证信息集合的凭证签发设备是否为目标凭证签发设备；利用与所述第二公钥对应的第二私钥对所述加密的目标验证集合进行解密，获取所述目标用户信息和所述目标凭证信息；确定利用所述目标用户信息生成的凭证信息与所述目标凭证信息是匹配的。
在实施中，所述方法可包括对凭证签发设备以及凭证签发内容的具体验证操作。
在第八方面的一种可能的实现方式中，向所述终端设备提供所述凭证验证信息，包括：将所述凭证验证信息执行加密后存储至第三区块链节点中并利用第三区块链节点将所述加密后的凭证验证信息发送到所述用户的第一区块链节点上；或者，将所述凭证验证信息执行加密后存储在凭证验证设备的验证端存储单元上并被发送到所述用户的终端设备。
在实施中，可在利用区块链技术实现对分布式数字身份的创建、发布、更新和查询，在此基础上，能够实现链上存储功能。
第九方面，本申请的实施例提供了一种身份信息处理方法，所述方法由凭证签发设备执行，包括：利用多个第一用户信息，生成第一集合，其中，所述第一集合包括第一加密信息集合、第一凭证信息集合以及第一签名信息，其中，所述第一加密信息集合包括利用第一公钥对所述多个用户信息进行加密的多个第一加密信息，所述第一凭证信息集合包括对所述多个用户信息执行盲化处理后的多个第一凭证信息，第一签名信息是对所述多个第一凭证信息进行集体签名后获取的信息；向所述终端设备提供所述第一集合。
所述方法可利用凭证签发设备对全部的身份信息进行整体签发的情况下，对每个身份信息分别进行盲化处理，从而保证所述第一集合在签发主体与签发内容上均满足签发需要。此外，凭证签发设备对于数字凭证的使用是无感知的，进一步提高了安全性。
在第九方面的一种可能的实现方式中，所述方法还包括：从与所述用户对应的第一区块链节点获取多个用户信息，其中，所述多个用户信息与所述多个第一用户信息相关。
在相关技术中，分布式身份系统可分别生成各自的去中心化身份信息后，利用彼此之间的公私钥进行加密/解密，而区块链技术本身就是去中心化而且区块链技术的信息是不可篡改，因此，本申请的实施例可利用区块链技术处理各个终端的相关数据并存储在各个终端对应的区块链节点上。
在第九方面的一种可能的实现方式中，向所述终端设备提供所述第一集合，包括：将所述第一集合进行加密并将加密后的第一集合存储在与凭证签发设备对应的第二区块链节点，或者将加密后的所述第一集合存储在与所述凭证签发设备对应的签发端存储单元，使得所述终端设备能够获取所述第一集合。
在实施中，所述凭证签发设备可根据实际需要选择链上存储或链下存储。
第十方面，本申请的实施例提供了一种身份信息验证设备，所述设备包括：用户信息获取单元用于标识获取与用户对应的多个第一用户信息；集合获取单元可用于从凭证签发设备获取利用所述多个第一用户信息生成的第一集合，其中，所述第一集合包括第一加密信息集合、第一凭证信息集合以及第一签名信息，其中，所述第一加密信息集合包括利用第一公钥对所述多个第一用户信息进行加密的多个第一加密信息，所述第一凭证信息集合包括对所述多个第一用户信息执行盲化处理后的多个第一凭证信息，第一签名信息是对所述多个第一凭证信息进行集体签名后获取的信息；验证集合生成单元可用于利用所述第一集合，生成与目标用户信息对应的目标验证集合，其中，所述目标用户信息指示凭证验证设备请求的信息。验证集合提供单元可向所述凭证验证设备提供所述目标验证集合。
第十一方面，本申请的实施例提供一种身份信息验证设备，所述身份信息处理设备包括：凭证集合获取单元用于响应于接收到来自用户的终端设备的服务请求，从所述终端设备获取与所述服务请求中的目标用户信息对应的目标凭证集合，其中，所述目标凭证集合包括加密的目标验证集合、第一凭证信息集合以及第一签名信息，其中，目标验证集合包括目标用户信息和目标凭证信息，所述加密的目标验证集合包括利用第二公钥对所述目标验证集合执行加密后获取的集合，第一凭证信息集合是包括利用第一公钥对用户的多个用户信息进行加密的多个第一加密信息，第一签名信息是对所述多个第一凭证信息进行集体签名后获取的信息；凭证验证信息提供单元用于向所述终端设备提供所述凭证验证信息。
第十二方面，本申请的实施例提供一种身份信息验证设备，所述身份信息处理设备包括：用户信息获取单元可用于从用户的终端设备获取与用户对应的多个用户信息；集合生成单元用于利用所述多个用户信息，生成第一集合，其中，所述第一集合包括第一加密信息集合、第一凭证信息集合以及第一签名信息，其中，所述第一加密信息集合包括利用第一公钥对所述多个用户信息进行加密的多个第一加密信息，所述第一凭证信息集合包括对所述多个用户信息执行盲化处理后的多个第一凭证信息，第一签名信息是对所述多个第一凭证信息进行集体签名后获取的信息；向所述终端设备提供所述第一集合。
第十三方面，本申请的实施例提供了一种身份信息验证设备，包括：处理器；用于存储处理器可执行指令的存储器；其中，所述处理器被配置为执行所述指令时实现第七方面及其可能的实现方式中的方法，实现第八方面及其可能的实现方式中的方法或者实现第九方面及其可能的实现方式中的方法。
第十四方面，本申请的实施例提供了一种非易失性计算机可读存储介质，其上存储有计算机程序指令，其特征在于，所述计算机程序指令被处理器执行时实现第七方面及其可能的实现方式中的方法，实现第八方面及其可能的实现方式中的方法或者实现第九方面及其可能的实现方式中的方法。
第十五方面，本申请的实施例提供了一种计算机程序产品，所述计算机程序产品包括指令，所述指令用于指示服务器执行第七方面及其可能的实现方式中的方法，第八方面及其可能的实现方式中的方法或者第九方面及其可能的实现方式中的方法的步骤。
本申请的这些和其他方面在以下(多个)实施例的描述中会更加简明易懂。
附图说明
包含在说明书中并且构成说明书的一部分的附图与说明书一起示出了本申请的示例性实施例、特征和方面，并且用于解释本申请的原理。
图1示出根据相关技术的集中式身份信息验证系统的示图；
图2示出根据相关技术的分布式身份信息验证系统的示图；
图3示出根据本申请一实施例的身份信息处理系统的业务处理示图；
图4示出根据本申请一实施例的基于区块链的分布式身份信息验证系统的场景图；
图5示出根据本申请一实施例的区块链节点的结构示意图；
图6示出根据本申请一实施例的基于区块链的身份信息处理系统的系统架构图；
图7示出根据本申请一实施例的基于区块链的身份信息处理系统的处理流程图；
图8示出根据本申请一实施例的身份信息处理设备的框图；
图9示出根据本申请一实施例的身份信息处理设备的框图；
图10示出根据本申请一实施例的身份信息处理设备的框图；
图11示出根据本申请一实施例的计算设备的框图。
具体实施方式
以下将参考附图详细说明本申请的各种示例性实施例、特征和方面。附图中相同的附图标记表示功能相同或相似的元件。尽管在附图中示出了实施例的各种方面，但是除非特别指出，不必按比例绘制附图。
在本申请实施例中，“/”可以表示前后关联的对象是一种“或”的关系，例如，A/B可以表示A或B；“和/或”可以用于描述关联对象存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A，B可以是单数或者复数。为了便于描述本申请实施例的技术方案，在本申请实施例中，可以采用“第一”、“第二”等字样对功能相同或相似的技术特征进行区分。该“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。在本申请实施例中，“示例性的”或者“例如”等词用于表示例子、例证或说明，被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念，便于理解。
另外，为了更好的说明本申请，在下文的具体实施方式中给出了具体细节。本领域技术人员应当理解，没有某些具体细节，本申请同样可以实施。在一些实例中，对于本领域技术人员熟知的方法、手段、元件和电路未作详细描述，以便于凸显本申请的主旨。
为了更好地理解本申请的示例性实施例，以下将参照图1描述根据相关技术的集中式身份信息验证系统。如图1所示，所述集中式身份信息验证系统包括IDP 101、服务提供方(service provider，SP)102和103以及用户104，其中，所述IDP 101可为SP 102和103以及用户104提供身份服务。作为示例，IDP 101可根据与身份相关的用户信息为用户生成数字凭证，所述用户信息可包括年龄、学历、职业等信息。
SP 102和103是服务的提供者，所述服务可包括教育、医疗、银行、运输、购物等各种领域下的相关服务。如图1所示，SP 102可为用户104向IDP签发数字凭证，因此SP 102是凭证签发设备。SP 103则是验证SP 102为用户104签发的数字凭证，因此，SP 103为凭证验证设备。
如图1所示，在步骤S110，用户104、SP 102和SP 103可分别向IDP 101执行注册。作为示例，用户104、SP 102和SP 103可在不同的时间点上，向IDP 101提供各自的用户信息完成注册操作。
在步骤S120用户104向SP 102申请数字凭证。SP 102在接收到该申请后，对用户101颁发数字凭证，并将该数字凭证发送到IDP 101。在步骤S130，IDP 101对SP 102的身份进行校验，并在验证通过后，在步骤S140，接收经由SP 102签发的数字凭证。IDP 101在接收到该数字凭证后，可将该数字凭证提供给用户104，在步骤S150，SP 102可向用户104提示已经向其发送数字凭证。
在步骤S160，用户104可利用该数字凭证向SP 103请求服务。SP 103在接收到请求后，从IDP 101或用户104获取该数字凭证，并在步骤S170，验证该数字凭证。在验证通过后，在步骤S180，SP 103向用户提供该服务。
可以看出，如图1所示的集中式身份信息验证系统中的SP 102和103以及用户104对于身份以及凭证的验证操作均依赖于IDP 101。也就是说，该集中式身份信息验证系统中的SP 102和103以及用户104无法脱离IDP 101完成身份验证和内容解释。此外，用于生成数字凭证的所有用户信息将在验证通过后全部展现出来，存在过度泄露隐私的情况。更进一步地，该集中式身份信息验证系统中的数字凭证的可移植性差，无法直接应用到其他系统中。
鉴于以上考虑，本申请的示例性实施例提供的数字凭证管理系统采用分布式身份信息验证系统。为了更好地描述分布式身份信息验证系统，以下将结合图2对该分布式身份信息验证系统执行描述。
在图2中，所述分布式身份信息验证系统200包括SP 21、SP 22以及用户23。在步骤S210，SP 21、SP 22以及用户23可分别生成各自的去中心化身份信息(decentralized identity，DID)，其中，所述DID可以是特定格式的字符串，用于代表实体(包括人、机器、物体等)的数字身份。在分布式身份信息验证系统中，为了与集中化身份信息验证系统中的解耦，而设计出的一种新的身份类型。DID可以标识任何主体(例如，人员、组织、事物、数据模型、抽象实体等)。
在步骤S220，用户23可向SP 21申请数字凭证，该数字凭证是指被SP 21签发的凭证。基于此，在步骤230，SP 21可利用用户23的公钥对数字凭证进行加密后，并将加密后的数字凭证发送给用户23。
在步骤230，用户23可从SP 21接收与其对应的加密后的数字凭证。在步骤S240，用户23可向SP 22发送重加密数字凭证，简单来说，用户23可利用自有私钥对该加密后的数字凭证执行解密后获取数字凭证后，利用SP 22的公钥对该数字凭证执行重加密获取该重加密数字凭证。
可以看出，如图2中的分布式身份信息验证系统200的数字凭证通常针对每个DID提供的多个身份信息进行的声明并且针对整个数字凭证进行加密，无法做到针对每个身份信息分别签发，且用户无法对数据凭证进行处理，例如，仅选择数字凭证中的某些属性声明，这样就限制了用户的使用场景，此外，该数字凭证需要用户自己存储，容易丢失。
为了更好地理解，以下将举例说明。用户可向公司申请该公司签发的数字凭证。为了获取该数字凭证，用户需要提供年龄信息、单位职务信息、健康信息以及婚育信息。在用户利用如图2所述的分布式身份信息验证系统200从SP 21获取到该公司颁发的数字凭证后，用 户想参加该公司为经理以上级别提供的教育培训活动。在此场景下，用户仅将数字凭证中的单位职务信息发送到提供教育培训活动的服务提供商即可，但是在图2中示出的分布式身份系统200中，用户无法从该数字凭证中仅提取出与单位职务信息相关的信息，只能将该数字凭证提供给教育培训活动，这就导致用户的年龄信息、健康信息以及婚育信息也被提供给了教育培训机构，但这些信息用户可能并不想提供给教育培训机构。用户可能处于隐私考虑，拒绝参加此次教育培训活动。
图3示出根据本申请一实施例的身份信息处理系统的业务处理示图。如图3所述，所述身份信息验证系统包括终端设备31、凭证签发设备32以及凭证验证设备33。
终端设备31是指具有通信能力和处理能力的设备。在实施例中，该终端设备31与用户对应，也就是说，用户可操作该终端设备31。作为示例，该终端设备31可利用通信能力向区块链系统提供各种用户信息，又或者，可利用通信能力向区块链系统发出各种请求。作为另一示例，该终端设备31可利用处理能力对相关信息进行加密和/或解密，又或者，该终端设备31可利用处理能力确定将向凭证签发设备提供的凭证信息。
利用终端设备可以是终端设备(user equipment，UE)，其中，UE包括具有无线通信功能的手持式设备、车载设备、可穿戴设备或计算设备。示例性地，UE可以是手机(mobile phone)、平板电脑或带无线收发功能的电脑。终端设备还可以是虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制中的无线终端、无人驾驶中的无线终端、远程医疗中的无线终端、智能电网中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。本申请实施例中，用于实现终端设备的功能的装置可以是终端设备；也可以是能够支持终端设备实现该功能的装置，例如芯片系统，该装置可以被安装在终端中或者能够与终端设备匹配使用。本申请实施例中，芯片系统可以由芯片构成，也可以包括芯片和其他分立器件。本申请实施例提供的技术方案中，以用于实现终端的功能的装置是终端为例，描述本申请实施例提供的技术方案。
在基于区块链技术的实现方案中，终端设备31可利用以上所述的DID向区块链申请与其对应的区块链节点，在以下描述中可被称作第一区块链节点。
凭证签发设备32是指可对终端设备31提供的信息执行签发的机构和/或设备。为了便于描述，在本申请的示例性实施例中，所述凭证签发设备31可指示对用户提供的信息执行签发的凭证签发方和/或凭证签发方所使用的凭证签发设备。凭证签发设备32可对终端设备31提供的信息在真实性、准确性等各方面负责。作为示例，所述凭证签发设备32可以是权威机构的终端，例如，所述凭证签发设备可以是对用户所经营的商铺信息进行签发的政府机构使用的设备。
所述凭证签发设备32可以是手机、平板电脑、台式计算机、便携笔记本式计算机等终端设备，还可以是独立的服务器，或者由多个服务器组成的服务器集群，本申请实施例中，用于实现凭证签发设备的功能的装置可以是凭证签发设备32；也可以是能够支持凭证签发设备实现该功能的装置，例如芯片系统，该装置可以被安装在终端中或者能够与凭证签发设备匹配使用。本申请实施例中，芯片系统可以由芯片构成，也可以包括芯片和其他分立器件。本申请实施例提供的技术方案中，以用于实现凭证签发设备的功能的装置是终端为例，描述本申请实施例提供的技术方案。
在基于区块链技术的实现方案中，凭证签发设备可利用以上所述的DID向区块链申请与 其对应的区块链节点，在以下描述中可被称作第二区块链节点。
凭证验证设备33是指对终端设备31提供的凭证信息进行验证的机构和/或设备。为了便于描述，在本申请的示例性实施例中，所述凭证验证设备33可指示对用户提供的凭证信息执行验证操作的凭证验证方和/或凭证验证方所使用的凭证验证设备。作为示例，用户利用终端设备31向服务提供设备发出服务请求时，服务提供设备需要对该用户的用户资格进行验证，确保用户有资格该服务。在此场景下，用户可利用终端设备31向凭证验证设备33发送凭证信息，并在验证通过后，凭证验证设备33可通知服务提供设备向用户提供服务。应理解，凭证验证设备33与服务提供设备可以是同一设备也可以是不同设备，对此本申请不设限。
所述凭证验证设备33可以是手机、平板电脑、台式计算机、便携笔记本式计算机等终端设备，还可以是独立的服务器，或者由多个服务器组成的服务器集群，本申请实施例中，用于实现凭证签发设备的功能的装置可以是凭证验证设备33；也可以是能够支持凭证签发设备实现该功能的装置，例如芯片系统，该装置可以被安装在终端中或者能够与凭证签发设备匹配使用。本申请实施例中，芯片系统可以由芯片构成，也可以包括芯片和其他分立器件。本申请实施例提供的技术方案中，以用于实现凭证签发设备的功能的装置是终端为例，描述本申请实施例提供的技术方案。
在基于区块链技术的实现方案中，凭证验证设备33可利用以上所述的DID向区块链申请与其对应的区块链节点，在以下描述中可被称作第三区块链节点。
如图3所示，在步骤S3110，终端设备31可收集用户相关的多个用户信息。在实施中，终端设备31可根据已有凭证模板提供所述多个用户信息。在相关技术中，每个凭证均有固定的凭证模板，用户可根据所述凭证模板填写所述用户信息。所述用户信息可包括用于指示用户身份的身份信息或者属性信息，例如，所述用户信息可包括用户的年龄信息、籍贯信息、居住地信息、性别信息、职位信息、教育信息、健康状况信息等。
作为示例，所述用户信息可用于生成后续的凭证信息，但可能不显示/存在于凭证签发终端签发的凭证中。例如，用户可根据凭证模板填写用户近一个月内的行程信息，但是该信息并非用于生成凭证的信息，而是凭证签发终端在生成所述凭证所不可或缺的信息。
在实施中，终端设备31可根据凭证签发设备32发送的电子表单提供所述用户信息，或者终端设备31可利用与其对应的第一区块链节点提供所述用户信息。
在步骤S3120，终端设备31可将所述用户信息发送到凭证签发设备32。在实施中，终端设备31可利用区块链技术将所述用户信息提供给凭证签发设备32。简言之，终端设备31可将在步骤S3110中获取的用户信息进行加密后存储在用户的第一区块链节点中。当凭证签发设备32接收到凭证签发请求后，可利用与凭证签发设备32对应的第二区块链节点提取出第一区块链节点所提供的加密的第一用户信息，并对该加密的用户信息进行解密后，获取所述用户信息。
在步骤S3210，凭证签发设备32可对该用户信息进行检查，此次检查是对用户信息的来源以及该用户信息是否满足所要签发的凭证等方面进行检查。在利用区块链技术的情况下，步骤S3210可利用区块链技术确定所述用户信息是由终端设备31提供的、无篡改的并且该第一用户信息是最近存在的信息。
在步骤S3220，凭证签发设备32可基于所述用户信息确定所述多个第一用户信息，并对所述多个第一用户信息执行签发处理，获取多个第一凭证信息。
如上所述，终端设备31提供的用户信息与生成数字凭证所需的用户信息可能是相同的也可能是不同的，在实施中，凭证签发设备32可根据实际需要从这些用户信息中提取出用于凭证签发的多个第一用户信息，然后对这些第一用户信息执行签发处理，获取多个第一凭证信息。
在实施中，可利用盲化处理实现所述凭证签发终端的签发处理。所述盲化处理是指按照映射规则将每个用户信息唯一映射成固定格式的数据。也就是说，所述盲化处理可具有绑定能力以及隐藏能力，其中，绑定能力是指该第一用户信息唯一对应第一凭证信息，隐藏能力是指攻击者无法或者很难利用该第一凭证信息获取该第一用户信息。在具体实施中，凭证签发设备32可采用具有绑定能力以及隐藏能力的任何盲化处理方法对用户信息执行盲化处理。
在一种可能的实施方式中，凭证签发设备32可利用皮尔森承诺(Pedersen commitment)执行盲化处理。简言之，凭证签发设备32可利用盲化因子对用户信息进行运算，获取第一凭证信息，其中，盲化因子可以是公开的。在实施中，所述盲化因子可存储在所述第二区块链节点上。
在步骤S3230，凭证签发设备32可对在步骤S3220中获取的多个第一凭证信息进行集体签名，获取第一签名信息。在实施中，为了体现是由凭证签发设备32对第一凭证信息进行的签发，可利用聚合签名算法对多个第一凭证信息进行集体签名，获取第一签名信息。在一种可能的实施例中，可采用C-L(camenisch-lysyanskaya)签名算法对所述多个第一凭证信息进行签名。C-L签名可用于群签名或聚合签名的场景中，可以提高签名的匿名性，并降低签名的计算复杂度。
为了能够从多个第一凭证信息中提取出适合各种应用场景的目标凭证信息，还需要向终端设备31提供多个用户信息。为了数据安全性，在步骤S3240，利用终端设备的第一公钥对所述多个用户信息进行加密，生成多个第一加密信息。
综上可述，为了满足能够将凭证签发终端32签发的凭证信息中的部分信息提供给凭证验证终端33，凭证签发终端32可对各个第一用户信息进行签发处理，以便于后续终端设备31根据应用场景选择第一凭证信息中的部分信息作为数字凭证。
因此，凭证签发设备32可将获取第一加密信息集合和第一凭证信息集合确定为第一集合，在步骤S3250，凭证签发设备32将第一集合发送到所述终端设备。在利用区块链实现的实施方式中，所述凭证签发设备32可将第一集合加密后存储在其对应的第二区块链节点上，以供其他节点提取使用。此外，所述凭证签发设备32还可将所述第一集合进行加密后存储在与凭证签发设备对应的签发端存储单元上，例如，所述凭证签发设备32可将所述第一集合进行加密后存储在本地存储器或者远程存储器(例如，云存储器)，并将存储地址以哈希值的方式存储在第二区块链节点上。
此外，为了便于后续凭证验证终端33对所述凭证签发终端进行验证，所述第一集合还可包括在步骤S3230中获取的第一签名信息。也就是说，所述第一集合包括第一加密信息集合、第一凭证信息集合以及第一签名信息。
虽然图3中仅给出了生成第一集合的示例，但是在实施中，终端设备31可根据多个凭证模板向凭证签发设备32提供不同的用户信息，并利用这些用户信息分别申请凭证信息。简单来说，凭证签发设备31还可获取与用户对应的多个第二用户信息。
例如，终端设备31可根据申请工作居住证的凭证模板向相关部门提供签发工作居住证所 需要的第一用户信息，并获取到相关部门签发的凭证信息，同时，终端设备31可根据申请单身青年的凭证模板向同一部门提供签发单身青年证明所需要的第二次用户信息，并获取到该同一部门签发的凭证信息。
这两种情况所需要提供的第一用户信息和第二用户信息可能有重复的信息也可能没有重复的信息。该凭证签发设备均按照步骤S3210至步骤S3240，生成利用所述多个第二用户信息生成的第二集合，所述第二集合可包括第二加密信息集合和第二凭证信息集合。在实施中，所述第二集合还可包括第二签名信息。应注意，所述第二加密信息集合是利用第三公钥对所述多个第二用户信息进行加密的多个第二加密信息，其中，第三公钥对应于凭证签发设备，在凭证签发设备相同的情况下，所述第三公钥可与所述第一公钥相同或者不同的。
此外，终端设备31还可向不同的凭证签发设备发送第一用户信息和第二用户信息，并从不同凭证签发设备获取不同的凭证信息。简单来说，另一凭证签发设备可获取与用户对应的多个第二用户信息，然后按照如步骤S3210至步骤S3240所示生成利用所述多个第二用户信息生成的第二集合，所述第二集合可包括第二加密信息集合和第二凭证信息集合。在实施中，所述第二集合还可包括第二签名信息。应注意，所述第二加密信息集合是利用第三公钥对所述多个第二用户信息进行加密的多个第二加密信息，其中，第三公钥对应于凭证签发设备，在凭证签发设备不同的情况下，所述第三公钥不用于第一公钥。
例如，终端设备31可根据申请工作居住证的凭证模板向相关部门提供签发工作居住证所需要的第一用户信息，同时，终端设备31可根据申请税费减免的凭证模板向相关部门提供签发税费减免所需要的第二用户信息，这两个凭证签发设备是不同的，因此，它们可使用不同的公钥对所述多个第一用户信息以及所述多个第二用户信息分别加密。
以上为了便于描述仅给出了两种用户信息，但在实际使用中，可能包括更多种用户信息以及对应的更多个凭证签发设备的情况，在此将不再赘述。
可以看出，凭证签发设备32对全部的身份信息进行整体签发的情况下，对每个身份信息分别进行盲化处理，从而保证所述第一集合在签发主体与签发内容上均满足签发需要。此外，凭证签发设备对于数字凭证的使用是无感知的，进一步提高了安全性。
为了便于描述，以下将参照图3先对仅从终端设备31获取第一集合的实施例进行描述。具体来说，终端设备31可获取所述第一集合。在区块链技术的实现方式中，终端设备31可获取第二区块链节点提供的加密的第一集合并对加密的第一集合进行解密，获取第一集合。在另一实现方式中，终端设备31可从第二区块链节点上获取存储加密的第一集合的存储地址，并从与所述存储地址对应的存储器中提取出加密的第一集合，对该加密的第一集合进行解密，获取第一集合。
在步骤S3130，终端设备31可确定所述凭证验证设备33请求的目标用户信息。在实施中，终端设备31可在利用区块链技术向凭证验证设备33发出凭证验证请求后，获取所述凭证验证设备33请求的目标用户信息。
在步骤S3140，终端设备31生成与所述目标用户信息对应的目标验证集合。在实施中，终端设备31可能不需要向凭证验证设备33提供所有的用户信息，又或者根据单个凭证模板提供的用户信息可能无法满足凭证验证设备33所需要的用户信息。在这种情况下，终端设备31还可根据获取的多个集合组合生成所需的各种目标验证集合。
在针对利用单个集合生成目标验证集合的实施例进行描述，具体如下：
(a)终端设备31利用与第一公钥对应的第一私钥对所述多个第一加密凭证执行解密，获取所述多个用户信息。作为示例，所述第一私钥可加密存储在所述第一区块链节点上。
(b)终端设备31可从所述多个用户信息中提取出所述目标用户信息。
(c)利用所述多个目标用户信息与所述多个第一凭证信息的对应关系，确定与所述目标用户信息对应的目标凭证信息；
(d)将所述目标用户信息以及所述目标凭证信息确定为目标验证集合。
针对多个集合生成目标验证集合的实施例，以下将以第一集合与第二集合生成目标验证集合的实施例进行描述。应注意，在实施中，可能存在更多的集合生成目标验证集合的情况，本申请对此不限制。
(a)利用与第一公钥对应的第一私钥对所述多个第一加密凭证以及与第三公钥对应的第三私钥对所述多个第二加密凭证执行解密，获取所述多个第一用户信息和所述多个第二用户信息，
(b)利用所述多个第一用户信息和所述多个第二用户信息，确定所述目标用户信息；
(c)利用所述多个第一用户信息与所述多个第一凭证信息的对应关系和利用所述多个第二用户信息与所述多个第二凭证信息的对应关系，确定与所述目标用户信息对应的目标凭证信息；
(d)将所述目标用户信息以及所述目标凭证信息确定为目标验证集合。
在步骤S3150，利用凭证验证设备33提供的第二公钥对目标验证集合执行加密，生成加密的目标验证集合。
在步骤S3160，终端设备31可向凭证验证设备33发送目标凭证集合，其中，目标凭证集合可包括加密的目标验证集合。在利用区块链实现的实施方式中，所述终端设备31可将目标凭证集合加密后存储在其对应的第一区块链节点上，以供其他节点提取使用。
可以看出，终端设备31可从凭证签发设备32获取到第一集合后，参与定制与目标用户信息对应的目标验证集合，使得终端用户能够根据实际需求参与数字凭证的生成，并且有效扩展了用户的使用场景，保护了用户隐私。
此外，为了对签发主体进行验证，也就是说，凭证验证设备33对获取的目标验证集合中的目标凭证信息的签发端进行验证，所述目标凭证集合还可包括第一凭证信息集合以及第一签名信息，即，目标凭证集合包括加密的目标验证集合、第一凭证信息集合以及第一签名信息。
在实施中，所述终端设备31还可将所述目标凭证集合进行加密后存储在与终端设备对应的终端设备存储单元上，例如，所述终端设备31可将所述目标凭证集合进行加密后存储在本地存储器或者远程存储器(例如，云存储器)，并将存储地址以哈希值的方式存储在第一区块链节点上。
也就是说，所述终端设备31可将所产生的各种数据(例如，第一验证信息等)存储在区块链节点中，也可存储在非区块链节点上，例如，可存储在终端设备的本地存储器或远程存储器(例如，云存储器)内。
作为示例，所述终端设备31可根据凭证信息的类型确定存储方式。举例来说，所述终端设备31可将认证型凭证信息存储在与其对应的区块链节点上，其中，所述认证型凭证信息是指仅需要根据需求进行判断后的判断结果的凭证，例如，是否为合法公民，是否结婚，是否 有孩子。此外，所述终端设备将专业型凭证存储在非区块链节点上，其中，专业型凭证是指需要提供具体内容的凭证，例如，用户的身份证照片、用户的指纹信息等。
凭证验证设备33可获取所述目标凭证集合。在区块链技术的实现方式中，凭证验证设备33可利用区块链技术获取第一区块链节点提供的加密的目标凭证集合并对加密的目标凭证集合进行解密，获取目标凭证集合。在另一实现方式中，凭证验证设备33可利用区块链技术获取第一区块链节点提供的存储加密的第一集合的存储地址，并从与所述存储地址对应的存储器中提取出加密的目标凭证集合，对该加密的目标凭证集合进行解密，获取目标凭证集合。
凭证验证设备33在获取到所述目标凭证集合后，在步骤S3310，对所述目标验证集合进行验证，确定凭证验证信息，其中，所述凭证验证信息用于指示所述目标验证集合是否通过验证。在一种可能的实施方式中，凭证验证设备33需要对凭证签发方和/或凭证内容进行验证。
在对凭证签发方进行验证的实施例中，凭证验证设备33需要确定该凭证签发设备是否是目标凭证签发设备。举例来说，凭证签发设备需要验证所述凭证签发设备是否为第一机构签发的凭证，也就是说，需要验证凭证签发设备32是否为第一机构。若凭证签发设备32为第一机构，则通过验证，若不是第一机构，则没有通过验证。
在对凭证内容进行验证的实施例中，凭证验证设备33还需要确定基于目标凭证集合获取的凭证信息是否与目标凭证信息是匹配的。举例来说，凭证验证设备33需要验证用户的教育信息，因此，凭证验证设备33需要确定从目标凭证集合中提取的凭证信息是否为用户的教育信息。可选地，凭证验证设备33还可确定该凭证信息是否满足服务要求。例如，服务要求是用户必须有高中以上学历，凭证验证设备33提取出的用户的教育信息为大学学历，因此，凭证验证设备33确定用户满足服务要求。
为此，凭证验证设备33可按照以下操作对目标凭证集合进行处理：
(aa)通过利用第一凭证信息集合对所述第一签名信息执行验签操作，确定所述第一凭证信息集合的凭证签发设备是否为目标凭证签发设备；
(bb)利用与所述第二公钥对应的第二私钥对所述加密的目标验证集合进行解密，获取所述目标用户信息和所述目标凭证信息；确定利用所述目标用户信息生成的凭证信息与所述目标凭证信息是否匹配。
在实施中，凭证验证设备33可根据获取的目标凭证集合包括的信息执行操作aa或者执行操作aa和操作bb。简言之，在所述第一凭证信息仅包括目标验证集合的情况下，所述凭证验证设备33可执行操作bb，在所述第一凭证信息包括目标验证集合、第一凭证信息集合以及第一签名信息的情况下，所述凭证验证设备33可执行本操作aa和操作bb。在实施中，所述凭证验证设备33可执行操作aa后执行操作bb，执行操作bb后执行操作aa，或者同时执行操作aa与操作bb，本申请并此不作限制。
在步骤S3320，凭证验证设备33可将所述凭证验证信息发送到终端设备31。
综上可述，凭证验证设备33可对以上凭证内容进行验证时，无需暴露不需要的信息并且在申请、生成与存储过程中均采用加密算法，进一步保证了安全性。
在利用区块链技术的实现方式中，凭证验证设备33可将所述凭证验证信息执行加密后存储至所述第三区块链节点中并利用第三区块链节点将所述加密后的凭证验证信息发送到所述用户的第一区块链节点上，在利用非区块链技术的实现方式中，凭证验证设备33可将所述凭 证验证信息执行加密后存储在凭证验证设备33对应的存储单元(例如，云存储器)并被发送到所述用户的终端设备。
在实施中，由于区块链内的各个区块链节点共同维护所共享的交易账本并且该交易账本可记录各个区块链节点对应的设备、设备的公钥以及所执行的各种操作，因此利用区块链技术的身份信息处理系统能够减少对设备的身份验证等操作。基于此，本申请的示例性实施例可包括基于区块链的身份信息处理系统。
为了更好地理解，将参照图4至图7描述基于区块链的分布式身份信息验证系统的场景图。
如图4所示，该场景中的分布式身份信息验证系统包括终端设备410、凭证签发设备420、凭证验证设备430和包括区块链的区块链系统(图4中仅示出区块链)。在图4中，终端设备410、凭证签发设备420、凭证验证设备430均可将创建的数字身份信息与对应的公钥关联记录在区块链的交易账本中，其中，所述交易账本中记录有如数字身份信息及对应的公钥、数字凭证的创建记录信息等。
具体的，终端设备410、凭证签发设备420与凭证验证设备430均向区块链申请其对应的区块链节点。作为示例，终端设备410对应于第一区块链节点，凭证签发设备420对应于第二区块链节点，凭证验证设备430对应于第三区块链节点。
终端设备410响应于用户的凭证创建操作，根据获取的用户的第一数字身份信息和待创建的凭证的用户信息，向凭证签发设备420发送凭证创建请求。在实施中，终端设备410可利用部署在第一区块链节点上的智能合约，向区块链系统申请凭证。区块链系统在接收到凭证创建请求后，将该凭证创建请求发送给确定的凭证签发设备。如图4所示，区块链系统可利用区块链技术将该凭证创建请求传输至第二区块链节点。
凭证签发设备420可按照如上描述的方式获取第一集合。在该实施中，第一集合可包括加密的目标验证集合、第一凭证信息集合以及第一签名信息。然后将这些信息利用终端设备记录在交易账单上的公钥对这些信息进行加密并存储在第一区块链节点上，并向终端设备410发送存储成功的信息。
在实施中，所述身份信息处理系统还可将这些信息存储在本地存储器或者远端存储器(例如，云存储器)。在存储在远端存储器的情况下，所述终端设备将这些远端存储器的地址信息利用哈希算法处理后的信息存储在第一区块链节点上，这样在保证数据安全的情况下节省了区块链上的数据存储空间。
终端设备410在获取到存储成功的信息后，利用区块链技术获取对应的第一集合。响应于用户的服务请求操作，可从凭证验证设备530获取其需要的目标凭证信息。用户终端410可根据该目标凭证信息生成目标凭证集合。然后，利用凭证验证设备530的公钥对目标凭证集合进行加密并将加密后的目标凭证集合存储在第二区块链节点上，向凭证验证设备430发送存储成功的信息。
在实施中，所述身份信息处理系统还可将这些信息存储在远端存储器(例如，云存储器)，然后将这些远端存储器的地址信息利用哈希算法处理后的信息存储在第二区块链节点上，这样在保证数据安全的情况下节省了区块链上的数据存储空间。
凭证验证设备430对应的第三区块链节点在接收到存储成功的信息后，可提取出第一区块链节点提供的目标凭证集合，并对目标凭证集合进行验证，获取凭证验证信息。凭证验证 设备430可利用终端设备记录在交易账单上的公钥对该凭证验证信息进行加密，然后将加密后的凭证验证信息上传至第三区块链节点。
在实施中，数字身份信息可以通过多种方式展现，如DID(Decentralized Identity，去中心化身份)等，DID还可以称为分布式数字身份。数字凭证也可以通过多种方式展现，如可验证声明(Verifiable Claims，简称VC)等。
在本申请中，区块链系统是一种分布式系统，分布式系统可以由多个节点(接入网络中的任意形式的计算设备，如服务器、用户终端)通过网络通信的形式连接形成。区块链技术由多个节点形成，节点之间形成组成的点对点(P2P，Peer To Peer)网络，P2P协议是一个运行在传输控制协议(TCP，Transmission Control Protocol)协议之上的应用层协议。在区块链技术中，任何机器如服务器、终端都可以加入而成为节点，节点包括硬件层、中间层、操作系统层和应用层。
区块链技术中各节点的功能包括：1)路由，节点具有的基本功能，用于支持节点之间的通信。节点除具有路由功能外，还可以具有以下功能：2)区块链，包括一系列按照产生的先后时间顺序相互接续的区块(Block)，新区块一旦加入到区块链中就不会再被移除，区块中记录了区块链技术中节点提交的记录数据，例如交易数据等。
参见图5，是本申请实施例提供的区块结构(Block Structure)的一个可选的示意图，每个区块中包括本区块存储数据记录的哈希值(本区块的哈希值)、以及前一区块的哈希值，各区块通过哈希值连接形成区块链(Blockchain)。另外，区块中还可以包括有区块生成时的时间戳等信息。区块链，本质上是一个去中心化的数据库，是一串使用密码学方法相关联产生的数据块，每一个数据块中包含了相关的信息，用于验证其信息的有效性(防伪)和生成下一个区块。
智能合约，计算机化的协议，可以执行某个合约的条款，通过部署在共享账本上的用于在满足一定条件时而执行的代码实现，根据实际的业务需求代码用于完成自动化的交易，例如查询买家所购买商品的物流状态，在买家签收货物后将买家的虚拟资源转移到商户的地址；当然，智能合约不仅限于执行用于交易的合约，还可以执行对接收的信息进行处理的合约。
以下将参照图6和图7对基于区块链的身份信息处理系统进行描述，图6示出了根据本申请一实施例的基于区块链的身份信息处理系统的系统架构图；图7示出了图6给出的系统架构的情况下基于区块链的身份信息处理系统的处理流程图。
如图6所示，终端610可指示利用区块链技术参与凭证处理的各个设备，包括用户终端、凭证签发设备以及凭证验证设备。终端610中可具有实现各自功能的程序。在实施中，所述程序可以是一个或多个软件开发包(SDK)的形式。举例来说，在终端610为用户终端的情况下，所述程序可包括生成DID、提交DID以及向凭证签发设备发送凭证申请并生成以上提及的目标凭证集合的代码。
终端620是指并非直接参与凭证处理的第三方设备。在实施中，终端620可指示期望查看凭证验证的记录的设备。在此情况下，终端620可通过解释器640内的程序获取该验证相关的DID信息、凭证信息等。在某些信息存储在链外(例如，本地存储器或者云存储器)的情况下，解释器640还可向终端620提供存储器630的存储地址。
在基于区块链的实现方式中，所产生的各种数据(例如，第一验证信息等)可存储在区块链节点中，也可存储在链下，例如，可存储在本地存储器或远程存储器内。在实施中，可 将认证型凭证信息存储在与其对应的区块链节点上，其中，所述认证型凭证信息是指仅需要根据需求进行判断后的判断结果的凭证，例如，是否为合法公民，是否结婚，是否有孩子。此外，所述终端设备将专业型凭证存储在非区块链节点上，其中，专业型凭证是指需要提供具体内容的凭证，例如，用户的身份证照片、用户的指纹信息等。
从图6可以看出，基于区块链技术的分布式身份信息处理系统不仅可以生成凭证、签发凭证并验证凭证，还可以开放查看功能，向需要查看该凭证的处理记录的终端开放查看权限。此外，还可根据凭证类型确定不同的存储方式。
以下将参照图7详细描述基于区块链的身份信息处理系统的处理流程。
如图7所示，在步骤S710，终端设备71、凭证签发设备72以及凭证验证设备73可利用应用程序申请各自的DID。作为示例，用户可根据需要提供的信息利用DID相关应用程序获取该用户的DID以及对应的公私钥。
在步骤S720，终端设备71、凭证签发设备72以及凭证验证设备73利用该DID与公钥，向区块链系统发送申请新的区块链账号的请求。在发送请求后，终端设备71、凭证签发设备72以及凭证验证设备73可从区块链系统获得已生成新的区块链账号的指示。该区块链账号可以与区块链系统上的各个区块链地址相关联。由此，终端设备71、凭证签发设备72以及凭证验证设备73可获取到与各自对应的区块链节点。
在步骤S730，终端设备71可利用第一区块链节点向区块链系统发出申请凭证的请求。在实施中，第一区块链节点可利用预先布置的第一智能合约，发出申请凭证的请求。所述区块链系统接收到该请求后，可通知凭证签发设备72的第二区块链节点。凭证签发设备72可根据用户所请求的凭证，收集所需要的用户信息。在实施中，可根据需要，可利用区块链技术获取第一区块链节点提供的这些用户信息。在实施中，终端设备71可获取该凭证签发设备72对应的公钥，然后将这些用户信息利用该公钥进行加密并利用第一区块链节点提供到区块链中。凭证签发设备72可获取第一区块链节点提供的这些加密后的用户信息，然后利用凭证签发设备72的私钥对这些用户信息进行解密，获取这些用户信息。此外，在实施中，凭证签发设备72还可利用在区块链上存储的链外地址获取这些用户信息。
在步骤S740，凭证签发设备72可利用获取的用户信息按照如上所述的步骤获取第一集合。获取的第一集合可利用终端设备71的公钥进行加密，并将加密后的第一集合利用第一区块链节点上传至区块链上，或者被存储在链外。如图7所示，所述第一集合可被加密并存储在链外存储器74上。所述链外存储器74可指示各个终端的本地存储器，还可以指示各个终端的远程存储器(例如，云存储器)，本申请对此不设限制。
在终端设备71接收到存储完成的指令后，在步骤S750，所述终端设备71可利用第一区块链节点，获取所述第二区块链节点提供的第一集合，或者可根据链外存储器74的存储地址，获取链外存储器74内存储的第一集合。
随后，终端设备71可根据来自凭证验证设备所要求验证的凭证，在步骤S760，确定目标凭证集合。确定的目标凭证集合可利用凭证验证设备73的公钥进行加密，并利用第三区块链节点存储在区块链上，或者被存储在链外，如图7所示，被存储在链外存储器74上。所述链外存储器74可指示各个终端的本地存储器，还可以指示各个终端的远程存储器(例如，云存储器)，本申请对此不设限制。
在存储完成后，区块链系统可通知凭证验证设备执行步骤S770，获取目标凭证集合。并 按照如上步骤根据目标凭证集合生成凭证验证信息。并将凭证验证信息按照如上步骤存储在区块链系统中。
可以理解的是，为了实现上述功能，根据本申请的示例性实施例的身份信息处理设备可包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请实施例能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请实施例的范围。
本申请实施例可以根据上述方法示例对上述终端等进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用对应各个功能划分各个功能模块的情况下，图8示出了上述实施例中所涉及的身份信息处理设备的一种可能的结构示意图。
在所述身份信息处理设备800执行如图3中的终端设备31所执行的步骤的情况下，所述身份信息处理设备800可包括集合获取单元810、目标验证集合确定单元820以及目标验证集合提供单元830。
集合获取单元810用于从凭证签发设备获取与多个第一用户信息对应的第一集合，其中，所述第一集合包括第一加密信息集合和第一凭证信息集合，所述第一加密信息集合包括对所述多个第一用户信息进行对应加密后的多个第一加密信息，所述第一凭证信息集合包括对所述多个第一用户信息执行签发处理后的多个第一凭证信息。
目标验证集合确定单元820用于基于所述第一集合中的第一加密信息集合和第一凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括所述多个第一用户信息中的目标用户信息以及所述多个第一凭证信息中与所述目标用户信息对应的目标凭证信息。
验证集合提供单元830可用于向所述凭证验证设备提供所述目标验证集合。
可选地，所述集合获取单元810还用于获取与多个第二用户信息对应的第二集合，其中，所述第二集合包括第二加密信息集合和第二凭证信息集合，所述第二加密信息集合包括所述多个第二用户信息进行对应加密后的多个第二加密信息，所述第二凭证信息集合包括对所述多个第二用户信息执行签发处理后的多个第二凭证信息。
可选地，所述验证集合确定单元830还用于基于所述第二集合中的第二加密信息集合和第二凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括所述目标用户信息和与所述目标用户信息对应的目标凭证信息，其中，所述目标验证集合包括：所述多个第二用户信息中的目标用户信息以及所述多个第二凭证信息中与所述目标用户信息对应的目标凭证信息。
可选地，所述验证集合确定单元830还用于基于所述第一集合中的第一加密信息集合和第一凭证信息集合以及所述第二集合中的第二加密信息集合和第二凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括：所述多个第一 用户信息和所述多个第二用户信息中的目标用户信息以及所述多个第一凭证信息和所述多个第二凭证信息中与所述目标用户信息对应的目标凭证信息。
在根据本申请的一实施例的身份信息处理设备执行如图3中的凭证验证设备33所执行的步骤的情况下，该身份信息处理设备可指示图9中所述的身份信息处理设备900。
所述身份信息验证设备可包括接收设备910、目标验证集合获取单元920以及凭证验证信息提供单元930。
接收单元910用于接收服务请求。
目标验证集合获取单元920用于从所述终端设备获取目标验证集合，其中，所述目标验证集合包括与服务对应的目标用户信息和目标凭证信息。
凭证验证信息提供单元930用于对所述目标验证集合进行验证，向所述终端设备提供凭证验证信息，其中，所述凭证验证信息用于指示所述目标验证集合是否通过验证。
在根据本申请的一实施例的身份信息处理设备执行如图3中的凭证签发设备32所执行的步骤的情况下，该身份信息处理设备可指示图10中所述的身份信息处理设备1000。
所述身份信息处理设备1000可包括集合确定单元1010和集合提供单元1020。
集合确定单元1010用于确定与多个第一用户信息对应的第一集合，其中，所述第一集合包括第一加密信息集合和第一凭证信息集合，所述第一加密信息集合包括对所述多个第一用户信息进行对应加密后的多个第一加密信息，所述第一凭证信息集合包括对所述多个第一用户信息执行签发处理后的多个第一凭证信息。
集合提供单元1020向所述终端设备提供所述第一集合。
此外，本申请的示例性实施例的身份信息处理系统可包括如图8所示的身份信息处理设备800、如图9所示的身份信息处理设备900以及如图10所示的身份信息处理设备1000。在实施中，所述身份信息处理设备800及其对应的第一区块链节点、所述身份信息处理设备900及其对应的第二区块链节点和/或所述身份信息处理设备1000及其对应的第三区块链节点均可采用如图11所述的计算设备。
图11示出根据本申请一实施例的计算设备的框图。计算设备1100典型地包括系统存储器206和一个或者多个处理器204。存储器总线208可以用于在处理器204和系统存储器206之间的通信。
取决于期望的配置，处理器204可以是任何类型的处理，包括但不限于：微处理器(μP)、微控制器(μC)、数字信息处理器(DSP)或者它们的任何组合。处理器204可以包括诸如一级高速缓存210和二级高速缓存212之类的一个或者多个级别的高速缓存、处理器核心214和寄存器216。示例的处理器核心214可以包括运算逻辑单元(ALU)、浮点数单元(FPU)、数字信号处理核心(DSP核心)或者它们的任何组合。示例的存储器控制器218可以与处理器204一起使用，或者在一些实现中，存储器控制器218可以是处理器204的一个内部部分。
处理器210可以运行本申请实施例提供的身份信息处理设备，以便于用户参与定制与特定场景匹配的数字凭证，从而避免了隐私泄露。处理器210可以包括不同的器件，比如集成CPU和GPU时，CPU和GPU可以配合执行本申请实施例提供的身份信息处理方法，比如身份信息处理方法中的部分算法由CPU执行，另一部分算法由GPU执行，以得到较快的处理效率。
取决于期望的配置，系统存储器206可以是任意类型的存储器，包括但不限于：易失性 存储器(诸如RAM)、非易失性存储器(诸如ROM、闪存等)或者它们的任何组合。系统存储器206可以包括操作系统220、一个或者多个程序222以及程序数据224。在一些实施方式中，程序222可以布置为在操作系统上由一个或多个处理器204利用程序数据224执行指令。
上述指令可以用于执行如图3至图7中的相应实施例中的各个步骤，在所述计算设备1100为终端设备的情况下，该程序222可以包括：终端设备从凭证签发设备获取与多个第一用户信息对应的第一集合，其中，所述第一集合包括第一加密信息集合和第一凭证信息集合，所述第一加密信息集合包括对所述多个第一用户信息进行对应加密后的多个第一加密信息，所述第一凭证信息集合包括对所述多个第一用户信息执行签发处理后的多个第一凭证信息；所述终端设备基于所述第一集合中的第一加密信息集合和第一凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括所述多个第一用户信息中的目标用户信息以及所述多个第一凭证信息中与所述目标用户信息对应的目标凭证信息；所述终端设备向所述凭证验证设备提供所述目标验证集合。
在所述计算设备1100为验证凭证设备的情况下，所述程序222可包括：凭证验证设备接收服务请求；所述凭证验证设备从终端设备获取目标验证集合，其中，所述目标验证集合包括与服务对应的目标用户信息和目标凭证信息；所述凭证验证设备对所述目标验证集合进行验证，向所述终端设备提供凭证验证信息，其中，所述凭证验证信息用于指示所述目标验证集合是否通过验证。
在所述计算设备1100为凭证签发设备的情况下，所述程序222可包括：所述凭证签发设备确定与所述多个第一用户信息对应的第一集合，其中，所述第一集合包括第一加密信息集合和第一凭证信息集合，所述第一加密信息集合包括对所述多个第一用户信息进行对应加密后的多个第一加密信息，所述第一凭证信息集合包括对所述多个第一用户信息执行签发处理后的多个第一凭证信息；所述凭证签发设备向所述终端设备提供所述第一集合。
如图11所示，在本申请中并不对存储设备232的类型做任何限定，例如，存储设备232可以是存储区域网设备，也可以是包含文件系统的存储设备，诸如，网络附属存储(Network Attached Storage NAS)设备。
此外，存储设备232可包括可移除存储器232以及不可移除存储器238。在本申请中提及的存储单元指示分布在作为不可移除存储器的硬盘上的存储空间，其中，硬盘可指示多种类型的硬盘，例如，固态硬盘(Solid State Drive,SSD)或者串行连接SCSI(Serial Attached SCSI，SAS)或者光纤通道(Fiber Channel，FC)硬盘驱动器(Hard Disk Drive，HDD)，其中，SCSI(Small Computer System Interface)为小型机系统接口等，
作为示例，在存储设备232是SAN设备的情况下，存储单元可指示分布在硬盘上的一段逻辑存储空间，也就是逻辑单元(Logic Unit，LU)，而逻辑单元号(Logic Unit Number，LUN)用于标识逻辑单元，该逻辑单元可通过SCSI寻址。在实施中，存储设备可将物理硬盘进行分区，各个分区可作为拥有逻辑地址的存储单元(即，LUN)以供主机进行访问。
计算设备200还可以包括有助于从各种接口设备(例如，输出设备242、外设接口244和通信设备246)到基本配置经由总线/接口控制器230的通信的接口总线240。示例的输出设备242包括图形处理单元248和音频处理单元250。它们可以被配置为有助于经由一个或者多个A/V端口252与诸如显示器或者扬声器之类的各种外部设备进行通信。
输出设备242可以是显示器，所述显示器用于显示图像，视频等。显示器包括显示面板。 显示面板可以采用液晶显示屏(liquid crystal display，LCD)，有机发光二极管(organic light-emitting diode，OLED)，有源矩阵有机发光二极体或主动矩阵有机发光二极体(active-matrix organic light emitting diode的，AMOLED)，柔性发光二极管(flex light-emitting diode，FLED)，Miniled，MicroLed，Micro-oLed，量子点发光二极管(quantum dot light emitting diodes，QLED)等。在一些实施例中，显示器可以包括1个或N个显示屏，N为大于1的正整数。显示器可用于显示由用户输入的信息或提供给用户的信息以及各种图形用户界面(graphical user interface，GUI)。例如，显示器可以显示照片、视频、网页、或者文件等。再例如，显示器可以显示图形用户界面。其中，图形用户界面上包括状态栏、可隐藏的导航栏、时间和天气小组件(widget)、以及应用的图标，例如浏览器图标等。状态栏中包括运营商名称(例如中国移动)、移动网络(例如4G)、时间和剩余电量。导航栏中包括后退(back)键图标、主屏幕(home)键图标和前进键图标。此外，可以理解的是，在一些实施例中，状态栏中还可以包括蓝牙图标、Wi-Fi图标、外接设备图标等。还可以理解的是，在另一些实施例中，图形用户界面中还可以包括Dock栏，Dock栏中可以包括常用的应用图标等。当处理器210检测到用户的手指(或触控笔等)针对某一应用图标的触摸事件后，响应于该触摸事件，打开与该应用图标对应的应用的用户界面，并在显示器上显示该应用的用户界面。对应于本申请的示例性实施例，显示器可显示需要用户填写的电子表格，其中，该电子表格中可包括各种用户信息。
在本申请实施例中，显示器可以是一个一体的柔性显示屏，也可以采用两个刚性屏以及位于两个刚性屏之间的一个柔性屏组成的拼接显示屏。
示例外设接口244可以包括串行接口控制器254和并行接口控制器256，它们可以被配置为有助于经由一个或者多个I/O端口258和诸如输入设备(例如，键盘、鼠标、笔、语音输入设备、触摸输入设备)或者其他外设(例如打印机、扫描仪等)之类的外部设备进行通信。示例的通信设备246可以包括网络控制器260，其可以被布置为便于经由一个或者多个通信端口264与一个或者多个其他计算设备262通过网络通信链路的通信。
网络通信链路可以是通信介质的一个示例。通信介质通常可以体现为在诸如载波或者其他传输机制之类的调制数据信号中的计算机可读指令、数据结构、程序模块，并且可以包括任何信息递送介质。“调制数据信号”可以这样的信号，它的数据集中的一个或者多个或者它的改变可以在信号中编码信息的方式进行。作为非限制性的示例，通信介质可以包括诸如有线网络或者专线网络之类的有线介质，以及诸如声音、射频(RF)、微波、红外(IR)或者其它无线介质在内的各种无线介质。这里使用的术语计算机可读介质可以包括存储介质和通信介质二者。
计算设备1100可以实现为服务器，例如文件服务器、数据库服务器、应用程序服务器和WEB服务器等，也可以实现为小尺寸便携(或者移动)电子设备的一部分，这些电子设备可以是诸如蜂窝电话、个人数字助理(PDA)、个人媒体播放器设备、无线网络浏览设备、个人头戴设备、应用专用设备、或者可以包括上面任何功能的混合设备。计算设备200还可以实现为包括桌面计算机和笔记本计算机配置的个人计算机。
应理解，在实际应用中，计算设备1100可以包括比图11所示的更多或更少的部件，本申请实施例不作限定。图示计算设备1100仅是一个范例，并且计算设备1100可以具有比图中所示出的更多的或者更少的部件，可以组合两个或更多的部件，或者可以具有不同的部件 配置。图中所示出的各种部件可以在包括一个或多个信号处理和/或专用集成电路在内的硬件、软件、或硬件和软件的组合中实现。
本申请的实施例提供了一种身份信息处理设备，包括：处理器以及用于存储处理器可执行指令的存储器；其中，所述处理器被配置为执行所述指令时实现上述方法。
本申请的实施例提供了一种非易失性计算机可读存储介质，其上存储有计算机程序指令，所述计算机程序指令被处理器执行时实现上述方法。
本申请的实施例提供了一种计算机程序产品，包括计算机可读代码，或者承载有计算机可读代码的非易失性计算机可读存储介质，当所述计算机可读代码在电子设备的处理器中运行时，所述电子设备中的处理器执行上述方法。
计算机可读存储介质可以是可以保持和存储由指令执行设备使用的指令的有形设备。计算机可读存储介质例如可以是――但不限于――电存储设备、磁存储设备、光存储设备、电磁存储设备、半导体存储设备或者上述的任意合适的组合。计算机可读存储介质的更具体的例子(非穷举的列表)包括：便携式计算机盘、硬盘、随机存取存储器(Random Access Memory，RAM)、只读存储器(Read Only Memory，ROM)、可擦式可编程只读存储器(Electrically Programmable Read-Only-Memory，EPROM或闪存)、静态随机存取存储器(Static Random-Access Memory，SRAM)、便携式压缩盘只读存储器(Compact Disc Read-Only Memory，CD-ROM)、数字多功能盘(Digital Video Disc，DVD)、记忆棒、软盘、机械编码设备、例如其上存储有指令的打孔卡或凹槽内凸起结构、以及上述的任意合适的组合。
这里所描述的计算机可读程序指令或代码可以从计算机可读存储介质下载到各个计算/处理设备，或者通过网络、例如因特网、局域网、广域网和/或无线网下载到外部计算机或外部存储设备。网络可以包括铜传输电缆、光纤传输、无线传输、路由器、防火墙、交换机、网关计算机和/或边缘服务器。每个计算/处理设备中的网络适配卡或者网络接口从网络接收计算机可读程序指令，并转发该计算机可读程序指令，以供存储在各个计算/处理设备中的计算机可读存储介质中。
用于执行本申请操作的计算机程序指令可以是汇编指令、指令集架构(Instruction Set Architecture，ISA)指令、机器指令、机器相关指令、微代码、固件指令、状态设置数据、或者以一种或多种编程语言的任意组合编写的源代码或目标代码，所述编程语言包括面向对象的编程语言—诸如Smalltalk、C++等，以及常规的过程式编程语言—诸如“C”语言或类似的编程语言。计算机可读程序指令可以完全地在用户计算机上执行、部分地在用户计算机上执行、作为一个独立的软件包执行、部分在用户计算机上部分在远程计算机上执行、或者完全在远程计算机或服务器上执行。在涉及远程计算机的情形中，远程计算机可以通过任意种类的网络—包括局域网(Local Area Network，LAN)或广域网(Wide Area Network，WAN)—连接到用户计算机，或者，可以连接到外部计算机(例如利用因特网服务提供商来通过因特网连接)。在一些实施例中，通过利用计算机可读程序指令的状态信息来个性化定制电子电路，例如可编程逻辑电路、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或可编程逻辑阵列(Programmable Logic Array，PLA)，该电子电路可以执行计算机可读程序指令，从而实现本申请的各个方面。
这里参照根据本申请实施例的方法、装置(系统)和计算机程序产品的流程图和/或框图描述了本申请的各个方面。应当理解，流程图和/或框图的每个方框以及流程图和/或框图中各 方框的组合，都可以由计算机可读程序指令实现。
这些计算机可读程序指令可以提供给通用计算机、专用计算机或其它可编程数据处理装置的处理器，从而生产出一种机器，使得这些指令在通过计算机或其它可编程数据处理装置的处理器执行时，产生了实现流程图和/或框图中的一个或多个方框中规定的功能/动作的装置。也可以把这些计算机可读程序指令存储在计算机可读存储介质中，这些指令使得计算机、可编程数据处理装置和/或其他设备以特定方式工作，从而，存储有指令的计算机可读介质则包括一个制造品，其包括实现流程图和/或框图中的一个或多个方框中规定的功能/动作的各个方面的指令。
也可以把计算机可读程序指令加载到计算机、其它可编程数据处理装置、或其它设备上，使得在计算机、其它可编程数据处理装置或其它设备上执行一系列操作步骤，以产生计算机实现的过程，从而使得在计算机、其它可编程数据处理装置、或其它设备上执行的指令实现流程图和/或框图中的一个或多个方框中规定的功能/动作。
附图中的流程图和框图显示了根据本申请的多个实施例的装置、系统、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段或指令的一部分，所述模块、程序段或指令的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个连续的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。
也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合，可以用执行相应的功能或动作的硬件(例如电路或ASIC(Application Specific Integrated Circuit，专用集成电路))来实现，或者可以用硬件和软件的组合，如固件等来实现。
尽管在此结合各实施例对本发明进行了描述，然而，在实施所要求保护的本发明过程中，本领域技术人员通过查看所述附图、公开内容、以及所附权利要求书，可理解并实现所述公开实施例的其它变化。在权利要求中，“包括”(comprising)一词不排除其他组成部分或步骤，“一”或“一个”不排除多个的情况。单个处理器或其它单元可以实现权利要求中列举的若干项功能。相互不同的从属权利要求中记载了某些措施，但这并不表示这些措施不能组合起来产生良好的效果。
以上已经描述了本申请的各实施例，上述说明是示例性的，并非穷尽性的，并且也不限于所披露的各实施例。在不偏离所说明的各实施例的范围和精神的情况下，对于本技术领域的普通技术人员来说许多修改和变更都是显而易见的。本文中所用术语的选择，旨在最好地解释各实施例的原理、实际应用或对市场中的技术的改进，或者使本技术领域的其它普通技术人员能理解本文披露的各实施例。

Claims (18)

  1. 一种身份信息处理方法，其特征在于，包括：
    终端设备从凭证签发设备获取与多个第一用户信息对应的第一集合，其中，所述第一集合包括第一加密信息集合和第一凭证信息集合，所述第一加密信息集合包括对所述多个第一用户信息进行对应加密后的多个第一加密信息，所述第一凭证信息集合包括对所述多个第一用户信息执行签发处理后的多个第一凭证信息；
    所述终端设备基于所述第一集合中的第一加密信息集合和第一凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括所述多个第一用户信息中的目标用户信息以及所述多个第一凭证信息中与所述目标用户信息对应的目标凭证信息；
    所述终端设备向所述凭证验证设备提供所述目标验证集合。
  2. 如权利要求1所述的方法，其特征在于，所述终端设备从凭证签发设备获取与所述多个第一用户信息对应的第一集合，包括：
    所述终端设备利用与所述终端设备对应的第一区块链节点，获取与凭证签发设备对应的第二区块链节点提供的所述第一集合。
  3. 如权利要求1所述的方法，其特征在于，所述终端设备从凭证签发设备获取与所述多个第一用户信息对应的第一集合，包括：
    所述终端设备提出数据请求；
    所述凭证签发设备将从本地或者云存储获取所述第一集合来响应所述终端设备提出的所述数据请求。
  4. 如权利要求1至3中的任一权利要求所述的方法，其特征在于，还包括：
    所述终端设备获取与多个第二用户信息对应的第二集合，其中，所述第二集合包括第二加密信息集合和第二凭证信息集合，所述第二加密信息集合包括所述多个第二用户信息进行对应加密后的多个第二加密信息，所述第二凭证信息集合包括对所述多个第二用户信息执行签发处理后的多个第二凭证信息。
  5. 如权利要求4所述的方法，其特征在于，还包括：
    所述终端设备基于所述第二集合中的第二加密信息集合和第二凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括所述目标用户信息和与所述目标用户信息对应的目标凭证信息，其中，所述目标验证集合包括：所述多个第二用户信息中的目标用户信息以及所述多个第二凭证信息中与所述目标用户信息对应的目标 凭证信息。
  6. 如权利要求4所述的方法，其特征在于，所述终端设备基于所述第一集合中的第一加密信息集合和第一凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，包括：
    所述终端设备基于所述第一集合中的第一加密信息集合和第一凭证信息集合以及所述第二集合中的第二加密信息集合和第二凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括：所述多个第一用户信息和所述多个第二用户信息中的目标用户信息以及所述多个第一凭证信息和所述多个第二凭证信息中与所述目标用户信息对应的目标凭证信息。
  7. 如权利要求1所述的方法，其特征在于，所述第一集合还包括所述凭证签发设备对所述多个第一凭证信息进行集体签名后获取的第一签名信息。
  8. 如权利要求7所述的方法，其特征在于，所述终端设备在向所述凭证验证设备提供所述目标验证集合后，还包括：
    所述终端设备向所述凭证验证设备提供所述第一凭证信息集合以及所述第一签名信息。
  9. 一种身份信息处理方法，其特征在于，包括：
    凭证验证设备接收服务请求；
    所述凭证验证设备从终端设备获取目标验证集合，其中，所述目标验证集合包括与服务对应的目标用户信息和目标凭证信息；
    所述凭证验证设备对所述目标验证集合进行验证，向所述终端设备提供凭证验证信息，其中，所述凭证验证信息用于指示所述目标验证集合是否通过验证。
  10. 如权利要求9所述的方法，其特征在于，还包括：
    所述凭证验证设备从所述终端设备获取第一凭证信息集合和第一签名信息，其中，第一凭证信息集合是包括多个第一凭证信息，第一签名信息是对所述多个第一凭证信息进行集体签名后获取的信息。
  11. 一种终端设备，其特征在于，包括：
    集合获取单元，用于从凭证签发设备获取与多个第一用户信息对应的第一集合，其中，所述第一集合包括第一加密信息集合和第一凭证信息集合，所述第一加密信息集合包括对所述多个第一用户信息进行对应加密后的多个第一加密信息，所述第一凭证信息集合包括对所述多个第一用户信息执行签发处理后的多个第一凭证信息；
    目标验证集合确定单元，用于基于所述第一集合中的第一加密信息集合和第一凭证信息 集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括所述多个第一用户信息中的目标用户信息以及所述多个第一凭证信息中与所述目标用户信息对应的目标凭证信息；
    目标验证集合提供单元，用于向所述凭证验证设备提供所述目标验证集合。
  12. 如权利要求11所述的终端设备，其特征在于，所述集合获取单元还用于获取与多个第二用户信息对应的第二集合，其中，所述第二集合包括第二加密信息集合和第二凭证信息集合，所述第二加密信息集合包括所述多个第二用户信息进行对应加密后的多个第二加密信息，所述第二凭证信息集合包括对所述多个第二用户信息执行签发处理后的多个第二凭证信息。
  13. 如权利要求12所述的终端设备，其特征在于，所述验证集合确定单元还用于基于所述第二集合中的第二加密信息集合和第二凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括所述目标用户信息和与所述目标用户信息对应的目标凭证信息，其中，所述目标验证集合包括：所述多个第二用户信息中的目标用户信息以及所述多个第二凭证信息中与所述目标用户信息对应的目标凭证信息。
  14. 如权利要求12所述的终端设备，其特征在于，所述验证集合确定单元还用于基于所述第一集合中的第一加密信息集合和第一凭证信息集合以及所述第二集合中的第二加密信息集合和第二凭证信息集合，确定与所述用户的目标用户信息对应的目标验证集合，其中，所述目标验证集合包括：所述多个第一用户信息和所述多个第二用户信息中的目标用户信息以及所述多个第一凭证信息和所述多个第二凭证信息中与所述目标用户信息对应的目标凭证信息。
  15. 一种凭证验证设备，其特征在于，包括：
    接收单元，用于接收服务请求；
    目标验证集合获取单元，用于从终端设备获取目标验证集合，其中，所述目标验证集合包括与服务对应的目标用户信息和目标凭证信息；
    凭证验证信息提供单元，用于对所述目标验证集合进行验证，向所述终端设备提供凭证验证信息，其中，所述凭证验证信息用于指示所述目标验证集合是否通过验证。
  16. 一种身份信息验证设备，其特征在于，包括：
    处理器；
    用于存储处理器可执行指令的存储器；
    其中，所述处理器被配置为执行所述指令时实现权利要求1-8任意一项所述的方法，或者权利要求9-10任意一项所述的方法。
  17. 一种非易失性计算机可读存储介质，其上存储有计算机程序指令，其特征在于，所述计算机程序指令被处理器执行时实现权利要求1-8任意一项所述的方法，或者权利要求9-10任意一项所述的方法的步骤。
  18. 一种计算机程序产品，其特征在于，所述计算机程序产品包括指令，所述指令用于指示服务器执行权利要求1-8任意一项所述的方法的步骤，或者权利要求9-10任意一项所述的方法的步骤。
PCT/CN2021/127425 2021-01-26 2021-10-29 身份信息处理方法、设备及系统 WO2022160829A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21922420.1A EP4270226A4 (en) 2021-01-26 2021-10-29 METHOD, DEVICE AND SYSTEM FOR PROCESSING IDENTITY INFORMATION
US18/359,252 US20230379155A1 (en) 2021-01-26 2023-07-26 Identity Information Processing Method, Device, and System

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110106249.0 2021-01-26
CN202110106249.0A CN114792004A (zh) 2021-01-26 2021-01-26 身份信息处理方法、设备及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/359,252 Continuation US20230379155A1 (en) 2021-01-26 2023-07-26 Identity Information Processing Method, Device, and System

Publications (1)

Publication Number Publication Date
WO2022160829A1 true WO2022160829A1 (zh) 2022-08-04

Family

ID=82459238

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/127425 WO2022160829A1 (zh) 2021-01-26 2021-10-29 身份信息处理方法、设备及系统

Country Status (4)

Country Link
US (1) US20230379155A1 (zh)
EP (1) EP4270226A4 (zh)
CN (1) CN114792004A (zh)
WO (1) WO2022160829A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115941186A (zh) * 2023-03-13 2023-04-07 北京泰尔英福科技有限公司 抗量子破解的多凭证验证方法、装置及非易失性存储介质
CN116192540A (zh) * 2023-05-05 2023-05-30 敏于行(北京)科技有限公司 动态组合可验证凭证的验证方法及系统

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20230038940A1 (en) * 2021-08-04 2023-02-09 Dashlane SAS Multiple Relying Parties in a Single-Sign-On Environment
CN115694842B (zh) * 2022-11-09 2024-02-20 中煤科工集团信息技术有限公司 工业互联网设备互信及数据交换方法、装置及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101155032A (zh) * 2006-09-25 2008-04-02 日电（中国）有限公司 匿名可选择凭证系统及其方法
CN104125485A (zh) * 2014-07-02 2014-10-29 深圳创维数字技术股份有限公司 一种用户信息共享的方法、设备及系统
CN104125199A (zh) * 2013-04-25 2014-10-29 中国科学院软件研究所 一种基于属性的匿名认证方法及系统
CN106533681A (zh) * 2015-09-11 2017-03-22 中国科学院软件研究所 一种支持部分出示的属性证明方法与系统
CN111931154A (zh) * 2020-10-10 2020-11-13 支付宝(杭州)信息技术有限公司 基于数字凭证的业务处理方法、装置及设备

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2517127A (en) * 2013-05-29 2015-02-18 Ibm Method for deriving a verification token from a credential
WO2019191213A1 (en) * 2018-03-27 2019-10-03 Workday, Inc. Digital credential authentication

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101155032A (zh) * 2006-09-25 2008-04-02 日电（中国）有限公司 匿名可选择凭证系统及其方法
CN104125199A (zh) * 2013-04-25 2014-10-29 中国科学院软件研究所 一种基于属性的匿名认证方法及系统
CN104125485A (zh) * 2014-07-02 2014-10-29 深圳创维数字技术股份有限公司 一种用户信息共享的方法、设备及系统
CN106533681A (zh) * 2015-09-11 2017-03-22 中国科学院软件研究所 一种支持部分出示的属性证明方法与系统
CN111931154A (zh) * 2020-10-10 2020-11-13 支付宝(杭州)信息技术有限公司 基于数字凭证的业务处理方法、装置及设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4270226A4

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115941186A (zh) * 2023-03-13 2023-04-07 北京泰尔英福科技有限公司 抗量子破解的多凭证验证方法、装置及非易失性存储介质
CN115941186B (zh) * 2023-03-13 2023-05-05 北京泰尔英福科技有限公司 抗量子破解的多凭证验证方法、装置及非易失性存储介质
CN116192540A (zh) * 2023-05-05 2023-05-30 敏于行(北京)科技有限公司 动态组合可验证凭证的验证方法及系统
CN116192540B (zh) * 2023-05-05 2023-07-11 敏于行(北京)科技有限公司 动态组合可验证凭证的验证方法及系统

Also Published As

Publication number Publication date
EP4270226A4 (en) 2024-05-29
US20230379155A1 (en) 2023-11-23
EP4270226A1 (en) 2023-11-01
CN114792004A (zh) 2022-07-26

Similar Documents

Publication Publication Date Title
WO2022160829A1 (zh) 身份信息处理方法、设备及系统
US11399079B2 (en) Zero-knowledge environment based networking engine
US11665147B2 (en) Blockchain systems and methods for user authentication
US20200274859A1 (en) User authentication system with self-signed certificate and identity verification with offline root certificate storage
US9965645B2 (en) Field level data protection for cloud services using asymmetric cryptography
US20210287770A1 (en) Electronic patient credentials
US10097558B2 (en) Delegated permissions in a distributed electronic environment
US11544394B2 (en) Information processing apparatus and method for processing information
US20160300223A1 (en) Protected data transfer across disparate networks
AU2019217241B2 (en) Systems and methods for use in managing digital identities
US20150326548A1 (en) Management of digital assets
US20230043361A1 (en) Modular data processing and storage system
KR20210131031A (ko) 블록체인 상의 스마트 계약을 이용한 사용자 키 관리 방법
US9756031B1 (en) Portable access to auditing information
US11689375B2 (en) Data in transit protection with exclusive control of keys and certificates across heterogeneous distributed computing environments
JP2023001908A (ja) 下流制御を用いた文書の配布および追跡
JP6542401B2 (ja) メッセージ終端間暗号化のためのキーチェーン管理方法およびシステム
WO2022218410A1 (zh) 数字货币的导出方法、充值方法、装置及系统
US20240045979A1 (en) Blockchain managed access system
TW201512881A (zh) 一種辨識系統及方法
TWM470986U (zh) 一種電子裝置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21922420

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021922420

Country of ref document: EP

Effective date: 20230724

NENP Non-entry into the national phase

Ref country code: DE