CN117978404A - Trusted digital identity issuing and distributed authentication method - Google Patents

Abstract

The invention discloses a method for trusted digital identity issuing and distributed authentication, which comprises three stages of trusted digital identity issuing, service credential issuing, combined identity statement creation and verification. The method takes the trusted identity of the authoritative network as a trust root, and then issues the basic digital identity mark, the basic digital identity certificate and the business certificate, so that the advantages of the blockchain and the distributed digital identity technology are maintained, the final tracing of the real identity of the user through the trusted digital identity is supported, the construction requirement of a network trusted identity management service system is met, the distributed application ecology is supported, the identity management and service system is supplemented and expanded, and the market potential is huge.

Description

A method for issuing and distributing trusted digital identities

Technical Field

The present invention relates to the field of network security technology, and in particular to a method for issuing and distributing a trusted digital identity.

Background technique

Digital identity is one of the key elements in building a trust system in the digital economy era, and is also the key to making the Internet controllable, manageable, secure and reliable.

Distributed digital identity is realized through blockchain technology. Identity owners, i.e. users, can independently control and manage their own digital identities. Data ownership is returned to users to solve privacy and security issues, and interoperability across applications is provided by formulating standard protocols. Blockchain's features such as difficulty in tampering and evidence tracing can further ensure the authenticity and validity of data. When confirming or verifying the attribute information of circulating digital identities, the decentralized characteristics of blockchain technology can be fully utilized. Distributed digital identity provides a new technical development direction for digital identity, and has attracted much attention from the government and industry.

Existing technical solutions generally follow the distributed digital identity DID-related standards of the international standards organization W3C Alliance and DIF (Decentralized Identity Organization). W3C mainly focuses on DID specifications, while DIF is committed to improving the interoperability of DID. Users can create, update, and delete DIDs in a decentralized, autonomous and anonymous manner and register them on the blockchain through smart contracts. Users are not required to complete real identity authentication before registration.

The workflow of the existing scheme is as follows: (1) The user, i.e., the credential holder and the credential issuer, registers the self-created distributed digital identity DID identifier on the blockchain through a smart contract, and stores the DID document containing the public key on the blockchain; (2) The user applies for a verifiable credential VC from the credential issuer and stores it in the terminal security area, and the credential issuer stores the status of the verifiable credential VC (whether it has been revoked) on the blockchain; (3) The user creates a verifiable expression VP based on the verifiable credential VC according to the business needs of the verifier, and presents it to the verifier for verification; (4) The credential verifier retrieves the DID document and VC status on the blockchain, and verifies the digital signature and validity (not revoked, etc.) of the verifiable credential VC contained in the verifiable expression VP.

The construction of my country's network trusted identity needs to meet the needs of front-end anonymity, back-end real-name, privacy and security, cross-domain trust, economy and ease of use. On the one hand, network trusted identity should support "front-end anonymous use". Natural persons can use network trusted identity authentication services to complete identity authentication and user authentication of network applications. Network applications can perform "controllable anonymization" transformation of account systems to reduce the use and retention of personal identity plaintext data and effectively protect citizens' information and personal privacy. On the other hand, network trusted identity should support "back-end real-name management" and can be traced back to the real identity of individuals through national authoritative agencies. Although the distributed digital identity technology proposed by W3C has technical characteristics such as autonomy and anonymity, and has made a lot of careful designs in protecting users' personal privacy, it does not meet the requirements of network real-name management.

Summary of the invention

In view of the deficiencies of the prior art, the present invention aims to provide a method for issuing a trusted digital identity and distributed authentication.

In order to achieve the above object, the present invention adopts the following technical solution:

A method for trusted digital identity issuance and distributed authentication, including three stages: trusted digital identity issuance, business credential issuance, and joint identity claim creation and verification;

1. The specific process of issuing a trusted digital identity is as follows:

A1. Users apply for a trusted digital identity through a digital identity application terminal. The trusted digital identity includes a basic digital identity identifier and a basic digital identity certificate. The digital identity application terminal creates a public-private key pair locally and stores it in encrypted form locally.

A2. Digital identity application terminals require users to verify their real identity, enter their identity information and collect their faces;

A3. The digital identity application terminal submits the identity information submitted by the user, the face image that has passed the liveness detection, and the created user public key to the digital identity distributed application platform. The digital identity distributed application platform forwards the user's identity information and face image to the authoritative identity authentication platform to complete the user's real identity verification;

A4. If the user's real identity verification is successful, the authoritative identity authentication platform returns the user's network trusted identity to the digital identity distributed application platform and proceeds to step A5; if the user's real identity information verification fails, the digital identity distributed application platform notifies the user of the application failure through the digital identity application terminal;

A5. The digital identity distributed application platform creates a basic digital identity, i.e., a basic DID, and a basic digital identity document, i.e., a basic DID document, for the user, and stores the mapping relationship between the user's network trusted identity and the basic DID in the database. At the same time, it creates a basic digital identity certificate according to the data format specified by the basic digital identity certificate template and signs it.

A6. The digital identity distributed application platform calls the digital identity chain smart contract to store the hash and status of the user's basic DID document and basic digital identity credentials on the digital identity chain;

A7. The digital identity distributed application platform returns the user's basic DID, basic DID document, and signature value of the basic-level digital identity credential to the digital identity application terminal;

A8. The digital identity application terminal assembles the identity information submitted by the user and the signature value of the basic digital identity certificate returned by the digital identity distributed application platform to generate a local basic digital identity certificate of the terminal, and encrypts and stores it together with the basic DID returned by the digital identity distributed application platform in the local security area of the terminal;

2. The specific process for issuing business vouchers is as follows:

B1. When a user needs to apply for a business certificate from a business system, he/she uses a digital identity application terminal to sign the basic digital identity certificate on the terminal with the user's private key and submit it to the business system;

B2. The business system accesses the digital identity chain, verifies the user signature of the basic digital identity certificate submitted by the user and the signature of the digital identity distributed application platform, and verifies the status of the basic digital identity certificate submitted by the user, confirming that the status of the basic digital identity certificate is valid;

B3. After verification, the business system issues a business certificate to the user based on the user's basic DID;

B4. The business system stores the hash and status of the business certificate issued in step B3 on the corresponding business chain;

B5. The digital identity application terminal receives the business certificate issued by the business system and encrypts and stores it in a secure area on the terminal.

3. The specific process of creating and verifying a joint identity claim is as follows:

C1. In a certain business scenario, when the verifier needs to verify the business credentials of the relevant business system, the verifier system first requires the user to use the digital identity application terminal to present the joint identity statement according to the joint identity statement template specified in the business scenario. After the user's authorization, the digital identity application terminal combines the business credentials issued by the relevant business system with the basic digital identity credentials of the terminal in the format specified by the joint identity statement template, creates a joint identity statement after signing with the user's private key, and encrypts the joint identity statement with the public key of the verifier and transmits it to the verifier system. The verifier system obtains the joint identity statement after decrypting it with the private key of the verifier;

C2. The digital identity application terminal will store the log record of the authorization of the joint identity statement to the verification system on the digital identity chain;

C3. The verification system queries the digital identity distributed application platform, related business systems, and the user's basic DID documents through any node on the digital identity chain; obtains the public key information of the digital identity distributed application platform and the user from the digital identity distributed application platform and the user's basic DID documents, verifies the user signature of the joint identity statement and the signature of the digital identity distributed application platform of the basic digital identity certificate in the joint identity statement, and confirms that the status of the basic digital identity certificate is valid and the user agrees to the authorization;

C4. The verification system reads the public key in the basic DID document of each relevant business system, verifies the signature of the corresponding business system carried by each business certificate, accesses the business chain of each relevant business system, queries and obtains the hash and status of each business certificate, and confirms that each business certificate is valid;

C5. After the verification system completes the verification of the joint identity claim, it continues with the subsequent business process.

Furthermore, in the above method, the digital identity distributed application platform can revoke the issued basic-level digital identity certificate. If the basic-level digital identity certificate is revoked, the revocation status of the basic-level digital identity certificate will also be stored in the digital identity chain; the user can apply to the digital identity distributed application platform to freeze or unfreeze the basic-level digital identity certificate applied for, and the freezing and unfreezing status of the basic-level digital identity certificate will also be stored in the digital identity chain.

The beneficial effects of the present invention are as follows: the present invention proposes a method for issuing and distributing a trusted digital identity that supports anonymous use in the foreground and real-name management in the background, which complies with the requirements for network real-name management, takes an authoritative network trusted identity as the trust root, and then issues a basic-level digital identity identifier, a basic-level digital identity certificate, and a business certificate. While retaining the advantages of blockchain and distributed digital identity technology, such as the multi-party consensus co-construction ecology, the difficult-to-tamper trusted flow of on-chain data, user autonomous authorization, personal data asset confirmation, privacy protection, and high reliability of distributed authentication, elimination of single point failures, and the verification party not relying on the issuer to complete identity authentication, the present invention supports tracing back to the user's real identity through a trusted digital identity, complies with the requirements for the construction of a network trusted identity management service system, supports a distributed application ecology, and is a supplement and expansion of the identity management and service system, with huge market potential.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of issuing a trusted digital identity in Embodiment 1 of the present invention;

FIG2 is a flow chart of issuing a business voucher in Embodiment 1 of the present invention;

FIG3 is a flowchart of joint identity claim creation and verification in Embodiment 1 of the present invention;

FIG4 is a flow chart of issuing a business voucher in Embodiment 2 of the present invention;

FIG5 is a flowchart of joint identity claim creation and verification in Embodiment 2 of the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

Example 1

This embodiment provides a method for trusted digital identity issuance and distributed authentication, including three stages: trusted digital identity issuance, business credential issuance, and joint identity claim creation and verification;

1. As shown in Figure 1, the specific process of issuing a trusted digital identity is as follows:

A1. Users apply for a trusted digital identity through a digital identity application terminal. The trusted digital identity includes a basic digital identity identifier and a basic digital identity certificate. The digital identity application terminal creates a public-private key pair locally and stores it in encrypted form locally.

A2. Digital identity application terminals require users to verify their real identity, enter their identity information and collect their faces;

A3. The digital identity application terminal submits the identity information submitted by the user, the face image that has passed the liveness detection, and the created user public key to the digital identity distributed application platform. The digital identity distributed application platform forwards the user's identity information and face image to the authoritative identity authentication platform to complete the user's real identity verification;

A4. If the user's real identity verification is successful, the authoritative identity authentication platform returns the user's network trusted identity to the digital identity distributed application platform and proceeds to step A5; if the user's real identity information verification fails, the digital identity distributed application platform notifies the user of the application failure through the digital identity application terminal;

A5. The digital identity distributed application platform creates a basic digital identity, i.e., a basic DID, and a basic digital identity document, i.e., a basic DID document, for the user, and stores the mapping relationship between the user's network trusted identity and the basic DID in the database. At the same time, it creates a basic digital identity certificate according to the data format specified by the basic digital identity certificate template and signs it.

A6. The digital identity distributed application platform calls the digital identity chain smart contract to store the hash and status of the user's basic DID document and basic digital identity certificate on the digital identity chain; the digital identity distributed application platform can revoke the issued basic digital identity certificate. If the basic digital identity certificate is revoked, the revocation status of the basic digital identity certificate will also be stored on the digital identity chain; users can also apply to the digital identity distributed application platform to freeze or unfreeze the basic digital identity certificate they have applied for, and the freezing and unfreezing status of the basic digital identity certificate will also be stored on the digital identity chain;

A7. The digital identity distributed application platform returns the user's basic DID, basic DID document, and signature value of the basic-level digital identity credential to the digital identity application terminal;

A8. The digital identity application terminal assembles the identity information submitted by the user and the signature value of the basic-level digital identity certificate returned by the digital identity distributed application platform to generate a basic-level digital identity certificate local to the terminal, and encrypts and stores it together with the basic DID returned by the digital identity distributed application platform in a secure area local to the terminal.

2. As shown in Figure 2, the specific process of issuing business vouchers is as follows:

B1. When a user needs to apply for a business certificate from a business system, he/she uses a digital identity application terminal to sign the basic digital identity certificate on the terminal with the user's private key and submit it to the business system;

B2. The business system accesses the digital identity chain, verifies the user signature of the basic digital identity certificate submitted by the user and the signature of the digital identity distributed application platform, and verifies the status of the basic digital identity certificate submitted by the user, confirming that the status of the basic digital identity certificate is valid (not revoked or frozen);

B3. After verification, the business system issues a business certificate to the user based on the user's basic DID;

B4. The business system stores the hash and status of the business certificate issued in step B3 on the corresponding business chain;

B5. The digital identity application terminal receives the business credentials issued by the business system and encrypts and stores them in a secure area on the terminal.

3. As shown in Figure 3, the specific process of creating and verifying a joint identity claim is as follows:

C1. In a certain business scenario, when the verifier needs to verify the business credentials of the relevant business system, the verifier system first requires the user to use the digital identity application terminal to present the joint identity statement according to the joint identity statement template specified in the business scenario. After the user's authorization, the digital identity application terminal combines the business credentials issued by the relevant business system (such as business credentials VC-A issued by business system A and business credentials VC-B issued by business system B) with the basic digital identity credentials of the terminal in the format specified by the joint identity statement template, creates a joint identity statement after signing with the user's private key, and encrypts the joint identity statement with the public key of the verifier and transmits it to the verifier system. The verifier system obtains the joint identity statement after decrypting it with the private key of the verifier;

C2. The digital identity application terminal will store the log record of the authorization of the joint identity statement to the verification system on the digital identity chain;

C3. The verification system queries the digital identity distributed application platform, related business systems, and the user's basic DID documents through any node on the digital identity chain; obtains the public key information of the digital identity distributed application platform and the user from the digital identity distributed application platform and the user's basic DID documents, verifies the user signature of the joint identity statement and the signature of the digital identity distributed application platform of the basic digital identity certificate in the joint identity statement, and confirms that the status of the basic digital identity certificate is valid (not revoked or frozen), and the user agrees to the authorization;

C4. The verification system reads the public key in the basic DID document of each relevant business system, verifies the signature of the corresponding business system carried by each business certificate, accesses the business chain of each relevant business system, queries and obtains the hash and status of each business certificate, and confirms that each business certificate is valid (not revoked or frozen);

C5. After the verification system completes the verification of the joint identity claim, it continues with the subsequent business process.

In the above method, users can apply for a trusted digital identity through a digital identity application terminal. After the digital identity distributed application platform verifies the user's real identity through an authoritative identity authentication platform, it "centrally issues" a basic digital identity identifier and a basic digital identity certificate for the user, and stores the DID document containing the user's public key and the basic digital identity certificate status on a digital identity chain where multiple parties participate in consensus and data is difficult to tamper with. The basic DID is generated by an encrypted transformation of an authoritative network trusted identity, institutional information, and timestamp. The digital identity distributed application platform stores the mapping relationship between the network trusted identity and the basic DID in the database to support tracing from the anonymous basic DID to the network trusted identity, and then from the network trusted identity to the user's real identity, realizing anonymous use in the foreground and real-name management in the background.

Business systems that are authorized to access the digital identity chain can reissue business credentials for users based on trusted digital identity credentials and business chains. The basic digital identity credentials and business credentials held by users are aggregated in the digital identity application terminal. When users are handling business, they can use the digital identity application terminal to flexibly combine the data of the basic digital identity credentials and multiple business credentials according to the requirements of the business scenario, generate a joint identity statement after the user's signature, realize the aggregation of the identity attributes and business attributes of the same natural person, and autonomously authorize the presentation to the verifier. The verifier accesses the "distributed authentication" digital signature of any node in the digital identity chain and the validity of the basic digital identity certificate, and accesses the "distributed authentication" of any node in the business chain to verify the validity of the business credentials. After the verification is passed, the subsequent business process is processed.

Example 2

This embodiment provides an application example of the method described in Embodiment 1.

This embodiment is a scenario where a user joins a company. When the user joins the company, he needs to submit his salary flow, education certificate and personal identity information for the past year to the company's information system. After being reviewed and found to meet the company's relevant requirements, he can go through the on-boarding process.

1. The user applies for a trusted digital identity according to the process of the method in Example 1.

2. The process of applying for the user's salary voucher and academic certificate is shown in Figure 4:

(1) The user opens the digital identity application terminal APP, submits the basic digital identity certificate signed with the user's personal private key, and applies for a degree certificate from University A;

(2) University A accesses the digital identity chain, verifies the user signature of the basic digital identity certificate submitted by the user and the signature of the digital identity distributed application platform, and confirms that the status of the basic digital identity certificate is valid and has not been revoked or frozen;

(3) After University A passes the verification, it issues a diploma certificate to the user based on the user's basic DID;

(4) University A stores the hash and status (valid) of the academic certificate on the education industry chain;

(5) The user continues to use the digital identity application terminal APP, submits the basic digital identity certificate signed with the personal private key, and applies for a salary slip from Bank A;

(6) Bank A accesses the digital identity chain, verifies the user signature in the basic digital identity certificate and the signature of the digital identity distributed application platform, and confirms that the status of the basic digital identity certificate is valid and has not been revoked or frozen;

(7) After verification, Bank A issues a salary voucher to the user based on the user's basic DID;

(8) Bank A stores the hash and status (valid) of the salary slip on the financial industry chain;

(9) The digital identity application terminal APP obtains the academic certificate and salary flow certificate and stores them in the local secure area of the terminal.

3. The submission and verification process of the user's onboarding materials is shown in Figure 5:

(1) The user submits relevant onboarding materials according to the process requirements of a certain enterprise, and uses the digital identity application terminal APP. After the user's authorization, the basic digital identity certificate, academic certificate and salary slip certificate applied by the user are combined according to the joint identity declaration template pre-set by the enterprise, that is, the required onboarding materials, to create a joint identity declaration signed by the user's private key, which is encrypted with the enterprise's public key and submitted to the enterprise's information system. After receiving the encrypted data of the joint identity certificate submitted by the user, the enterprise's information system uses its private key to decrypt it and obtain the joint identity declaration submitted by the user.

(2) The digital identity application terminal APP authorizes the joint identity statement to be recorded in the log of a certain enterprise information system and stored in the digital identity chain;

(3) The enterprise's information system accesses the digital identity chain, queries the basic DID document of the digital identity distributed application platform, the user's basic DID document, the basic DID document of University A, and the basic DID document of Bank A, verifies the user signature of the joint identity declaration, the signature of the digital identity distributed application platform of the basic-level digital identity certificate, and confirms that the status of the basic-level digital identity certificate is valid (not revoked or frozen).

(4) The enterprise's information system verifies the signature of University A on the diploma certificate and accesses the education industry chain to obtain the diploma status of the diploma and confirm that the diploma is valid (not revoked or frozen).

(5) The enterprise's information system verifies the signature of Bank A on the payroll voucher and accesses the financial industry chain to obtain the status of the payroll voucher and confirm that the payroll voucher is valid (not revoked or frozen).

(6) The enterprise completes the verification of all onboarding materials (including academic certificates, salary receipts and basic digital identity certificates), and the acquisition of all onboarding materials is authorized by the user. If the verification is passed and the user meets the enterprise's onboarding qualification requirements, the enterprise can handle the subsequent onboarding process for the user.

For those skilled in the art, various corresponding changes and modifications can be made according to the above technical solutions and concepts, and all of these changes and modifications should be included in the protection scope of the claims of the present invention.

Claims (2)

1. A method for issuing a trusted digital identity and distributed authentication, characterized by comprising three stages: issuing a trusted digital identity, issuing a business credential, and creating and verifying a joint identity statement; 1. The specific process of issuing a trusted digital identity is as follows: A1. Users apply for a trusted digital identity through a digital identity application terminal. The trusted digital identity includes a basic digital identity identifier and a basic digital identity certificate. The digital identity application terminal creates a public-private key pair locally and stores it in encrypted form locally. A2. Digital identity application terminals require users to verify their real identity, enter their identity information and collect their faces; A3. The digital identity application terminal submits the identity information submitted by the user, the face image that has passed the liveness detection, and the created user public key to the digital identity distributed application platform. The digital identity distributed application platform forwards the user's identity information and face image to the authoritative identity authentication platform to complete the user's real identity verification; A4. If the user's real identity verification is successful, the authoritative identity authentication platform returns the user's network trusted identity to the digital identity distributed application platform and proceeds to step A5; if the user's real identity information verification fails, the digital identity distributed application platform notifies the user of the application failure through the digital identity application terminal; A5. The digital identity distributed application platform creates a basic digital identity, i.e., a basic DID, and a basic digital identity document, i.e., a basic DID document, for the user, and stores the mapping relationship between the user's network trusted identity and the basic DID in the database. At the same time, it creates a basic digital identity certificate according to the data format specified by the basic digital identity certificate template and signs it. A6. The digital identity distributed application platform calls the digital identity chain smart contract to store the hash and status of the user's basic DID document and basic digital identity credentials on the digital identity chain; A7. The digital identity distributed application platform returns the user's basic DID, basic DID document, and signature value of the basic-level digital identity credential to the digital identity application terminal; A8. The digital identity application terminal assembles the identity information submitted by the user and the signature value of the basic digital identity certificate returned by the digital identity distributed application platform to generate a local basic digital identity certificate of the terminal, and encrypts and stores it together with the basic DID returned by the digital identity distributed application platform in the local security area of the terminal; 2. The specific process for issuing business vouchers is as follows: B1. When a user needs to apply for a business certificate from a business system, he/she uses a digital identity application terminal to sign the basic digital identity certificate on the terminal with the user's private key and submit it to the business system; B2. The business system accesses the digital identity chain, verifies the user signature of the basic digital identity certificate submitted by the user and the signature of the digital identity distributed application platform, and verifies the status of the basic digital identity certificate submitted by the user, confirming that the status of the basic digital identity certificate is valid; B3. After verification, the business system issues a business certificate to the user based on the user's basic DID; B4. The business system stores the hash and status of the business certificate issued in step B3 on the corresponding business chain; B5. The digital identity application terminal receives the business certificate issued by the business system and encrypts and stores it in a secure area on the terminal. 3. The specific process of creating and verifying a joint identity claim is as follows: C1. In a certain business scenario, when the verifier needs to verify the business credentials of the relevant business system, the verifier system first requires the user to use the digital identity application terminal to present the joint identity statement according to the joint identity statement template specified in the business scenario. After the user's authorization, the digital identity application terminal combines the business credentials issued by the relevant business system with the basic digital identity credentials of the terminal in the format specified by the joint identity statement template, creates a joint identity statement after signing with the user's private key, and encrypts the joint identity statement with the public key of the verifier and transmits it to the verifier system. The verifier system obtains the joint identity statement after decrypting it with the private key of the verifier; C2. The digital identity application terminal will store the log record of the authorization of the joint identity statement to the verification system on the digital identity chain; C3. The verification system queries the digital identity distributed application platform, related business systems, and the user's basic DID documents through any node on the digital identity chain; obtains the public key information of the digital identity distributed application platform and the user from the digital identity distributed application platform and the user's basic DID documents, verifies the user signature of the joint identity statement and the signature of the digital identity distributed application platform of the basic digital identity certificate in the joint identity statement, and confirms that the status of the basic digital identity certificate is valid and the user agrees to the authorization; C4. The verification system reads the public key in the basic DID document of each relevant business system, verifies the signature of the corresponding business system carried by each business certificate, accesses the business chain of each relevant business system, queries and obtains the hash and status of each business certificate, and confirms that each business certificate is valid; C5. After the verification system completes the verification of the joint identity claim, it continues with the subsequent business process. 2. The method according to claim 1 is characterized in that the digital identity distributed application platform can revoke the issued basic-level digital identity certificate. If the basic-level digital identity certificate is revoked, the revocation status of the basic-level digital identity certificate will also be stored in the digital identity chain; the user can apply to the digital identity distributed application platform to freeze or unfreeze the basic-level digital identity certificate applied for, and the freezing and unfreezing status of the basic-level digital identity certificate will also be stored in the digital identity chain.