CN113194082B - Identity verification method based on block chain, block chain platform and operator platform - Google Patents

Abstract

The present disclosure provides an identity verification method, a block chain platform and an operator platform based on a block chain, wherein the method comprises: receiving an identity authentication request sent by a server of a first application program, and acquiring a private key in the identity authentication request; responding to a public key and a private key signature corresponding to the private key which are inquired in the block chain account book, and sending a verification request carrying the private key to an operator platform; and responding to the received verification passing message carrying the user digital identity information returned by the operator platform, and sending the verification passing message carrying the user digital identity information to the server of the first application program. Anonymous login is realized, and the digital identity information of the user is ensured not to be tampered. The method has the advantages that the safety and controllability in the authorized login scene are greatly improved, the privacy and safety of the personal information of the user are protected, meanwhile, a convenient and efficient mode is provided for the user to register and login a new application program, the user experience is improved, and the application of the block chain technology is promoted.

Description

Block chain-based authentication method, block chain platform and operator platform

technical field

The disclosure belongs to the field of communication technology, and specifically relates to a blockchain-based identity verification method, a blockchain platform, and an operator platform.

Background technique

Surveys show that 80% of people don't like the cumbersome process of web registration, and 35% of online shoppers abandon their shopping carts because they don't have an account. According to a survey, by 2020, we will have more than 200 digital accounts. At this stage, each of us has many accounts, logs in to various websites, and registers in various applications. Then comes the unlimited proliferation of user privacy, receiving all kinds of harassing calls every day, and what's more, the leakage of user privacy leads to property losses.

In this case, the existing technology is mainly to log in through social media, using a third-party authorization mechanism, and using the OAuth 2.0 protocol to complete. The OAuth 2.0 protocol focuses on the simplicity of client developers, either by organizing approved interactions between resource owners and HTTP (HyperText Transfer Protocol) service providers on behalf of users, or by allowing third-party applications to represent The user is granted access. The protocol also provides dedicated authentication processes for web applications, desktop applications and mobile, and living room devices. In October 2012, the OAuth 2.0 protocol was officially published as RFC 6749. Like our commonly used WeChat, Alipay login is completed using the OAuth 2.0 protocol. Taking WeChat as an example, before performing WeChat OAuth2.0 authorized login access, register a developer account on the WeChat open platform, have a mobile application that has been approved, and obtain the corresponding application account and password, apply for WeChat login and pass After review, the admission process can begin. When the user logs in to other applications, the WeChat login button will be displayed. If the user's mobile phone does not have WeChat installed, it will prompt to install the WeChat client. Specific steps are as follows:

1. The third-party server initiates a WeChat authorization login request. After the WeChat user authorizes the third-party application, the WeChat server will launch the application or redirect to the third-party website with the authorization temporary ticket code parameter;

2. The third-party server adds the account number and password through the code parameter, and exchanges the access_token through the API;

3. The third-party server calls the interface through the access_token to obtain the user's basic data resources or help the user to implement basic operations.

For users, these steps can be completed by simply clicking a few buttons, which saves a series of procedures for registering users, so it is widely used at this stage. Social media account logins have become a mainstream alternative to online registration. This process allows Internet users to use single sign-on and use existing information in the platform, such as WeChat, Alipay, etc. Among them, the OAuth2.0 scheme is mainly used. Although the program has many advantages, such as simplicity, openness and security. However, this solution also has many disadvantages, such as certain loopholes in security. In November 2016, three researchers from the Chinese University of Hong Kong in China published an article stating that "one billion mobile application accounts can be logged in effortlessly using the OAuth 2.0 protocol." Researchers have found that third-party applications that incorrectly use the OAuth 2.0 protocol can be remotely exploited by hackers without the user's knowledge.

In addition, how to protect users' personal information is also a top priority. Enterprises try their best to protect users' personal information, but the cost is expensive. According to Ctrl-Shift, a provider of user attention marketing solutions, the cost of identity verification in the UK exceeds £3.3 billion a year, equivalent to $22 billion. This does not include the costs incurred by storage, protection, default, management, etc.

Contents of the invention

Aiming at the above-mentioned deficiencies in the prior art, the present disclosure provides a blockchain-based identity verification method, a blockchain platform, and an operator platform.

As a first aspect of the present disclosure, a blockchain-based authentication method is provided, including:

Receive the identity verification request sent by the server of the first application program, and obtain the private key therein. The identity verification request is that the server of the first application program sends an authorized login request to the server of the second application program. The server of the program receives the user authorization login message returned by the server of the second application program, and obtains the private key from the user's terminal device and then sends it;

In response to querying the public key and private key signature corresponding to the private key in the blockchain account book, sending a verification request carrying the private key to the operator platform;

In response to receiving the verification passed message carrying the user's digital identity information returned by the operator platform, sending the identity verification passed message carrying the user's digital identity information to the server of the first application program.

Preferably, the method also includes:

In response to receiving the public key and the private key signature broadcast by the operator platform in the block chain, the public key and the private key signature are saved in the block chain ledger.

As a second aspect of the present disclosure, a blockchain-based authentication method is provided, including:

Receive the verification request sent by the blockchain platform and obtain the private key;

In response to locally querying the user's digital identity information corresponding to the private key, a verification pass message carrying the user's digital identity information is sent to the blockchain platform.

Preferably, the method also includes:

In response to detecting that the user logs in to an application program belonging to the operator platform, locally obtain the user information of the user, and generate the user digital identity information according to the user information;

Generate a private key and a public key corresponding to the user's digital identity information;

generating the private key signature according to the private key and the user information;

Send the private key to the user's terminal device, and broadcast the signature of the public key and the private key in the block chain.

Preferably, said generating said user digital identity information according to said user information includes:

Calculate the hash value of the user information, and use the hash value as the leaf node information of the Merkle tree;

calculating the root node information of the Merkle tree according to the leaf node information, and determining the root node information as the user digital identity information.

As a third aspect of the present disclosure, a blockchain platform is provided, including:

The receiving module is configured to receive the identity verification request sent by the server of the first application program. The identity verification request is that the server of the first application program sends an authorization login request to the server of the second application program. The server receives the user authorization login message returned by the server of the second application program, and sends it after obtaining the private key from the user's terminal device;

An acquisition module, configured to acquire the private key in the identity verification request;

A sending module, configured to send a verification request carrying the private key to the operator platform in response to querying the public key and private key signature corresponding to the private key in the blockchain ledger; The verification pass message carrying the user's digital identity information returned by the platform sends the identity verification pass message carrying the user's digital identity information to the server of the first application program.

Preferably, it also includes:

The storage module is configured to save the public key and the private key signature in the blockchain account book in response to receiving the public key and the private key signature broadcast by the operator platform in the blockchain.

As a fourth aspect of the present disclosure, an operator platform is provided, including:

The receiving module is used to receive the verification request sent by the blockchain platform;

The first obtaining module is used to obtain the private key in the verification request;

A sending module, configured to send a verification pass message carrying the user digital identity information to the blockchain platform in response to locally querying the user digital identity information corresponding to the private key.

Preferably, it also includes:

The second obtaining module is used to obtain the user information of the user locally in response to monitoring that the user logs in to the application program belonging to the operator platform;

A first generating module, configured to generate the user digital identity information according to the user information;

A second generating module, configured to generate a private key and a public key corresponding to the user's digital identity information;

A third generating module, configured to generate the private key signature according to the private key and the user information;

a sending module, configured to send the private key to the user's terminal device;

The broadcast module is used to broadcast the signature of the public key and the private key in the block chain.

Preferably, the first generating module is specifically used for:

Calculate the hash value of the user information, and use the hash value as the leaf node information of the Merkle tree;

calculating the root node information of the Merkle tree according to the leaf node information, and determining the root node information as the user digital identity information.

In the blockchain-based identity verification method provided by the embodiments of the present disclosure, when the blockchain platform receives the identity verification request sent by the server of the first application program, if the public key corresponding to the private key is found in the blockchain ledger Sign with the private key, and query the user's digital identity information through the operator platform, indicating that the user has registered the user's digital identity information on the operator platform in advance, and the user identity verification is passed, and the server of the first application program sends a Authentication of digital identity information through messages, enabling anonymous logins. Combining blockchain to authenticate users to ensure that user digital identity information is not tampered with. The security and controllability of authorized login scenarios have been greatly improved. While protecting the privacy and security of users' personal information, it also provides a convenient and efficient way for users to register and log in to new applications. It improves the user experience and promotes the application of blockchain technology.

Description of drawings

FIG. 1 is a flow chart of a blockchain-based identity verification method on the blockchain platform side provided by an embodiment of the present disclosure;

FIG. 2 is a flow chart of a blockchain-based identity verification method on the operator platform side provided by an embodiment of the present disclosure;

FIG. 3 is another flow chart of a blockchain-based identity verification method on the operator platform side provided by an embodiment of the present disclosure;

FIG. 4 is an optional implementation manner of step S302 in FIG. 3 provided by an embodiment of the present disclosure;

FIG. 5 is a schematic structural diagram of a blockchain platform provided by an embodiment of the present disclosure;

Fig. 6 is a schematic structural diagram of an operator platform provided by an embodiment of the present disclosure.

Detailed ways

In order to enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

In order to solve the problem of lack of security in the OAuth2.0 scheme in the scenario of authorized login, and how to reduce the cost of protecting the user's personal information. The disclosure provides a blockchain-based identity verification method, a blockchain platform, and an operator platform. The following will be described in detail one by one with reference to the drawings of the embodiments provided in the present disclosure.

FIG. 1 shows a flow chart of a blockchain-based identity verification method provided by an embodiment of the present disclosure on the blockchain platform side. As shown in Figure 1, the blockchain-based identity verification method provided by this embodiment includes the following steps.

Step S101, receiving an identity verification request sent by a server of a first application program.

Step S102, obtaining the private key in the identity verification request.

Step S103, in response to querying the public key and private key signature corresponding to the private key in the blockchain ledger, send a verification request carrying the private key to the operator platform.

Step S104, in response to receiving the verification passed message carrying the user's digital identity information returned by the operator platform, sending an identity verification passed message carrying the user's digital identity information to the server of the first application program.

Wherein, the identity verification request is that the server of the first application program sends an authorization login request to the server of the second application program, and the server of the first application program receives the user authorization login message returned by the server of the second application program, and sends the request from the server of the second application program It is sent after the user's terminal device obtains the private key. The first application program is the application program that the user needs to log in. The first application program is pre-registered on the operator platform, and the second application program is the authorized login platform that the user jumps to when logging in to the first application program (for example, WeChat can authorize login other applications). Specifically, the server of the first application program sends an authorization login request to the server of the second application program, and the server of the second application program redirects to the address of the second application program. application, whether to allow the first application to use the user's personal information, etc.) or after entering the account number and password of the second application, the server of the second application redirects to the address of the first application, and the first application The server obtains the private key pre-stored in the terminal device from the user's terminal device.

In the blockchain-based identity verification method provided by the embodiments of the present disclosure, the operator platform creates user digital identity information for the user in advance to replace the user's real account information, and the blockchain ledger of the blockchain platform pre-stores the user digital identity information. The private key corresponding to the identity information, and the public key and private key signature corresponding to the private key. When the blockchain platform receives the identity verification request sent by the server of the first application program, if the public key and private key signature corresponding to the private key are found in the blockchain ledger, and the user's identity is found through the operator platform The user's digital identity information indicates that the user pre-registers the user's digital identity information on the operator's platform, passes the user identity verification, and sends an identity verification pass message carrying the user's digital identity information to the server of the first application program.

In the prior art, after the server of the first application program receives the user authorization login message returned by the server of the second application program, the server of the first application program will obtain the real personal information of the user (for example, the user registers the second application program In this disclosure, after the user identity verification is passed, the blockchain platform sends the user's digital identity information to the server of the first application program, so as to realize anonymous login, and the user is an authenticated user. If the blockchain platform does not send an identity verification pass message carrying the user's digital identity information to the server of the first application program, the user cannot log in to the first application program.

In the embodiment of the present disclosure, the user's digital identity information can replace the user's real account information to realize anonymous login, and combine the blockchain to verify the user's identity to ensure that the user's digital identity information is not tampered with. The security and controllability of authorized login scenarios have been greatly improved. While protecting the privacy and security of users' personal information, it also provides a convenient and efficient way for users to register and log in to new applications. It improves the user experience and promotes the application of blockchain technology.

In addition, the user's digital identity information can be used not only for third-party partner verification, but also for places that require real-name registration, such as stations, access control, banks, etc., which greatly facilitates users while protecting user privacy. At the same time, the supervisory layer can also target specific users.

In some embodiments, the method further includes: storing the public key and the private key signature in the blockchain ledger in response to receiving the public key and the private key signature broadcast by the operator platform in the blockchain.

In this step, the public key and private key signatures broadcast by the operator platform are pre-saved in the blockchain ledger for verification on the blockchain platform when the user logs in to the first application program and authenticates the user , to protect user privacy and avoid user information leakage.

It should be noted that as long as the server of the first application program that has joined the blockchain can share the authenticated user. Assuming that the first application program also has its own authentication user database, the authenticated user corresponding to the first application program can directly log in to other first application programs in the blockchain, and the user also needs to execute the method of this embodiment when logging in to other first application programs Step 101-step S104.

Fig. 2 shows a flow chart of a blockchain-based identity verification method on the operator platform side provided by an embodiment of the present disclosure. As shown in Figure 2, the blockchain-based identity verification method provided by this embodiment includes the following steps.

Step S201, receiving a verification request sent by the blockchain platform.

Step S202, obtaining the private key in the verification request.

Step S203, in response to locally querying the user's digital identity information corresponding to the private key, sending a verification pass message carrying the user's digital identity information to the blockchain platform.

In the blockchain-based identity verification method provided by the embodiments of the present disclosure, the operator platform creates user digital identity information for the user in advance to replace the user's real account information. The operator platform pre-stores the private key corresponding to the user's digital identity information. The operator platform receives the verification request sent by the blockchain platform, obtains the private key in it, and if the user's digital identity information corresponding to the private key is queried locally, it sends a verification pass message carrying the user's digital identity information to the blockchain platform. When the user is successfully verified on both the blockchain platform and the operator platform, the blockchain platform sends an identity verification pass message carrying the user's digital identity information to the server of the first application program, thereby realizing anonymous login, and the user is an authenticated user. If the blockchain platform does not send an identity verification pass message carrying the user's digital identity information to the server of the first application program, the user cannot log in to the first application program.

In the embodiment of the present disclosure, the user's digital identity information can replace the user's real account information to realize anonymous login, and combine the blockchain to verify the user's identity to ensure that the user's digital identity information is not tampered with. The security and controllability of authorized login scenarios have been greatly improved. While protecting the privacy and security of users' personal information, it also provides a convenient and efficient way for users to register and log in to new applications. It improves the user experience and promotes the application of blockchain technology.

In addition, the user's digital identity information can be used not only for third-party partner verification, but also for places that require real-name registration, such as stations, access control, banks, etc., which greatly facilitates users while protecting user privacy. At the same time, the supervisory layer can also target specific users.

FIG. 3 shows another flow chart of the blockchain-based identity verification method on the operator platform side provided by an embodiment of the present disclosure. As shown in Figure 3, in some embodiments, the method also includes:

Step S301, in response to detecting that the user logs in to an application program belonging to the operator's platform, obtain user information of the user locally.

Step S302, generating user digital identity information according to user information.

In step S301-step S302, if it is detected that the user logs in to the application program belonging to the operator's platform, the user's user information (including the user's name, ID number, gender, mobile phone number, operator VIP level) is obtained locally information, user attribution information, primary and secondary card identification, user network access duration, etc.). Generate unique user digital identity information for the user based on the user information of the user.

Step S303, generating a private key and a public key corresponding to the user's digital identity information.

Step S304, generating a private key signature according to the private key and user information.

Step S305, sending the private key to the user's terminal device, and broadcasting the public key and private key signature in the block chain.

In step S303-step S305, algorithm encryption is used to generate a private key and a public key corresponding to the user's digital identity information, and a private key signature is generated using the private key and user information. Among them, the private key is sent to the user's terminal device for storage, and the public key and private key signature are broadcast in the blockchain.

FIG. 4 shows an optional implementation manner of step S302 in FIG. 3 provided by an embodiment of the present disclosure.

In some embodiments, as shown in FIG. 4 , the generation of user digital identity information according to user information (that is, step S302) includes:

Step S401, calculate the hash value of the user information, and use the hash value as the leaf node information of the Merkle tree.

Step S402, calculating the root node information of the Merkle tree according to the leaf node information, and determining the root node information as the user's digital identity information.

In step S401-step S402, user digital identity information is created for the user using the Merkle tree algorithm. By default, according to the pre-agreed rules and order, a hash value is calculated for each user information as the leaf node information of the Merkle tree, and the child nodes of the Merkle tree are calculated according to the leaf node information step by step according to the pre-agreed algorithm information. For example, leaf nodes or sub-nodes at the same level perform operations such as addition, subtraction, multiplication, and division cyclically, or perform different types of operations according to the number of levels recursive to leaf nodes, and calculate the corresponding positions of the hash values of two different leaf nodes. Operate the result, and then generate the child node information corresponding to the two leaf nodes. Calculate step by step according to the child node information, finally calculate the root node information of the Merkle tree, and finally form the Merkle tree. The root node information is determined as user digital identity information.

It should be noted that as long as the server of the first application program that has joined the blockchain can share the authenticated user. Assuming that the first application program also has its own authentication user database, the authenticated user corresponding to the first application program can directly log in to other first application programs in the blockchain, and the user also needs to execute Figure 2-Diagram when logging in to other first application programs 4 corresponds to all the steps in the examples.

Fig. 5 shows a schematic structural diagram of a blockchain platform provided by an embodiment of the present disclosure. Based on the same technical concept as the embodiment corresponding to FIG. 1 , as shown in FIG. 5 , the blockchain platform provided by the embodiment of the present disclosure includes the following modules.

The receiving module 11 is configured to receive the identity verification request sent by the server of the first application program. The identity verification request is that the server of the first application program sends an authorization login request to the server of the second application program. The server receives the user authorization login message returned by the server of the second application program, and sends it after obtaining the private key from the user's terminal device;

Obtaining module 12, obtaining the private key in the identity verification request;

The sending module 13 is used to send a verification request carrying the private key to the operator platform in response to querying the public key and private key signature corresponding to the private key in the blockchain account book; The merchant platform returns a verification pass message carrying the user's digital identity information, and sends the identity verification pass message carrying the user's digital identity information to the server of the first application program.

Preferably, it also includes:

The storage module is configured to save the public key and the private key signature in the blockchain account book in response to receiving the public key and the private key signature broadcast by the operator platform in the blockchain.

FIG. 6 shows a schematic structural diagram of a blockchain platform provided by an embodiment of the present disclosure. Based on the same technical concept as the embodiment corresponding to FIG. 2 , as shown in FIG. 6 , the operator platform provided by the embodiment of the present disclosure includes the following modules.

The receiving module 21 is configured to receive the verification request sent by the blockchain platform.

The first acquiring module 22 acquires the private key in the verification request.

The sending module 22 is configured to send a verification pass message carrying the user's digital identity information to the blockchain platform in response to locally querying the user's digital identity information corresponding to the private key.

Preferably, it also includes:

The second obtaining module is used to obtain the user information of the user locally in response to monitoring that the user logs in to the application program belonging to the operator platform;

A first generating module, configured to generate the user digital identity information according to the user information;

A second generating module, configured to generate a private key and a public key corresponding to the user's digital identity information;

A third generating module, configured to generate the private key signature according to the private key and the user information;

a sending module, configured to send the private key to the user's terminal device;

The broadcast module is used to broadcast the signature of the public key and the private key in the block chain.

Preferably, the first generating module is specifically used for:

Calculate the hash value of the user information, and use the hash value as the leaf node information of the Merkle tree;

calculating the root node information of the Merkle tree according to the leaf node information, and determining the root node information as the user digital identity information.

It can be understood that, the above embodiments are only exemplary embodiments adopted for illustrating the principle of the present invention, but the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also regarded as the protection scope of the present invention.

Claims (8)

1. An identity authentication method based on a block chain is characterized by comprising the following steps:

receiving an authentication request sent by a server of a first application program, and acquiring a private key therein, wherein the authentication request is sent after the server of the first application program sends an authorized login request to a server of a second application program, and a user authorized login message returned by the server of the second application program is received by the server of the first application program, and the private key is acquired from a terminal device of the user;

responding to a public key and a private key signature corresponding to the private key which are inquired in a block chain account book, and sending a verification request which carries the private key and corresponds to the identity verification request to an operator platform;

in response to receiving a verification passing message which is returned by the operator platform and carries the user digital identity information, sending the identity verification passing message which carries the user digital identity information to a server of the first application program;

wherein the user digital identity information is determined by the operator platform from root node information of the mercker tree; the root node information is obtained by taking a hash value of user information of a user as leaf node information of the Merckel tree and calculating according to the leaf node information.

2. The blockchain-based identity authentication method according to claim 1, further comprising:

and responding to the received public key and private key signature broadcasted by the operator platform in the block chain, and storing the public key and the private key signature in a block chain account book.

3. An identity authentication method based on a block chain is characterized by comprising the following steps:

receiving an authentication request which is sent by a block chain platform and corresponds to an identity authentication request received by the block chain platform, and acquiring a private key in the authentication request, wherein the identity authentication request is sent to the block chain platform by a server of a first application program;

responding to the user digital identity information corresponding to the private key inquired locally, and sending a verification passing message carrying the user digital identity information to the block chain platform;

wherein the user digital identity information is determined according to root node information of the Mercker tree; the root node information is obtained by taking a hash value of user information of a user as leaf node information of the Mercker tree and calculating according to the leaf node information.

4. The blockchain-based identity authentication method according to claim 3, wherein the method further comprises:

in response to monitoring that a user logs in an application program belonging to the operator platform, locally acquiring user information of the user, and generating the user digital identity information according to the user information;

generating a private key and a public key corresponding to the user digital identity information;

generating the private key signature according to the private key and the user information;

and sending the private key to the terminal equipment of the user, and broadcasting the public key and the private key signature in a block chain.

5. A blockchain platform, comprising:

the system comprises a receiving module, a sending module and a sending module, wherein the receiving module is used for receiving an identity authentication request sent by a server of a first application program, the identity authentication request is sent by the server of the first application program to a server of a second application program, and the identity authentication request is sent after the server of the first application program receives a user authorization login message returned by the server of the second application program and acquires a private key of a user from terminal equipment of the user;

the obtaining module is used for obtaining the private key in the identity authentication request;

the sending module is used for responding to a public key and a private key signature which correspond to the private key and are inquired in a block chain account book, and sending a verification request which carries the private key and corresponds to the identity verification request to an operator platform; in response to receiving a verification passing message which is returned by the operator platform and carries the user digital identity information, sending the identity verification passing message which carries the user digital identity information to a server of the first application program;

wherein the user digital identity information is determined by the operator platform from root node information of the mercker tree; the root node information is obtained by taking a hash value of user information of a user as leaf node information of the Merckel tree and calculating according to the leaf node information.

6. The blockchain platform of claim 5, further comprising:

and the storage module is used for responding to the public key and the private key signature which are received from the operator platform broadcast in the block chain, and storing the public key and the private key signature in the block chain account book.

7. An operator platform, comprising:

the system comprises a receiving module, a judging module and a processing module, wherein the receiving module is used for receiving an authentication request which is sent by a block chain platform and corresponds to an identity authentication request received by the block chain platform, and the identity authentication request is sent to the block chain platform by a server of a first application program;

the first acquisition module is used for acquiring a private key in the verification request;

the sending module is used for responding to the user digital identity information corresponding to the private key inquired locally and sending a verification passing message carrying the user digital identity information to the block chain platform;

wherein the user digital identity information is determined according to root node information of the Mercker tree; the root node information is obtained by taking a hash value of user information of a user as leaf node information of the Mercker tree and calculating according to the leaf node information.

8. The operator platform of claim 7, further comprising:

the second acquisition module is used for responding to the monitored application program of the user login belonging to the operator platform and locally acquiring the user information of the user;

the first generation module is used for generating the user digital identity information according to the user information;

the second generation module is used for generating a private key and a public key corresponding to the user digital identity information;

the third generation module is used for generating the private key signature according to the private key and the user information;

the sending module is used for sending the private key to the terminal equipment of the user;

a broadcast module to broadcast the public key and the private key signature in a blockchain.

Images