WO2020134942A1 - 身份核实方法及其*** - Google Patents

身份核实方法及其*** Download PDF

Info

Publication number
WO2020134942A1
WO2020134942A1 PCT/CN2019/123309 CN2019123309W WO2020134942A1 WO 2020134942 A1 WO2020134942 A1 WO 2020134942A1 CN 2019123309 W CN2019123309 W CN 2019123309W WO 2020134942 A1 WO2020134942 A1 WO 2020134942A1
Authority
WO
WIPO (PCT)
Prior art keywords
identity
identity verification
verification
information
node
Prior art date
Application number
PCT/CN2019/123309
Other languages
English (en)
French (fr)
Inventor
王志伟
杨文波
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Priority to EP19901914.2A priority Critical patent/EP3905078A4/en
Priority to SG11202100832TA priority patent/SG11202100832TA/en
Publication of WO2020134942A1 publication Critical patent/WO2020134942A1/zh
Priority to US17/163,122 priority patent/US11323260B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees

Definitions

  • This application relates to the field of computer technology, in particular to the identity verification technology based on blockchain.
  • the purpose of this application is to provide an identity verification method and system that uses blockchain technology to achieve identity verification, which can achieve cross-border and cross-regional identity verification on the premise of satisfying the data outbound control of various countries.
  • an identity verification method including:
  • the application that needs the identity verification service sends a first request to the digital identity client, including the identity identification and the first information;
  • the application receives the signature information returned by the digital identity client and the public key corresponding to the identity identifier, where the signature information is obtained by the digital identity client using the private key corresponding to the public key to digitally sign the first information;
  • the application sends a second request to the first node of the first blockchain, which includes the signature information and the public key, for the first node to verify based on the signature information and the public key;
  • the application receives the verification result of the verification returned by the first node, and performs identity verification according to the verification result.
  • the first node and the application belong to the same country or region.
  • the digital identity client runs in the user terminal; the digital identity client and the identity verification object belong to the same country or region.
  • the first information includes a service identifier.
  • the first information further includes a random number.
  • the application further includes:
  • the digital identity client performs account level verification according to the identity
  • the digital identity client obtains the public key and private key corresponding to the identity, and uses the private key to digitally sign the first information to obtain the signature information;
  • the digital identity client sends the public key and the signature information to the application.
  • the application after the application sends the second request to the first node of the first blockchain, it also includes:
  • the first node verifies based on the signature information and the public key.
  • the second request further includes a hash value of the identity
  • the first node performs verification based on the signature information and the public key, and further includes:
  • the first node calculates the public key address according to the public key, and finds the identity hash value corresponding to the public key address and the type of identity verification that succeeds in verification on the first blockchain;
  • the first node uses the public key to perform signature verification on the signature information. If the signature verification is passed and the ID hash value found on the first blockchain is the same as the ID hash value in the second request, then The identity verification type with the verification succeeded is sent to the application as the verification result.
  • the application after the application receives the verification result of the verification returned by the first node, the application further includes:
  • the application judges whether the type of successful identity verification in the verification result meets the business needs, and if not, queries the second node of the second blockchain used to issue the identity verification service for the identity verification service that can be provided, Select an identity verification service that meets the business needs from the query results, and send a third request to the digital identity client, where the third request includes the type of identity verification service selected;
  • the digital identity client sends a fourth request to the corresponding identity verification server according to the type of identity verification service in the third request, where the fourth request includes the signature information and the public key;
  • the identity verification server performs identity verification, and updates the received public key address, the identity verification type successfully verified, and the hash value of the identity identification to the first blockchain.
  • the updating of the received public key address, the identity verification type successfully verified, and the hash value of the identity identification to the first blockchain further includes:
  • the identity verification server sends the received public key, the successfully verified identity verification type and the signature information to a node of the first blockchain, which performs signature verification based on the received signature information and public key If the verification is passed, the identity verification type corresponding to the public key in the first blockchain that is successfully verified is updated.
  • the method further includes:
  • the application sends a fifth request to the first node of the first blockchain, which includes the signature information and the public key;
  • the first node performs verification according to the signature information and the public key in the fifth request and returns the verification result
  • the application receives identity verification based on the verification result returned by the first node.
  • the second node and the object requiring identity verification belong to the same country or region.
  • the identity verification service of the second blockchain is released as follows:
  • the identity verification server sends the identity verification service information that can be provided to the third node of the second blockchain, where the third node and the identity verification server belong to the same country or region;
  • the information of the identity verification service of the third node is saved to the second blockchain and propagated to other nodes of the second blockchain, including the second node.
  • the method before the application requiring the identity verification service sends the first request to the digital identity client, the method further includes:
  • the digital identity client receives the identity identification
  • the digital identity client queries the second node of the second blockchain used to publish the identity verification service for available identity verification services, and completes identity verification through interaction with the identity verification server according to the query result, and receives the identity verification service
  • the identity verification result of the terminal generates a pair of public and private keys corresponding to the identity, calculates the public key address and sends the public key address to the identity verification server;
  • the identity verification server saves the received public key address, the successfully verified identity verification type, and the hash value of the identity identification to the first blockchain.
  • the digital identity client after the digital identity client receives the identity, it further includes:
  • This application also discloses an identity verification system, including: applications that require identity verification services, digital identity clients and the first blockchain;
  • the application includes a request sending module and an identity verification module; the request sending module is used to send a first request to the digital identity client, which includes an identity and first information, and sends it to the first node of the first blockchain
  • the second request includes the signature information and the public key returned by the digital identity client;
  • the identity verification module is used to verify the identity based on the verification result returned by the first node;
  • the digital identity client includes a signature module and a sending module; the signature module is used to digitally sign the first information using the private key corresponding to the identity in the first request to obtain the signature information; the sending module is used to The signature information and the public key corresponding to the identity are returned to the application;
  • the first node includes a verification module for verifying based on the signature information and the public key in the second request, and returns the verification result to the application.
  • the first node and the application belong to the same country or region.
  • the digital identity client runs in the user terminal; the digital identity client and the identity verification object belong to the same country or region.
  • the first information includes a service identifier.
  • the first information further includes a random number.
  • the digital identity client further includes:
  • the account verification module is used to perform account level verification according to the identity after receiving the first request;
  • the signature module is used to obtain the corresponding public key and private key according to the identity after the account level verification is passed, and use the private key to digitally sign the first information to obtain the signature information;
  • the sending module is used to send the public key and the signature information to the application.
  • the second request further includes a hash value of the identity
  • the first node also includes:
  • the search module is used to hash the public key to obtain the public key address, and find the identity identification hash value corresponding to the public key address and the type of identity verification successfully verified on the first blockchain;
  • a verification module used to perform signature verification on the signature information using the public key, if the signature verification is passed and the ID hash value found on the first blockchain is the same as the ID hash value in the second request, Then, the identity verification type with the successful verification is sent to the application as a verification result.
  • the application also includes: a nuclear strength discriminating module for judging whether the type of identity verification successful in the verification result meets business needs; a service query module for the type of identity verification for successful verification in the verification result When the business needs are not met, the second node of the second blockchain used to publish the identity verification service is queried for the identity verification service that can be provided, and the identity verification service that meets the business needs is selected from the query results; the request sending module also Used to send a third request to the digital identity client, where the third request includes the selected type of identity verification service;
  • the digital identity client also includes a verification request module for sending a fourth request to the corresponding identity verification server according to the type of identity verification service in the third request, where the fourth request includes the signature information and the public key ;
  • the identity verification server includes an update module for performing identity verification according to the third request, and updating the received public key address, the identity verification type successfully verified, and the hash value of the identity identification to the first block chain.
  • the update module sends the received public key, successfully verified identity verification type, and the signature information to a node of the first blockchain for the node to use the received signature information and public
  • the key is verified, and if the verification is passed, the identity verification type corresponding to the successful verification of the public key in the first blockchain is updated.
  • the second node and the object requiring identity verification belong to the same country or region.
  • the identity verification server further includes a service publishing module for sending information of the identity verification service that can be provided to the third node of the second blockchain, wherein the third node and the identity verification The server belongs to the same country or region;
  • the third node is used to save the information of the identity verification service to the second blockchain and propagate it to other nodes of the second blockchain, including the second node.
  • the digital identity client further includes a query module and a key generation module, where,
  • the query module is used to query the second node of the second blockchain used to publish the identity verification service for the available identity verification service based on the received identity identification, and complete the interaction with the identity verification server according to the query result Identity verification, receiving the identity verification result from the identity verification server;
  • the key generation module is used to generate a pair of public and private keys corresponding to the identity, and calculate the public key address;
  • the sending module of the digital identity client is also used to send the public key address to the identity verification server;
  • the identity verification server includes a verification module for identity verification, and saves the received public key address, the type of identity verification successfully verified, and the hash value of the identity tag to the first blockchain.
  • This application also discloses an identity verification method, including:
  • the fourth node of the third blockchain receives the identity verification information from the identity verification server, and the identity verification information includes the first hash value of the information to be verified;
  • the fourth node saves the identity verification information to the third blockchain, and propagates the identity verification information to the fifth node of the third blockchain through the third blockchain;
  • the fifth node receives the identity verification request from the first application, which includes the second hash value of the information to be verified;
  • the fifth node compares the first hash value and the second hash value, and returns an identity verification result to the first application according to the comparison result.
  • the fourth node and the identity verification server belong to the same country or region;
  • the fifth node and the identity verification server do not belong to the same country or region.
  • the fifth node and the first application belong to the same country or region.
  • the first hash value and the second hash value are obtained by the same hash algorithm.
  • the returning the identity verification result to the first application according to the comparison result further includes:
  • the fifth node returns information indicating that the identity verification is passed to the first application, and if they are different, the fifth node returns information indicating that the identity verification is not passed to the first application.
  • the identity verification information further includes identification information of the person whose identity is to be verified;
  • the identity verification request also includes identification information of the person to be verified
  • the fifth node further includes: searching for information with the same identification information in the information stored in the third blockchain according to the identification information in the identity verification request Verify the information, to find the first hash value.
  • the information to be verified includes one of the following or any combination thereof:
  • Fingerprint information facial feature information, bank account information.
  • This application also discloses an identity verification system, including an identity verification server, a third blockchain, and a first application:
  • the identity verification server is used to send identity verification information to the fourth node of the third blockchain, where the identity verification information includes the first hash value of the information to be verified;
  • the fourth node is used to save the identity verification information to the third blockchain, and propagate the identity verification information to the fifth node of the third blockchain through the third blockchain;
  • the first application is used to send an identity verification request to the fifth node, which includes the second hash value of the information to be verified;
  • the fifth node is used to compare the first hash value and the second hash value, and return an identity verification result to the first application according to the comparison result.
  • the fourth node and the identity verification server belong to the same country or region;
  • the fifth node and the identity verification server do not belong to the same country or region.
  • the fifth node and the first application belong to the same country or region.
  • the first hash value and the second hash value are obtained by the same hash algorithm.
  • the fifth node returns information indicating that the identity verification is passed to the first application when the comparison result is the same, and returns information indicating that the identity verification is not passed to the first application when the comparison result is different.
  • the identity verification information further includes identification information of the person whose identity is to be verified;
  • the identity verification request also includes identification information of the person to be verified
  • the fifth node is also used to search for identity verification information having the same identification information in the information stored in the third blockchain according to the identification information in the identity verification request, so as to find the first hash value.
  • the information to be verified includes one of the following or any combination thereof:
  • Fingerprint information facial feature information, bank account information.
  • This application also discloses an identity verification system, including:
  • Memory for storing computer executable instructions
  • the processor is configured to implement the steps in the method as described above when the computer-executable instructions are executed.
  • the present application also discloses a computer-readable storage medium that stores computer-executable instructions, which when executed by a processor, implement the steps in the method as described above.
  • the use of blockchain technology to achieve identity verification can achieve cross-country identity verification on the premise of satisfying the data outbound control of various countries.
  • a cross-border nuclear network system is built between various countries and regions, and the blockchain is used to prevent tampering and traceability.
  • Different nodes are deployed in different countries to achieve a balance between privacy protection and convenience of calling between domestic services and cross-border calling.
  • the identity verification server of the country/region of residence hashes the sensitive information to be verified, and uploads the hash value of the sensitive information instead of the sensitive information itself to the district through the node of the country/region of residence Blockchain, spread to other countries or regions through the blockchain.
  • Applications from other countries or regions that require identity verification services submit an identity verification request to the node in the country or region (ie, the calling country/region), which also carries the hash value of the information to be verified, and the blockchain of the calling country/region
  • the node judges whether the hash value in the identity verification request is consistent with the hash value stored in the blockchain, and if it is consistent, returns the identity verification passed message to the application, otherwise returns the identity verification failed message to the application.
  • FIG. 2 is a schematic flowchart of an identity verification method according to a second embodiment of the present application
  • FIG. 3 is a schematic diagram of a process of publishing and subscribing to an identity verification service according to the second embodiment of the present application
  • FIG. 4 is a schematic flowchart of the process of uploading the identity verification type verified by the identity verification server according to the second embodiment of the present application
  • FIG. 5 is a schematic structural diagram of an identity verification system according to a third embodiment of the present application.
  • FIG. 6 is a schematic diagram of information transmission of the identity verification method according to the fourth embodiment of the present application.
  • Application refers to an application software system with specific functions.
  • the applications in the embodiments of the present application generally refer to applications that require identity verification services.
  • Digital identity client a client for digital identity verification.
  • the digital identity client is an application software and has an account system.
  • everybody can register an account system in their country of residence, and the local identity verification service in their country provides account login and other functions.
  • the digital identity client is also the user's digital identity wallet, and the certificates in the wallet are stored in the home country server.
  • the identity wallet contains information such as passports and national ID cards.
  • the digital identity client can generate public and private key pairs through the TEE/SE and other security areas managed by itself. The address of the public key is sent to the blockchain.
  • the wallet will also record the public key and current The version number and other information, the corresponding private key will be saved to the secure area.
  • the calculation method of the public key address is (Base58(version+ripemd160(SHA256(public)key))+checksum). Using this calculation method can prevent the public key from being excessively cracked after being disclosed.
  • Identity verification server a service provider that provides identity verification services.
  • the identity verification service is provided locally (domestically or within a region).
  • the identity verification server is implemented in the cloud.
  • the identity verification service mainly provides two functions. One function is to verify the identity of the citizen of the country/region and verify the identity of the user and the user's unique identification index. Another function is to publish the identity verification service in the home country/region to the identity verification service release blockchain (ie, the second blockchain) for other countries/regions to subscribe for services that require the service. Each country has strict requirements for data outbound, so each country can deploy identity verification services in its own country.
  • the required identity verification data sources are all deployed in its own country, but it can accept direct connection services from other countries to ensure that sensitive data cannot exit the country.
  • the national identity verification service also provides account management for domestic users. Only alliance nodes (that is, certified service providers) can publish services, and each release of services requires their own signature.
  • the identity verification blockchain is the first blockchain.
  • the blockchain carries the storage of the user's public key address, which identity verification services have been verified by the user's current public key, and is used for the comparison of the public key address corresponding to the authentication currently submitted by the user
  • the data on this blockchain is the key data to achieve cross-country verification.
  • the important function of the blockchain is PKI basic services, including: 1. Storage of user's public key address; 2. Verification operation of digital signature; 3. Calculation of whether the uploaded public key matches the public key address.
  • the identity verification service releases the blockchain, which is the second blockchain.
  • this blockchain carries services provided by different service providers in various countries. Service providers in various countries can also subscribe to identity authentication services in other countries. In principle, this service only provides identity verification services (only returns) Yes or no). Service users in the calling country can customize which services meet their business intensity requirements. Each country has some government-provided or identification tools provided by certain companies for its own citizens in order to determine who you are. For example, the Chinese public security department provides the citizen’s name and ID number , The face comparison service, if the static information and biological information provided by A are consistent with the comparison source of the public security department, it can be considered that the information of A is credible, and it is considered as real evidence, and the person providing the information is determined It is A himself.
  • each country has a certain degree of strong control over the sensitive information of its citizens. For example, country A does not want other countries to obtain (or retain) the face data of its own citizens, but the application of country B is due to risk and other considerations. Perform face-level strong identity verification operations.
  • the service provider AS in country A only needs to publish the face verification service in the country to the identity verification service release blockchain.
  • Service providers BS in other countries, such as country B can subscribe To this service, if the BS believes that the AS is reliable, it can use the digital identity client to complete the access to the AS without retaining data.
  • IFAA Internet finance certification
  • Internet Financial Certification Alliance In order to adapt to the development of new verification methods such as biometric verification, it provides secure and better user experience authentication methods to support the rapid development of Internet financial services. Through cooperation with equipment manufacturers, chip manufacturers, algorithm vendors, security vendors, standards agencies, and testing agencies, create a set of solutions that use biometrics to authorize access.
  • FIDO Fast Identity Online
  • the FIDO Alliance is an industry association established in July 2012. Its purpose is to meet market demands and meet online verification requirements. The agreement is the first open industry standard for online and digital verification, which improves security, protects privacy, and simplifies the user experience. Users can log in using smart phone fingerprint collectors, USB tokens and other methods, and service providers no longer need to maintain complex and costly authentication backgrounds.
  • Hash Chinese is called hash or hash, which is a function of compressing any length of information to a certain length of message digest.
  • Public key address Data obtained by performing a specific hash operation based on the public key.
  • the first embodiment of the present application relates to an identity verification method.
  • the process is shown in FIG. 1.
  • the method includes the following steps:
  • an application requiring an identity verification service sends a first request to a digital identity client, which includes an identity identification and first information.
  • the first information includes a service identifier. Including the service identifier in the first information can make the behavior of identity verification associated with a specific service.
  • the first information includes a service identifier and a random number, and the random number may also be called a challenge value. Including a random number in the first information used for signature can prevent replay attacks.
  • the first information includes one or more characteristic information of the service.
  • the application receives the signature information returned by the digital identity client and the public key corresponding to the identity identifier, where the signature information is obtained by the digital identity client using the private key corresponding to the public key to digitally sign the first information.
  • the digital identity client runs in the user terminal.
  • the digital identity client and the identity verification object belong to the same country or region. The object of identity verification is the person who needs to verify identity. In another embodiment, the digital identity client and the identity verification object may not belong to the same country or region, as long as the digital identity client is not prohibited by law from acquiring sensitive information related to identity verification of the identity verification object.
  • step 103 is entered, and the application sends a second request to the first node of the first blockchain, which includes the signature information and the public key, for the first node to verify based on the signature information and the public key.
  • the first node and the application belong to the same country or region, or the first node may also be called a calling country/region node.
  • the first node and the application may not belong to the same country or region, as long as the application is not prohibited by law from accessing the first node.
  • step 104 the application receives the verification result of the verification returned by the first node, and performs identity verification according to the verification result.
  • the second embodiment of the present application relates to an identity verification method, and its flow is shown in FIG. 2.
  • the first embodiment mainly describes the behavior of the application side in the identity verification process, and the second embodiment is from the perspective of the entire system (the system includes the application, digital identity client, blockchain, and identity verification server, etc. ) Describe how each part interacts with each other to achieve identity verification.
  • step 201 an application requiring an identity verification service sends a first request to a digital identity client, which includes an identity identification and first information. This step is the same as step 101.
  • step 202 after receiving the first request, the digital identity client obtains the corresponding public key and private key according to the identity identifier therein, and uses the private key to digitally sign the first information to obtain signature information.
  • account level verification is required before digital signature.
  • step 203 is entered, and the digital identity client sends the public key and signature information to the application.
  • the version number used when generating the public key and the private key is sent to the application together.
  • step 204 the application sends a second request to the first node of the first blockchain, which includes the signature information and the public key.
  • the second request further includes a hash value of the identity.
  • step 205 is entered.
  • the first node verifies the signature information and the public key.
  • this step further includes: the first node calculating the public key address according to the public key, and finding on the first blockchain the identity identification hash value corresponding to the public key address and the type of identity verification that is successfully verified.
  • the first node uses the public key to perform signature verification on the signature information. If the signature verification is passed and the identity hash value found on the first blockchain is the same as the identity hash value in the second request, the successful identity will be verified The verification type is sent to the application as a verification result, otherwise, information indicating that the identity verification fails is returned to the application.
  • the identity request hash value may not be included in the second request. Accordingly, the first node may not perform the identity hash value in the second request and the identity hash in the first blockchain. Verify that the values are consistent.
  • step 206 is entered, and the digital identity client returns a verification result to the application, which includes the identity verification type of successful verification.
  • step 207 is entered, and the application determines whether the type of identity verification that succeeds in the verification result meets the business needs. If it is satisfied, the identity verification is successful, and the identity verification process is ended. If it is not satisfied, step 208 is entered.
  • the type of identity verification that is successfully verified may also be referred to as the strength of identity verification.
  • step 208 the application queries the second node of the second blockchain for issuing the identity verification service for the identity verification service that can be provided.
  • the second node and the object requiring identity verification belong to the same country or region.
  • step 209 is entered, and the application selects an identity verification service that meets business needs from the query result returned by the second node.
  • step 210 is entered, and the application sends a third request to the digital identity client, where the third request includes the selected identity verification service type.
  • step 211 is entered, and the digital identity client sends a fourth request to the corresponding identity verification server according to the type of the identity verification service in the third request, where the fourth request includes the signature information and the public key.
  • step 212 is entered, and the identity verification server performs identity verification.
  • step 213 is entered, and the identity verification server updates the received public key address, the identity verification type that has been successfully verified, and the identity identification hash value to the first blockchain.
  • this step further includes: the identity verification server sends the received public key, the successfully verified identity verification type and signature information to a node of the first blockchain, and the node based on the received signature The information and the public key are verified, and if the verification is passed, the identity verification type corresponding to the successful verification of the public key in the first blockchain is updated.
  • the identity verification server updates the first blockchain by calling the country/region node. In other embodiments, the identity verification server can update the blockchain through any node in the first blockchain.
  • step 214 is entered, and the application sends a fifth request to the first node of the first blockchain, which includes the signature information and the public key.
  • step 215 is entered, and the first node performs verification according to the signature information and the public key in the fifth request and returns the verification result in step 216.
  • step 217 is entered, and the application receives the identity verification based on the verification result returned by the first node.
  • the second blockchain is a blockchain for publishing and subscribing to identity verification services.
  • the above steps 208 and 209 are essentially subscriptions to the identity verification service.
  • the following describes the process of publishing and subscribing to the identity verification service in conjunction with FIG.
  • the identity verification server sends the identity verification service information that can be provided to the third node of the second blockchain, where the third node and the identity verification server belong to the same country or region (or Is the country/region node of household registration).
  • the types of identity verification services can be diverse, such as face verification and so on.
  • the information sent by the identity verification server may be the issuer identification, the type of identity verification service, and related verification data.
  • step 302 is entered, and the information of the identity verification service of the third node is saved to the second blockchain.
  • This step may be referred to as the identity verification service's information on-chain (the on-chain is saved to the blockchain).
  • step 303 the third node propagates the information of the identity verification service on the chain to other nodes in the second blockchain, including the second node (or may be called the calling country/region node). So far, the release of the identity verification service is completed.
  • step 304 is entered, and the application requiring the identity verification service subscribes to the identity verification service that has been on-chain from the second node.
  • step 305 is entered, and the second node returns information of the identity verification service to the application. Afterwards, if the information of the subscribed identity verification service is updated, the updated content will also be automatically sent to the subscribing application. This completes the subscription of the identity verification service.
  • Steps 201 to 206 can be regarded as querying the identity verification type verified by the identity verification server on the first blockchain. The following explains how to upload the identity verification type verified by the identity verification server. The process is shown in Figure 4.
  • the digital identity client receives the identity identification.
  • first perform account level verification such as gesture decryption, password decryption or fingerprint decryption, etc.
  • query whether the ID corresponding to the checker ID exists in the digital identity client .
  • the digital identity client queries the second node of the second blockchain for issuing the identity verification service for available identity verification services.
  • the second node is a country of residence register.
  • step 403 is entered, and the second node returns to the available identity verification service.
  • step 404 is entered, and the digital identity client completes identity verification through interaction with the identity verification server according to the query result.
  • step 405 is entered, and the identity verification server returns the identity verification result.
  • step 406 the digital identity client receives the identity verification result from the identity verification server, and generates a pair of keys (including public and private keys) corresponding to the identity identifier in the local security environment.
  • the digital identity client generates a public-private key pair in the security area of the mobile phone (such as TEE, SE, etc.) based on a secure ECC elliptic curve algorithm.
  • the private key is stored in the local security area, and the public key is stored locally.
  • the key length is 64 bytes (ecc algorithm public key, x, y forced 32 bytes, less than zero padding, the first bit>1 does not fill zero, all positive numbers), (Base58(version+ripemd160(SHA256(public)key))+checksum).
  • Base58 is a subset of Base64, filtering out some characters that can cause confusion, such as 0 (number zero), O (uppercase o), l (lowercase L), I (uppercase i), and "+" and "/" symbols , Ripemd160, sha256 are two hash algorithms, version is the version number, the default is 01, checksum uses the CRC16 check code (2 bytes) of the value after ripemd160.
  • the digital identity client calculates the public key address and sends the public key address to the identity verification server.
  • the version number may also be sent to the identity verification server.
  • step 408 is entered, and the identity verification server uploads the received public key address, the successfully verified identity verification type, and the hash value of the identity tag (ie, saves it to the first blockchain).
  • the public key address, the successfully verified identity verification type, and the hash value of the identity identification are a record, and the corresponding successfully verified identity verification type and the identity identification hash value can be queried through the public key address.
  • the identity verification server can also upload the version number together.
  • the third embodiment of the present application relates to an identity verification system whose structure is shown in FIG. 5.
  • the identity verification system includes: an application 50 requiring an identity verification service, a digital identity client 51, and a first blockchain 52. Second blockchain 53, identity verification server 54.
  • Applications include request sending module and identity verification module.
  • the request sending module is used to send the first request to the digital identity client, including the identity identifier and the first information, and send the second request to the first node of the first blockchain, which includes the signature information returned by the digital identity client And public key.
  • the identity verification module is used for identity verification according to the verification result returned by the first node.
  • the first information includes a service identifier. Including the service identifier in the first information can make the behavior of identity verification associated with a specific service.
  • the first information includes a service identifier and a random number, and the random number may also be called a challenge value. Including a random number in the first information used for signature can prevent replay attacks.
  • the first information includes one or more characteristic information of the service.
  • the digital identity client includes a signature module and a sending module.
  • the signature module is used to digitally sign the first information using the private key corresponding to the identity in the first request to obtain signature information.
  • the sending module is used to return the signature information and the public key corresponding to the identity to the application.
  • the digital identity client runs in the user terminal.
  • the digital identity client and the identity verification object belong to the same country or region.
  • the first node includes a verification module for verifying based on the signature information and the public key in the second request, and returns the verification result to the application.
  • the first node and the application belong to the same country or region.
  • the digital identity client further includes: an account verification module, configured to perform account level verification according to the identity identification after receiving the first request.
  • the signature module is used to obtain the corresponding public key and private key according to the identity after the account level verification is passed, and use the private key to digitally sign the first information to obtain signature information.
  • the sending module is used to send the public key and signature information to the application.
  • the second request further includes a hash value of the identity.
  • the first node also includes a search module and a verification module, where the search module is used to hash the public key to obtain the public key address, and find the identity hash value and verification corresponding to the public key address on the first blockchain The type of successful identity verification.
  • the verification module is used to perform signature verification on the signature information using the public key. If the signature verification is passed and the ID hash value found on the first blockchain is the same as the ID hash value in the second request, the verification will succeed.
  • the identity verification type is sent to the application as a verification result. Otherwise, a message indicating that the identity verification fails is returned to the application.
  • the identity request hash value may not be in the second request, and the first node may not make the identity request hash value in the second request consistent with the identity hash value in the first blockchain Verification.
  • the application further includes: a core strength determination module, used to determine whether the type of identity verification that succeeds in verification in the verification result meets business needs.
  • the service query module is used to query the second node of the second blockchain used for issuing the identity verification service to query the identity verification service that can be provided when the type of identity verification that the verification succeeds in the verification result does not meet the business needs. In the query result, select the identity verification service that meets the business needs.
  • the request sending module is also used to send a third request to the digital identity client, where the third request includes the selected identity verification service type.
  • the digital identity client also includes a verification request module for sending a fourth request to the corresponding identity verification server according to the type of identity verification service in the third request, where the fourth request includes signature information and a public key.
  • the identity verification server includes an update module for performing identity verification according to the third request, and updating the received public key address, the identity verification type successfully verified, and the identity hash value to the first blockchain.
  • the second node and the object requiring identity verification belong to
  • the update module sends the received public key, successfully verified identity verification type and signature information to a node of the first blockchain for the node to verify based on the received signature information and public key, If the verification is passed, the identity verification type corresponding to the public key in the first blockchain is successfully verified.
  • the identity verification server also includes a service publishing module for sending information of the identity verification service that can be provided to a third node of the second blockchain, where the third node and the identity verification server belong to the same Country or region.
  • the third node is used to save the information of the identity verification service to the second blockchain and propagate it to other nodes of the second blockchain, including the second node.
  • the digital identity client further includes a query module and a key generation module, wherein the query module is used to query the second node of the second blockchain for issuing the identity verification service for availability based on the received identity identification ID verification service, and complete the identity verification through the interaction with the identity verification server according to the query result, and receive the identity verification result from the identity verification server.
  • the key generation module is used to generate a pair of public and private keys corresponding to the identity, and calculate the public key address.
  • the sending module of the digital identity client is also used to send the public key address to the identity verification server.
  • the identity verification server includes a verification module for performing identity verification, and saves the received public key address, the successfully verified identity verification type and the hash value of the identity identification to the first blockchain.
  • the first and second embodiments are method embodiments corresponding to this embodiment.
  • the technical details in the first and second embodiments can be applied to this embodiment, and the technical details in this embodiment can also be applied to the first And the second embodiment.
  • the fourth embodiment of the present application relates to an identity verification method, and its flow is shown in FIG. 6.
  • This embodiment needs to verify whether a piece of information to be verified belongs to a user (person whose identity is to be verified). For example, it is necessary to verify whether a user's fingerprint is consistent with the user's fingerprint in the identity verification server.
  • the laws of the country of residence of the user may prohibit fingerprint information from exiting the country, and fingerprint verification cannot be performed outside the country of residence.
  • the identity verification server uploads the hash value of the fingerprint to a node of the country of residence of the blockchain, and the hash value of the fingerprint is diffused outside the country of residence of the blockchain through the node
  • the application of the calling country/region that needs to verify the fingerprint can send the hash value of the collected fingerprint to the node of the blockchain in the calling country/region, and the calling country/region node will receive from the application
  • the fingerprint hash value is compared with the fingerprint hash value stored in the blockchain. If they are the same, the identity verification success information is returned to the application, otherwise the identity verification failure information is returned. In this way, fingerprint verification is successfully implemented under the premise of complying with the data control regulations of the country of residence.
  • the identity verification server sends identity verification information to a node of the third blockchain (herein referred to as a fourth node).
  • the information to be verified may be fingerprint information (or fingerprint feature information), face feature information, bank account information, and so on.
  • the identification information of the person to be verified is the information that can uniquely identify the person to be verified, such as the ID number, driving license number, social insurance number, etc., or can be the ID number, driving license number, social insurance number, etc.
  • the transformed value of an algorithm (such as a certain hash algorithm) (to play a secret role), such as the hash value of the ID number, etc.
  • the fourth node of the third blockchain receives the identity verification information from the identity verification server, saves the identity verification information to the third blockchain, and propagates the identity verification information to other parties in the third blockchain node.
  • step 603 is entered.
  • the first application that needs identity verification obtains the information to be verified, performs a hash operation on it, and sends an identity verification request to a node of the third blockchain (herein may be referred to as the fifth node), including
  • the hash value of the information to be verified herein referred to as the second hash value
  • the identification information of the person to be verified is usually obtained by the same hash algorithm.
  • the fifth node receives the identity verification request from the first application, compares the first hash value in the request with the second hash value stored in the third blockchain, and according to the comparison result
  • the first application returns the identity verification result.
  • the fifth node if they are the same, the fifth node returns to the first application information indicating that the identity verification has passed, and if they are different, the fifth node returns to the first application information indicating that the identity verification has not passed.
  • the fifth node searches for identity verification information with the same identification information in the information stored in the third blockchain according to the identification information in the identity verification request, so as to find the first hash value.
  • the fourth node and the identity verification server belong to the same country or region.
  • the fifth node and the identity verification server do not belong to the same country or region.
  • the fifth node and the first application belong to the same country or region.
  • the fifth embodiment of the present application relates to an identity verification system.
  • the system includes an identity verification server, a third blockchain (including fourth and fifth nodes) and a first application:
  • the identity verification server 71 is used to send identity verification information to the fourth node 72 of the third blockchain.
  • the identity verification information includes the first hash value of the information to be verified and the identification information of the person verifying the identity.
  • the information to be verified may be fingerprint information (or fingerprint feature information), face feature information, bank account information, and so on.
  • the identification information of the person to be verified is the information that can uniquely identify the person to be verified, such as the ID number, driving license number, social insurance number, etc., or can be the ID number, driving license number, social insurance number, etc.
  • the value transformed by an algorithm such as a hash algorithm), such as the hash value of the ID number, and so on.
  • the fourth node 72 is used to save the identity verification information to the third blockchain, and propagate the identity verification information to other nodes of the third blockchain through the third blockchain, including the fifth node.
  • the first application 74 is used to send an identity verification request to the fifth node 73, which includes the second hash value of the information to be verified and identification information of the person verifying the identity.
  • the first hash value and the second hash value are obtained by the same hash algorithm.
  • the fifth node 73 is used to compare the first hash value and the second hash value, and return the identity verification result to the first application according to the comparison result.
  • the fifth node returns information indicating that the identity verification is passed to the first application when the comparison result is the same, and returns information indicating that the identity verification is not passed to the first application when the comparison result is different.
  • the fifth node searches for identity verification information with the same identification information in the information stored in the third blockchain according to the identification information in the identity verification request, so as to find the first hash value.
  • the fourth node and the identity verification server belong to the same country or region.
  • the fifth node and the identity verification server do not belong to the same country or region.
  • the fifth node and the first application belong to the same country or region.
  • the fourth embodiment is a method embodiment corresponding to this embodiment.
  • the technical details in the fourth embodiment can be applied to this embodiment, and the technical details in this embodiment can also be applied to the fourth embodiment.
  • each module shown in the embodiment of the identity verification system can be understood by referring to the related description of the aforementioned identity verification method.
  • the functions of the modules shown in the embodiments of the identity verification system may be implemented by programs (executable instructions) running on the processor, or by specific logic circuits. If the identity verification system described in the embodiments of the present application is implemented in the form of a software function module and sold or used as an independent product, it may also be stored in a computer-readable storage medium. Based on such an understanding, the technical solutions of the embodiments of the present application can be embodied in the form of software products in essence or part that contributes to the prior art.
  • the computer software product is stored in a storage medium and includes several instructions for A computer device (which may be a personal computer, server, or network device, etc.) executes all or part of the methods described in the embodiments of the present application.
  • the foregoing storage media include various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM, Read Only Memory), a magnetic disk, or an optical disk. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.
  • the embodiments of the present application also provide a computer-readable storage medium in which computer-executable instructions are stored, and when the computer-executable instructions are executed by the processor, the method embodiments of the present application are implemented.
  • Computer-readable storage media including permanent and non-permanent, removable and non-removable media, can store information by any method or technology. The information may be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, read-only compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, Magnetic tape cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable storage media do not include temporary storage computer-readable media (transitory media), such as modulated data signals and carrier waves.
  • PRAM phase change memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • RAM random access memory
  • ROM read-only memory
  • EEPROM electrically erasable programmable read-only memory
  • flash memory or other memory technologies
  • CD-ROM compact disc read-only memory
  • embodiments of the present application also provide an identity verification system, which includes a memory for storing computer-executable instructions, and a processor; the processor is used to implement the various instructions when executing the computer-executable instructions in the memory Steps in method implementation.
  • the processor can be a central processing unit (Central Processing Unit, referred to as "CPU"), can also be other general-purpose processors, digital signal processors (Digital Signal Processor, referred to as "DSP"), application-specific integrated circuits (Application Specific Integrated Circuit (abbreviated as "ASIC”) etc.
  • CPU Central Processing Unit
  • DSP Digital Signal Processor
  • ASIC Application Specific Integrated Circuit
  • the foregoing memory may be a read-only memory (read-only memory, "ROM” for short), a random access memory (random access memory, "RAM” for short), a flash memory (Flash), a hard disk, or a solid-state hard disk.
  • ROM read-only memory
  • RAM random access memory
  • flash flash memory
  • hard disk or a solid-state hard disk.
  • an act is performed according to an element, it means that the act is performed at least according to the element, which includes two cases: the act is performed according to the element only, and according to the element and Other elements perform this behavior.
  • Expressions of multiple, multiple, multiple, etc. include 2, 2, 2 and 2 and more than 2, 2 or more.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Storage Device Security (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本申请涉及计算机技术领域，公开了一种身份核实方法及其***,可以在满足各国数据出境管控的前提下实现跨国的身份核实。该方法包括：需要身份核实服务的应用向数字身份客户端发送第一请求，其中包括身份标识和第一信息；应用接收数字身份客户端返回的签名信息和身份标识对应的公钥，其中签名信息由数字身份客户端使用公钥对应的私钥对第一信息数字签名得到；应用向第一区块链的第一节点发送第二请求，其中包括签名信息和公钥，供第一节点根据签名信息和公钥进行校验；应用接收第一节点返回的校验的校验结果，根据该校验结果进行身份核实。

Description

身份核实方法及其*** 技术领域
本申请涉及计算机技术领域，特别涉及基于区块链的身份核实技术。
背景技术
随着人口在全世界各个国家进行流动日渐频繁，当人们在非户籍国希望享受到某些服务，但必须身份认证时，会出现诸多问题。一个比较重要的问题是很多国家数据出境管控较严格，有不少身份认证所需的数据(例如指纹、人脸数据等)是不被允许出境的。如何在数据出境管控的前提下实现跨国跨地区的身份核实，就成为很多跨国服务急需解决的问题。
发明内容
本申请的目的在于提供一种身份核实方法及其***，使用区块链技术实现身份核实，可以在满足各国数据出境管控的前提下实现跨国跨地区的身份核实。
为了解决上述问题，本申请公开了一种身份核实方法，包括：
需要身份核实服务的应用向数字身份客户端发送第一请求，其中包括身份标识和第一信息；
该应用接收该数字身份客户端返回的签名信息和该身份标识对应的公钥，其中该签名信息由该数字身份客户端使用该公钥对应的私钥对该第一信息数字签名得到；
该应用向第一区块链的第一节点发送第二请求，其中包括该签名信息和公钥，供该第一节点根据该签名信息和公钥进行校验；
该应用接收该第一节点返回的该校验的校验结果，根据该校验结果进行身份核实。
在一个优选例中，该第一节点与该应用属于同一国家或地区。
在一个优选例中，该数字身份客户端运行在用户终端中；该数字身份客户端与身份核实对象属于同一国家或地区。
在一个优选例中，该第一信息包括业务标识。
在一个优选例中，该第一信息还包括一个随机数。
在一个优选例中，该应用向数字身份客户端发送第一请求之后，还包括：
该数字身份客户端根据该身份标识进行账户级别验证；
该账户级别验证通过后，该数字身份客户端获取该身份标识对应的公钥和私钥，使用该私钥对该第一信息进行数字签名得到该签名信息；
该数字身份客户端将该公钥和该签名信息发送给该应用。
在一个优选例中，该应用向第一区块链的第一节点发送第二请求之后，还包括：
该第一节点根据该签名信息和公钥进行校验。
在一个优选例中，该第二请求中还包括该身份标识的哈希值；
该第一节点根据该签名信息和公钥进行校验，进一步包括：
该第一节点根据该公钥计算公钥地址，在该第一区块链上找到对应该公钥地址的身份标识哈希值和验证成功的身份核实类型；
该第一节点使用该公钥对该签名信息进行签名验证，如果签名验证通过并且该第一区块链上找到的身份标识哈希值和该第二请求中的身份标识哈希值相同，则将该验证成功的身份核实类型作为校验结果发送给该应用。
在一个优选例中，该应用接收该第一节点返回的该校验的校验结果之后，还包括：
该应用判断该校验结果中的验证成功的身份核实类型是否满足业务需要，如果不满足，则向用于发布身份核实服务的第二区块链的第二节点查询能够提供的身份核实服务，从查询结果中选择符合该业务需要的身份核实服务，向该数字身份客户端发送第三请求，该第三请求中包括被选择的身份核实服务的类型；
该数字身份客户端根据该第三请求中身份核实服务的类型，向相应的身份核实服务端发送第四请求，该第四请求中包括该签名信息、该公钥；
该身份核实服务端进行身份验证，将所收到的公钥地址、验证成功的身份核实类型和该身份标识的哈希值更新到该第一区块链。
在一个优选例中，该将所收到的公钥地址、验证成功的身份核实类型和该身份标识的哈希值更新到该第一区块链，进一步包括：
该身份核实服务端将所收到的公钥、验证成功的身份核实类型和该签名信息发送到该第一区块链的一个节点，该节点根据收到的签名信息和公钥进行签名校验，如果校 验通过则更新该第一区块链中该公钥对应的验证成功的身份核实类型。
在一个优选例中，该将所收到的公钥地址、验证成功的身份核实类型和该身份标识的哈希值更新到该第一区块链之后，还包括：
该应用向第一区块链的第一节点发送第五请求，其中包括该签名信息和该公钥；
该第一节点根据该第五请求中的签名信息和公钥进行校验并返回校验结果；
该应用接收根据该第一节点返回校验结果进行身份核实。
在一个优选例中，该第二节点与需要身份核实的对象属于同一国家或地区。
在一个优选例中，该第二区块链的身份核实服务的发布方式如下：
身份核实服务端将能够提供的身份核实服务的信息发送到该第二区块链的第三节点，其中该第三节点与该身份核实服务端属于同一国家或地区；
该第三节点该身份核实服务的信息保存到该第二区块链，并传播到该第二区块链的其他节点，其中包括该第二节点。
在一个优选例中，在该需要身份核实服务的应用向数字身份客户端发送第一请求之前，还包括：
该数字身份客户端接收该身份标识；
该数字身份客户端向用于发布身份核实服务的第二区块链的第二节点查询可用的身份核实服务，并根据查询结果通过与身份核实服务端的交互完成身份验证，接收来自该身份核实服务端的身份验证结果，生成与该身份标识对应的一对公钥和私钥，计算公钥地址并将该公钥地址发送给该身份核实服务端；
该身份核实服务端将所收到的公钥地址、验证成功的身份核实类型和该身份标识的哈希值保存到该第一区块链。
在一个优选例中，该数字身份客户端接收该身份标识之后，还包括：
根据该身份标识进行账户级别验证。
本申请还公开了一种身份核实***，包括：需要身份核实服务的应用、数字身份客户端和第一区块链；
该应用包括请求发送模块和身份核实模块；该请求发送模块用于向该数字身份客户端发送第一请求，其中包括身份标识和第一信息，并向该第一区块链的第一节点发送 第二请求，其中包括该数字身份客户端返回的签名信息和公钥；该身份核实模块用于根据该第一节点返回的校验结果进行身份核实；
该数字身份客户端包括签名模块和发送模块；该签名模块用于使用该第一请求中的身份标识对应的私钥对该第一信息进行数字签名而得到该签名信息；该发送模块用于将该签名信息和该身份标识对应的公钥返回给该应用；
该第一节点包括校验模块，用于根据该第二请求中的签名信息和公钥进行校验，并向该应用返回校验结果。
在一个优选例中，该第一节点与该应用属于同一国家或地区。
在一个优选例中，该数字身份客户端运行在用户终端中；该数字身份客户端与身份核实对象属于同一国家或地区。
在一个优选例中，该第一信息包括业务标识。
在一个优选例中，该第一信息还包括一个随机数。
在一个优选例中，该数字身份客户端还包括：
账户验证模块，用于在收到该第一请求后，根据该身份标识进行账户级别验证；
签名模块，用于在该账户级别验证通过后，根据该身份标识获取对应的公钥和私钥，使用该私钥对该第一信息进行数字签名得到该签名信息；
发送模块，用于将该公钥和该签名信息发送给该应用。
在一个优选例中，该第二请求中还包括该身份标识的哈希值；
该第一节点还包括：
查找模块，用于对该公钥进行哈希运算得到公钥地址，在该第一区块链上找到对应该公钥地址的身份标识哈希值和验证成功的身份核实类型；
验证模块，用于使用该公钥对该签名信息进行签名验证，如果签名验证通过并且该第一区块链上找到的身份标识哈希值和该第二请求中的身份标识哈希值相同，则将该验证成功的身份核实类型作为校验结果发送给该应用。
在一个优选例中，
该应用还包括：核身强度判别模块，用于判断该校验结果中的验证成功的身份核实类型是否满足业务需要；服务查询模块，用于在该校验结果中的验证成功的身份核实 类型不满足业务需要时，向用于发布身份核实服务的第二区块链的第二节点查询能够提供的身份核实服务，从查询结果中选择符合该业务需要的身份核实服务；该请求发送模块还用于向该数字身份客户端发送第三请求，该第三请求中包括被选择的身份核实服务的类型；
该数字身份客户端还包括验证请求模块，用于根据该第三请求中身份核实服务的类型，向相应的身份核实服务端发送第四请求，该第四请求中包括该签名信息、该公钥；
该身份核实服务端包括更新模块，用于根据该第三请求进行身份验证，将所收到的公钥地址、验证成功的身份核实类型和该身份标识的哈希值更新到该第一区块链。
在一个优选例中，该更新模块将所收到的公钥、验证成功的身份核实类型和该签名信息发送到该第一区块链的一个节点，供该节点根据收到的签名信息和公钥进行校验，如果校验通过则更新该第一区块链中该公钥对应的验证成功的身份核实类型。
在一个优选例中，该第二节点与需要身份核实的对象属于同一国家或地区。
在一个优选例中，该身份核实服务端还包括服务发布模块，用于将能够提供的身份核实服务的信息发送到该第二区块链的第三节点，其中该第三节点与该身份核实服务端属于同一国家或地区；
该第三节点用于将该身份核实服务的信息保存到该第二区块链，并传播到该第二区块链的其他节点，其中包括该第二节点。
在一个优选例中，该数字身份客户端还包括查询模块和密钥生成模块，其中，
该查询模块，用于根据所接收的该身份标识，向用于发布身份核实服务的第二区块链的第二节点查询可用的身份核实服务，并根据查询结果通过与身份核实服务端的交互完成身份验证，接收来自该身份核实服务端的身份验证结果；
该密钥生成模块，用于生成与该身份标识对应的一对公钥和私钥，计算公钥地址；
该数字身份客户端的发送模块还用于将该公钥地址发送给该身份核实服务端；
该身份核实服务端包括验证模块，用于进行身份验证，并将所收到的公钥地址、验证成功的身份核实类型和该身份标识的哈希值保存到该第一区块链。
本申请还公开了一种身份核实方法，包括：
第三区块链的第四节点接收来自身份核实服务端的身份核实信息，该身份核实信息中包括待验证信息的第一哈希值；
该第四节点将该身份核实信息保存到该第三区块链，并通过该第三区块链将该身份核实信息传播到该第三区块链的第五节点；
该第五节点接收来自第一应用的身份核实请求，其中包括待验证信息的第二哈希值；
该第五节点对该第一哈希值和该第二哈希值进行比较，并根据比较结果向该第一应用返回身份核实结果。
在一个优选例中，该第四节点和该身份核实服务端属于同一国家或地区；
该第五节点和该身份核实服务端不属于同一国家或地区。
在一个优选例中，该第五节点和该第一应用属于同一国家或地区。
在一个优选例中，该第一哈希值和该第二哈希值是通过相同的哈希算法得到的。
在一个优选例中，该根据比较结果向该第一应用返回身份核实结果，进一步包括：
如果相同则该第五节点向该第一应用返回表示身份核实通过的信息，如果不同则该第五节点向该第一应用返回表示身份核实未通过的信息。
在一个优选例中，该身份核实信息还包括待核实身份者的标识信息；
该身份核实请求中还包括待核实身份者的标识信息；
该第五节点对该第一哈希值和该第二哈希值进行比较之前，还包括：根据该身份核实请求中的标识信息在该第三区块链保存的信息中查找具有相同标识信息的身份核实信息，从而找到该第一哈希值。
在一个优选例中，该待验证信息包括以下之一或其任意组合：
指纹信息，人脸特征信息，银行账户信息。
本申请还公开了一种身份核实***，包括身份核实服务端，第三区块链和第一应用：
该身份核实服务端用于向该第三区块链的第四节点发送身份核实信息，该身份核实信息中包括待验证信息的第一哈希值；
该第四节点用于将该身份核实信息保存到该第三区块链，并通过第三区块链将该身份核实信息传播到该第三区块链的第五节点；
该第一应用用于向该第五节点发送身份核实请求，其中包括待验证信息的第二哈 希值；
该第五节点用于对该第一哈希值和该第二哈希值进行比较，并根据比较结果向该第一应用返回身份核实结果。
在一个优选例中，该第四节点和该身份核实服务端属于同一国家或地区；
该第五节点和该身份核实服务端不属于同一国家或地区。
在一个优选例中，该第五节点和该第一应用属于同一国家或地区。
在一个优选例中，该第一哈希值和该第二哈希值是通过相同的哈希算法得到的。
在一个优选例中，该第五节点在该比较结果相同时向该第一应用返回表示身份核实通过的信息，在该比较结果不同时向该第一应用返回表示身份核实未通过的信息。
在一个优选例中，该身份核实信息还包括待核实身份者的标识信息；
该身份核实请求中还包括待核实身份者的标识信息；
该第五节点还用于根据该身份核实请求中的标识信息在该第三区块链保存的信息中查找具有相同标识信息的身份核实信息，从而找到该第一哈希值。
在一个优选例中，该待验证信息包括以下之一或其任意组合：
指纹信息，人脸特征信息，银行账户信息。
本申请还公开了一种身份核实***，包括：
存储器，用于存储计算机可执行指令；以及，
处理器，用于在执行该计算机可执行指令时实现如前文描述的方法中的步骤。
本申请还公开了一种计算机可读存储介质，该计算机可读存储介质中存储有计算机可执行指令，该计算机可执行指令被处理器执行时实现如前文描述的方法中的步骤。
本申请一个实施方式中，使用区块链的技术实现身份核实，可以在满足各国数据出境管控的前提下实现跨国的身份核实。
基于区块链技术，在各个国家、地区之间建设跨境的核身网络***，利用区块链防篡改，可追溯。在不同的国家都部署不同的节点，在本国服务和跨国调用之间取得隐私保护和调用的便利性之间的平衡。
在本申请一个实施方式中，户籍国/地区的身份核实服务端将敏感的待验证信息进 行哈希运算，将敏感信息的哈希值而不是敏感信息本身通过户籍国/地区的节点上传到区块链，通过区块链扩散到其他国家或地区。其他国家或地区的需要身份核实服务的应用向所在国或地区(即调用国/地区)的节点提出身份核实请求，其中也携带待验证信息的哈希值，由调用国/地区的区块链节点判断身份核实请求中的哈希值是否与区块链中保存的哈希值一致，如果一致则向应用返回身份核实通过的消息，否则向应用返回身份核实不通过的消息。通过这种技术方案可以在符合各个国家对数据出境管控的规定的前提下顺利进行身份核实。
本申请的说明书中记载了大量的技术特征，分布在各个技术方案中，如果要罗列出本申请所有可能的技术特征的组合(即技术方案)的话，会使得说明书过于冗长。为了避免这个问题，本申请所述发明内容中公开的各个技术特征、在下文各个实施方式和例子中公开的各技术特征、以及附图中公开的各个技术特征，都可以自由地互相组合，从而构成各种新的技术方案(这些技术方案均因视为在本说明书中已经记载)，除非这种技术特征的组合在技术上是不可行的。例如，在一个例子中公开了特征A+B+C，在另一个例子中公开了特征A+B+D+E，而特征C和D是起到相同作用的等同技术手段，技术上只要择一使用即可，不可能同时采用，特征E技术上可以与特征C相组合，则，A+B+C+D的方案因技术不可行而应当不被视为已经记载，而A+B+C+E的方案应当视为已经被记载。
附图说明
图1是根据本申请第一实施方式的身份核实方法流程示意图
图2是根据本申请第二实施方式的身份核实方法流程示意图
图3是根据本申请第二实施方式的发布和订阅身份核实服务的流程示意图
图4是根据本申请第二实施方式的将经过身份核实服务端验证的身份核实类型上链的流程示意图
图5是根据本申请第三实施方式的身份核实***结构示意图
图6是根据本申请第四实施方式的身份核实方法信息传递示意图
具体实施方式
在以下的叙述中，为了使读者更好地理解本申请而提出了许多技术细节。但是， 本领域的普通技术人员可以理解，即使没有这些技术细节和基于以下各实施方式的种种变化和修改，也可以实现本申请所要求保护的技术方案。
部分概念的说明：
应用：指具备特定功能的应用软件***。本申请实施例中的应用一般指需要身份核实服务的应用。
数字身份客户端，用于进行数字身份验证的客户端。在一个实施例中，该数字身份客户端是一个应用软件，且具有账号体系，每个人都可以注册其户籍国的账号体系，由本国本地身份核实服务提供账户登录等功能。在一个实施例中，该数字身份客户端也是用户的数字身份钱包，钱包里面的证件是存在本国的服务器的。身份钱包中有护照、本国身份证等信息，当在网站上以某个证件注册时，会首先校验其身份钱包中是否有该证件，再访问本国的实人实证服务(identification)。当进行本国身份认证(identification)结束后，数字身份客户端可以通过自己管理的TEE/SE等安全区产生公私钥对，公钥的地址发到区块链上，钱包也会记录公钥、当前的版本号等信息，对应的私钥会被保存到安全区。可选地，公钥地址的计算方式为(Base58(version+ripemd160(SHA256(public key))+checksum)，采用这个计算方式可以防止公钥公开后被过多破解。
身份核实服务端，提供身份核实服务的服务方。在一个实施例中，身份核实服务是在本地(国内或地区内)提供的。在一个实施例中，身份核实服务端是在云端实现的。在一个实施例中，身份核实服务主要提供两个功能，一个功能是对本国/本地区公民的身份进行实人实证校验，并将对用户进行了哪些校验及用户唯一标识索引上链。另一个功能是将本国/本地区的身份核实服务发布至身份核实服务发布区块链(即第二区块链)，以供其他国家/地区需要该服务的服务订阅。各个国家对于数据出境都要求较为严格，因此各国家可以在本国部署身份核实服务，所需要的身份核实数据源都部署在本国境内，但可以接受他国的直连服务，保证敏感数据不能出境。同时本国的身份核实服务也提供对于本国用户的账户管理。只有联盟节点(即认证过的服务商)才可以发布服务，每次发布服务需要加上自己的签名。
身份核实区块链，即第一区块链。在一个实施例中，该区块链承载了用户公钥地址的存储，用户当前公钥进行了哪些身份核实服务的验证，用于用户当前提交的authentication(证明)对应的公钥地址的比对和验签，本区块链上的数据是实现跨国验证的关键数据。该区块链的重要功能是PKI基础服务，包含：1、用户公钥地址的存储；2、对数字签名的验签操作；3、计算上传上来的公钥与公钥地址是否匹配。
身份核实服务发布区块链，即第二区块链。在一个实施例中，本区块链承载了各个国家不同的服务商对外提供的服务，各个国家的服务商也可以订阅其他国家的身份认证服务，原则上该服务只提供身份核验服务(仅返回是或否)。调用国的服务使用方可以自定义哪些服务是符合其业务强度要求的。每个国家对于自己的公民都有一些政府提供的，或者某些公司提供的一些身份认证(identification)的工具，以便确定你是谁，举例来说，中国公安部门提供了公民姓名，身份证号，人脸的比对等服务，如果甲提供的静态信息及生物信息均与公安部门比对源一致，则可以认为甲的信息可信，并被认定为实人实证，确定了提供信息的人就是甲本人。然而各个国家对于公民的敏感信息都有一定程度的强管控，例如A国家不希望其他国家获取到(或留存)本国公民的人脸数据，而B国家的应用出于风险等方面的考虑，希望进行人脸级别的强身份核实操作，这时A国家的服务商AS只要将本国的人脸核验服务发布到身份核实服务发布区块链上，其他国家，例如B国，的服务商BS可以订阅到该服务，如果BS认为AS可靠，就可以借助数字身份客户端完成对AS的访问，而不用留存数据。
IFAA:IFAA(internet finance authentication alliance)，互联网金融认证联盟。为适应生物特征校验等新型校验方式的发展，提供安全并具有更优秀用户体验认证方式，为迅速发展的互联网金融业务提供支持。通过和设备厂商、芯片厂商、算法厂商、安全厂商、标准机构、检测机构合作，创造一种使用生物特征授权访问的一套解决方案。
FIDO:FIDO(Fast Identity Online)联盟，即线上快速身份验证联盟。FIDO联盟为于2012年7月成立的行业协会，其宗旨为满足市场需求和应付网上验证要求。该协议为在线与数码验证方面的首个开放行业标准，可提高安全性、保护私隐及简化用户体验。用户可以使用智能手机指纹采集器、USB令牌等多种方式登录，服务商无需再维护复杂且成本高昂的认证后台。
Hash：中文称为哈希或散列，是一种将任意长度的信息压缩到某一固定长度的消息摘要的函数。
公钥地址：根据公钥进行特定的哈希运算得到的数据。
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请的实施方式作进一步地详细描述。
本申请的第一实施方式涉及一种身份核实方法，其流程如图1所示，该方法包括以下步骤：
在步骤101中，需要身份核实服务的应用向数字身份客户端发送第一请求，其中包括身份标识和第一信息。可选地，第一信息包括业务标识。在第一信息中包括业务标识可以使得身份核实的行为与特定的业务相关联。可选地，第一信息包括业务标识和一个随机数，该随机数也可以被称为挑战值。在用于签名的第一信息中包括一个随机数可以防止重放攻击。可选地，第一信息包括业务的一个或多个特征信息。
此后进入步骤102，应用接收数字身份客户端返回的签名信息和身份标识对应的公钥，其中签名信息由数字身份客户端使用公钥对应的私钥对第一信息数字签名得到。在一个实施例中，数字身份客户端运行在用户终端中。在一个实施例中，数字身份客户端与身份核实对象属于同一国家或地区。身份核实对象就是需要核实身份的人。在另一个实施例中，数字身份客户端与身份核实对象也可以不属于同一国家或地区，只要法律上不禁止该数字身份客户端获取身份核实对象的与身份核实相关的敏感信息即可。
此后进入步骤103，应用向第一区块链的第一节点发送第二请求，其中包括签名信息和公钥，供第一节点根据签名信息和公钥进行校验。在一个实施例中，第一节点与应用属于同一国家或地区，或者说第一节点也可以被称为调用国/地区节点。在另一个实施例中，第一节点与应用也可以不属于同一国家或地区，只要法律上不禁止该应用访问第一节点即可。
此后进入步骤104，应用接收第一节点返回的校验的校验结果，根据该校验结果进行身份核实。
本申请的第二实施方式涉及一种身份核实方法，其流程如图2所示。第一实施方式描述的主要是应用这一端在身份核实过程中的行为，第二实施方式是从整个***的角度(该***包括应用、数字身份客户端、区块链、和身份核实服务端等)描述各个部分如何相互交互实现身份核实的。
在步骤201中，需要身份核实服务的应用向数字身份客户端发送第一请求，其中包括身份标识和第一信息。该步骤与步骤101相同。
此后进入步骤202，数字身份客户端收到第一请求后，根据其中的身份标识获取对应的公钥和私钥，使用私钥对第一信息进行数字签名得到签名信息。可选地，在数字签名之前还需要进行账户级别验证。
此后进入步骤203，数字身份客户端将公钥和签名信息发送给应用。可选地，同时将该公钥和私钥生成时使用的版本号一起发送给应用。
此后进入步骤204，应用向第一区块链的第一节点发送第二请求，其中包括签名信息和公钥。可选地，第二请求中还包括身份标识的哈希值。
此后进入步骤205，第一节点收到第二请求后，根据其中的签名信息和公钥进行校验。可选地，该步骤进一步包括：第一节点根据公钥计算公钥地址，在第一区块链上找到该公钥地址对应的身份标识哈希值和验证成功的身份核实类型。第一节点使用公钥对签名信息进行签名验证，如果签名验证通过并且第一区块链上找到的身份标识哈希值和第二请求中的身份标识哈希值相同，则将验证成功的身份核实类型作为校验结果发送给应用，否则向该应用返回标识身份校验失败的信息。在一个实施例中，第二请求中也可以没有身份标识哈希值，相应地，第一节点也可以不进行第二请求中的身份标识哈希值和第一区块链中身份标识哈希值是否一致的验证。
此后进入步骤206，数字身份客户端向应用返回校验结果，其中包括验证成功的身份核实类型。
此后进入步骤207，应用判断校验结果中的验证成功的身份核实类型是否满足业务需要，如果满足则身份核实成功，结束身份核实的流程，如果不满足则进入步骤208。在一些实施例中，验证成功的身份核实类型也可以被称为身份核实的强度。
在步骤208中，应用向用于发布身份核实服务的第二区块链的第二节点查询能够提供的身份核实服务。可选地，第二节点与需要身份核实的对象属于同一国家或地区。
此后进入步骤209，应用从第二节点返回的查询结果中选择符合业务需要的身份核实服务。
此后进入步骤210，应用向数字身份客户端发送第三请求，该第三请求中包括被选择的身份核实服务的类型。
此后进入步骤211，数字身份客户端根据第三请求中身份核实服务的类型，向相应的身份核实服务端发送第四请求，该第四请求中包括签名信息和公钥。
此后进入步骤212，身份核实服务端进行身份验证。
此后进入步骤213，身份核实服务端将所收到的公钥地址、验证成功的身份核实类型和身份标识的哈希值更新到第一区块链。在一个实施例中，本步骤进一步包括：身份核实服务端将所收到的公钥、验证成功的身份核实类型和签名信息发送到第一区块链的一个节点，该节点根据收到的签名信息和公钥进行校验，如果校验通过则更新第一区块链中该公钥对应的验证成功的身份核实类型。在图2中身份核实服务端是通过调用国/ 地区节点更新第一区块链的，在其他实施例中身份核实服务端可以通过第一区块链中的任意节点更新区块链。
此后进入步骤214，应用向第一区块链的第一节点发送第五请求，其中包括签名信息和公钥。
此后进入步骤215，第一节点根据第五请求中的签名信息和公钥进行校验并在步骤216返回校验结果。
此后进入步骤217，应用接收根据第一节点返回校验结果进行身份核实。
第二区块链是用于发布和订阅身份核实服务的区块链。上述步骤208和209实质上是对身份核实服务的订阅。下面结合图3说明发布和订阅身份核实服务的流程。
在步骤301中，身份核实服务端将能够提供的身份核实服务的信息发送到第二区块链的第三节点，其中该第三节点与该身份核实服务端属于同一国家或地区(或者可称为户籍国/地区节点)。身份核实服务的类型可以是多种多样的，例如人脸验证等。可选地，身份核实服务端发送的信息可以是发布机构标识，身份核实服务的类型，相关的校验数据等。
此后进入步骤302，第三节点身份核实服务的信息保存到第二区块链。此步骤可以称为身份核实服务的信息的上链(上链即保存到区块链)。
此后进入步骤303，第三节点将上链的身份核实服务的信息传播到第二区块链的其他节点，其中包括第二节点(或可称为调用国/地区节点)。至此身份核实服务的发布就完成了。
此后进入步骤304，需要身份核实服务的应用向第二节点订阅已经上链的身份核实服务。
此后进入步骤305，第二节点向该应用返回身份核实服务的信息。之后如果被订阅的身份核实服务的信息有更新，更新的内容也会自动发送至进行订阅的应用。至此完成身份核实服务的订阅。
步骤201至206可以看作通过第一区块链查询已经上链的经过身份核实服务端验证的身份核实类型。下面说明如何将经过身份核实服务端验证的身份核实类型上链。该流程如图4所示。
在步骤401中，数字身份客户端接收身份标识。在一个实施例中，根据传入的校 验人标识，先进行账户级别验证(例如手势解密、密码解密或指纹解密等)，查询该数字身份客户端中是否有该校验人标识对应的标识。
此后进入步骤402，数字身份客户端向用于发布身份核实服务的第二区块链的第二节点查询可用的身份核实服务。在一个实施例中，第二节点是户籍国/地区节点。
此后进入步骤403，第二节点返回可用的身份核实服务。
此后进入步骤404，数字身份客户端根据查询结果通过与身份核实服务端的交互完成身份验证。其中包括数字身份客户端发送请求身份验证的消息，以及其他必要的交互。
此后进入步骤405，身份核实服务端返回身份验证结果。
此后进入步骤406，数字身份客户端接收来自身份核实服务端的身份验证结果，在本地安全环境生成与身份标识对应的一对密钥(包括公钥和私钥)。在一个实施例中，数字身份客户端基于安全的ECC椭圆曲线算法，在手机的安全区(如TEE、SE等)生成公私钥对，私钥存储在本地安全区，公钥存储在本地，公钥长度为64byte(ecc算法公钥，x、y强制32byte，不足补零，首位>1不补零，全部为正数)，(Base58(version+ripemd160(SHA256(public key))+checksum)。Base58是Base64的子集，过滤了一些容易引起混淆的字符，例如0(数字零)，O(大写o)，l(小写L)，I(大写i)，以及“+”和“/”符号，ripemd160、sha256为两种hash算法，version是版本号，默认01，checksum采用ripemd160之后值的CRC16校验码(2字节)。生成公私钥后，基于IFAA、FIDO等生物验证方式，保护私钥的访问。
此后进入步骤407，数字身份客户端计算公钥地址并将该公钥地址发送给身份核实服务端。可选地，可以将版本号也一起发送给身份核实服务端。
此后进入步骤408，身份核实服务端将所收到的公钥地址、验证成功的身份核实类型和身份标识的哈希值上链(即保存到第一区块链)。公钥地址、验证成功的身份核实类型和身份标识的哈希值是一条记录，可以通过公钥地址查询对应的验证成功的身份核实类型和身份标识的哈希值。可选地，身份核实服务端可以将版本号也一起上链。
本申请的第三实施方式涉及一种身份核实***，其结构如图5所示，该身份核实***包括：需要身份核实服务的应用50、数字身份客户端51和第一区块链52，第二区块链53，身份核实服务端54。
应用包括请求发送模块和身份核实模块。请求发送模块用于向数字身份客户端发送第一请求，其中包括身份标识和第一信息，并向第一区块链的第一节点发送第二请求， 其中包括数字身份客户端返回的签名信息和公钥。身份核实模块用于根据第一节点返回的校验结果进行身份核实。可选地，第一信息包括业务标识。在第一信息中包括业务标识可以使得身份核实的行为与特定的业务相关联。可选地，第一信息包括业务标识和一个随机数，该随机数也可以被称为挑战值。在用于签名的第一信息中包括一个随机数可以防止重放攻击。可选地，第一信息包括业务的一个或多个特征信息。
数字身份客户端包括签名模块和发送模块。签名模块用于使用第一请求中的身份标识对应的私钥对第一信息进行数字签名而得到签名信息。发送模块用于将签名信息和身份标识对应的公钥返回给应用。可选地，数字身份客户端运行在用户终端中。数字身份客户端与身份核实对象属于同一国家或地区。
第一节点包括校验模块，用于根据第二请求中的签名信息和公钥进行校验，并向应用返回校验结果。可选地，第一节点与应用属于同一国家或地区。
可选地，数字身份客户端还包括：账户验证模块，用于在收到第一请求后，根据身份标识进行账户级别验证。签名模块，用于在账户级别验证通过后，根据身份标识获取对应的公钥和私钥，使用私钥对第一信息进行数字签名得到签名信息。发送模块，用于将公钥和签名信息发送给应用。
可选地，第二请求中还包括身份标识的哈希值。第一节点还包括查找模块和验证模块，其中，查找模块用于对公钥进行哈希运算得到公钥地址，在第一区块链上找到对应该公钥地址的身份标识哈希值和验证成功的身份核实类型。验证模块用于使用公钥对签名信息进行签名验证，如果签名验证通过并且第一区块链上找到的身份标识哈希值和第二请求中的身份标识哈希值相同，则将验证成功的身份核实类型作为校验结果发送给应用。否则向该应用返回标识身份校验失败的信息。在一个实施例中，第二请求中也可以没有身份标识哈希值，第一节点也可以不进行第二请求中的身份标识哈希值和第一区块链中身份标识哈希值是否一致的验证。
可选地，应用还包括：核身强度判别模块，用于判断校验结果中的验证成功的身份核实类型是否满足业务需要。服务查询模块，用于在校验结果中的验证成功的身份核实类型不满足业务需要时，向用于发布身份核实服务的第二区块链的第二节点查询能够提供的身份核实服务，从查询结果中选择符合业务需要的身份核实服务。请求发送模块还用于向数字身份客户端发送第三请求，该第三请求中包括被选择的身份核实服务的类型。数字身份客户端还包括验证请求模块，用于根据第三请求中身份核实服务的类型，向相应的身份核实服务端发送第四请求，该第四请求中包括签名信息、公钥。身份核实 服务端包括更新模块，用于根据第三请求进行身份验证，将所收到的公钥地址、验证成功的身份核实类型和身份标识的哈希值更新到第一区块链。第二节点与需要身份核实的对象属于同一国家或地区。
可选地，更新模块将所收到的公钥、验证成功的身份核实类型和签名信息发送到第一区块链的一个节点，供该节点根据收到的签名信息和公钥进行校验，如果校验通过则更新第一区块链中该公钥对应的验证成功的身份核实类型。
可选地，身份核实服务端还包括服务发布模块，用于将能够提供的身份核实服务的信息发送到第二区块链的第三节点，其中该第三节点与该身份核实服务端属于同一国家或地区。第三节点用于将身份核实服务的信息保存到第二区块链，并传播到第二区块链的其他节点，其中包括第二节点。
可选地，数字身份客户端还包括查询模块和密钥生成模块，其中，查询模块用于根据所接收的身份标识，向用于发布身份核实服务的第二区块链的第二节点查询可用的身份核实服务，并根据查询结果通过与身份核实服务端的交互完成身份验证，接收来自身份核实服务端的身份验证结果。密钥生成模块用于生成与身份标识对应的一对公钥和私钥，计算公钥地址。数字身份客户端的发送模块还用于将公钥地址发送给身份核实服务端。身份核实服务端包括验证模块，用于进行身份验证，并将所收到的公钥地址、验证成功的身份核实类型和身份标识的哈希值保存到第一区块链。
第一和第二实施方式是与本实施方式相对应的方法实施方式，第一和第二实施方式中的技术细节可以应用于本实施方式，本实施方式中的技术细节也可以应用于第一和第二实施方式。
本申请的第四实施方式涉及一种身份核实方法，其流程如图6所示。
本实施方式需要验证一个待验证信息是否属于一个用户(待核实身份者)。例如，需要验证一个用户的指纹是否与身份核实服务端中该用户的指纹一致。但是，该用户户籍国/地区的法律可能禁止指纹信息出境，那么在该户籍国/地区之外就无法进行指纹验证了。本实施方式中，身份核实服务端把指纹的哈希值上传到区块链的户籍国/地区节点，通过该节点将指纹的哈希值扩散到该区块链在户籍国/地区之外的其他节点，需要验证指纹的调用国/地区的应用可以将采集到的指纹的哈希值发送到该区块链在调用国/地区的节点，该调用国/地区节点将从该应用收到的指纹哈希值和区块链中保存的指纹哈希值进行比较，如果相同就向该应用返回身份核实成功信息，否则返回身份核实失败信息。通 过这种方式，在符合户籍国/地区数据管制法规的前提下，成功地实现了指纹验证。
在步骤601中，身份核实服务端向第三区块链的一个节点(这里称为第四节点)发送身份核实信息。其中包括待核实身份者的标识信息和待验证信息的哈希值(这里称为第一哈希值)。待验证信息可以是指纹信息(或者指纹的特征信息)、人脸特征信息、银行账户信息，等等。待核实身份者的标识信息是可以唯一标识待核实身份者的信息，例如身份证号、驾驶证号、社会保险号等，也可以是将身份证号、驾驶证号、社会保险号等经过某种算法(例如某种哈希算法)变换后的值(以起到保密作用)，例如身份证号的哈希值，等等。
此后进入步骤602，第三区块链的第四节点接收来自身份核实服务端的身份核实信息，将身份核实信息保存到第三区块链，并将身份核实信息传播到第三区块链的其他节点。
此后进入步骤603，需要进行身份核实的第一应用获取待验证信息，对其作哈希运算，向第三区块链的一个节点(这里可以称为第五节点)发送身份核实请求，其中包括待验证信息的哈希值(这里称为第二哈希值)和待核实身份者的标识信息。通常第一哈希值和第二哈希值是通过相同的哈希算法得到的。
此后进入步骤604，第五节点接收来自第一应用的身份核实请求，对该请求中的第一哈希值和第三区块链中保存的第二哈希值进行比较，并根据比较结果向第一应用返回身份核实结果。在一个实施例中，如果相同则第五节点向第一应用返回表示身份核实通过的信息，如果不同则第五节点向第一应用返回表示身份核实未通过的信息。在一个实施例中，第五节点根据身份核实请求中的标识信息在第三区块链保存的信息中查找具有相同标识信息的身份核实信息，从而找到第一哈希值。
可选地，第四节点和身份核实服务端属于同一国家或地区。第五节点和身份核实服务端不属于同一国家或地区。第五节点和第一应用属于同一国家或地区。
本申请的第五实施方式涉及一种身份核实***，如图6所示，该***包括身份核实服务端，第三区块链(其中包括第四和第五节点)和第一应用：
身份核实服务端71用于向第三区块链的第四节点72发送身份核实信息，身份核实信息中包括待验证信息的第一哈希值和核实身份者的标识信息。待验证信息可以是指纹信息(或者指纹的特征信息)、人脸特征信息、银行账户信息等等。待核实身份者的标识信息是可以唯一标识待核实身份者的信息，例如身份证号、驾驶证号、社会保险号 等，也可以是将身份证号、驾驶证号、社会保险号等经过某种算法(例如某种哈希算法)变换后的值，例如身份证号的哈希值，等等。
第四节点72用于将身份核实信息保存到第三区块链，并通过第三区块链将身份核实信息传播到第三区块链的其他节点，其中包括第五节点。
第一应用74用于向第五节点73发送身份核实请求，其中包括待验证信息的第二哈希值和核实身份者的标识信息。在一个实施例中，第一哈希值和第二哈希值是通过相同的哈希算法得到的。
第五节点73用于对第一哈希值和第二哈希值进行比较，并根据比较结果向第一应用返回身份核实结果。在一个实施例中，第五节点在比较结果相同时向第一应用返回表示身份核实通过的信息，在比较结果不同时向第一应用返回表示身份核实未通过的信息。在一个实施例中，第五节点根据身份核实请求中的标识信息在第三区块链保存的信息中查找具有相同标识信息的身份核实信息，从而找到第一哈希值。
在一个实施例中，第四节点和身份核实服务端属于同一国家或地区。第五节点和身份核实服务端不属于同一国家或地区。在一个实施例中，第五节点和第一应用属于同一国家或地区。
第四实施方式是与本实施方式相对应的方法实施方式，第四实施方式中的技术细节可以应用于本实施方式，本实施方式中的技术细节也可以应用于第四实施方式。
需要说明的是，本领域技术人员应当理解，所述身份核实***的实施方式中所示的各模块的实现功能可参照前述身份核实方法的相关描述而理解。所述身份核实***的实施方式中所示的各模块的功能可通过运行于处理器上的程序(可执行指令)而实现，也可通过具体的逻辑电路而实现。本申请实施例所述身份核实***如果以软件功能模块的形式实现并作为独立的产品销售或使用时，也可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机、服务器、或者网络设备等)执行本申请各个实施例所述方法的全部或部分。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read Only Memory)、磁碟或者光盘等各种可以存储程序代码的介质。这样，本申请实施例不限制于任何特定的硬件和软件结合。
相应地，本申请实施方式还提供一种计算机可读存储介质，其中存储有计算机可 执行指令，该计算机可执行指令被处理器执行时实现本申请的各方法实施方式。计算机可读存储介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括但不限于，相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读存储介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
此外，本申请实施方式还提供一种身份核实***，其中包括用于存储计算机可执行指令的存储器，以及，处理器；该处理器用于在执行该存储器中的计算机可执行指令时实现所述各方法实施方式中的步骤。其中，该处理器可以是中央处理单元(Central Processing Unit，简称“CPU”)，还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，简称“DSP”)、专用集成电路(Application Specific Integrated Circuit，简称“ASIC”)等。前述的存储器可以是只读存储器(read-only memory，简称“ROM”)、随机存取存储器(random access memory，简称“RAM”)、快闪存储器(Flash)、硬盘或者固态硬盘等。本发明各实施方式所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
需要说明的是，在本专利的申请文件中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。本专利的申请文件中，如果提到根据某要素执行某行为，则是指至少根据该要素执行该行为的意思，其中包括了两种情况：仅根据该要素执行该行为、和根据该要素和其它要素执行该行为。多个、多次、多种等表达包括2个、2次、2种以及2个以上、2次以上、2种以上。
在本申请提及的所有文献都被认为是整体性地包括在本申请的公开内容中，以便在必要时可以作为修改的依据。此外应理解，以上所述仅为本说明书的较佳实施例而已，并非用于限定本说明书的保护范围。凡在本说明书一个或多个实施例的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本说明书一个或多个实施例的保护范围之内。

Claims (43)

  1. 一种身份核实方法，其特征在于，包括：
    需要身份核实服务的应用向数字身份客户端发送第一请求，其中包括身份标识和第一信息；
    所述应用接收所述数字身份客户端返回的签名信息和所述身份标识对应的公钥，其中所述签名信息由所述数字身份客户端使用所述公钥对应的私钥对所述第一信息数字签名得到；
    所述应用向第一区块链的第一节点发送第二请求，其中包括所述签名信息和公钥，供所述第一节点根据所述签名信息和公钥进行校验；
    所述应用接收所述第一节点返回的所述校验的校验结果，根据该校验结果进行身份核实。
  2. 如权利要求1所述的方法，其特征在于，所述第一节点与所述应用属于同一国家或地区。
  3. 如权利要求1所述的方法，其特征在于，所述数字身份客户端运行在用户终端中；所述数字身份客户端与身份核实对象属于同一国家或地区。
  4. 如权利要求1所述的方法，其特征在于，所述第一信息包括业务标识。
  5. 如权利要求4所述的方法，其特征在于，所述第一信息还包括一个随机数。
  6. 如权利要求1所述的方法，其特征在于，所述应用向数字身份客户端发送第一请求之后，还包括：
    所述数字身份客户端根据所述身份标识进行账户级别验证；
    所述账户级别验证通过后，所述数字身份客户端获取所述身份标识对应的公钥和私钥，使用所述私钥对所述第一信息进行数字签名得到所述签名信息；
    所述数字身份客户端将所述公钥和所述签名信息发送给所述应用。
  7. 如权利要求1所述的方法，其特征在于，所述应用向第一区块链的第一节点发送第二请求之后，还包括：
    所述第一节点根据所述签名信息和公钥进行校验。
  8. 如权利要求7所述的方法，其特征在于，所述第二请求中还包括所述身份标识的哈希值；
    所述第一节点根据所述签名信息和公钥进行校验，进一步包括：
    所述第一节点对所述公钥进行哈希运算得到公钥哈希值，在所述第一区块链上找到对应该公钥哈希值的身份标识哈希值和验证成功的身份核实类型；
    所述第一节点使用所述公钥对所述签名信息进行签名验证，如果签名验证通过并且所述第一区块链上找到的身份标识哈希值和所述第二请求中的身份标识哈希值相同，则将所述验证成功的身份核实类型作为校验结果发送给所述应用。
  9. 如权利要求8所述的方法，其特征在于，所述应用接收所述第一节点返回的所述校验的校验结果之后，还包括：
    所述应用判断所述校验结果中的验证成功的身份核实类型是否满足业务需要，如果不满足，则向用于发布身份核实服务的第二区块链的第二节点查询能够提供的身份核实服务，从查询结果中选择符合所述业务需要的身份核实服务，向所述数字身份客户端发送第三请求，该第三请求中包括被选择的身份核实服务的类型；
    所述数字身份客户端根据所述第三请求中身份核实服务的类型，向相应的身份核实服务端发送第四请求，该第四请求中包括所述签名信息、所述公钥；
    所述身份核实服务端进行身份验证，将所收到的公钥哈希值、验证成功的身份核实类型和所述身份标识的哈希值更新到所述第一区块链。
  10. 如权利要求9所述的方法，其特征在于，所述将所收到的公钥哈希值、验证成功的身份核实类型和所述身份标识的哈希值更新到所述第一区块链，进一步包括：
    所述身份核实服务端将所收到的公钥、验证成功的身份核实类型和所述签名信息发送到所述第一区块链的一个节点，该节点根据收到的签名信息和公钥进行签名校验，如果校验通过则更新所述第一区块链中该公钥对应的验证成功的身份核实类型。
  11. 如权利要求10所述的方法，其特征在于，所述将所收到的公钥哈希值、验证成功的身份核实类型和所述身份标识的哈希值更新到所述第一区块链之后，还包括：
    所述应用向第一区块链的第一节点发送第五请求，其中包括所述签名信息和所述公钥；
    所述第一节点根据所述第五请求中的签名信息和公钥进行校验并返回校验结果；
    所述应用接收根据所述第一节点返回校验结果进行身份核实。
  12. 如权利要求9所述的方法，其特征在于，所述第二节点与需要身份核实的对象属于同一国家或地区。
  13. 如权利要求9所述的方法，其特征在于，所述第二区块链的身份核实服务的发布方式如下：
    身份核实服务端将能够提供的身份核实服务的信息发送到所述第二区块链的第三节点，其中该第三节点与该身份核实服务端属于同一国家或地区；
    所述第三节点所述身份核实服务的信息保存到所述第二区块链，并传播到所述第二 区块链的其他节点，其中包括所述第二节点。
  14. 如权利要求1所述的方法，其特征在于，在所述需要身份核实服务的应用向数字身份客户端发送第一请求之前，还包括：
    所述数字身份客户端接收所述身份标识；
    所述数字身份客户端向用于发布身份核实服务的第二区块链的第二节点查询可用的身份核实服务，并根据查询结果通过与身份核实服务端的交互完成身份验证，接收来自所述身份核实服务端的身份验证结果，生成与所述身份标识对应的一对公钥和私钥，计算公钥哈希值并将该公钥哈希值发送给所述身份核实服务端；
    所述身份核实服务端将所收到的公钥哈希值、验证成功的身份核实类型和所述身份标识的哈希值保存到所述第一区块链。
  15. 如权利要求14所述的方法，其特征在于，所述数字身份客户端接收所述身份标识之后，还包括：
    根据所述身份标识进行账户级别验证。
  16. 一种身份核实***，其特征在于，包括：需要身份核实服务的应用、数字身份客户端和第一区块链；
    所述应用包括请求发送模块和身份核实模块；所述请求发送模块用于向所述数字身份客户端发送第一请求，其中包括身份标识和第一信息，并向所述第一区块链的第一节点发送第二请求，其中包括所述数字身份客户端返回的签名信息和公钥；所述身份核实模块用于根据所述第一节点返回的校验结果进行身份核实；
    所述数字身份客户端包括签名模块和发送模块；所述签名模块用于使用所述第一请求中的身份标识对应的私钥对所述第一信息进行数字签名而得到所述签名信息；所述发送模块用于将所述签名信息和所述身份标识对应的公钥返回给所述应用；
    所述第一节点包括校验模块，用于根据所述第二请求中的签名信息和公钥进行校验，并向所述应用返回校验结果。
  17. 如权利要求16所述的***，其特征在于，所述第一节点与所述应用属于同一国家或地区。
  18. 如权利要求16所述的***，其特征在于，所述数字身份客户端运行在用户终端中；所述数字身份客户端与身份核实对象属于同一国家或地区。
  19. 如权利要求16所述的***，其特征在于，所述第一信息包括业务标识。
  20. 如权利要求19所述的***，其特征在于，所述第一信息还包括一个随机数。
  21. 如权利要求16所述的***，其特征在于，所述数字身份客户端还包括：
    账户验证模块，用于在收到所述第一请求后，根据所述身份标识进行账户级别验证；
    签名模块，用于在所述账户级别验证通过后，根据所述身份标识获取对应的公钥和私钥，使用所述私钥对所述第一信息进行数字签名得到所述签名信息；
    发送模块，用于将所述公钥和所述签名信息发送给所述应用。
  22. 如权利要求16所述的***，其特征在于，所述第二请求中还包括所述身份标识的哈希值；
    所述第一节点还包括：
    查找模块，用于对所述公钥进行哈希运算得到公钥哈希值，在所述第一区块链上找到对应该公钥哈希值的身份标识哈希值和验证成功的身份核实类型；
    验证模块，用于使用所述公钥对所述签名信息进行签名验证，如果签名验证通过并且所述第一区块链上找到的身份标识哈希值和所述第二请求中的身份标识哈希值相同，则将所述验证成功的身份核实类型作为校验结果发送给所述应用。
  23. 如权利要求22所述的***，其特征在于，
    所述应用还包括：核身强度判别模块，用于判断所述校验结果中的验证成功的身份核实类型是否满足业务需要；服务查询模块，用于在所述校验结果中的验证成功的身份核实类型不满足业务需要时，向用于发布身份核实服务的第二区块链的第二节点查询能够提供的身份核实服务，从查询结果中选择符合所述业务需要的身份核实服务；所述请求发送模块还用于向所述数字身份客户端发送第三请求，该第三请求中包括被选择的身份核实服务的类型；
    所述数字身份客户端还包括验证请求模块，用于根据所述第三请求中身份核实服务的类型，向相应的身份核实服务端发送第四请求，该第四请求中包括所述签名信息、所述公钥；
    所述身份核实服务端包括更新模块，用于根据所述第三请求进行身份验证，将所收到的公钥哈希值、验证成功的身份核实类型和所述身份标识的哈希值更新到所述第一区块链。
  24. 如权利要求23所述的***，其特征在于，所述更新模块将所收到的公钥、验证成功的身份核实类型和所述签名信息发送到所述第一区块链的一个节点，供该节点根据收到的签名信息和公钥进行校验，如果校验通过则更新所述第一区块链中该公钥对应的验证成功的身份核实类型。
  25. 如权利要求23所述的***，其特征在于，所述第二节点与需要身份核实的对象属于同一国家或地区。
  26. 如权利要求23所述的***，其特征在于，
    所述身份核实服务端还包括服务发布模块，用于将能够提供的身份核实服务的信息发送到所述第二区块链的第三节点，其中该第三节点与该身份核实服务端属于同一国家或地区；
    所述第三节点用于将所述身份核实服务的信息保存到所述第二区块链，并传播到所述第二区块链的其他节点，其中包括所述第二节点。
  27. 如权利要求16所述的***，其特征在于，所述数字身份客户端还包括查询模块和密钥生成模块，其中，
    所述查询模块，用于根据所接收的所述身份标识，向用于发布身份核实服务的第二区块链的第二节点查询可用的身份核实服务，并根据查询结果通过与身份核实服务端的交互完成身份验证，接收来自所述身份核实服务端的身份验证结果；
    所述密钥生成模块，用于生成与所述身份标识对应的一对公钥和私钥，计算公钥哈希值；
    所述数字身份客户端的发送模块还用于将所述公钥哈希值发送给所述身份核实服务端；
    所述身份核实服务端包括验证模块，用于进行身份验证，并将所收到的公钥哈希值、验证成功的身份核实类型和所述身份标识的哈希值保存到所述第一区块链。
  28. 一种身份核实方法，其特征在于，包括：
    第三区块链的第四节点接收来自身份核实服务端的身份核实信息，所述身份核实信息中包括待验证信息的第一哈希值；
    所述第四节点将所述身份核实信息保存到所述第三区块链，并通过所述第三区块链将所述身份核实信息传播到所述第三区块链的第五节点；
    所述第五节点接收来自第一应用的身份核实请求，其中包括待验证信息的第二哈希值；
    所述第五节点对所述第一哈希值和所述第二哈希值进行比较，并根据比较结果向所述第一应用返回身份核实结果。
  29. 如权利要求28所述的身份核实方法，其特征在于，所述第四节点和所述身份核实服务端属于同一国家或地区；
    所述第五节点和所述身份核实服务端不属于同一国家或地区。
  30. 如权利要求29所述的身份核实方法，其特征在于，所述第五节点和所述第一应用属于同一国家或地区。
  31. 如权利要求28所述的身份核实方法，其特征在于，所述第一哈希值和所述第二哈希值是通过相同的哈希算法得到的。
  32. 如权利要求28所述的身份核实方法，其特征在于，所述根据比较结果向所述第一应用返回身份核实结果，进一步包括：
    如果相同则所述第五节点向所述第一应用返回表示身份核实通过的信息，如果不同则所述第五节点向所述第一应用返回表示身份核实未通过的信息。
  33. 如权利要求28至32中任意一项所述的身份核实方法，其特征在于，所述身份核实信息还包括待核实身份者的标识信息；
    所述身份核实请求中还包括待核实身份者的标识信息；
    所述第五节点对所述第一哈希值和所述第二哈希值进行比较之前，还包括：根据所述身份核实请求中的标识信息在所述第三区块链保存的信息中查找具有相同标识信息的身份核实信息，从而找到所述第一哈希值。
  34. 如权利要求28至32中任意一项所述的身份核实方法，其特征在于，所述待验证信息包括以下之一或其任意组合：
    指纹信息，人脸特征信息，银行账户信息。
  35. 一种身份核实***，其特征在于，包括身份核实服务端，第三区块链和第一应用：
    所述身份核实服务端用于向所述第三区块链的第四节点发送身份核实信息，所述身份核实信息中包括待验证信息的第一哈希值；
    所述第四节点用于将所述身份核实信息保存到所述第三区块链，并通过第三区块链将所述身份核实信息传播到所述第三区块链的第五节点；
    所述第一应用用于向所述第五节点发送身份核实请求，其中包括待验证信息的第二哈希值；
    所述第五节点用于对所述第一哈希值和所述第二哈希值进行比较，并根据比较结果向所述第一应用返回身份核实结果。
  36. 如权利要求35所述的身份核实***，其特征在于，所述第四节点和所述身份核实服务端属于同一国家或地区；
    所述第五节点和所述身份核实服务端不属于同一国家或地区。
  37. 如权利要求36所述的身份核实***，其特征在于，所述第五节点和所述第一应用属于同一国家或地区。
  38. 如权利要求35所述的身份核实***，其特征在于，所述第一哈希值和所述第 二哈希值是通过相同的哈希算法得到的。
  39. 如权利要求35所述的身份核实***，其特征在于，所述第五节点在所述比较结果相同时向所述第一应用返回表示身份核实通过的信息，在所述比较结果不同时向所述第一应用返回表示身份核实未通过的信息。
  40. 如权利要求35至39中任意一项所述的身份核实***，其特征在于，所述身份核实信息还包括待核实身份者的标识信息；
    所述身份核实请求中还包括待核实身份者的标识信息；
    所述第五节点还用于根据所述身份核实请求中的标识信息在所述第三区块链保存的信息中查找具有相同标识信息的身份核实信息，从而找到所述第一哈希值。
  41. 如权利要求35至39中任意一项所述的身份核实***，其特征在于，所述待验证信息包括以下之一或其任意组合：
    指纹信息，人脸特征信息，银行账户信息。
  42. 一种身份核实***，其特征在于，包括：
    存储器，用于存储计算机可执行指令；以及，
    处理器，用于在执行所述计算机可执行指令时实现如权利要求1至15、或28至34中任意一项所述的方法中的步骤。
  43. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机可执行指令，所述计算机可执行指令被处理器执行时实现如权利要求1至15、或28至34中任意一项所述的方法中的步骤。
PCT/CN2019/123309 2018-12-25 2019-12-05 身份核实方法及其*** WO2020134942A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP19901914.2A EP3905078A4 (en) 2018-12-25 2019-12-05 IDENTITY VERIFICATION PROCESS AND SYSTEM THEREOF
SG11202100832TA SG11202100832TA (en) 2018-12-25 2019-12-05 Method and device for identity verification
US17/163,122 US11323260B2 (en) 2018-12-25 2021-01-29 Method and device for identity verification

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811591932.2 2018-12-25
CN201811591932.2A CN110046482A (zh) 2018-12-25 2018-12-25 身份核实方法及其***

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/163,122 Continuation US11323260B2 (en) 2018-12-25 2021-01-29 Method and device for identity verification

Publications (1)

Publication Number Publication Date
WO2020134942A1 true WO2020134942A1 (zh) 2020-07-02

Family

ID=67274025

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/123309 WO2020134942A1 (zh) 2018-12-25 2019-12-05 身份核实方法及其***

Country Status (6)

Country Link
US (1) US11323260B2 (zh)
EP (1) EP3905078A4 (zh)
CN (1) CN110046482A (zh)
SG (1) SG11202100832TA (zh)
TW (1) TWI737001B (zh)
WO (1) WO2020134942A1 (zh)

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111914240A (zh) * 2020-07-28 2020-11-10 中国联合网络通信集团有限公司 基于区块链的身份验证方法、***及公证方节点
CN112632497A (zh) * 2020-12-26 2021-04-09 深圳市八方通达科技有限公司 一种基于区块链的身份信息验证方法及***
CN112925846A (zh) * 2021-01-18 2021-06-08 迅鳐成都科技有限公司 基于区块链与身份认证的历史操作追溯方法及***
CN113434849A (zh) * 2020-09-04 2021-09-24 支付宝(杭州)信息技术有限公司 一种基于可信硬件的数据管理方法、装置及设备
CN114499952A (zh) * 2021-12-23 2022-05-13 中电科大数据研究院有限公司 一种联盟链共识身份认证方法
CN114584324A (zh) * 2022-04-28 2022-06-03 天聚地合(苏州)科技股份有限公司 一种基于区块链的身份授权方法和***
CN115460017A (zh) * 2022-10-27 2022-12-09 中航信移动科技有限公司 一种基于区块链的数字身份权限验证***
CN115982247A (zh) * 2023-03-15 2023-04-18 中国信息通信研究院 基于区块链的账户信息查询方法和装置、设备和介质

Families Citing this family (34)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110046482A (zh) * 2018-12-25 2019-07-23 阿里巴巴集团控股有限公司 身份核实方法及其***
CN109981750B (zh) * 2019-03-06 2021-09-17 北京百度网讯科技有限公司 业务流程***、业务数据处理方法和装置
US11487886B2 (en) * 2019-05-03 2022-11-01 International Business Machines Corporation Database private document sharing
CN110490640B (zh) * 2019-07-24 2021-08-31 创新先进技术有限公司 用于对象分发处理的方法、装置及***
US11501295B2 (en) 2019-07-24 2022-11-15 Advanced New Technologies Co., Ltd. Object distribution processing
CN110555296B (zh) * 2019-08-01 2020-08-18 阿里巴巴集团控股有限公司 基于区块链的身份验证方法、装置及设备
CN110430201A (zh) * 2019-08-09 2019-11-08 北京智汇信元科技有限公司 一种分布式身份凭证生成、验证方法及***
CN110704826A (zh) * 2019-09-02 2020-01-17 深圳壹账通智能科技有限公司 信息推荐方法及装置、存储介质和电子设备
CN110493007B (zh) * 2019-09-06 2021-07-13 腾讯科技（深圳）有限公司 一种基于区块链的信息验证方法、装置、设备及存储介质
CN110601827B (zh) * 2019-09-12 2022-09-02 腾讯科技（深圳）有限公司 基于区块链的身份识别方法、装置及***、存储介质
CN110753029B (zh) * 2019-09-16 2021-09-14 中国联合网络通信集团有限公司 一种身份验证方法及生物识别平台
CN110990827A (zh) * 2019-10-28 2020-04-10 上海隔镜信息科技有限公司 一种身份信息验证方法、服务器及存储介质
CN110995670B (zh) * 2019-11-20 2022-02-25 深圳市雄帝科技股份有限公司 基于区块链的数字身份信息管理方法及***
CN113206817B (zh) * 2020-02-03 2022-07-12 中移物联网有限公司 一种设备连接确认方法和区块链网络
CN111324666B (zh) * 2020-02-14 2024-06-18 腾讯科技（深圳）有限公司 基于区块链的数据处理方法及装置
CN111770063B (zh) * 2020-02-18 2022-09-16 支付宝(杭州)信息技术有限公司 数字身份信息的派生、验证方法、装置及设备
CN111008841B (zh) * 2020-03-05 2020-06-09 支付宝(杭州)信息技术有限公司 一种业务处理***、业务处理的方法、装置及设备
CN113472521A (zh) * 2020-03-30 2021-10-01 山东浪潮质量链科技有限公司 基于区块链的实名数字身份管理方法、签名设备和验证设备
CN111523147B (zh) 2020-07-03 2020-11-24 支付宝(杭州)信息技术有限公司 一种基于区块链的核身方法及相关硬件
TWI759968B (zh) 2020-08-06 2022-04-01 美商動信安全股份有限公司 安全金鑰裝置、安全認證系統以及安全認證方法
CN114531224B (zh) * 2020-10-31 2024-03-01 华为技术有限公司 地址的生成方法、区块链信息的处理方法以及相关设备
CN112637170A (zh) * 2020-12-15 2021-04-09 浙江大华技术股份有限公司 设备保密信息管理方法、设备及存储介质
CN112866242B (zh) * 2021-01-15 2023-03-14 迅鳐成都科技有限公司 一种基于区块链的数字身份验证方法、设备及存储介质
TWI769738B (zh) * 2021-03-12 2022-07-01 帳聯網路科技股份有限公司 基於門檻式簽章的資產跨鏈交換系統及其方法
CN113572615B (zh) * 2021-06-03 2022-09-20 北京邮电大学 分布式网络用户的身份验证方法、***、设备及存储介质
CN113344757A (zh) * 2021-06-29 2021-09-03 重庆广播电视大学重庆工商职业学院 基于物联网和区块链的数据溯源验证方法及***
CN113487321A (zh) * 2021-07-06 2021-10-08 域世安(北京)科技有限公司 基于区块链钱包的身份识别与验证方法及***
WO2023012867A1 (ja) * 2021-08-02 2023-02-09 日本電信電話株式会社 情報処理装置、ノードの選択方法、及びプログラム
CN113742705B (zh) * 2021-08-30 2024-05-24 北京一砂信息技术有限公司 一种基于ifaa号码认证服务实现的方法及***
CN114499988B (zh) * 2021-12-30 2022-11-08 电子科技大学 一种基于区块链的物联网密钥分配及设备认证方法
CN114900321B (zh) * 2022-07-14 2022-10-14 云上人和物联科技有限公司 一种自主实名电子身份凭证生成***及方法
CN115442123B (zh) * 2022-09-01 2024-04-30 中国联合网络通信集团有限公司 实名制认证方法、装置、电子设备及计算机可读介质
CN115580403B (zh) * 2022-12-09 2023-04-25 深圳市永达电子信息股份有限公司 一种基于pki的计算节点接入控制方法
CN115880088A (zh) * 2023-02-14 2023-03-31 布比（北京）网络技术有限公司 账务处理方法、接入服务器、节点服务器及账务处理***

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103107992A (zh) * 2013-02-04 2013-05-15 杭州师范大学 面向云存储加密数据共享的多级权限管理方法
CN106789041A (zh) * 2017-02-15 2017-05-31 江苏信源久安信息科技有限公司 一种去中心化证书可信区块链方法
CN107079036A (zh) * 2016-12-23 2017-08-18 深圳前海达闼云端智能科技有限公司 注册及授权方法、装置及***
CN108064440A (zh) * 2017-05-25 2018-05-22 深圳前海达闼云端智能科技有限公司 基于区块链的fido认证方法、装置及***
CN110046482A (zh) * 2018-12-25 2019-07-23 阿里巴巴集团控股有限公司 身份核实方法及其***

Family Cites Families (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6061449A (en) * 1997-10-10 2000-05-09 General Instrument Corporation Secure processor with external memory using block chaining and block re-ordering
US20040024750A1 (en) 2002-07-31 2004-02-05 Ulyanov Sergei V. Intelligent mechatronic control suspension system based on quantum soft computing
US7336783B2 (en) * 2003-01-24 2008-02-26 Samsung Electronics, C., Ltd. Cryptographic systems and methods supporting multiple modes
US9032206B2 (en) * 2013-02-25 2015-05-12 Surfeasy, Inc. Rule sets for client-applied encryption in communications networks
US10915891B1 (en) 2015-03-16 2021-02-09 Winklevoss Ip, Llc Autonomous devices
JP2018516030A (ja) * 2015-05-05 2018-06-14 ショカード、インコーポレイテッド ブロックチェーンを使用するｉｄ管理サービス
US9985964B2 (en) * 2016-03-28 2018-05-29 Black Gold Coin, Inc. Systems and methods for providing block chain-based multifactor personal identity verification
US10715311B2 (en) * 2017-07-28 2020-07-14 Workday, Inc. System and method for blockchain-based user authentication based on a cryptographic challenge
WO2018049656A1 (zh) * 2016-09-18 2018-03-22 深圳前海达闼云端智能科技有限公司 基于区块链的身份认证方法、装置、节点及***
KR102414732B1 (ko) * 2017-04-05 2022-06-28 삼성에스디에스 주식회사 블록체인 기반 디지털 아이덴티티 관리 방법
EP3396608A1 (en) 2017-04-24 2018-10-31 BlockSettle AB Method and system for settling a blockchain transaction
CN107257336A (zh) * 2017-06-15 2017-10-17 北京汇通金财信息科技有限公司 一种用户认证方法及***
US10135834B1 (en) * 2017-10-20 2018-11-20 Social Patent LLC System and method of executing operations in a social network application
US10657261B2 (en) * 2017-11-30 2020-05-19 Mocana Corporation System and method for recording device lifecycle transactions as versioned blocks in a blockchain network using a transaction connector and broker service
US10783545B2 (en) 2018-04-19 2020-09-22 American Express Travel Related Services Company, Inc. Reward point redemption for cryptocurrency
US20210012332A1 (en) * 2018-04-24 2021-01-14 Duvon Corporation Autonomous exchange via entrusted ledger digital signature
TR201808119A2 (tr) * 2018-06-07 2018-07-23 Elektronik Bilgi Guevenligi Anonim Sirketi E-i̇mza ve blockchain katmanlarindan oluşan bi̇r ki̇şi̇ tanima yöntemi̇
CN108833114A (zh) * 2018-06-13 2018-11-16 上海交通大学 一种基于区块链的去中心化身份认证***及方法
US20190385215A1 (en) 2018-06-19 2019-12-19 American Express Travel Related Services Company, Inc. Buyer-centric marketplace using blockchain
CN108959971A (zh) * 2018-08-09 2018-12-07 佛山市苔藓云链科技有限公司 一种通过区块链维护互联网个人可识别信息的方法
CN109039655A (zh) * 2018-09-13 2018-12-18 全链通有限公司 基于区块链的实名身份认证方法及装置、身份区块链
AU2019362088A1 (en) 2018-10-19 2021-06-10 Digital Asset (Switzerland) GmbH Privacy preserving validation and commit architecture
CN111275404B (zh) * 2020-01-21 2023-09-19 百度在线网络技术（北京）有限公司 基于区块链的评审方法、装置、设备和介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103107992A (zh) * 2013-02-04 2013-05-15 杭州师范大学 面向云存储加密数据共享的多级权限管理方法
CN107079036A (zh) * 2016-12-23 2017-08-18 深圳前海达闼云端智能科技有限公司 注册及授权方法、装置及***
CN106789041A (zh) * 2017-02-15 2017-05-31 江苏信源久安信息科技有限公司 一种去中心化证书可信区块链方法
CN108064440A (zh) * 2017-05-25 2018-05-22 深圳前海达闼云端智能科技有限公司 基于区块链的fido认证方法、装置及***
CN110046482A (zh) * 2018-12-25 2019-07-23 阿里巴巴集团控股有限公司 身份核实方法及其***

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3905078A4 *

Cited By (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111914240A (zh) * 2020-07-28 2020-11-10 中国联合网络通信集团有限公司 基于区块链的身份验证方法、***及公证方节点
CN111914240B (zh) * 2020-07-28 2023-09-15 中国联合网络通信集团有限公司 基于区块链的身份验证方法、***及公证方节点
CN113434849A (zh) * 2020-09-04 2021-09-24 支付宝(杭州)信息技术有限公司 一种基于可信硬件的数据管理方法、装置及设备
CN112632497A (zh) * 2020-12-26 2021-04-09 深圳市八方通达科技有限公司 一种基于区块链的身份信息验证方法及***
CN112925846A (zh) * 2021-01-18 2021-06-08 迅鳐成都科技有限公司 基于区块链与身份认证的历史操作追溯方法及***
CN114499952A (zh) * 2021-12-23 2022-05-13 中电科大数据研究院有限公司 一种联盟链共识身份认证方法
CN114499952B (zh) * 2021-12-23 2024-04-09 中电科大数据研究院有限公司 一种联盟链共识身份认证方法
CN114584324A (zh) * 2022-04-28 2022-06-03 天聚地合(苏州)科技股份有限公司 一种基于区块链的身份授权方法和***
CN114584324B (zh) * 2022-04-28 2022-08-26 天聚地合(苏州)科技股份有限公司 一种基于区块链的身份授权方法和***
CN115460017A (zh) * 2022-10-27 2022-12-09 中航信移动科技有限公司 一种基于区块链的数字身份权限验证***
CN115460017B (zh) * 2022-10-27 2023-01-31 中航信移动科技有限公司 一种基于区块链的数字身份权限验证***
CN115982247A (zh) * 2023-03-15 2023-04-18 中国信息通信研究院 基于区块链的账户信息查询方法和装置、设备和介质

Also Published As

Publication number Publication date
EP3905078A4 (en) 2022-09-21
US11323260B2 (en) 2022-05-03
TW202024977A (zh) 2020-07-01
EP3905078A1 (en) 2021-11-03
US20210152357A1 (en) 2021-05-20
CN110046482A (zh) 2019-07-23
SG11202100832TA (en) 2021-02-25
TWI737001B (zh) 2021-08-21

Similar Documents

Publication Publication Date Title
WO2020134942A1 (zh) 身份核实方法及其***
US11973750B2 (en) Federated identity management with decentralized computing platforms
CA3053316C (en) Method for providing simplified account registration service and user authentication service, and authentication server using same
US11496310B2 (en) Methods and systems for universal storage and access to user-owned credentials for trans-institutional digital authentication
US9954842B2 (en) Method, client, server and system of login verification
EP3073670B1 (en) A system and a method for personal identification and verification
CN110795501A (zh) 基于区块链的可验证声明的创建方法、装置、设备及***
CN110768968B (zh) 基于可验证声明的授权方法、装置、设备及***
EP1698993B1 (en) Method and system for integrating multiple identities, identity mechanisms and identity providers in a single user paradigm
JP2020108156A (ja) 期待値を有するデータセキュリティ処理
CN110753944B (zh) 用于基于区块链的数据管理的***和方法
US20190303929A1 (en) Using out-of-band mobile device possession attestation to release verified user identity attributes during internet transactions
JP2016521932A (ja) 端末識別方法、ならびにマシン識別コードを登録する方法、システム及び装置
CN111031074A (zh) 一种认证方法、服务器和客户端
Wu et al. A Blockchain‐Based Hierarchical Authentication Scheme for Multiserver Architecture
Bhargav-Spantzel Protocols and systems for privacy preserving protection of digital identity
Paci et al. An overview of VeryIDX-A privacy-preserving digital identity management system for mobile devices.
WO2024010738A1 (en) Validate digital ownerships in immutable databases via physical devices
Bhargav-Spantzel CERIAS Tech Report 2007-84 Protocols and Systems for Privacy Preserving Protection of Digital Identity
CN116976891A (zh) 一种金融数据安全管理***、装置及其方法
CN117421774A (zh) 基于区块链的数据存证方法、装置、设备、介质及产品

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19901914

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019901914

Country of ref document: EP

Effective date: 20210726