Data authorization based on decentralized identifiers

Patent metadata

Field	Value
Publication number	US-11271754-B2
Application number	US-202117372790-A
Country	US
Kind code	B2
Filing date	Jul 12, 2021
Priority date	Mar 13, 2020
Publication date	Mar 8, 2022
Grant date	Mar 8, 2022

Abstract

Disclosed herein are methods, systems, and apparatus for controlling authorization of access to user data. One of the methods includes generating a first decentralized identifier based on information about a second decentralized identifier and information about a third decentralized identifier; registering a first set of records and the first decentralized identifier at a second blockchain, the second blockchain includes one or more blockchain contracts configured to, upon execution, perform one or more operations associated with the first decentralized identifier, and registering the first set of records includes storing a hash value for each record in the first set of records in the second blockchain; and controlling authorization of access to the first set of records based on the first decentralized identifier, including in response to receiving a request to grant a second user access to a particular record in the first set of records, determining whether the request includes the first decentralized identifier.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
generating a first decentralized identifier based on information of a second decentralized identifier and information of a third decentralized identifier, wherein the second decentralized identifier is associated with a first user, and the third decentralized identifier is associated with a first blockchain that stores records associated with the first user;
registering a first set of records and the first decentralized identifier at a second blockchain, wherein the first set of records comprises data associated with the first user and is stored in a first consortium blockchain, and wherein the second blockchain comprises one or more blockchain contracts that, upon execution, perform one or more operations associated with the first decentralized identifier, and wherein registering the first set of records comprises storing a hash value for each record in the first set of records in the second blockchain; and
controlling authorization of access to the first set of records based on the first decentralized identifier, wherein controlling the authorization of access to the first set of records comprises:
receiving a request to grant a second user access to a particular record in the first set of records; and
determining whether the request comprises the first decentralized identifier.

2. The computer-implemented method of claim 1 , wherein the first decentralized identifier comprises a digital activity decentralized identifier, the second decentralized identifier comprises a digital identity decentralized identifier, and the third decentralized identifier comprises a business decentralized identifier.

3. The computer-implemented method of claim 1 , wherein the first set of records is generated or managed by a business system that provides a service to the first user, and the business system manages storage of the first set of records into the first consortium blockchain and retrieval of the first set of records from the first consortium blockchain.

4. The computer-implemented method of claim 1 , wherein the first blockchain comprises a consortium blockchain.

5. The computer-implemented method of claim 1 , wherein the second blockchain comprises a decentralized identifier blockchain that stores records associated with a plurality of decentralized identifiers of a plurality of users, and the decentralized identifier blockchain comprises one or more blockchain contracts that, upon execution, perform one or more operations associated with the decentralized identifiers.

6. The computer-implemented method of claim 1 , wherein the request comprises a first value that represents a hash value of the particular record, wherein controlling the authorization of access to the first set of records comprises:
comparing the first value in the request with a hash value of the particular record stored in the second blockchain, and
upon determining that the first value in the request is equal to the hash value of the particular record stored in the second blockchain, approving the request to grant the second user access to the particular record, or upon determining that the first value in the request is different from the hash value of the particular record stored in the second blockchain, denying the request to grant the second user access to the particular record.

7. The computer-implemented method of claim 1 , comprising sending a first message to a first application program associated with the first user to cause the first application program to retrieve the particular record from the first blockchain and present the particular record for review by the first user.

8. The computer-implemented method of claim 7 , wherein the first message comprises a first value that represents the hash value of the particular record, and the first message causes the first application program to perform operations comprising:
calculating a second value that represents a hash value of the particular record retrieved from the first blockchain,
comparing the first value with the second value, and
upon determining that the first value is equal to the second value, approving the request to grant the second user access to the particular record, or upon determining that the first value is different from the second value, denying the request to grant the second user access to the particular record.

9. A computer-implemented system, comprising:
one or more computers; and
one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:
generating a first decentralized identifier based on information of a second decentralized identifier and information of a third decentralized identifier, wherein the second decentralized identifier is associated with a first user, and the third decentralized identifier is associated with a first blockchain that stores records associated with the first user;
registering a first set of records and the first decentralized identifier at a second blockchain, wherein the first set of records comprises data associated with the first user and is stored in a first consortium blockchain, and wherein the second blockchain comprises one or more blockchain contracts that, upon execution, perform one or more operations associated with the first decentralized identifier, and wherein registering the first set of records comprises storing a hash value for each record in the first set of records in the second blockchain; and
controlling authorization of access to the first set of records based on the first decentralized identifier, wherein controlling the authorization of access to the first set of records comprises:
receiving a request to grant a second user access to a particular record in the first set of records; and
determining whether the request comprises the first decentralized identifier.

10. The computer-implemented system of claim 9 , wherein the first decentralized identifier comprises a digital activity decentralized identifier, the second decentralized identifier comprises a digital identity decentralized identifier, and the third decentralized identifier comprises a business decentralized identifier.

11. The computer-implemented system of claim 9 , wherein the first set of records is generated or managed by a business system that provides a service to the first user, and the business system manages storage of the first set of records into the first consortium blockchain and retrieval of the first set of records from the first consortium blockchain.

12. The computer-implemented system of claim 9 , wherein the first blockchain comprises a consortium blockchain.

13. The computer-implemented system of claim 9 , wherein the second blockchain comprises a decentralized identifier blockchain that stores records associated with a plurality of decentralized identifiers of a plurality of users, and the decentralized identifier blockchain comprises one or more blockchain contracts that, upon execution, perform one or more operations associated with the decentralized identifiers.

14. The computer-implemented system of claim 9 , wherein the request comprises a first value that represents a hash value of the particular record, wherein controlling the authorization of access to the first set of records comprises:
comparing the first value in the request with a hash value of the particular record stored in the second blockchain, and
upon determining that the first value in the request is

Assignees

• Alipay Hangzhou Inf Tech Co Ltd

Inventors

• Peng Yujun

Classifications

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04L9/3239 Primary

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• G06F21/6227

  where protection concerns the structure of data, e.g. records, types, queries · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title