Identity registration methods, apparatuses, and devices

Patent metadata

Field	Value
Publication number	US-11614929-B2
Application number	US-202117359069-A
Country	US
Kind code	B2
Filing date	Jun 25, 2021
Priority date	Aug 28, 2020
Publication date	Mar 28, 2023
Grant date	Mar 28, 2023

Abstract

Embodiments of the present specification disclose identity registration methods, apparatuses, and devices. One method comprising: identifying description information from a user for a secure application configured to obtain trusted data to be installed; retrieving installation package data corresponding to the secure application based on the description information; installing the secure application in a trusted execution environment (TEE) based on the installation package data; and adding the description information to a digital identity document of the user recorded on a blockchain.

First claim

What is claimed is:

1. A computer-implemented method for identity registration, comprising:
obtaining, from a terminal device, a data acquisition request for target data owned by a data owner and stored by a data provider;
determining a first data retrieving application to be installed in a trusted execution environment (TEE) of the terminal device to retrieve the target data from the data provider, wherein the first data retrieving application is determined by invoking an interface of a smart contract to query a secure application list;
sending the secure application list to the terminal device;
obtaining description information for the first data retrieving application;
retrieving installation package data corresponding to the first data retrieving application based on the description information for the first data retrieving application;
installing the first data retrieving application in the TEE of the terminal device based on the installation package data;
adding the description information for the first data retrieving application to a digital identity document of the terminal device recorded on a blockchain; and
executing the first data retrieving application in the TEE to retrieve the target data from the data provider.

2. The computer-implemented method of claim 1 , comprising:
identifying enterprise identity information from the terminal device;
verifying the enterprise identity information; and
generating a user identifier for a user after the enterprise identity information is successfully verified.

3. The computer-implemented method of claim 2 , comprising:
identifying an information receiving address from the user; and
after the user identifier is generated, generating the digital identity document, wherein the digital identity document comprises the user identifier and the information receiving address.

4. The computer-implemented method of claim 1 , comprising:
sending the target data to the terminal device.

5. The computer-implemented method of claim 1 , wherein determining the first data retrieving application to retrieve the target data comprises:
determining whether the target data is original data owned by the data owner; and
in response to determining that the target data is the original data:
determining the data provider of the original data;
determining acquisition path information of the original data based on a registered communication address of the data provider; and
determining the first data retrieving application based on the acquisition path information.

6. The computer-implemented method of claim 1 , comprising:
determining whether the target data is original data owned by the data owner; and
in response to determining that the target data is not the original data:
determining the original data corresponding to the target data;
determining a second data retrieving application selected by the data owner to retrieve the original data;
determining a processing operation for the original data based on the target data and the original data; and
determining a data processing program selected by a user to perform the processing operation.

7. The computer-implemented method of claim 6 , wherein executing the first data retrieving application in the TEE comprises:
executing the second data retrieving application in the TEE;
identifying the original data based on executing the second data retrieving application; and
inputting the original data to the data processing program in the TEE.

8. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:
obtaining, from a terminal device, a data acquisition request for target data owned by a data owner and stored by a data provider;
determining a first data retrieving application to be installed in a trusted execution environment (TEE) of the terminal device to retrieve the target data from the data provider, wherein the first data retrieving application is determined by invoking an interface of a smart contract to query a secure application list;
sending the secure application list to the terminal device;
obtaining description information for the first data retrieving application;
retrieving installation package data corresponding to the first data retrieving application based on the description information for the first data retrieving application;
installing the first data retrieving application in the TEE of the terminal device based on the installation package data;
adding the description information for the first data retrieving application to a digital identity document of the terminal device recorded on a blockchain; and
executing the first data retrieving application in the TEE to retrieve the target data from the data provider.

9. The non-transitory, computer-readable medium of claim 8 , the operations comprise:
identifying enterprise identity information from the terminal device;
verifying the enterprise identity information; and
generating a user identifier for a user after the enterprise identity information is successfully verified.

10. The non-transitory, computer-readable medium of claim 9 , the operations comprise:
identifying an information receiving address from the user; and
after the user identifier is generated, generating the digital identity document, wherein the digital identity document comprises the user identifier and the information receiving address.

11. The non-transitory, computer-readable medium of claim 8 , the operations comprise:
sending the target data to the terminal device.

12. The non-transitory, computer-readable medium of claim 8 , wherein determining the first data retrieving application to retrieve the target data comprises:
determining whether the target data is original data owned by the data owner; and
in response to determining that the target data is the original data:
determining the data provider of the original data;
determining acquisition path information of the original data based on a registered communication address of the data provider; and
determining the first data retrieving application based on the acquisition path information.

13. The non-transitory, computer-readable medium of claim 8 , the operations comprise:
determining whether the target data is original data owned by the data owner; and
in response to determining that the target data is not the original data:
determining the original data corresponding to the target data;
determining a second data retrieving application selected by the data owner to retrieve the original data;
determining a processing operation for the original data based on the target data and the original data; and
determining a data processing program selected by a user to perform the processing operation.

14. The non-transitory, computer-readable medium of claim 13 , wherein executing the first data retrieving application in the TEE comprises:
executing the second data retrieving application in the TEE;
identifying the original data based on executing the second data retrieving application; and
inputting the original data to the data processing program in the TEE.

15. A computer-implemented system, comprising:
one or more computers; and
one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform operations comprising:
obtaining, from a terminal device, a data acquisition request for target data owned by a

Assignees

• Alipay Hangzhou Inf Tech Co Ltd

Inventors

• Chen Yuan
• Yang Renhui
• Yang Wenyu
• Liu Qin
• Li Shubo

Classifications

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F8/61 Primary

  Installation · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title