System and method for blockchain-based cross-entity authentication

1. A computer-implemented method for blockchain-based cross-entity authentication, comprising:

obtaining, at a first computing system from a blockchain, a first blockchain transaction comprising an authentication request sent by a first entity for authenticating a user, wherein the authentication request comprises a DID (decentralized identifier) corresponding to the user;

determining, at the first computing system, that the first entity is permitted to access authentication information of the user corresponding to the DID, wherein the authentication information is endorsed by a second entity;

obtaining, at the first computing system, an authentication result of whether the DID is registered with the second entity;

generating, at the first computing system, a second blockchain transaction comprising the authentication result; and

notifying, by the first computing system, the first entity of the authentication result by adding the second blockchain transaction to the blockchain.

2. The method of claim 1 , before obtaining the first blockchain transaction, further comprising:

obtaining, at a second computing system, the authentication request by the first entity for authenticating a user;

generating, at the second computing system, the first blockchain transaction for obtaining the authentication result; and

notifying, by the second computing system, the first computing system of the authentication request by adding the first blockchain transaction to the blockchain.

3. The method of claim 1 , further comprising:

obtaining, at the second computing system, the second blockchain transaction from the blockchain, the second blockchain transaction comprising the authentication result, wherein the authentication result indicates that the authentication succeeded; and

transmitting, by the second computing system, the authentication result to the first entity for granting the user access to the first entity.

4. The method of claim 1 , further comprising:

obtaining, at the second computing system, the second blockchain transaction from the blockchain, the second blockchain transaction comprising the authentication result, wherein the authentication result indicates that the authentication failed; and

transmitting, by the second computing system, the authentication result to the first entity for denying the user access to the first entity.

5. The method of claim 1 , wherein:

the user is registered with the second entity; and

the user is not registered with the first entity.

6. The method of claim 1 , wherein:

the obtained first blockchain transaction comprises an authorization encrypted with a private key of the user for permitting the first entity to access the authentication information of the user endorsed by the second entity;

the encrypted authorization comprises the DID of the user;

the encrypted authorization comprises a digital signature on the authentication request based on a private key of the first entity; and

after obtaining the first blockchain transaction and before obtaining the authentication result, the method further comprises:

obtaining, at the first computing system, a public key of the user;

decrypting, at the first computing system, the encrypted authorization with the public key of the user to verify that the authorization is signed by the user and to obtain the digital signature;

obtaining, at the first computing system, a public key of the first entity from the blockchain;

decrypting, at the first computing system, the digital signature with the obtained public key of the first entity; and

comparing, at the first computing system, the decrypted digital signature with a hash value of the authentication request to verify that the authentication request is signed by the first entity.

7. The method of claim 1 , wherein:

the authentication information of the user endorsed by the second entity comprises information corresponding to a VC (verifiable claim) indicating that the user is registered with the second entity; and

the VC corresponds to the DID.

8. The method of claim 7 , wherein:

the VC comprises a permission configured by the second entity or the user for permitting the first entity to access the VC; and

after obtaining the first blockchain transaction and before obtaining the authentication result, the method further comprises: verifying, at the first computing system, based on the permission that the first entity is permitted to access the VC.

9. The method of claim 7 , wherein:

a hash value of the VC is stored in the blockchain;

the VC is stored in a data store; and

the data store comprises one or more of the following: a local data store maintained by the second entity, a public data store accessible to the second entity, and a data store maintained by a platform for the second entity.

10. The method of claim 9 , wherein obtaining the authentication result comprises:

obtaining the VC corresponding to the DID by querying the data store;

generating an unencrypted authentication result by verifying whether the user is registered with the second entity based on the obtained VC; and

generating the authentication result by encrypting the unencrypted authentication result with a private key of the second entity.

11. The method of claim 7 , before obtaining the first blockchain transaction, further comprising:

obtaining, at the first computing system from the second entity, a VC creation request for creating the VC indicating that the user is registered with the second entity;

obtaining, at the first computing system, a digital signature corresponding to the second entity; and

creating, by the first computing system, the VC based on the obtained VC creation request and the obtained digital signature.

12. The method of claim 11 , before obtaining the VC creation request, further comprising:

obtaining, at the first computing system from the second entity, a DID creation request for creating the DID corresponding to an account identifier;

obtaining, at the first computing system, a public key of a cryptographic key pair;

generating, by the first computing system, the DID based on the public key; and

storing, by the first computing system, a mapping relationship between the account identifier and the generated DID.

13. The method of claim 1 , wherein:

the DID comprises a limited-use DID that is limited by an expiring time or an expiring number of use.

14. The method of claim 1 , wherein:

the DID comprises a limited-use DID that is limited for accessing only the first entity.

15. A non-transitory computer-readable storage medium storing instructions executable by one or more processors, wherein execution of the instructions causes the one or more processors to perform operations comprising:

obtaining, from a blockchain, a first blockchain transaction comprising an authentication request sent by a first entity for authenticating a user, wherein the authentication request comprises a DID (decentralized identifier) corresponding to the user;

determining that the first entity is permitted to access authentication information of the user corresponding to the DID, wherein the authentication information is endorsed by a second entity;

obtaining an authentication result of whether the DID is registered with the second entity;

generating a second blockchain transaction comprising the authentication result; and

notifying the first entity of the authentication result by adding the second blockchain transaction to the blockchain.

16. The storage medium of claim 15 , wherein:

the obtained first blockchain transaction comprises an authorization encrypted with a private key of the user for permitting the first entity to access the authentication information of the user endorsed by the second entity;

the encrypted authorization comprises the DID of the user;

the encrypted authorization comprises a digital signature on the authentication request based on a private key of the first entity; and

after obtaining the first blockchain transaction and before obtaining the authentication result, the operations further comprise:

obtaining, at the first computing system, a public key of the user;

decrypting, at the first computing system, the encrypted authorization with the public key of the user to verify that the authorization is signed by the user and to obtain the digital signature;

obtaining, at the first computing system, a public key of the first entity from the blockchain;

decrypting, at the first computing system, the digital signature with the obtained public key of the first entity; and

comparing, at the first computing system, the decrypted digital signature with a hash value of the authentication request to verify that the authentication request is signed by the first entity.

17. The storage medium of claim 15 , wherein:

the authentication information of the user endorsed by the second entity comprises information corresponding to a VC (verifiable claim) indicating that the user is registered with the second entity; and

the VC corresponds to the DID.

18. The storage medium of claim 17 , wherein:

a hash value of the VC is stored in the blockchain;

the VC is stored in a data store; and

the data store comprises one or more of the following: a local data store maintained by the second entity, a public data store accessible to the second entity, and a data store maintained by a platform for the second entity.

19. The storage medium of claim 18 , wherein obtaining the authentication result comprises:

obtaining the VC corresponding to the DID by querying the data store;

generating an unencrypted authentication result by verifying whether the user is registered with the second entity based on the obtained VC; and

generating the authentication result by encrypting the unencrypted authentication result with a private key of the second entity.

20. A system comprising one or more processors and one or more non-transitory computer-readable memories coupled to the one or more processors and configured with instructions executable by the one or more processors to cause the system to perform operations comprising:

obtaining, from a blockchain, a first blockchain transaction comprising an authentication request sent by a first entity for authenticating a user, wherein the authentication request comprises a DID (decentralized identifier) corresponding to the user;

determining that the first entity is permitted to access authentication information of the user corresponding to the DID, wherein the authentication information is endorsed by a second entity;

obtaining an authentication result of whether the DID is registered with the second entity;

generating a second blockchain transaction comprising the authentication result; and

notifying the first entity of the authentication result by adding the second blockchain transaction to the blockchain.