System and method for decentralized-identifier authentication
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for blockchain-based decentralized-identifier authentication, are provided. One of the methods includes: obtaining, from a computing device, a request for creating an authentication challenge for a decentralized identifier (DID); obtaining, from a blockchain network, a DID document corresponding to the DID; retrieving a public key associated with the DID from the received DID document; creating the authentication challenge by encrypting a piece of original text using the public key to create a piece of ciphertext; obtaining information associated with an authentication service endpoint for the DID from the received DID document; sending, to the authentication service endpoint according to the obtained information, the created authentication challenge.
1. A computer-implemented method for blockchain-based decentralized-identifier authentication, comprising:
obtaining, by a server from a computing device, a request for creating an authentication challenge for a decentralized identifier (DID);
obtaining, by the server from a blockchain network, a DID document corresponding to the DID;
retrieving, by the server, a public key associated with the DID from the obtained DID document;
creating, by the server, the authentication challenge by encrypting a piece of original text using the public key to create a piece of ciphertext;
obtaining, by the server, information associated with an authentication service endpoint for the DID from the obtained DID document, wherein the information associated with the authentication service endpoint comprises a uniform resource identifier of the authentication service endpoint; and
sending, by the server to the authentication service endpoint according to the uniform resource identifier, the created authentication challenge.
2. The method of claim 1 , wherein the obtaining, from a blockchain network, a DID document corresponding to the DID comprises:
sending a blockchain transaction to one or more blockchain nodes of the blockchain to retrieve the DID document corresponding to the DID, wherein the blockchain transaction comprises information associated with the DID; and
obtaining the DID document from the blockchain.
3. The method of claim 2 , wherein the blockchain transaction invokes a blockchain contract for managing relationships between DIDs and corresponding DID documents.
4. The method of claim 3 , wherein the blockchain contract comprises an interface for retrieving information associated with one or more DID documents corresponding to one or more DIDs.
5. The method of claim 1 , wherein the request for creating the authentication challenge comprises:
the DID; and
a network address to which a response to the authentication challenge is to be sent.
6. The method of claim 5 , wherein the network address is accessible to the computing device.
7. The method of claim 5 , wherein the authentication challenge comprises the network address.
8. The method of claim 1 , further comprising:
storing, by the server, an identifier of the authentication challenge in relation to information associated with the authentication challenge in a memory using a key-value structure.
9. The method of claim 8 , wherein the information associated with the authentication challenge comprises:
the DID;
the original text; or
a network address to which a response to the authentication challenge is to be sent.
10. The method of claim 1 , further comprising:
obtaining, by the server, a response to the authentication challenge, wherein the response comprises a piece of plaintext associated with the authentication challenge;
determining whether the plaintext is identical to the original text; and
in response to determining that the plaintext is identical to the original text, determining that authentication is successful.
11. One or more non-transitory computer-readable storage media for blockchain-based decentralized-identifier authentication, configured with instructions executable by one or more processors to cause the one or more processors to perform operations comprising:
obtaining, from a computing device, a request for creating an authentication challenge for a decentralized identifier (DID);
obtaining, from a blockchain network, a DID document corresponding to the DID;
retrieving a public key associated with the DID from the obtained DID document;
creating the authentication challenge by encrypting a piece of original text using the public key to create a piece of ciphertext;
obtaining information associated with an authentication service endpoint for the DID from the obtained DID document, wherein the information associated with the authentication service endpoint comprises a uniform resource identifier of the authentication service endpoint; and
sending, to the authentication service endpoint according to the uniform resource identifier, the created authentication challenge.
12. The media of claim 11 , wherein the obtaining, from a blockchain network, a DID document corresponding to the DID comprises:
sending a blockchain transaction to one or more blockchain nodes of the blockchain to retrieve the DID document corresponding to the DID, wherein the blockchain transaction comprises information associated with the DID; and
obtaining the DID document from the blockchain.
13. The media of claim 12 , wherein the blockchain transaction invokes a blockchain contract for managing relationships between DIDs and corresponding DID documents.
14. The media of claim 13 , wherein the blockchain contract comprises an interface for retrieving information associated with one or more DID documents corresponding to one or more DIDs.
15. The media of claim 11 , wherein the request for creating the authentication challenge comprises:
the DID; and
a network address to which a response to the authentication challenge is to be sent.
16. The media of claim 15 , wherein the network address is accessible to the computing device.
17. The media of claim 15 , wherein the authentication challenge comprises the network address.
18. The media of claim 11 , wherein the operations further comprise:
storing an identifier of the authentication challenge in relation to information associated with the authentication challenge in a memory using a key-value structure.
19. The media of claim 18 , wherein the information associated with the authentication challenge comprises:
the DID;
the original text; or
a network address to which a response to the authentication challenge is to be sent.
20. A system for blockchain-based decentralized-identifier authentication, comprising a processor and a non-transitory computer-readable storage medium storing instructions executable by the processor to cause the system to perform operations comprising:
obtaining, from a computing device, a request for creating an authentication challenge for a decentralized identifier (DID);
obtaining, from a blockchain network, a DID document corresponding to the DID;
retrieving a public key associated with the DID from the obtained DID document;
creating the authentication challenge by encrypting a piece of original text using the public key to create a piece of ciphertext;
obtaining information associated with an authentication service endpoint for the DID from the obtained DID document, wherein the information associated with the authentication service endpoint comprises a uniform resource identifier of the authentication service endpoint; and
sending, to the authentication service endpoint according to the uniform resource identifier, the created authentication challenge.