# US 2021/0344507 A1 · Data authorization based on decentralized identifiers > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344507 A1 - Document ID: US20210344507A1 - Status: Published application - Kind: A1 - Application number: 17/372,790 - Filed: 2021-07-12 - Published: 2021-11-04 - Earliest claimed: 2020-03-13 - Assignees: Alipay (Hangzhou) Information Technology Co., Ltd. - Applicants: Alipay (Hangzhou) Information Technology Co., Ltd. - Inventors: Yujun Peng - Web page: https://patentgrep.com/patent/US20210344507A1 ## CPC - H04L 9/3247: {involving digital signatures} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 63/101: {Access control lists [ACL]} - H04L 63/123: {received data contents, e.g. message integrity} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 2209/88: Medical equipments - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed herein are methods, systems, and apparatus for controlling authorization of access to user data. One of the methods includes generating a first decentralized identifier based on information about a second decentralized identifier and information about a third decentralized identifier; registering a first set of records and the first decentralized identifier at a second blockchain, the second blockchain includes one or more blockchain contracts configured to, upon execution, perform one or more operations associated with the first decentralized identifier, and registering the first set of records includes storing a hash value for each record in the first set of records in the second blockchain; and controlling authorization of access to the first set of records based on the first decentralized identifier, including in response to receiving a request to grant a second user access to a particular record in the first set of records, determining whether the request includes the first decentralized identifier. ## Claims ### Claim 1 A computer-implemented method, comprising: generating a first decentralized identifier based on information about a second decentralized identifier and information about a third decentralized identifier, wherein the second decentralized identifier is associated with a first user, and wherein the third decentralized identifier is associated with a first blockchain that is configured to store records associated with the first user; registering a first set of records and the first decentralized identifier at a second blockchain, wherein the first set of records include data associated with the first user, wherein the first set of records is stored in a first consortium blockchain, wherein the second blockchain includes one or more blockchain contracts configured to, upon execution, perform one or more operations associated with the first decentralized identifier, and wherein registering the first set of records includes storing a hash value for each record in the first set of records in the second blockchain; and controlling authorization of access to the first set of records based on the first decentralized identifier, including, in response to receiving a request to grant a second user access to a particular record in the first set of records, determining whether the request includes the first decentralized identifier. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the first decentralized identifier comprises a digital activity decentralized identifier, the second decentralized identifier comprises a digital identity decentralized identifier, and the third decentralized identifier comprises a business decentralized identifier. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the first set of records is generated or managed by a business system that provides a service to the first user, and the business system manages storage of the records into the first consortium blockchain and retrieval of the records from the first consortium blockchain. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the first blockchain comprises a consortium blockchain. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the second blockchain comprises a decentralized identifier blockchain that is configured to store records associated with a plurality of decentralized identifiers of a plurality of users, and the decentralized identifier blockchain includes one or more blockchain contracts configured to, upon execution, perform one or more operations associated with the decentralized identifiers. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the request includes a first value that represents a hash value of the particular record, wherein controlling authorization of access to the first set of records includes: comparing the first value in the request with a hash value of the particular record stored in the second blockchain, and at least one of (i) upon determining that the first value in the request is equal to the hash value of the particular record stored in the second blockchain, approving the request to grant the second user access to the particular record, or (ii) upon determining that the first value in the request is different from the hash value of the particular record stored in the second blockchain, denying the request to grant the second user access to the particular record. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, comprising sending a first message to a first application program associated with the first user to cause the first application program to retrieve the particular record from the first blockchain and present the particular record for review by the first user. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, wherein the first message includes a first value that represents the hash value of the particular record, and the first message is configured to cause the first application program to perform operations comprising: calculating a second value that represents a hash value of the particular record retrieved from the first blockchain, comparing the first value with the second value, and at least one of (i) upon determining that the first value is equal to the second value, approving the request to grant the second user access to the particular record, or (ii) upon determining that the first value is different from the second value, denying the request to grant the second user access to the particular record. ### Claim 9 A computer-implemented system, comprising: one or more computers; and one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising: generating a first decentralized identifier based on information about a second decentralized identifier and information about a third decentralized identifier, wherein the second decentralized identifier is associated with a first user, and wherein the third decentralized identifier is associated with a first blockchain that is configured to store records associated with the first user; registering a first set of records and the first decentralized identifier at a second blockchain, wherein the first set of records include data associated with the first user, wherein the first set of records is stored in a first consortium blockchain, wherein the second blockchain includes one or more blockchain contracts configured to, upon execution, perform one or more operations associated with the first decentralized identifier, and wherein registering the first set of records includes storing a hash value for each record in the first set of records in the second blockchain; and controlling authorization of access to the first set of records based on the first decentralized identifier, including, in response to receiving a request to grant a second user access to a particular record in the first set of records, determining whether the request includes the first decentralized identifier. ### Claim 10 (depends on 9) The computer-implemented system of claim 9, wherein the first decentralized identifier comprises a digital activity decentralized identifier, the second decentralized identifier comprises a digital identity decentralized identifier, and the third decentralized identifier comprises a business decentralized identifier. ### Claim 11 (depends on 9) The computer-implemented system of claim 9, wherein the first set of records is generated or managed by a business system that provides a service to the first user, and the business system manages storage of the records into the first consortium blockchain and retrieval of the records from the first consortium blockchain. ### Claim 12 (depends on 9) The computer-implemented system of claim 9, wherein the first blockchain comprises a consortium blockchain. ### Claim 13 (depends on 9) The computer-implemented system of claim 9, wherein the second blockchain comprises a decentralized identifier blockchain that is configured to store records associated with a plurality of decentralized identifiers of a plurality of users, and the decentralized identifier blockchain includes one or more blockchain contracts configured to, upon execution, perform one or more operations associated with the decentralized identifiers. ### Claim 14 (depends on 9) The computer-implemented system of claim 9, wherein the request includes a first value that represents a hash value of the particular record, wherein controlling authorization of access to the first set of records includes: comparing the first value in the request with a hash value of the particular record stored in the second blockchain, and at least one of (i) upon determining that the first value in the request is equal to the hash value of the particular record stored in the second blockchain, approving the request to grant the second user access to the particular record, or (ii) upon determining that the first value in the request is different from the hash value of the particular record stored in the second blockchain, denying the request to grant the second user access to the particular record. ### Claim 15 (depends on 9) The computer-implemented system of claim 9, the operations further comprising sending a first message to a first application program associated with the first user to cause the first application program to retrieve the particular record from the first blockchain and present the particular record for review by the first user. ### Claim 16 (depends on 15) The computer-implemented system of claim 15, wherein the first message includes a first value that represents the hash value of the particular record, and the first message is configured to cause the first application program to perform operations comprising: calculating a second value that represents a hash value of the particular record retrieved from the first blockchain, comparing the first value with the second value, and at least one of (i) upon determining that the first value is equal to the second value, approving the request to grant the second user access to the particular record, or (ii) upon determining that the first value is different from the second value, denying the request to grant the second user access to the particular record. ### Claim 17 A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising: generating a first decentralized identifier based on information about a second decentralized identifier and information about a third decentralized identifier, wherein the second decentralized identifier is associated with a first user, and wherein the third decentralized identifier is associated with a first blockchain that is configured to store records associated with the first user; registering a first set of records and the first decentralized identifier at a second blockchain, wherein the first set of records include data associated with the first user, wherein the first set of records is stored in a first consortium blockchain, wherein the second blockchain includes one or more blockchain contracts configured to, upon execution, perform one or more operations associated with the first decentralized identifier, and wherein registering the first set of records includes storing a hash value for each record in the first set of records in the second blockchain; and controlling authorization of access to the first set of records based on the first decentralized identifier, including, in response to receiving a request to grant a second user access to a particular record in the first set of records, determining whether the request includes the first decentralized identifier. ### Claim 18 (depends on 17) The non-transitory, computer-readable medium of claim 17, wherein the first decentralized identifier comprises a digital activity decentralized identifier, the second decentralized identifier comprises a digital identity decentralized identifier, and the third decentralized identifier comprises a business decentralized identifier. ### Claim 19 (depends on 17) The non-transitory, computer-readable medium of claim 17, wherein the request includes a first value that represents a hash value of the particular record, wherein controlling authorization of access to the first set of records includes: comparing the first value in the request with a hash value of the particular record stored in the second blockchain, and at least one of (i) upon determining that the first value in the request is equal to the hash value of the particular record stored in the second blockchain, approving the request to grant the second user access to the particular record, or (ii) upon determining that the first value in the request is different from the hash value of the particular record stored in the second blockchain, denying the request to grant the second user access to the particular record. ### Claim 20 (depends on 17) The non-transitory, computer-readable medium of claim 17, the operations further comprising sending a first message to a first application program associated with the first user to cause the first application program to retrieve the particular record from the first blockchain and present the particular record for review by the first user.