Public Internet of Things privacy protection identity authentication method and system based on block chain

Abstract

The invention belongs to the technical field of Internet security, and discloses a public Internet of Things privacy protection identity authentication method and system based on a block chain, which do not depend on a centralized server, adopts a storage mechanism based on a distributed hash table to realize data storage in a chain-on-chain and chain-off mode, realizes decentralized storage and improves the security of data. Identity sources of the sensor nodes are authenticated through an intelligent contract technology under the condition that real identities are not needed; the method has unforgeability under a random oracle model, and meets the security requirements of integrity, authentication, anonymity and traceability at the same time.

Description

Technical Field

[0001] The present invention belongs to the field of Internet security technology, and in particular relates to a public Internet of Things privacy protection identity authentication method and system based on blockchain. Background Art

[0002] Many smart devices embedded with sensors, chips, etc. have been deployed on the Internet of Things. From wearable devices, smart homes to smart cars, these devices continuously collect, process and share data, which brings convenience to people's lives, but also brings great risks and challenges to personal privacy. IoT devices usually contain a large amount of sensitive data. If these data are not reliably protected, they will cause huge losses to users once leaked. In the Internet of Things, data security is crucial. If the data is unreliable, it will bring disastrous consequences. A research report from Juniper Research stated that by 2023, global spending on IoT network security solutions will exceed US$6 billion. Secondly, these smart devices designed for specific application environments usually have the characteristics of weak computing power, small storage space, narrow communication range, and poor processing power, so lightweight encryption modules should be considered in the Internet of Things.

[0003] IoT device authentication is a security mechanism used to verify the identity of IoT devices. In IoT applications, devices need to be able to connect to the cloud platform securely and communicate with other devices in a trusted manner. Therefore, devices need a mechanism to verify their identity. As a security mechanism for IoT, authentication protects the privacy of public IoT data.

[0004] For current IoT applications, a centralized server architecture is usually used, that is, a trusted third-party intermediary provides a platform to store and maintain IoT device data. The problems caused by this are: first, the data privacy security of users and devices depends on the prevention level of the central server. Once a hacker invades the system, it will cause unpredictable losses to users; second, for an application scenario such as the IoT with many nodes, wide coverage, and large data transmission volume, the centralized server architecture will inevitably bring huge infrastructure construction and maintenance costs. Third, the cornerstone of the normal operation of centralized servers is the trust issue. Users choose the platform provided by the intermediary based on the principle of trust. However, some unscrupulous businesses now choose to sell users' personal privacy data for personal gain.

[0005] In the Internet of Things, device data is transmitted through insecure wireless channels, and attackers can easily eavesdrop, tamper with, and forge data. Digital signature technology has attracted widespread attention due to its data integrity, identity authentication, and non-repudiation. However, traditional digital signatures are no longer applicable to resource-constrained IoT environments. For example, early certificate-based authentication systems require operations such as issuing, storing, revoking, and updating certificates in specific implementations. Not only are there complex certificate management issues, but the overhead of issuing and maintaining certificates for each growing number of IoT devices is also too expensive. Certificateless signatures (CLS) are more in line with the distributed, flexible, and variable characteristics of the IoT, and have fewer restrictions on IoT implementation. Therefore, certificateless aggregate signature technology is needed to ensure the integrity and authentication of messages. At the same time, if the user's real identity is leaked during data transmission, it will lead to serious privacy issues. The use of identity anonymity technology can separate user data from identity information, thereby protecting user identity privacy. Many solutions rely on a trusted authority (TA) for central data storage, which has the risk of single point failure. Blockchain technology is used to build a safer, more decentralized, and more distributed solution, and further eliminate the centralization problem.

[0006] Through the above analysis, the problems and defects of the existing technology are: traditional digital signatures are no longer applicable to the resource-constrained IoT environment. Summary of the invention

[0007] In view of the problems existing in the prior art, the present invention provides a method and system for public Internet of Things privacy protection identity authentication based on blockchain

[0008] The present invention is implemented as follows: a method for privacy protection identity authentication of a public Internet of Things based on blockchain, comprising:

[0009] S1, uses DHT-based distributed storage mechanism and blockchain technology to achieve on-chain and off-chain storage of data;

[0010] S2, using pseudonyms instead of real identities to reduce the transmission and use of identity information;

[0011] S3, adopts the improved delegated Byzantine fault tolerance (dBFT) algorithm;

[0012] S4, uses trusted execution technology to build a high-security authentication environment based on hardware protection and enhance the computing security of the authentication process.

[0013] Furthermore, S3 specifically includes: selecting a leader from the miners to generate a new candidate block for the new transaction, and then broadcasting the candidate block to other miners; if more than 2 / 3 of the miners successfully verify the candidate block, the candidate block will be linked to the blockchain; at the same time, the consensus process of dBFT is optimized through the aggregate signature technology to reduce the space complexity of the signature in the blockchain system.

[0014] Furthermore, S4 specifically includes: when the attacker captures some sensor nodes, he will launch a distributed denial of service (DDoS) attack on the aggregator. The trust management component runs on the permissioned blockchain to actively detect the damaged sensor nodes; in the same cluster based on the reputation-based trust model, each sensor node will monitor the behavior of its neighbor nodes and update the reputation value of the neighbor nodes. If the node reputation value is lower than the threshold, the node will be disconnected from the chain.

[0015] Furthermore, by analyzing the security requirements of existing IoT systems, blockchain is applied to IoT and a distributed and secure IoT system architecture is designed;

[0016] Use decentralized, immutable, transparent, and traceable blockchain to store sensitive information in the Internet of Things, including user information and device data;

[0017] Based on the proposed privacy protection scheme, a distributed identity authentication protocol based on smart contracts is constructed. This protocol combines the certificateless cryptographic mechanism and signature aggregation technology to overcome the key escrow problem and reduce the storage load of the system.

[0018] Further, the identity authentication process is:

[0019] (1) The user and device use the elliptic curve digital encryption algorithm to generate a key pair and use the hash value of the public key as the identity ID;

[0020] (2) The user generates a PID using a pseudonym algorithm;

[0021] (3) The device completes the registration operation and records the information into the blockchain network;

[0022] (4) The user sends a device-related transaction to the smart contract account to establish a connection with the device and obtain the device's read and operation permissions;

[0023] (5) All subsequent user operations on the device are completed in the form of transactions, including remote control and device query.

[0024] Another object of the present invention is to provide a blockchain-based public Internet of Things privacy protection identity authentication system for implementing the blockchain-based public Internet of Things privacy protection identity authentication method, comprising:

[0025] DHT distributed storage module, which is used to realize on-chain and off-chain storage of data based on DHT distributed storage mechanism and blockchain technology;

[0026] Pseudonym replacement module, used to replace real identity with pseudonym, reducing the transmission and use of identity information;

[0027] Delegated Byzantine Fault Tolerance module, used to adopt the improved Delegated Byzantine Fault Tolerance (dBFT) algorithm;

[0028] The security enhancement module uses trusted execution technology to build a high-security authentication environment based on hardware protection and enhance the computing security of the authentication process;

[0029] The identity authentication module is used to authenticate the user identity.

[0030] Another object of the present invention is to provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the blockchain-based public Internet of Things privacy protection identity authentication method.

[0031] Another object of the present invention is to provide a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of the blockchain-based public Internet of Things privacy protection identity authentication method.

[0032] Another object of the present invention is to provide an information data processing terminal, which is used to implement the public Internet of Things privacy protection identity authentication system based on blockchain.

[0033] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0034] First, the present invention does not rely on centralized servers, but adopts a storage mechanism based on distributed hash tables to store data in an on-chain and off-chain manner, thereby realizing decentralized storage and improving data security. It uses smart contract technology to authenticate the identity source of sensor nodes without the need for real identities. It is unforgeable under the random oracle model and simultaneously meets the security requirements of integrity, authentication, anonymity, and traceability.

[0035] The present invention provides a decentralized Internet of Things system, which ensures that the self-maintenance and self-operation of devices are achieved without the intervention of a third-party group, and at the same time completes the identity authentication of devices to devices and devices to users, so that nodes and devices in the network can verify each other's identities, and ensure the normal operation of the decentralized system. In the Internet of Things, device data is transmitted through an insecure wireless channel, and attackers can easily eavesdrop, tamper with and forge data. Digital signature technology has attracted widespread attention due to its data integrity, identity authentication and non-repudiation. However, traditional digital signatures are no longer applicable to resource-constrained Internet of Things environments. For example, early certificate-based identity authentication systems need to perform operations such as issuing, storing, revoking and updating certificates when they are specifically implemented. Not only are there complex certificate management issues, but the cost of issuing and maintaining certificates for each growing number of Internet of Things devices is also too expensive. Certificateless signature (CLS) is more in line with the distributed, flexible and variable characteristics of the Internet of Things, and has fewer restrictions on the implementation of the Internet of Things. Therefore, certificateless aggregate signature technology is needed to ensure the integrity and authentication of messages. At the same time, if the real identity of the user is leaked during the data transmission process, it will lead to serious privacy issues. The use of identity anonymity technology can separate user data from identity information, thereby protecting the privacy of user identity. Many solutions rely on trusted institutions (TA) for central data storage, which has the risk of single point failure. Blockchain technology is used to build a safer, more decentralized and distributed solution, and further eliminate the centralization problem.

[0036] Second, the present invention solves the problems of the current centralized server architecture. First, the data privacy security of users and devices depends on the prevention level of the central server. Once hackers invade the system, it will cause unpredictable losses to users; second, for application scenarios such as the Internet of Things with many nodes, wide coverage, and large data transmission volume, the centralized server architecture will inevitably bring huge infrastructure construction and maintenance costs. Third, the cornerstone of the normal operation of centralized servers is the trust issue. Users choose the platform provided by the intermediary based on the principle of trust, but some unscrupulous merchants choose to sell users' personal privacy data for personal gain.

[0037] Third, the present invention provides an architecture of an e-commerce invoice management method, which uses blockchain technology to enhance the security and privacy protection of sensitive information in an IoT environment. The following are significant technical advances achieved by the present invention in solving the problems of the prior art:

[0038] 1. Decentralized storage: By adopting blockchain technology, the present invention avoids the credit problem of traditional centralized storage systems. The decentralized nature means there is no single point of failure, thus increasing the stability and anti-attack capabilities of the system.

[0039] 2. Data immutability: Once the data on the blockchain is recorded, it cannot be modified or deleted. This feature provides additional security for the management of e-commerce invoices and ensures the authenticity and integrity of transaction data.

[0040] 3. Transparency and traceability: Blockchain provides a transparent data storage environment where all participants can view unchangeable transaction records, thereby enhancing the traceability of data and helping to enhance the trust of users and participants.

[0041] 4. Enhanced privacy protection: By using pseudonyms instead of real identities, the present invention reduces the transmission and use of identity information and effectively reduces the risk of exposure of user privacy information.

[0042] 5. Improved consensus mechanism: The improved dBFT algorithm is used to optimize the consensus process, improve transaction processing speed and efficiency, and reduce the computing and storage overhead caused by the consensus mechanism.

[0043] 6. Enhanced computing security: By adopting trusted execution technology, the present invention builds a high-security authentication environment based on hardware protection, which can resist various network attacks including DDoS.

[0044] 7. Reputation-based trust management: Introducing a reputation system to monitor and evaluate sensor nodes can effectively identify and isolate malicious nodes, thereby improving the overall security of the network.

[0045] By combining blockchain technology and advanced security mechanisms, the present invention significantly improves the security and privacy protection capabilities of e-commerce invoice management in the Internet of Things environment, solves many problems of existing technologies in data security, privacy protection, and system reliability, and represents an important technological advancement in the field of e-commerce and Internet of Things security. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0047] Figure 1 This is a schematic diagram of the architecture of a public Internet of Things privacy protection solution based on blockchain provided by an embodiment of the present invention;

[0048] Figure 2 It is a diagram of a distributed identity authentication protocol application solution based on a smart contract provided by an embodiment of the present invention;

[0049] Figure 3 It is a schematic diagram of the blockchain structure provided by an embodiment of the present invention;

[0050] Figure 4 It is a schematic diagram of the smart contract blockchain architecture provided by an embodiment of the present invention;

[0051] Figure 5 This is a flow chart of identity authentication of an Internet of Things device provided by an embodiment of the present invention;

[0052] Figure 6 This is a structural diagram of a public Internet of Things privacy protection identity authentication system based on blockchain provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0054] In view of the problems existing in the prior art, the present invention provides a method and system for privacy protection identity authentication in a public Internet of Things based on blockchain. The present invention is described in detail below in conjunction with the accompanying drawings.

[0055] The following are two specific examples to illustrate the practical application of this blockchain-based public IoT privacy protection identity authentication method:

[0056] Example 1: Identity Authentication System in Smart City

[0057] In a smart city scenario, various IoT devices (such as smart street lights, environmental monitoring stations, public transportation equipment, etc.) need to interact with other systems or users. In order to ensure the security and privacy of data and achieve efficient identity authentication, this blockchain-based public IoT privacy protection identity authentication method can be adopted.

[0058] 1. Data storage: Using the DHT distributed storage mechanism and blockchain technology, the identity information, transaction records and other data of IoT devices are stored on the blockchain. At the same time, some infrequently accessed data is stored in the DHT network to achieve collaborative management of data on and off the chain.

[0059] 2. Pseudonymous identity: When registering, an IoT device generates a unique pseudonym to replace its real identity. When interacting with other systems or users, the pseudonym is used for authentication to reduce the exposure of real identity information.

[0060] 3. Improved Delegated Byzantine Fault Tolerance (dBFT) Algorithm: The identity authentication system in the smart city adopts an improved dBFT algorithm to ensure that the system can still maintain normal operation and provide reliable authentication services when some nodes fail or are attacked.

[0061] 4. Trusted Execution Environment: To further enhance the security of the authentication process, the system uses trusted execution technology (such as Intel SGX) to build a high-security authentication environment based on hardware protection. In this environment, sensitive data and operations during the authentication process can be effectively protected to prevent being stolen by malware or attackers.

[0062] Example 2: Identity authentication and data sharing of autonomous vehicles

[0063] In the scenario of self-driving cars, vehicles need to communicate and share data in real time with roadside infrastructure, other vehicles, and cloud services. In order to ensure the security of communication and the privacy of data, a public IoT privacy-preserving identity authentication method based on blockchain can be adopted.

[0064] 1. On-chain and off-chain storage: The identity information, driving records, maintenance records and other data of self-driving cars can be stored on-chain and off-chain through the DHT distributed storage mechanism and blockchain technology. This can not only ensure the security and immutability of data, but also improve the access efficiency of data.

[0065] 2. Pseudonymous identity authentication: Each autonomous vehicle is given a unique pseudonym when it is registered, which is used for communication and identity authentication with other vehicles or infrastructure. This pseudonym mechanism helps protect the true identity of the vehicle and the privacy of the owner.

[0066] 3. Improved dBFT algorithm: In the communication network of autonomous vehicles, an improved dBFT algorithm is used to ensure the reliability and security of communication. Even if some nodes in the network fail or are attacked, the improved dBFT algorithm can ensure the continuity of communication and the integrity of data.

[0067] 4. Trusted Execution Environment: To enhance the security of self-driving cars when processing sensitive data and performing critical tasks, a trusted execution environment can be deployed on the vehicle. In this environment, the vehicle's identity authentication process, data encryption operations, and communication protocols with other vehicles can be protected at the hardware level.

[0068] These two embodiments demonstrate the application of the blockchain-based public IoT privacy protection identity authentication method in different scenarios. By combining the DHT distributed storage mechanism, pseudonymous identity, improved dBFT algorithm and trusted execution technology, data security storage, privacy protection and efficient identity authentication are achieved. In view of the single point failure problem, key escrow and system storage load problems faced by the current traditional centralized system, the embodiment of the present invention provides a blockchain-based public IoT privacy protection identity authentication method, which combines blockchain technology and certificateless signature to solve the single point failure problem faced by the traditional centralized system, so that redundant operations such as issuing, storing, revoking and updating certificates are no longer performed.

[0069] like Figure 1 , which is a schematic diagram of the architecture of an e-commerce invoice management method provided by an embodiment of the present invention, adopts a decentralized, immutable, transparent, and traceable blockchain to store sensitive information in the Internet of Things, such as user information and device data;

[0070] The use of DHT-based distributed storage mechanism and blockchain technology realizes the on-chain and off-chain storage of data, which not only avoids the credit problems caused by centralized servers, but also controls the access of other entities to data through miners on the blockchain, greatly reducing the risk of data leakage;

[0071] Use pseudonyms instead of real identities to reduce the transmission and use of identity information. In IoT communications, in order to protect the privacy information of devices and users, using pseudonyms instead of real identities can effectively reduce the transmission of real privacy information in the network, thereby reducing the exposure of private information and effectively protecting the privacy security of device information;

[0072] The improved Delegated Byzantine Fault Tolerance (dBFT) algorithm is adopted. In this mechanism, a leader is selected from the miners to generate a new candidate block for the new transaction, and then the candidate block is broadcast to other miners. If more than 2 / 3 of the miners successfully verify the candidate block, the candidate block will be linked to the blockchain. At the same time, the consensus process of dBFT is optimized through the aggregate signature technology, which greatly reduces the space complexity of signatures in the blockchain system;

[0073] Trusted execution technology is used to build a high-security authentication environment based on hardware protection to enhance the computing security of the authentication process. When the attacker captures some sensor nodes, a distributed denial of service (DDoS) attack will be launched against the aggregator. The trust management component runs on the permissioned blockchain to actively detect the compromised sensor nodes. In the same cluster based on the reputation-based trust model, each sensor node will monitor the behavior of its neighbor nodes and update the reputation value of the neighbor nodes. If the node reputation value is lower than the threshold, the node will be disconnected from the chain.

[0074] After security proof and analysis, the results show that the invention can meet the security requirements of the Internet of Things and can resist joint and tampering attacks, etc.

[0075] like Figure 2 , which is a diagram of a distributed identity authentication protocol application solution based on a smart contract provided by an embodiment of the present invention.

[0076] A smart contract is a computer protocol that allows contracts to be verified or executed in code without the involvement of a third party. Once a smart contract is deployed, its predefined code exists as a contract account in the blockchain network. Similar to a trusted authenticator, a smart contract account opens its predefined interface functions for other accounts to call. After each node verifies the transaction signature, it executes the contract according to the transaction parameters, verifies the sender and transaction parameters, and changes the blockchain ledger. In this solution, the smart contract can authenticate the source of the sensor node identity without the need for the real identity of the sensor node, and selects legitimate nodes to sign the message, thereby improving the security of the solution;

[0077] In the user or device revocation operation, the use of smart contracts can quickly revoke user identity and device information, saving the query and storage overhead of the revocation list;

[0078] At the same time, the scheme supports signature aggregation (i.e. forming a compact signature from multiple signatures) and batch verification (i.e. verifying multiple messages from multiple devices or users at the same time), which effectively improves the authentication efficiency. Aggregate signature technology can aggregate n signatures into one signature. The verifier only needs to verify the aggregate signature information to confirm the validity of the n signature information, thereby significantly reducing the computational and communication overhead;

[0079] The transactions of this protocol include user identity transactions and device data transactions. The user identity authentication process is simplified through the extended blockchain structure, providing a distributed anonymous identity authentication form. The security of the proposed protocol is proved in the random oracle model (ROM), and security analysis and comparison are performed.

[0080] like Figure 3 As shown, it is a schematic diagram of a blockchain structure provided by an example of the present invention.

[0081] A blockchain is a series of data blocks maintained by a distributed network of peers, which are connected by hashing so that a single bit change in one block is repeated in other subsequent blocks, and the chain structure is maintained by hashing functions. In addition, the data block contains a list of transactions, and any new transaction can be added to the data block only after it is verified by all participating peers. Blocks are continuously added to the chain at certain intervals, which is replicated on other participating nodes on the network. Figure 3 As shown in the figure, each block consists of a block header and a block body. The block header consists of the hash value of the parent block, the difficulty value, the random number, the timestamp, and the Merkle tree root. The hash value of the parent block provides data integrity verification for the previous block, the difficulty value is used to adjust the speed of block generation, the random number is used to verify the legitimacy of the accounting right, and the timestamp marks the time when the block is generated. The Merkle tree ensures its integrity. The Merkle tree allows fast search and verification of data. The Merkle tree is a binary tree structure established with a hash function. The bottom leaf node is the data block. The content of each non-leaf node is equal to the hash value of its child nodes connected in series. By analogy, a Merkle tree root is finally obtained. Using the anti-collision property of the hash function, as long as the Merkle tree root is determined, all data blocks cannot be tampered with. In the blockchain, each data block is a transaction, and the obtained Merkle tree root is stored in the block header. Therefore, it is suitable for lightweight devices.

[0082] Using the alliance chain environment as a test platform, combining the alliance chain with identity authentication can significantly reduce the trust requirements of the identity authentication scheme. The alliance chain network is usually jointly built by interested organizations, which is very suitable for the application scenario of the present invention. The data uploaded to the blockchain distributed ledger and the modification operations on these data are permanently recorded in the blockchain. Therefore, uploading false information or actions on the chain data can be held accountable. Through the distributed ledger of the alliance chain, the identity information of IoT devices in each domain can be reliably shared, thereby providing credentials for identity authentication and eliminating dependence on trusted third parties.

[0083] The blockchain is responsible for verifying the transaction information and the aggregated signature. After verification, the transaction information is stored on the blockchain, and the aggregated signature is sent to the recipient through a secure channel. TA is responsible for verifying the individual signatures generated by each sensor, and after verification, it aggregates them, and finally sends the aggregated signature to the blockchain through a secure channel.

[0084] like Figure 4 As shown, it is a schematic diagram of a smart contract blockchain architecture provided by an example of the present invention.

[0085] The emergence of blockchain technology allows mutually distrustful parties to share data reliably, and smart contracts running on blockchains allow mutually distrustful parties to reliably execute business logic. A smart contract is a piece of code stored and run on a blockchain, which also has the characteristic of being tamper-proof; in addition, the execution of smart contracts is decentralized, and each node participating in the blockchain network executes smart contracts separately. Only when these nodes reach a consensus on the execution result of the smart contract will the result be recognized. Therefore, the identity authentication service in the smart contract eliminates the reliance on trusted third parties and ensures the reliability of the authentication results. In Hyperledger Fabric, smart contracts are called chaincodes. Like smart contracts, their main functions are to execute transactions and provide access to on-chain data.

[0086] Distributed hash table is a distributed storage method. DHT can make each node responsible for storing a small part of data without the need for a central server, thereby realizing DHT addressing and storage. This solution stores the user's pseudo identity, timestamp, credit identification, and storage address of device data in the blockchain, ensuring the immutability of the data on the chain. At the same time, the specific data of the device is stored in DHT, which well realizes storage scalability and decentralized storage mechanism. When an external entity requests DHT to access device data, it is up to the miners in the blockchain to decide whether to grant the requester access rights.

[0087] like Figure 5 As shown in the figure, the identity authentication protocol based on smart contracts implements the identity authentication of the Internet of Things. The verification process is as follows: (1) The user and the device use the elliptic curve digital encryption algorithm to generate a key pair, and the hash value of the public key is used as the identity ID; (2) The user generates a PID through a pseudonym algorithm; (3) The device completes the registration operation and records the information to the blockchain network; (4) The user sends a device association transaction to the smart contract account to establish a connection with the device and obtain the device's read and operation permissions; (5) After that, the user's operation on the device is completed in the form of a transaction, including remote control, device query, etc. After receiving the transaction, the node first verifies the signature of the transaction to ensure the legitimacy of the sender and prevents false transactions sent by malicious users. After that, the smart contract is executed to judge the permissions of the user or device, and responds or writes to the account with read or write permissions.

[0088] In the identity registration smart contract, the existence of the IoT device's identity information is first verified. If it does not exist, it is directly saved and bound to the identity of the user who calls the chain code. If it exists, the identity of the chain code caller bound to the existing identity information is first checked. If it matches the current chain code caller, the IoT device identity information is updated. If it does not match, an error is returned. In the identity authentication smart contract, the identity information is first searched according to the device identifier. If it exists, its signature is verified. If the verification is successful, success is returned, indicating that the identity authentication of the IoT device is successful.

[0089] Under the random oracle model (ROM), based on the difficulty assumption of solving the elliptic curve discrete logarithm problem ECDLP, it can be proved that the protocol scheme proposed in the present invention can resist type I attacks (the system master key cannot be obtained, the user's public key, part of the private key and the temporary key within a certain period of time can be replaced) and type II attacks (the system master key can be obtained, and the user's temporary private key and part of the private key can be calculated, but the user's public key cannot be forged) in the ROM.

[0090] like Figure 6 As shown, the public Internet of Things privacy protection identity authentication system based on blockchain provided by the embodiment of the present invention includes:

[0091] DHT distributed storage module, which is used to realize on-chain and off-chain storage of data based on DHT distributed storage mechanism and blockchain technology;

[0092] Pseudonym replacement module, used to replace real identity with pseudonym, reducing the transmission and use of identity information;

[0093] Delegated Byzantine Fault Tolerance module, used to adopt the improved Delegated Byzantine Fault Tolerance (dBFT) algorithm;

[0094] The security enhancement module uses trusted execution technology to build a high-security authentication environment based on hardware protection and enhance the computing security of the authentication process;

[0095] The identity authentication module is used to authenticate the user identity.

[0096] An application embodiment of the present invention provides a computer device, which includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor executes the steps of a public Internet of Things privacy protection identity authentication method based on blockchain.

[0097] An application embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of a public Internet of Things privacy protection identity authentication method based on blockchain.

[0098] An application embodiment of the present invention provides an information data processing terminal, which is used to implement a public Internet of Things privacy protection identity authentication system based on blockchain.

[0099] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0100] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A privacy-preserving identity authentication method for public IoT based on blockchain. It is characterized in that include: By utilizing the distributed characteristics of distributed hash tables, non-sensitive data of IoT sensor nodes is stored in the DHT network, achieving efficient access to off-chain storage. Sensitive data or key transaction records are stored on-chain through blockchain technology to ensure the data is tamper-proof and secure; A decentralized identity authentication mechanism is designed for IoT sensor nodes through smart contract technology. When registering, the node generates a unique digital identity through a smart contract. This digital identity is used for identity authentication in subsequent data interaction processes to ensure that the authentication is completed without exposing the real identity. A random oracle model is used to analyze and prove the security of smart contracts. The unpredictability and randomness of the random oracle model are used to ensure the unforgeability of smart contracts during the identity authentication process. At the same time, cryptographic technology is combined to ensure the integrity, authentication, anonymity and traceability of the data.

2. The method for privacy protection identity authentication based on blockchain for public Internet of Things as claimed in claim 1, It is characterized in that Specifically include: S1, uses DHT-based distributed storage mechanism and blockchain technology to achieve on-chain and off-chain storage of data; S2, using pseudonyms instead of real identities to reduce the transmission and use of identity information; S3, adopts the improved authorized Byzantine fault-tolerant algorithm; S4, uses trusted execution technology to build a high-security authentication environment based on hardware protection and enhance the computing security of the authentication process.

3. The method for privacy protection identity authentication of public Internet of Things based on blockchain as claimed in claim 2, It is characterized in that S3 specifically includes: selecting a leader from the miners to generate a new candidate block for the new transaction, and then broadcasting the candidate block to other miners; if more than 2 / 3 of the miners successfully verify the candidate block, the candidate block will be linked to the blockchain; at the same time, the consensus process of dBFT is optimized through aggregate signature technology to reduce the spatial complexity of signatures in the blockchain system.

4. The method for privacy protection identity authentication based on blockchain for public Internet of Things as claimed in claim 2, It is characterized in that S4 specifically includes: when the attacker captures some sensor nodes, he will launch a distributed denial of service attack on the aggregator. The trust management component runs on the permissioned blockchain to actively detect damaged sensor nodes; in the same cluster based on the reputation-based trust model, each sensor node will monitor the behavior of its neighbor nodes and update the reputation value of the neighbor nodes. If the node reputation value is lower than the threshold, the node will be disconnected from the chain.

5. The method for privacy protection identity authentication based on blockchain for public Internet of Things according to claim 1, It is characterized in that By analyzing the security requirements of existing IoT systems, we applied blockchain to IoT and designed a distributed and secure IoT system architecture. Use decentralized, immutable, transparent, and traceable blockchain to store sensitive information in the Internet of Things, including user information and device data; Based on the proposed privacy protection scheme, a distributed identity authentication protocol based on smart contracts is constructed. This protocol combines the certificateless cryptographic mechanism and signature aggregation technology to overcome the key escrow problem and reduce the storage load of the system.

6. The method for privacy protection identity authentication of a public Internet of Things based on blockchain as claimed in claim 2, It is characterized in that The identity authentication process is: (1) The user and device use the elliptic curve digital encryption algorithm to generate a key pair and use the hash value of the public key as the identity ID; (2) The user generates a PID using a pseudonym algorithm; (3) The device completes the registration operation and records the information into the blockchain network; (4) The user sends a device-related transaction to the smart contract account to establish a connection with the device and obtain the device's read and operation permissions; (5) All subsequent user operations on the device are completed in the form of transactions, including remote control and device query.

7. A blockchain-based public Internet of Things privacy protection identity authentication system that implements the blockchain-based public Internet of Things privacy protection identity authentication method as described in any one of claims 1 to 6, It is characterized in that include: DHT distributed storage module, which is used to realize on-chain and off-chain storage of data based on DHT distributed storage mechanism and blockchain technology; Pseudonym replacement module, used to replace real identity with pseudonym, reducing the transmission and use of identity information; Authorized Byzantine Fault Tolerance module, used to adopt the improved authorized Byzantine fault tolerance algorithm; The security enhancement module uses trusted execution technology to build a high-security authentication environment based on hardware protection and enhance the computing security of the authentication process; The identity authentication module is used to authenticate the user identity.

8. A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the blockchain-based public Internet of Things privacy protection identity authentication method as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of the blockchain-based public Internet of Things privacy protection identity authentication method as described in any one of claims 1 to 6.

10. An information data processing terminal, which is used to implement the blockchain-based public Internet of Things privacy protection identity authentication system as described in claim 7.

Images