Expandable block chain identity authentication method and system for distributed resource aggregation scene

Abstract

The invention provides an expandable block chain identity authentication method and system for a distributed resource aggregation scene, and relates to the technical field of block chain identity authentication, and the method comprises the steps: receiving a user identity authentication request, generating an identity identification string through a distributed Hash algorithm, and selecting a verification node cluster to deploy a smart contract; each verification node executes the smart contract to verify the identity identification string, constructs an access authority control strategy and generates an authentication block; and when the number of the blocks reaches a preset threshold value, selecting a newly added verification node based on the terminal equipment information, deploying an intelligent contract, and realizing distributed storage through the verification node cluster broadcast authentication blocks. According to the invention, the expandability of identity authentication is improved, the dynamic expansion of the verification node is realized, and the reliable storage and efficient propagation of the authentication information are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of blockchain identity authentication, and mainly to an extensible blockchain identity authentication method and system based on a distributed resource aggregation scenario. Background Art

[0002] With the rapid development of distributed resource aggregation applications, users' demand for identity authentication for resource access is growing. Traditional centralized identity authentication methods are difficult to meet the authentication requirements in distributed scenarios, and blockchain technology, with its decentralized, tamper-proof and traceable characteristics, provides a new technical path for identity authentication in distributed environments.

[0003] At present, blockchain-based identity authentication technology has been widely used in many fields such as finance, medical care, and the Internet of Things. It realizes identity authentication and access control through smart contracts, and uses distributed storage to ensure the security and availability of authentication information.

[0004] However, the existing blockchain identity authentication technology still has the following problems: First, the existing authentication block broadcast mechanism lacks targeted optimization, and is prone to propagation delays and network congestion in large-scale node networks, affecting authentication efficiency; second, the storage load distribution of verification nodes is uneven, some nodes are under excessive storage pressure while other nodes have idle resources, reducing the overall performance of the system; third, there is a lack of an effective node dynamic expansion mechanism, and the scale of verification nodes cannot be adjusted in real time according to business load, limiting the scalability of the system.

[0005] Therefore, there is an urgent need for a blockchain identity authentication method and system that can solve the problems of low authentication block propagation efficiency, unbalanced storage load, and limited node expansion capabilities. Summary of the invention

[0006] In order to solve the above-mentioned problems existing in the prior art, the present invention provides a scalable blockchain identity authentication method and system for distributed resource aggregation scenarios, optimizes the efficiency of authentication block propagation by designing a hierarchical broadcast strategy, adopts multi-copy shard storage to achieve balanced distribution of authentication information, and introduces a dynamic node expansion mechanism to ensure system scalability.

[0007] The technical solution of the present invention is as follows:

[0008] The present invention provides a scalable blockchain identity authentication method for distributed resource aggregation scenarios, including:

[0009] Receive an identity authentication request submitted by a user, wherein the identity authentication request includes user identity information, resource access requirement information, user terminal device information, and a corresponding timestamp; encrypt the user identity information based on a preset distributed hash algorithm to obtain an identity string, and construct the identity string and the resource access requirement information as a data carrier of a blockchain node;

[0010] In a preset blockchain network, multiple verification nodes are selected to form a verification node cluster, and each verification node in the verification node cluster is deployed with a smart contract; each verification node in the verification node cluster executes a corresponding smart contract respectively, and the smart contract verifies the identity string based on a preset consensus rule; when the verification passes, a dynamic access permission control strategy is constructed based on the resource access requirement information, and the dynamic access permission control strategy includes a resource access validity period, a resource access depth, and a resource operation permission; the identity string, the access permission control strategy, and the verification time information obtained when the verification passes are packaged to generate an authentication block;

[0011] The number of blocks in the blockchain network is monitored. When the number of blocks reaches a preset threshold, a terminal device with remaining computing resources is selected as a new verification node based on the user terminal device information; the new verification node is added to the verification node cluster, and the same smart contract as the original verification node is deployed in the new verification node; the newly generated authentication block is broadcasted to all nodes in the blockchain network through the verification node cluster to realize distributed storage of authentication information.

[0012] As a preferred implementation of the present invention, the user identity information is encrypted based on a preset distributed hash algorithm to obtain an identity string, and the identity string and the resource access requirement information are constructed as a data carrier of a blockchain node, specifically:

[0013] Receive user identity information, divide the user identity information into multiple data blocks, each of which has a size of 1024 bits; obtain the processor identification, memory capacity, and disk serial number of the user terminal device as hardware feature information; perform string concatenation of the hardware feature information and the current timestamp and perform SHA-256 operation to obtain a random salt value; perform XOR operation on the random salt value and each of the data blocks to obtain multiple obfuscated data blocks;

[0014] Sequentially perform encryption transformation on each of the obfuscated data blocks, the encryption transformation comprising:

[0015] Perform a linear mixing operation to generate intermediate state data, perform a bit cyclic left shift of 8 bits on the intermediate state data to obtain rotated data, rearrange the position of the rotated data according to a preset permutation table to obtain permuted data, perform a nonlinear transformation on the permuted data using an S-box substitution table to obtain transformed data, and perform a modular addition operation on the transformed data and a round constant to obtain a data block hash value;

[0016] Construct a Merkle hash tree based on the hash values ​​of the multiple data blocks, and use each of the hash values ​​of the data blocks as a leaf node; pair the leaf nodes in pairs and calculate the combined hash value to construct a parent node, and repeat the node pairing and hash calculation process until a root node is generated; use the hash value of the root node as an identity string;

[0017] Constructing a three-layer coding structure, storing the identity string and the intermediate data in the generation process at the bottom layer, storing resource access demand information at the middle layer, and storing the digital signature generated by the elliptic curve algorithm at the top layer; serializing the three-layer coding structure into a unified data carrier;

[0018] Initialize a Bloom filter with a bit array length of m, select k different hash functions; input the identity string into the k hash functions in sequence, take the output value of each hash function modulo m to obtain the bit array subscript; set the position of the corresponding subscript in the bit array to 1; generate a feature vector of the Bloom filter; combine the feature vector with the unified data carrier to construct a complete data structure of a blockchain node.

[0019] As a preferred implementation of the present invention, multiple verification nodes are selected in a preset blockchain network to form a verification node cluster, and each verification node in the verification node cluster is deployed with a smart contract; each verification node in the verification node cluster executes a corresponding smart contract respectively, and the smart contract verifies the identity string based on a preset consensus rule; when the verification passes, a dynamic access permission control strategy is constructed based on the resource access requirement information, specifically:

[0020] Based on the node computing power score, historical reliability score, network connection quality score and storage capacity score, multiple verification nodes are selected from the preset blockchain network to form a verification node cluster;

[0021] Receive an access request, the access request including an identity string, access resource type information, access operation type information, and access time information; package the identity string, the access resource type information, the access operation type information, and the access time information to form a verification request data packet;

[0022] The verification request data packet is sent to each verification node in the verification node cluster, each verification node in the verification node cluster is deployed with the same identity authentication smart contract, the identity authentication smart contract is called by each verification node in the verification node cluster, the identity authentication smart contract is preset with a consensus rule, and the identity string in the verification request data packet is verified based on the consensus rule to obtain a verification result, wherein the consensus rule includes:

[0023] Verify the integrity of the identity string by reconstructing the Merkle tree path; verify the timeliness of the identity string based on the time window mechanism; verify the legitimacy of the signature of the identity string based on the asymmetric encryption algorithm;

[0024] The verification results of each verification node are processed by consensus, including:

[0025] The verification node with the highest reputation value is selected from the verification node cluster as the main verification node; the main verification node collects the verification results of each verification node in the verification node cluster, and when the number of consistency verification results exceeds a preset ratio of the total number of verification nodes, determines that the verification is passed and generates a verification pass mark;

[0026] When the verification pass mark is generated, the access resource type information, access operation type information and access time information in the verification request data packet are extracted; a three-dimensional access control matrix is ​​constructed based on the access resource type information, access operation type information and access time information, wherein the coordinate axes of the three-dimensional access control matrix correspond to the resource type, operation type and time dimensions respectively;

[0027] Collect user access behavior feature information in real time, the user access behavior feature information includes historical access frequency data, historical access time data, and historical access resource type data; adjust the access permission level in the three-dimensional access control matrix according to the pre-acquired user behavior credibility, and generate a dynamic access permission control strategy, wherein the resource dimension information, operation dimension information and time dimension information in the three-dimensional access control matrix.

[0028] As a preferred implementation of the present invention, the integrity of the identity string is verified by reconstructing the Merkle tree path; the timeliness of the identity string is verified based on the time window mechanism; and the legitimacy of the signature of the identity string is verified based on the asymmetric encryption algorithm. Specifically:

[0029] Obtain the Merkle tree leaf node information and node path information corresponding to the target identity string from the local storage of the verification node, wherein the node path information includes the brother node hash values ​​of each node on the path from the leaf node to the root node; based on the leaf node information and the brother node hash values, calculate the combined hash layer by layer along the node path to obtain a reconstructed root hash value; compare the reconstructed root hash value with the Merkle root hash value stored in the block header to generate an integrity verification result;

[0030] Extract the creation timestamp from the identity string to obtain the current time of the verification node; set the sliding time window size based on the business security level; calculate the time difference between the current time and the creation timestamp; compare the time difference with the sliding time window size; record the most recently processed timestamp sequence, perform continuity analysis on the creation timestamp and the timestamp sequence, and generate a timeliness verification result;

[0031] Extract the signature value and public key information from the digital signature of the identity string; query the trusted public key pool maintained by the verification node to confirm the authenticity of the public key information; use the public key information to decrypt the signature value to obtain the original message digest; perform hash calculation on the original content of the identity string to obtain the recalculated message digest; compare the original message digest with the recalculated message digest to generate a signature legitimacy verification result;

[0032] Execute the processing of the integrity verification result, the timeliness verification result, and the signature legitimacy verification result in parallel; construct a verification result cache pool, which is managed by a least recently used strategy; when the identity string appears repeatedly, query the verification result cache pool to return the cached verification result;

[0033] When the integrity verification result, the timeliness verification result, and the signature legitimacy verification result are all passed, a verification pass certificate including a verification timestamp, a verification node identifier, and a verification result summary is generated; the verification pass certificate is signed using the private key of the verification node; the signed verification pass certificate is submitted to the blockchain network record; when any verification result is failed, a verification failure report including a failed verification link identifier, a description of the failure reason, and a verification node identifier is generated.

[0034] As a preferred implementation of the present invention, packaging the identity string, the dynamic access right control policy and the verification time information to generate an authentication block includes:

[0035] The identity string is analyzed hierarchically to obtain a basic information layer, an attribute information layer, and a signature information layer; the basic information layer includes a user identification code and a version identification code, the attribute information layer includes an identity type code and an expiration date code, and the signature information layer includes a digital signature code and a certification authority code;

[0036] Performing structured processing on the three-dimensional access control matrix in the dynamic access permission control policy, extracting resource dimension information, operation dimension information and time dimension information in the three-dimensional access control matrix; selecting a compression encoding method to encode the resource dimension information, the operation dimension information and the time dimension information according to the sparsity of the three-dimensional access control matrix, and generating permission matrix encoding data;

[0037] The verification time information is standardized to extract the verification start timestamp, the verification end timestamp and the verification duration; a time window identifier is generated according to the verification start timestamp and the verification end timestamp; the time window identifier is combined with the verification duration to form time series feature data;

[0038] Constructing a block header structure of the authentication block, the block header structure comprising a version number field, a previous block hash field, a timestamp field, a difficulty target field, and a random number field; combining the hierarchical parsing result of the identity string, the authority matrix encoding data, and the time series feature data to form block body data;

[0039] Constructing a first Merkle tree, dividing the block body data into data segments according to a preset byte length; calculating hash values ​​for the data segments to obtain leaf nodes; calculating hash values ​​for the leaf nodes layer by layer until a root hash value is obtained; and writing the root hash value into the block header structure;

[0040] Construct a second Merkle tree, and use the field values ​​of the block header structure and the verification node signature information as leaf nodes; calculate hash values ​​for the leaf nodes layer by layer until a block identifier hash value is obtained; combine the block identifier hash value with the block header structure in which the root hash value is written to generate a final block header; and combine the final block header with the block body data to generate an authentication block.

[0041] As a preferred implementation of the present invention, monitoring the number of blocks in the blockchain network, when the number of blocks reaches a preset threshold, selecting a terminal device with remaining computing resources as a new verification node based on the user terminal device information; adding the new verification node to the verification node cluster, and deploying the same smart contract as the original verification node in the new verification node includes:

[0042] Count the number of blocks in the blockchain network; obtain the block generation rate in the historical time period of the blockchain network; calculate the trend of block number changes based on the block generation rate; compare the block number with a preset block threshold, and when the block number exceeds the preset block threshold, trigger the verification node expansion process;

[0043] Broadcasting a resource query request to a user terminal device in the blockchain network; receiving device resource information returned by the user terminal device, the device resource information including processor usage, memory usage, storage space margin, and network bandwidth margin; calculating the remaining computing resource score of the user terminal device;

[0044] Obtaining device type information of the user terminal device, the device type information including processor specifications, memory capacity, storage capacity, and network bandwidth specifications; calculating a basic computing power score of the user terminal device according to the device type information; performing weighted calculation on the remaining computing resource score and the basic computing power score to obtain a comprehensive device score;

[0045] Obtaining geographic distribution information of existing verification nodes from the verification node cluster; constructing a geographic distribution optimization objective function based on the geographic distribution information; selecting a user terminal device as a new verification node based on the device comprehensive score and the geographic distribution information, wherein the device comprehensive score includes a remaining computing resource score and a basic computing power score, wherein the user terminal device information also includes device resource information;

[0046] Selecting a verification node with the lowest comprehensive device score from the verification node cluster as a data synchronization source node; synchronizing block data, transaction data, and status data in the data synchronization source node to the newly added verification node; verifying the data synchronization result in the newly added verification node; and when the data synchronization result is verified, adding the newly added verification node to the verification node cluster;

[0047] Obtain smart contract information deployed in the verification node cluster, wherein the smart contract information includes a contract code, a contract version number, and contract configuration parameters; verify the integrity of the smart contract information; and deploy the smart contract information to the newly added verification node.

[0048] The present invention also provides an extensible blockchain identity authentication system for distributed resource aggregation scenarios, the system comprising an identity authentication request processing unit, a verification and authority control unit, and a node expansion and block broadcasting unit, wherein:

[0049] The identity authentication request processing unit receives an identity authentication request submitted by a user, wherein the identity authentication request includes user identity information, resource access requirement information, user terminal device information, and a corresponding timestamp; encrypts the user identity information based on a preset distributed hash algorithm to obtain an identity string, and constructs the identity string and the resource access requirement information as a data carrier of a blockchain node;

[0050] The verification and permission control unit is used to select multiple verification nodes in a preset blockchain network to form a verification node cluster, and each verification node in the verification node cluster is deployed with a smart contract; each verification node in the verification node cluster executes a corresponding smart contract respectively, and the smart contract verifies the identity string based on a preset consensus rule; when the verification is passed, a dynamic access permission control strategy is constructed based on the resource access requirement information, and the dynamic access permission control strategy includes a resource access validity period, a resource access depth, and a resource operation permission; the identity string, the access permission control strategy, and the verification time information obtained when the verification is passed are packaged to generate an authentication block;

[0051] The node expansion and block broadcasting unit is used to monitor the number of blocks in the blockchain network. When the number of blocks reaches a preset threshold, a terminal device with remaining computing resources is selected as a new verification node based on the user terminal device information; the new verification node is added to the verification node cluster, and the same smart contract as the original verification node is deployed in the new verification node; the newly generated authentication block is broadcast to all nodes in the blockchain network through the verification node cluster to realize distributed storage of authentication information.

[0052] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a scalable blockchain identity authentication method for a distributed resource aggregation scenario as described in any one of the embodiments is implemented.

[0053] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a scalable blockchain identity authentication method for a distributed resource aggregation scenario as described in any one of the embodiments.

[0054] The beneficial effects of this application are as follows:

[0055] 1. The distributed hash algorithm is used to encrypt user identity information, and it is verified through a cluster of multiple verification nodes and smart contracts, which effectively prevents identity information leakage and tampering, and enhances the security of identity authentication. The use of the consensus mechanism further improves the reliability of the authentication results and avoids single point failures and malicious attacks.

[0056] 2. Dynamically build access permission control strategies based on resource access demand information, including resource access time limit, resource access depth, and resource operation permissions, to achieve fine-grained resource access control and ensure the security and rational use of resources.

[0057] 3. By monitoring the number of blocks in the blockchain network and dynamically adding terminal devices with remaining computing resources as new verification nodes, the dynamic expansion of the verification node cluster is achieved, the scalability of the system is improved, and the computing resources of the terminal devices are fully utilized, thereby improving resource utilization. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A schematic diagram of a process of a scalable blockchain identity authentication method for a distributed resource aggregation scenario according to an embodiment of the present invention;

[0059] Figure 2 This is a schematic diagram of the structure of a scalable blockchain identity authentication system for a distributed resource aggregation scenario according to an embodiment of the present invention. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0061] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0062] Embodiment 1:

[0063] Figure 1 Schematic diagram of the process of the scalable blockchain identity authentication method for the distributed resource aggregation scenario in Example 1 of the present invention, such as Figure 1 As shown, the method includes:

[0064] S1. Receive an identity authentication request submitted by a user, wherein the identity authentication request includes user identity information, resource access requirement information, user terminal device information, and a corresponding timestamp; encrypt the user identity information based on a preset distributed hash algorithm to obtain an identity string, and construct the identity string and the resource access requirement information as a data carrier of a blockchain node;

[0065] S11. The user submits an identity authentication request, which includes user identity information (e.g. user name, ID number, etc.), resource access requirement information (e.g. file name to be accessed, operation type, etc.), and user terminal device information (e.g. device model, operating system version, IP address, and hardware feature information, etc.);

[0066] S12, encrypting the user identity information based on a preset distributed hash algorithm to obtain an identity string, and constructing the identity string and the resource access requirement information as a data carrier of a blockchain node; selecting multiple verification nodes in the preset blockchain network to form a verification node cluster, specifically:

[0067] Receive user identity information, and divide the user identity information into multiple data blocks, each of which has a size of 1024 bits. For example, if the user identity information is a 2048-bit string, it is divided into two 1024-bit data blocks;

[0068] Obtain the processor identification, memory capacity, and disk serial number of the user terminal device as hardware feature information; perform string concatenation of the hardware feature information and the current timestamp and perform SHA-256 operation to obtain a random salt value; perform XOR operation on the random salt value and each of the data blocks to obtain multiple obfuscated data blocks;

[0069] Sequentially perform encryption transformation on each of the obfuscated data blocks, the encryption transformation comprising:

[0070] Perform a linear mixing operation to generate intermediate state data, perform a bit cyclic left shift of 8 bits on the intermediate state data to obtain rotated data, rearrange the position of the rotated data according to a preset permutation table to obtain permuted data, perform a nonlinear transformation on the permuted data using an S-box substitution table to obtain transformed data, and perform a modular addition operation on the transformed data and a round constant to obtain a data block hash value;

[0071] Construct a Merkle hash tree based on the hash values ​​of the multiple data blocks, and use each of the hash values ​​of the data blocks as a leaf node; pair the leaf nodes in pairs and calculate the combined hash value to construct a parent node, and repeat the node pairing and hash calculation process until a root node is generated; use the hash value of the root node as an identity string;

[0072] Constructing a three-layer coding structure, storing the identity string and the intermediate data in the generation process at the bottom layer, storing resource access demand information at the middle layer, and storing the digital signature generated by the elliptic curve algorithm at the top layer; serializing the three-layer coding structure into a unified data carrier;

[0073] Initialize a Bloom filter with a bit array length of m, select k different hash functions; input the identity string into the k hash functions in sequence, take the output value of each hash function modulo m to obtain a bit array subscript; set the position of the corresponding subscript in the bit array to 1; generate a feature vector of the Bloom filter; combine the feature vector with the unified data carrier to construct a complete data structure of a blockchain node;

[0074] Based on step S1, this embodiment effectively prevents the leakage and tampering of user identity information through distributed hash algorithm, Merkle tree, Bloom filter and other technical means, thereby improving the security of identity authentication; and the Bloom filter can quickly determine whether the identity identification string exists, thereby reducing unnecessary computing and communication overhead and improving the efficiency of identity authentication; based on the decentralized characteristics of blockchain, this embodiment avoids single point failures and control by centralized institutions, thereby enhancing the reliability and stability of the system.

[0075] S2. Select multiple verification nodes in a preset blockchain network to form a verification node cluster, each verification node in the verification node cluster is deployed with a smart contract; each verification node in the verification node cluster executes a corresponding smart contract respectively, and the smart contract verifies the identity string based on a preset consensus rule; when the verification passes, a dynamic access permission control strategy is constructed based on the resource access requirement information, and the dynamic access permission control strategy includes a resource access time limit, a resource access depth, and a resource operation permission;

[0076] S21. Based on the node computing power score, historical reliability score, network connection quality score and storage capacity score, multiple verification nodes are selected in the preset blockchain network to form a verification node cluster. The above-mentioned score calculation is all existing technology and will not be repeated here.

[0077] S22, receiving an access request, the access request including an identity string, access resource type information, access operation type information, and access time information; packaging the identity string, the access resource type information, the access operation type information, and the access time information into a verification request data packet;

[0078] The verification request data packet is sent to each verification node in the verification node cluster, each verification node in the verification node cluster is deployed with the same identity authentication smart contract, the identity authentication smart contract is called by each verification node in the verification node cluster, the identity authentication smart contract is preset with a consensus rule, and the identity string in the verification request data packet is verified based on the consensus rule to obtain a verification result, wherein the consensus rule includes:

[0079] Verify the integrity of the identity string by reconstructing the Merkle tree path; verify the timeliness of the identity string based on the time window mechanism; verify the legitimacy of the signature of the identity string based on the asymmetric encryption algorithm;

[0080] S221. Obtain the Merkle tree leaf node information and node path information corresponding to the target identity string from the local storage of the verification node, wherein the node path information includes the brother node hash values ​​of each node on the path from the leaf node to the root node; based on the leaf node information and the brother node hash values, calculate the combined hash layer by layer along the node path to obtain a reconstructed root hash value; compare the reconstructed root hash value with the Merkle root hash value stored in the block header to generate an integrity verification result to ensure that the identity string has not been tampered with;

[0081] S222, extract the creation timestamp from the identity string, obtain the current time of the verification node; set the sliding time window size based on the business security level; calculate the time difference between the current time and the creation timestamp; compare the time difference with the sliding time window size; record the most recently processed timestamp sequence, perform continuity analysis on the creation timestamp and the timestamp sequence, and generate a timeliness verification result;

[0082] S223, extracting the signature value and public key information from the digital signature of the identity string; querying the trusted public key pool maintained by the verification node to confirm the authenticity of the public key information; using the public key information to decrypt the signature value to obtain the original message digest; performing a hash calculation on the original content of the identity string to obtain a recalculated message digest; comparing the original message digest with the recalculated message digest to generate a signature legitimacy verification result;

[0083] S224, executing the processing of the integrity verification result, the timeliness verification result, and the signature legitimacy verification result in parallel; constructing a verification result cache pool, wherein the verification result cache pool is managed by a least recently used strategy; when the identity string appears repeatedly, querying the verification result cache pool to return the cached verification result;

[0084] When the integrity verification result, the timeliness verification result, and the signature legitimacy verification result are all passed, a verification pass certificate including a verification timestamp, a verification node identifier, and a verification result summary is generated; the verification pass certificate is signed using the private key of the verification node; the signed verification pass certificate is submitted to the blockchain network record; when any verification result is failed, a verification failure report including a failed verification link identifier, a description of the failure reason, and a verification node identifier is generated;

[0085] S23. The verification results of each verification node are processed by consensus, including:

[0086] The verification node with the highest reputation value is selected from the verification node cluster as the main verification node; the main verification node collects the verification results of each verification node in the verification node cluster, and when the number of consistency verification results exceeds a preset proportion (e.g., 70%) of the total number of verification nodes, determines that the verification is passed and generates a verification pass mark;

[0087] When the verification pass mark is generated, the access resource type information, access operation type information and access time information in the verification request data packet are extracted; a three-dimensional access control matrix is ​​constructed based on the access resource type information, access operation type information and access time information, wherein the coordinate axes of the three-dimensional access control matrix correspond to the resource type, the operation type and the time dimension respectively, for example, the resource type may be file A or file B; the operation type may be read or write; and the time dimension may be weekday or weekend;

[0088] Collect user access behavior feature information in real time, including historical access frequency data, historical access time data, and historical access resource type data. For example, the user accessed file A once a day in the past week, and the access time was concentrated between 9 and 10 a.m. This information will be input into a pre-trained behavior evaluation model to obtain the user behavior credibility. For example, the credibility of the model output is 0.9, indicating that the user behavior is relatively credible;

[0089] The access permission level in the three-dimensional access control matrix is ​​adjusted according to the pre-acquired user behavior credibility, and a dynamic access permission control strategy is generated. For example, if the user behavior credibility is high, the user's access permission level to certain resources can be increased; if the user behavior credibility is low, the user's access permission level to certain resources can be reduced, and finally a dynamic access permission control strategy is generated. Further, for example, if the user behavior credibility is 0.9, the user is allowed to read file A on both weekdays and weekends; if the user behavior credibility is 0.5, the user is only allowed to read file A on weekdays;

[0090] Among them, the resource dimension information, operation dimension information and time dimension information in the three-dimensional access control matrix;

[0091] Based on step S2, this embodiment realizes decentralized identity authentication through the combination of blockchain technology and smart contracts, prevents single point failures and malicious tampering, and effectively improves the security of identity authentication. The application of consensus mechanism and asymmetric encryption algorithm further enhances the security and reliability of the system; the three-dimensional access control matrix combines resource type, operation type and time dimension to realize more refined access control, and can set different access rights according to different scenarios and needs to effectively protect sensitive data; by collecting user access behavior feature information in real time, and dynamically adjusting access rights in combination with behavior evaluation models, dynamic adaptive access control is realized, which can automatically adjust access policies according to user behavior patterns, and improve the security and availability of the system;

[0092] S3. Pack the identity string, the access right control policy and the verification time information obtained when the verification is passed to generate an authentication block, specifically:

[0093] Receive an identity string, access permission control policy, and verification time information;

[0094] The identity string is hierarchically parsed to obtain a basic information layer, an attribute information layer, and a signature information layer; the basic information layer includes a user identification code (e.g., "User123") and a version identification code (e.g., "V1.0"), the attribute information layer includes an identity type code (e.g., "ordinary user" or "administrator", represented by the numbers "0" and "1", respectively) and an expiration date code (e.g., "20241231"); the signature information layer includes a digital signature code (e.g., a string of hash values ​​"e5b7e995...") and a certification authority code (e.g., "CA001");

[0095] Performing structural processing on the three-dimensional access control matrix in the dynamic access permission control policy, extracting resource dimension information, operation dimension information and time dimension information in the three-dimensional access control matrix, where the resource dimension includes, for example, file A, file B and file C, the operation dimension includes, for example, reading, writing and executing, and the time dimension includes, for example, weekdays and weekends;

[0096] According to the sparsity of the three-dimensional access control matrix (for example, the proportion of non-zero elements in the matrix), a compression encoding method (for example, run-length encoding or sparse matrix encoding) is selected to encode the resource dimension information, the operation dimension information, and the time dimension information. Assume that file A is readable and writable on weekdays, file B is readable on weekends, and file C is executable on weekdays. Using run-length encoding, the resource dimension information, the operation dimension information, and the time dimension information can be encoded as "A-read-write-weekdays, B-read-weekends, C-execute-weekdays" respectively; generate permission matrix encoding data;

[0097] The verification time information is standardized to extract the verification start timestamp (e.g., "1678886400", representing 0:00 on March 15, 2023), the verification end timestamp (e.g., "1678972800", representing 0:00 on March 16, 2023) and the verification duration (e.g., "86400" seconds, representing 24 hours); a time window identifier is generated according to the verification start timestamp and the verification end timestamp, such as "20230315-20230316"; the time window identifier is combined with the verification duration to form time series feature data, such as "20230315-20230316-86400";

[0098] Constructing a block header structure of the authentication block, the block header structure comprising a version number field, a previous block hash field, a timestamp field, a difficulty target field, and a random number field; combining the hierarchical parsing result of the identity string, the authority matrix encoding data, and the time series feature data to form block body data;

[0099] Constructing a first Merkle tree, dividing the block body data into data segments according to a preset byte length; calculating hash values ​​for the data segments to obtain leaf nodes; calculating hash values ​​for the leaf nodes layer by layer until a root hash value is obtained; and writing the root hash value into the block header structure;

[0100] Construct a second Merkle tree, and use the field values ​​of the block header structure (version number, previous block hash, timestamp, difficulty target, random number, first Merkle tree root hash) and the verification node signature information (such as the digital signature of the verification node "j7k8l9m0...") as leaf nodes; calculate the hash value of the leaf node layer by layer until the block identification hash value (such as "n5o6p7q8...") is obtained; combine the block identification hash value with the block header structure written with the root hash value to generate a final block header; combine the final block header with the block body data to generate an authentication block;

[0101] Based on step S3, this embodiment ensures the integrity and non-tamperability of the authentication block through multi-layer hash calculation and digital signature, and prevents the identity, access rights and verification time information from being maliciously modified; by compressing and encoding the access control matrix, the overhead of data storage and transmission is reduced, and the authentication efficiency is improved; by using blockchain technology, the decentralized storage and management of authentication information is realized, and the transparency and credibility of the system are improved.

[0102] S4. Monitor the number of blocks in the blockchain network. When the number of blocks reaches a preset threshold, select a terminal device with remaining computing resources as a new verification node based on the user terminal device information; add the new verification node to the verification node cluster, and deploy the same smart contract as the original verification node in the new verification node;

[0103] S41. Count the number of blocks in the blockchain network and obtain the block generation rate in the historical time period of the blockchain network, specifically:

[0104] Assume that the blockchain network consists of multiple verification nodes, for example, there are 5 verification nodes initially. Each verification node runs the same smart contract to monitor the network status and execute the consensus algorithm; the smart contract deployed on each verification node begins to count the number of blocks in the blockchain network. Assume that the initial number of blocks is 1000. At the same time, the smart contract also records the block generation time, for example, one block is generated every 10 minutes. The smart contract calculates the trend of block number changes based on the block generation rate within a historical time period (for example, the past 1 hour). For example, 6 blocks were generated in the past hour, and the block generation rate is 6 blocks per hour;

[0105] S42, calculating the block number change trend according to the block generation rate; comparing the block number with the preset block threshold, when the block number exceeds the preset block threshold, triggering the verification node expansion process, assuming that the preset threshold is 1200. When the block number exceeds the preset threshold, for example, when it reaches 1201, the verification node expansion process is triggered;

[0106] S43. After the extension process is triggered, a resource query request is broadcast to the user terminal devices in the blockchain network. Assume that there are 10 user terminal devices in the network.

[0107] Receive device resource information returned by the user terminal device, where the device resource information includes processor usage (e.g., the processor usage of device A is 20%), memory usage (e.g., the memory usage of device A is 30%), storage space margin (e.g., the storage space margin of device A is 500 GB), and network bandwidth margin (e.g., the network bandwidth margin of device A is 100 Mbps);

[0108] Calculate the remaining computing resource score of the user terminal device. For example, the remaining computing resource score of device A can be obtained by weighted calculation based on the remaining resources of its processor, memory, storage space, and network bandwidth. Assume that the score is 85 points.

[0109] At the same time, the smart contract obtains the device type information of the user terminal device, which includes processor specifications (for example, the processor of device A is i7-12700H), memory capacity (for example, the memory of device A is 16GB), storage capacity (for example, the storage capacity of device A is 1TB), and network bandwidth specifications (for example, the network bandwidth of device A is 1Gbps);

[0110] Calculate the basic computing power score of the user terminal device according to the device type information. For example, the basic computing power score of device A can be calculated by weighted calculation based on its processor, memory, storage and network bandwidth specifications, assuming that the score is 90 points;

[0111] The remaining computing resource score and the basic computing power score are weighted to obtain a comprehensive score of the device. For example, the comprehensive score of device A is (85*0.6)+(90*0.4)=87 points.

[0112] S44. The smart contract obtains the geographical distribution information of the existing verification nodes from the verification node cluster. For example, the five existing verification nodes are located in Asia, Europe, North America, South America, and Oceania respectively.

[0113] Constructing a geographic distribution optimization objective function based on the geographic distribution information, for example, giving priority to user terminal devices with a large geographic location difference from existing verification nodes;

[0114] Furthermore, the objective function F of the rational distribution optimization is shown in the following formula:

[0115] F=α·D avg +β·(1-G std )+γ·C cov ;

[0116] Among them, D avg represents the average distance term, G std Indicates the uniformity of geographical distribution, C cov represents the coverage index, α represents the average distance term weight, β represents the distribution uniformity weight, and γ represents the coverage weight;

[0117] Select the user terminal device as the new verification node based on the device comprehensive score and geographical distribution information. For example, assuming that the comprehensive score of device B is 92 points and it is located in Africa, which meets the geographical distribution optimization goal, then select device B as the new verification node; the device comprehensive score includes the remaining computing resource score and the basic computing power score, wherein the user terminal device information also includes device resource information;

[0118] Selecting a verification node with the lowest comprehensive device score from the verification node cluster as a data synchronization source node. For example, assuming that verification node 3 has the lowest load, verification node 3 is selected as the data synchronization source node.

[0119] Synchronize the block data, transaction data and status data in the data synchronization source node to the newly added verification node (device B); verify the data synchronization result in the newly added verification node (device B), for example, check whether the block hash value after synchronization is consistent with the source node. When the data synchronization result is verified, add the newly added verification node (device B) to the verification node cluster;

[0120] When the data synchronization result is verified to be passed, the newly added verification node (device B) is added to the verification node cluster;

[0121] Obtain the smart contract information deployed in the verification node cluster, the smart contract information includes the contract code, contract version number (e.g., version 1.0), and contract configuration parameters; verify the integrity of the smart contract information; deploy the smart contract information to the newly added verification node, for example, verify the hash value of the contract code. Deploy the smart contract information to the newly added verification node (device B);

[0122] Based on step S4, this embodiment dynamically adjusts the number of verification nodes according to the network load to avoid network congestion and performance degradation caused by insufficient number of nodes, thereby improving the overall throughput and processing capacity of the network; by selecting terminal devices with sufficient computing resources as new verification nodes, the stable operation of the new nodes is guaranteed, and the risk of node failure is reduced, thereby improving the stability and reliability of the entire network; by optimizing the objective function through geographical distribution, it is possible to effectively avoid the concentration of verification nodes in a specific area, promote the geographical dispersion of nodes, and thus enhance the decentralization and anti-censorship of the network.

[0123] S5. Broadcasting the newly generated authentication block to all nodes in the blockchain network through the verification node cluster to achieve distributed storage of authentication information, including:

[0124] S51, receiving a newly generated authentication block, extracting authentication information in the authentication block, wherein the authentication information includes an authentication entity identifier (e.g., entity_123456), an authentication timestamp (e.g., 024-02-0110:30:15), an authentication type tag (e.g., identity_verify), authentication result data, authentication signature data, and an authentication validity period (e.g., 2025-02-01 10:30:15); calculating a block hash value of the authentication block using the SHA256 algorithm; associating the block hash value of the authentication block (e.g., 0x8d7f...e92a) with the latest block hash value (e.g., 0x9c3e...f81b) in the blockchain network;

[0125] S52, obtaining network status information of each verification node in the verification node cluster, wherein the network status information includes node online status (e.g., active), node bandwidth capacity (e.g., 100 Mbps), node delay value (e.g., 50 ms), and node load level (e.g., 45%);

[0126] Calculate the propagation capability score of each verification node based on the network status information. For example, the bandwidth capacity weight is 0.4, the node delay weight is 0.3, the load level weight is 0.3, and the propagation capability score of node A is 85 points;

[0127] Prioritize validator nodes based on the propagation ability score;

[0128] S53, constructing a hierarchical broadcast network of verification nodes, and dividing the verification nodes into multiple propagation levels according to the propagation ability scores according to user needs, for example, dividing nodes with scores above 90 points into the first level, nodes with scores of 75-90 points into the second level, and nodes with scores of 60-75 points into the third level;

[0129] The optimal propagation fan-out number of nodes at each level is calculated. The optimal propagation fan-out number is related to the node bandwidth capacity and network delay value, and is expressed as follows:

[0130]

[0131] Among them, B node represents the available bandwidth capacity of the node, S block represents the block data size, η represents the bandwidth reservation coefficient, λ represents the network congestion coefficient, T max Indicates the maximum allowed propagation delay time, L net Indicates the network single-hop delay;

[0132] Based on the network connection quality between nodes, the optimal propagation path between levels is determined. The generated propagation time sequence table records the propagation time point of each node. For example, node A propagates blocks to its four child nodes B, C, D, and E at "10:30:16", generating a propagation time sequence table between nodes;

[0133] S54, hierarchically broadcasting the authentication block in the verification node cluster according to the propagation timing table, first sending the authentication block to the verification node of the first level; receiving the block confirmation information of the verification node of the first level; triggering the block propagation of the verification node of the first level to the verification node of the second level; and so on until the verification nodes of all levels complete the block reception;

[0134] S55. Monitor the network quality indicators of the block propagation process during the propagation process, the network quality indicators include the bandwidth utilization of the propagation path, the propagation delay value and the block confirmation rate; when the network quality indicators are lower than the preset threshold, recalculate the propagation path; adjust the node propagation level; update the propagation timing table; for example, when it is detected that the bandwidth utilization of a certain propagation path is lower than 60%, or the propagation delay exceeds 200ms, or the block confirmation rate is lower than 95%, trigger the propagation path optimization. Re-evaluate the node status, adjust the propagation level division, update the propagation relationship between nodes, and generate a new propagation timing table;

[0135] S56. Perform distributed storage of authentication blocks in the verification node cluster. Each node maintains complete block data and establishes indexes based on block hash, timestamp, authentication entity, etc. Distributed storage ensures the availability and persistence of authentication information and supports subsequent authentication information query and verification.

[0136] Based on step S5, this embodiment improves the propagation efficiency of the authentication block in a large-scale node network through hierarchical propagation and dynamic optimization; the reliability of block propagation is ensured based on real-time monitoring and adaptive adjustment of node status; and the designed distributed storage mechanism provides a decentralized permanent recording capability for authentication information.

[0137] Embodiment 2:

[0138] Figure 2 This is a schematic diagram of the structure of a scalable blockchain identity authentication system for a distributed resource aggregation scenario in Example 2 of the present invention. Figure 2 As shown, the system includes an identity authentication request processing unit, a verification and authority control unit, and a node expansion and block broadcasting unit, wherein:

[0139] The identity authentication request processing unit receives an identity authentication request submitted by a user, wherein the identity authentication request includes user identity information, resource access requirement information, user terminal device information, and a corresponding timestamp; encrypts the user identity information based on a preset distributed hash algorithm to obtain an identity string, and constructs the identity string and the resource access requirement information as a data carrier of a blockchain node;

[0140] The verification and permission control unit is used to select multiple verification nodes in a preset blockchain network to form a verification node cluster, and each verification node in the verification node cluster is deployed with a smart contract; each verification node in the verification node cluster executes a corresponding smart contract respectively, and the smart contract verifies the identity string based on a preset consensus rule; when the verification is passed, a dynamic access permission control strategy is constructed based on the resource access requirement information, and the dynamic access permission control strategy includes a resource access validity period, a resource access depth, and a resource operation permission; the identity string, the access permission control strategy, and the verification time information obtained when the verification is passed are packaged to generate an authentication block;

[0141] The node expansion and block broadcasting unit is used to monitor the number of blocks in the blockchain network. When the number of blocks reaches a preset threshold, a terminal device with remaining computing resources is selected as a new verification node based on the user terminal device information; the new verification node is added to the verification node cluster, and the same smart contract as the original verification node is deployed in the new verification node; the newly generated authentication block is broadcast to all nodes in the blockchain network through the verification node cluster to realize distributed storage of authentication information.

[0142] Embodiment 3:

[0143] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, a scalable blockchain identity authentication method for a distributed resource aggregation scenario as described in any one of Embodiment 1 is implemented.

[0144] Embodiment 4:

[0145] This embodiment also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, a scalable blockchain identity authentication method for a distributed resource aggregation scenario as described in any one of Embodiment 1 is implemented.

[0146] It is worth noting that the system, electronic device and computer-readable storage medium described in the present invention are all based on the same inventive concept as the method described in Example 1, and will not be described in detail here.

[0147] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A scalable blockchain identity authentication method for distributed resource aggregation scenarios, characterized in that: include: Receive an identity authentication request submitted by a user, wherein the identity authentication request includes user identity information, resource access requirement information, user terminal device information, and a corresponding timestamp; The user identity information is encrypted based on a preset distributed hash algorithm to obtain an identity string, and the identity string and the resource access requirement information are constructed as a data carrier of a blockchain node; A plurality of verification nodes are selected in a preset blockchain network to form a verification node cluster, each verification node in the verification node cluster is deployed with a smart contract; a corresponding smart contract is executed by each verification node in the verification node cluster, and the smart contract verifies the identity string based on a preset consensus rule; when the verification passes, a dynamic access permission control strategy is constructed based on the resource access requirement information, and the dynamic access permission control strategy includes a resource access time limit, a resource access depth, and a resource operation permission; Packing the identity string, the access permission control policy and the verification time information obtained when the verification is passed to generate an authentication block; Monitoring the number of blocks in the blockchain network, and when the number of blocks reaches a preset threshold, selecting a terminal device with remaining computing resources as a new verification node based on the user terminal device information; The newly added verification node is added to the verification node cluster, and the same smart contract as the original verification node is deployed in the newly added verification node; the newly generated authentication block is broadcast to all nodes in the blockchain network through the verification node cluster to realize distributed storage of authentication information.

2. The scalable blockchain identity authentication method for distributed resource aggregation scenarios according to claim 1 is characterized in that: The user identity information is encrypted based on a preset distributed hash algorithm to obtain an identity string, and the identity string and the resource access requirement information are constructed as a data carrier of a blockchain node, specifically: Receive user identity information, divide the user identity information into multiple data blocks, each of which has a size of 1024 bits; obtain the processor identification, memory capacity, and disk serial number of the user terminal device as hardware feature information; The hardware feature information and the current timestamp are concatenated and a SHA-256 operation is performed to obtain a random salt value; the random salt value is XOR-operated with each of the data blocks to obtain multiple obfuscated data blocks; Sequentially perform encryption transformation on each of the obfuscated data blocks, the encryption transformation comprising: Perform a linear mixing operation to generate intermediate state data, perform a bit cyclic left shift of 8 bits on the intermediate state data to obtain rotated data, rearrange the position of the rotated data according to a preset permutation table to obtain permuted data, perform a nonlinear transformation on the permuted data using an S-box substitution table to obtain transformed data, and perform a modular addition operation on the transformed data and a round constant to obtain a data block hash value; Construct a Merkle hash tree based on the hash values ​​of the multiple data blocks, and use each of the hash values ​​of the data blocks as a leaf node; pair the leaf nodes in pairs and calculate the combined hash value to construct a parent node, and repeat the node pairing and hash calculation process until a root node is generated; use the hash value of the root node as an identity string; Constructing a three-layer coding structure, storing the identity string and the intermediate data in the generation process at the bottom layer, storing resource access demand information at the middle layer, and storing the digital signature generated by the elliptic curve algorithm at the top layer; serializing the three-layer coding structure into a unified data carrier; Initialize a Bloom filter with a bit array length of m, select k different hash functions; input the identity string into the k hash functions in sequence, take the output value of each hash function modulo m to obtain the bit array subscript; set the position of the corresponding subscript in the bit array to 1; generate a feature vector of the Bloom filter; combine the feature vector with the unified data carrier to construct a complete data structure of a blockchain node.

3. The scalable blockchain identity authentication method for distributed resource aggregation scenarios according to claim 1 is characterized in that: In a preset blockchain network, multiple verification nodes are selected to form a verification node cluster, and each verification node in the verification node cluster is deployed with a smart contract; each verification node in the verification node cluster executes a corresponding smart contract respectively, and the smart contract verifies the identity string based on a preset consensus rule; when the verification passes, a dynamic access permission control strategy is constructed based on the resource access requirement information, specifically: Based on the node computing power score, historical reliability score, network connection quality score and storage capacity score, multiple verification nodes are selected from the preset blockchain network to form a verification node cluster; Receive an access request, the access request including an identity string, access resource type information, access operation type information, and access time information; package the identity string, the access resource type information, the access operation type information, and the access time information to form a verification request data packet; The verification request data packet is sent to each verification node in the verification node cluster, each verification node in the verification node cluster is deployed with the same identity authentication smart contract, the identity authentication smart contract is called by each verification node in the verification node cluster, the identity authentication smart contract is preset with a consensus rule, and the identity string in the verification request data packet is verified based on the consensus rule to obtain a verification result, wherein the consensus rule includes: Verify the integrity of the identity string by reconstructing the Merkle tree path; verify the timeliness of the identity string based on the time window mechanism; verify the legitimacy of the signature of the identity string based on the asymmetric encryption algorithm; The verification results of each verification node are processed by consensus, including: The verification node with the highest reputation value is selected from the verification node cluster as the main verification node; the main verification node collects the verification results of each verification node in the verification node cluster, and when the number of consistency verification results exceeds a preset ratio of the total number of verification nodes, determines that the verification is passed and generates a verification pass mark; When the verification pass mark is generated, the access resource type information, access operation type information and access time information in the verification request data packet are extracted; a three-dimensional access control matrix is ​​constructed based on the access resource type information, access operation type information and access time information, wherein the coordinate axes of the three-dimensional access control matrix correspond to the resource type, operation type and time dimensions respectively; Collect user access behavior feature information in real time, the user access behavior feature information includes historical access frequency data, historical access time data, and historical access resource type data; adjust the access permission level in the three-dimensional access control matrix according to the pre-acquired user behavior credibility, and generate a dynamic access permission control strategy, wherein the resource dimension information, operation dimension information and time dimension information in the three-dimensional access control matrix.

4. The scalable blockchain identity authentication method for distributed resource aggregation scenarios according to claim 3 is characterized in that: Verify the integrity of the identity string by reconstructing the Merkle tree path; verify the timeliness of the identity string based on the time window mechanism; verify the legitimacy of the signature of the identity string based on the asymmetric encryption algorithm. Specifically: Obtain Merkle tree leaf node information and node path information corresponding to the target identity string from the local storage of the verification node, wherein the node path information includes the sibling node hash value of each node on the path from the leaf node to the root node; Based on the leaf node information and the brother node hash value, the combined hash is calculated layer by layer along the node path to obtain a reconstructed root hash value; the reconstructed root hash value is compared with the Merkle root hash value stored in the block header to generate an integrity verification result; Extracting the creation timestamp from the identity string to obtain the current time of the verification node; Set the sliding time window size based on the business security level; Calculate the time difference between the current time and the creation timestamp; Comparing the time difference with the sliding time window size; Record the most recently processed timestamp sequence, perform continuity analysis on the creation timestamp and the timestamp sequence, and generate a timeliness verification result; Extracting a signature value and public key information from the digital signature of the identity string; Query the trusted public key pool maintained by the verification node to confirm the authenticity of the public key information; use the public key information to decrypt the signature value to obtain the original message digest; perform hash calculation on the original content of the identity string to obtain the recalculated message digest; compare the original message digest with the recalculated message digest to generate a signature legitimacy verification result; Execute the processing of the integrity verification result, the timeliness verification result, and the signature legitimacy verification result in parallel; construct a verification result cache pool, which is managed by a least recently used strategy; when the identity string appears repeatedly, query the verification result cache pool to return the cached verification result; When the integrity verification result, the timeliness verification result, and the signature legitimacy verification result are all passed, a verification pass certificate including a verification timestamp, a verification node identifier, and a verification result summary is generated; the verification pass certificate is signed using the private key of the verification node; the signed verification pass certificate is submitted to the blockchain network record; when any verification result is failed, a verification failure report including a failed verification link identifier, a description of the failure reason, and a verification node identifier is generated.

5. The scalable blockchain identity authentication method for distributed resource aggregation scenarios according to claim 1 is characterized in that: Packaging the identity string, the dynamic access right control policy and the verification time information to generate an authentication block includes: The identity string is analyzed hierarchically to obtain a basic information layer, an attribute information layer, and a signature information layer; the basic information layer includes a user identification code and a version identification code, the attribute information layer includes an identity type code and an expiration date code, and the signature information layer includes a digital signature code and a certification authority code; Performing structured processing on the three-dimensional access control matrix in the dynamic access permission control policy, extracting resource dimension information, operation dimension information and time dimension information in the three-dimensional access control matrix; selecting a compression encoding method to encode the resource dimension information, the operation dimension information and the time dimension information according to the sparsity of the three-dimensional access control matrix, and generating permission matrix encoding data; The verification time information is standardized to extract the verification start timestamp, the verification end timestamp and the verification duration; a time window identifier is generated according to the verification start timestamp and the verification end timestamp; the time window identifier is combined with the verification duration to form time series feature data; Constructing a block header structure of the authentication block, the block header structure comprising a version number field, a previous block hash field, a timestamp field, a difficulty target field, and a random number field; combining the hierarchical parsing result of the identity string, the authority matrix encoding data, and the time series feature data to form block body data; Constructing a first Merkle tree, dividing the block body data into data segments according to a preset byte length; calculating hash values ​​for the data segments to obtain leaf nodes; calculating hash values ​​for the leaf nodes layer by layer until a root hash value is obtained; and writing the root hash value into the block header structure; Construct a second Merkle tree, and use the field values ​​of the block header structure and the verification node signature information as leaf nodes; calculate hash values ​​for the leaf nodes layer by layer until a block identifier hash value is obtained; combine the block identifier hash value with the block header structure in which the root hash value is written to generate a final block header; and combine the final block header with the block body data to generate an authentication block.

6. The scalable blockchain identity authentication method for distributed resource aggregation scenarios according to claim 1 is characterized in that: Monitoring the number of blocks in the blockchain network, and when the number of blocks reaches a preset threshold, selecting a terminal device with remaining computing resources as a new verification node based on the user terminal device information; Adding the newly added verification node to the verification node cluster and deploying the same smart contract as the original verification node in the newly added verification node includes: Count the number of blocks in the blockchain network; obtain the block generation rate in the historical time period of the blockchain network; calculate the trend of block number changes based on the block generation rate; compare the block number with a preset block threshold, and when the block number exceeds the preset block threshold, trigger the verification node expansion process; Broadcasting a resource query request to a user terminal device in the blockchain network; receiving device resource information returned by the user terminal device, the device resource information including processor usage, memory usage, storage space margin, and network bandwidth margin; calculating the remaining computing resource score of the user terminal device; Obtaining device type information of the user terminal device, the device type information including processor specifications, memory capacity, storage capacity, and network bandwidth specifications; calculating a basic computing power score of the user terminal device according to the device type information; performing weighted calculation on the remaining computing resource score and the basic computing power score to obtain a comprehensive device score; Obtaining geographic distribution information of existing verification nodes from the verification node cluster; constructing a geographic distribution optimization objective function based on the geographic distribution information; selecting a user terminal device as a new verification node based on the device comprehensive score and the geographic distribution information, wherein the device comprehensive score includes a remaining computing resource score and a basic computing power score, wherein the user terminal device information also includes device resource information; Selecting a verification node with the lowest comprehensive device score from the verification node cluster as a data synchronization source node; synchronizing block data, transaction data, and status data in the data synchronization source node to the newly added verification node; verifying the data synchronization result in the newly added verification node; and when the data synchronization result is verified, adding the newly added verification node to the verification node cluster; Obtain smart contract information deployed in the verification node cluster, wherein the smart contract information includes a contract code, a contract version number, and contract configuration parameters; verify the integrity of the smart contract information; and deploy the smart contract information to the newly added verification node.

7. A scalable blockchain identity authentication system for distributed resource aggregation scenarios, used to implement the scalable blockchain identity authentication method for distributed resource aggregation scenarios as described in any one of claims 1 to 6, characterized in that: It includes an identity authentication request processing unit, a verification and permission control unit, and a node expansion and block broadcasting unit, among which: The identity authentication request processing unit receives an identity authentication request submitted by a user, wherein the identity authentication request includes user identity information, resource access requirement information, user terminal device information, and a corresponding timestamp; encrypts the user identity information based on a preset distributed hash algorithm to obtain an identity string, and constructs the identity string and the resource access requirement information as a data carrier of a blockchain node; The verification and permission control unit is used to select multiple verification nodes in a preset blockchain network to form a verification node cluster, and each verification node in the verification node cluster is deployed with a smart contract; each verification node in the verification node cluster executes a corresponding smart contract respectively, and the smart contract verifies the identity string based on a preset consensus rule; when the verification is passed, a dynamic access permission control strategy is constructed based on the resource access requirement information, and the dynamic access permission control strategy includes a resource access validity period, a resource access depth, and a resource operation permission; the identity string, the access permission control strategy, and the verification time information obtained when the verification is passed are packaged to generate an authentication block; The node expansion and block broadcasting unit is used to monitor the number of blocks in the blockchain network. When the number of blocks reaches a preset threshold, a terminal device with remaining computing resources is selected as a new verification node based on the user terminal device information; the new verification node is added to the verification node cluster, and the same smart contract as the original verification node is deployed in the new verification node; the newly generated authentication block is broadcast to all nodes in the blockchain network through the verification node cluster to realize distributed storage of authentication information.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, it implements the scalable blockchain identity authentication method for the distributed resource aggregation scenario as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, a scalable blockchain identity authentication method for a distributed resource aggregation scenario as described in any one of claims 1 to 6 is implemented.

Images