Cross-heterogeneous security domain hybrid identity authentication method and system based on block chain

Abstract

The invention provides a cross-heterogeneous security domain hybrid identity authentication method and system based on a block chain, and the method comprises the steps: initializing each heterogeneous security domain Di, and carrying out the identity registration of an Internet of Things device Dei and an edge server ESi based on an intra-domain authentication system; adding the ESi into the block chain; constructing cross-domain trust, and determining smart contract and cross-domain data sharing channel division; transmitting the data to an intra-domain database DBi or uploading the data to a block chain; the Dei sends a cross-domain data access request message to an intra-domain ESi; the ESi verifies the legality of the cross-domain access; if the request data is linked, the ESi directly pulls the data from the block chain locally and forwards the data back to the Dei; otherwise, the ESi forwards the cross-domain request to a target domain ESj; and the ESj verifies the legality of the cross-domain request, and forwards the corresponding data back to the Dei through the ESi after the verification is passed. According to the method, a heterogeneous cross-domain identity authentication mechanism based on the block chain is constructed to form hybrid cross-domain sharing channel support, so that interconnection and intercommunication of security domains and secure and efficient sharing of data in the industrial internet are promoted.

Description

Technical Field

[0001] The present invention relates to the field of blockchain applications, and in particular to a cross-heterogeneous security domain hybrid identity authentication method and system based on blockchain. Background Art

[0002] The cross-institutional and cross-departmental circulation and interaction of industrial data elements is a key link in promoting collaborative innovation and optimal resource allocation in the upstream and downstream of the industrial Internet industry chain. However, since different institutions or departments often adopt heterogeneous identity authentication systems, there are problems such as difficulty in identity mutual recognition, imperfect trust mechanism, and insufficient data privacy protection in the cross-domain data sharing process, which seriously restricts the efficient circulation and value release of industrial data. Traditional centralized cross-domain identity authentication solutions rely on a single trusted third-party organization, which is prone to become a performance bottleneck or cause a single point of failure, and it is difficult to adapt to complex scenarios with multiple security domains and heterogeneous authentication systems. Although traditional blockchain-based cross-domain sharing solutions have improved data transparency and immutability through distributed ledger technology, the limitations of on-chain storage and computing resources make it difficult to support large-scale, high-frequency data sharing needs, and the privacy protection capabilities are limited. The present invention proposes a cross-heterogeneous security domain hybrid identity authentication method and system based on blockchain. By constructing a heterogeneous cross-domain identity authentication mechanism based on blockchain, an on-chain-off-chain hybrid cross-domain sharing channel support is formed according to the sensitivity, sharing frequency and scale requirements of each security domain data, thereby realizing trusted mutual recognition of cross-domain identities, efficient collaboration of data sharing and flexible adaptation of privacy protection, thereby promoting the interconnection of various security domains in the industrial Internet and the safe and efficient sharing of industrial data. Summary of the invention

[0003] The present invention provides a cross-heterogeneous security domain hybrid identity authentication method and system based on blockchain, characterized in that the method and system involve blockchain, database, Internet of Things device, edge server, and domain identity management agency (certificate management agency or key generation center), and the method and system include:

[0004] Step 1: Each heterogeneous security domain D i Initialize based on the domain identity authentication mechanism, and the domain identity management agency generates the system public key PK i and the system private key SK i , and configure system parameters, then the IoT device De i and edge server ES i Based on the domain identity authentication system, the De i Submit an identity registration request to the domain identity management agency, and obtain a legal identity within the domain after review and approval, ensuring secure access and communication of the device;

[0005] Step 2: Each security domain D iInternal Edge Server ES i Join the blockchain, complete node registration and initial configuration, and participate in the consensus process and on-chain data synchronization as a consensus node;

[0006] Step 3: Each security domain D i Internal Edge Server ES i Based on the blockchain, we build cross-domain trust, reach consensus on a series of cross-domain access management smart contracts, and negotiate the symmetric key K used for cross-domain data encryption and decryption on the chain. b And write the cross-domain data sharing channel division range within each security domain into the blockchain;

[0007] Step 4: Each security domain D i Based on the division of cross-domain data sharing channels, data is transferred to the database DB within the domain i Store or via edge server ES i After encryption, upload to the blockchain for synchronization;

[0008] Step 5, Security Zone D i IoT devices i Send to target domain D j The cross-domain data access request message is sent to the edge server ES in the domain i ;

[0009] Step 6: Local Edge Server ES i Verify the legitimacy of cross-domain access through multiple factors including timestamp, device identity, digital signature, and request content;

[0010] Step 7: If the IoT device i The requested cross-domain data has been uploaded to the local edge server ES i Pull data directly from the blockchain and forward it back to the IoT device i , while the edge server ES i Upload cross-domain request records to blockchain for evidence storage;

[0011] Step 8: If the IoT device i The requested cross-domain data is off-chain, local edge server ES i Reconstruct the cross-domain request message and forward it to the target domain edge server ES j ;

[0012] Step 9: Target domain edge server ES j Verify the legitimacy of the cross-domain request through multiple factors such as message timestamp, identity proof, and cross-domain request content. After verification, ES j From the domain database DB j Read the corresponding data from ES i Forwarded to Dei , the last edge server ES i Upload device cross-domain access records to the blockchain for evidence storage.

[0013] Specifically, in step 1, each heterogeneous security domain D i Initialize based on the domain identity authentication mechanism, IoT devices De i and edge server ES i Identity registration is performed based on the intra-domain identity authentication system. Specifically, if the current security domain D i The public key infrastructure authentication system is adopted. The current identity management agency in the domain is the certificate management agency CA. i , by CA i Generate system public key PK i and the system private key SK i , formulate the current security domain D i Internal certificate policies and rules, configuration of related system parameters, De i Generate a pair of public and private keys (PK di , S.K. di ) and then send your identity information and public key PK di The registration request is sent to the domain certificate authority CA i , C.A. i After receiving the device registration request, the device identity information is reviewed. After the review is passed, CA i Use the system private key SK i Identity information and public key PK submitted by the device di Digital signature and IoT device De i Issue digital certificates, edge server ES i The registration process is the same; if the current security domain is D i Adopting an authentication system based on identity password, the current identity management agency in the domain is the key generation center KGC i , by KGC i Generate system public key PK i and the system private key SK i , and publish system parameters, IoT devices De i Domain Key Generation Center KGC i Submit your identity ID di , Key Generation Center KGC i Use the system private key SK i And a specific algorithm to calculate the device private key SK di , and send the generated private key SK through a secure channel di Send back to the IoT device i ;

[0014] Specifically, in step 2, each security domain D i Internal Edge Server ES i Join the blockchain, specifically: Edge Server ES i Submit a node joining request to the blockchain network. After blockchain identity verification and permission review, obtain the blockchain node identity and corresponding key pair, establish a communication connection with other consensus nodes, and synchronize the initial data of the blockchain;

[0015] Specifically, in step 3, each security domain D i Internal Edge Server ES i Build cross-domain trust based on blockchain, determine smart contracts, and negotiate the symmetric key K for cross-domain data encryption and decryption on the chain b , and reached a consensus on the division of cross-domain data sharing channels within their respective security domains, specifically: Edge Server ES i Deploy a series of cross-domain data sharing smart contracts through the blockchain network to define data access rights, sharing rules and privacy protection strategies; each security domain edge server ES i Negotiate the symmetric key K used for cross-domain data encryption and decryption on the chain b ; Then each edge server ES i Divide cross-domain data sharing channels, upload data that requires high transparency, multi-party consensus, and long-term storage to the blockchain for simultaneous sharing in multiple security domains, and share other large-scale, high-frequency updated, privacy-sensitive, etc. data through off-chain secure cross-domain communication; each security domain D i Internal Edge Server ES i The configuration information of the shared channel is recorded through the blockchain to form an unalterable consensus record, providing a trusted basis for cross-domain data sharing;

[0016] Specifically, in step 4, each security domain D i Based on the division of cross-domain data sharing channels, data is transferred to the database DB within the domain i Store or via edge server ES i After encryption, upload to the blockchain for synchronization, specifically: each security domain D i IoT devices i Send data to the edge server ES i , E.S. i Based on the division of cross-domain sharing channels for intra-domain data, data that requires high transparency, multi-party consensus, and long-term storage will be stored using a symmetric key K b After encryption, upload to the blockchain, and transfer large-scale, high-frequency updated, privacy-sensitive and other data to the domain database DB i ;

[0017] Specifically, in step 5, the security domain Di IoT devices i Send to target domain D j The cross-domain data access request message is sent to the edge server ES in the current domain. i , specifically: If the current security domain D i Using the public key infrastructure authentication system, IoT devices i Use your own private key SK di Digitally sign and encapsulate the message content. i Get the edge server ES in the domain i The digital certificate of the edge server ES is extracted from it i Public Key PK ei , then use PK ei The encapsulated message is encrypted and sent to the edge server ES i ; If the current security domain is D i Using an identity password-based authentication system, IoT devices i Use your own private key SK di Digitally sign and encapsulate the message content. i Get the edge server ES in the domain i The identity of the domain and calculate its public key PK based on the system parameters in the domain ei , then use PK ei The encapsulated message is encrypted and sent to the edge server ES i ;

[0018] Specifically, in step 6, the local edge server ES i Verify the legitimacy of cross-domain access and determine the cross-domain channel based on the cross-domain request message category, specifically: Edge Server ES i Use your own private key SK ei Decrypt the ciphertext message, then verify the digital signature in the message to ensure the integrity and source authenticity of the message, and then comprehensively judge the legitimacy of the cross-domain request based on multiple factors such as the message timestamp, sender identity information, and cross-domain request content. If it is illegal, directly reject the cross-domain access request of the device; if the request is legal, determine the cross-domain channel;

[0019] Specifically, in step 7, if the IoT device De i The requested cross-domain data has been uploaded to the local edge server ES i Pull data directly from the blockchain and forward it back to the IoT device i , specifically: Edge Server ES i Retrieve from the blockchain local data summary, if the IoT device De i The requested data has been uploaded to the chain. iExtract the corresponding data directly from the blockchain, encrypt it and send it back to De i , and upload the device's cross-domain access records to the blockchain for evidence storage;

[0020] Specifically, in step 8, if the IoT device De i The requested cross-domain data is off-chain, local edge server ES i Reconstruct the cross-domain request message and forward it to the target domain edge server ES j , specifically: If the IoT device De i The requested data is off-chain, ES i Pull the target domain D from the blockchain j Internal Edge Server ES j Identity information, according to the target domain D j The identity authentication system used is based on the blockchain evidence information to extract or calculate the target domain D j Internal Edge Server ES j The public key PK ej , followed by ES i Use your own private key SK ei Digitally sign and encapsulate the cross-domain message plaintext, and then use the public key PK ej After encrypting the encapsulated message, it is sent to the target domain D j Internal Edge Server ES j ;

[0021] Specifically, in step 9, the target domain edge server ES j Verify the legitimacy of the cross-domain request. After passing the verification, ES j From the domain database DB j Read the corresponding data from ES i Forwarded to De i , specifically: receiving the i After the cross-domain access request, the edge server ES j Use your own private key SK ej Decrypt the plaintext of the cross-domain request message, then verify the digital signature in the message to ensure the integrity and authenticity of the source of the message, and then comprehensively judge the legitimacy of the cross-domain request based on multiple factors such as the message timestamp, sender identity information, and cross-domain request content. If it is illegal, the cross-domain access request of the device is directly rejected. If the request is legal, the edge server ES j From the domain database DB j Read the corresponding data, organize it into a cross-domain response message, digitally sign and encapsulate it, and use the security domain D i Internal Edge Server ES i After encrypting with the public key, the ciphertext response message is sent to ES iForwarded back to IoT device i , the last edge server ES i Upload device cross-domain access records to blockchain for evidence storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0023] Figure 1 It is a hybrid identity authentication method and system flow chart across heterogeneous security domains based on blockchain;

[0024] Figure 2 The flowchart of hybrid cross-domain data channel negotiation based on blockchain. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] At present, the traditional cross-domain authentication schemes based on centralization and blockchain have obvious deficiencies in terms of security, efficiency and privacy protection, and it is difficult to meet the cross-domain data sharing needs in the complex heterogeneous environment of the industrial Internet. This invention aims at the cross-domain authentication problem in industrial scenarios, uses blockchain, edge computing and cryptographic algorithms, and constructs a heterogeneous cross-domain identity authentication mechanism based on blockchain. According to the sensitivity, sharing frequency and scale requirements of each security domain data, a hybrid cross-domain sharing channel support is formed on the chain and off the chain, which realizes the trusted mutual recognition of cross-domain identities, efficient collaboration of data sharing and flexible adaptation of privacy protection. The specific steps are as follows:

[0027] S101: Heterogeneous security domain D i Initialize based on the domain identity authentication mechanism, IoT devices De i and edge server ES i Identity registration is performed based on the domain identity authentication system.

[0028] Specifically, if the current security domain D i The public key infrastructure authentication system is adopted. The current identity management agency in the domain is the certificate management agency CA. i , by CAi Generate system public key PK i and the system private key SK i , formulate the current security domain D i Internal certificate policies and rules, configuration of related system parameters, De i Generate a pair of public and private keys (PK di , S.K. di ) and then send your identity information and public key PK di The registration request is sent to the domain certificate authority CA i , C.A. i After receiving the device registration request, the device identity information is reviewed. After the review is passed, CA i Use the system private key SK i Identity information and public key PK submitted by the device di Digital signature and IoT device De i Issue digital certificates, edge server ES i The registration process is the same; if the current security domain is D i Adopting an authentication system based on identity password, the current identity management agency in the domain is the key generation center KGC i , by KGC i Generate system public key PK i and the system private key SK i , and publish system parameters, IoT devices De i Domain Key Generation Center KGC i Submit your identity ID di , Key Generation Center KGC i Use the system private key SK i And a specific algorithm to calculate the device private key SK di , and send the generated private key SK through a secure channel di Send back to the IoT device i .

[0029] S102: Each security domain D i Internal Edge Server ES i Join the blockchain.

[0030] Specifically, the edge server ES i Submit a node joining request to the blockchain network. After blockchain identity verification and permission review, obtain the blockchain node identity and corresponding key pair, establish a communication connection with other consensus nodes, and synchronize the initial data of the blockchain.

[0031] S103: Each security domain D i Internal Edge Server ES iBased on the blockchain, we build cross-domain trust, reach consensus on a series of cross-domain access management smart contracts, and negotiate the symmetric key K used for cross-domain data encryption and decryption on the chain. b The cross-domain data sharing channel division range within each security domain is written into the blockchain.

[0032] Specifically, the edge server ES i Deploy a series of cross-domain data sharing smart contracts through the blockchain network to define data access rights, sharing rules and privacy protection strategies; each security domain edge server ES i Negotiate the symmetric key K used for cross-domain data encryption and decryption on the chain b ; Then each edge server ES i Divide cross-domain data sharing channels, upload data that requires high transparency, multi-party consensus, and long-term storage to the blockchain for simultaneous sharing in multiple security domains, and share other large-scale, high-frequency updated, privacy-sensitive, etc. data through off-chain secure cross-domain communication; each security domain D i Internal Edge Server ES i By recording the configuration information of the shared channel through the blockchain, an unalterable consensus record is formed, providing a trusted basis for cross-domain data sharing.

[0033] S104: Each security domain D i Based on the division of cross-domain data sharing channels, data is transferred to the database DB within the domain i Store or via edge server ES i After encryption, upload to the blockchain for synchronization.

[0034] Specifically, each security domain D i IoT devices i Send data to the edge server ES i , E.S. i Based on the division of cross-domain sharing channels for intra-domain data, data that requires high transparency, multi-party consensus, and long-term storage will be stored using a symmetric key K b After encryption, upload to the blockchain, and transfer large-scale, high-frequency updated, privacy-sensitive and other data to the domain database DB i .

[0035] S105: Security Zone D i IoT devices i Send to target domain D j The cross-domain data access request message is sent to the edge server ES in the domain i .

[0036] Specifically, if the current security domain D i Using the public key infrastructure authentication system, IoT devices i Use your own private key SKdi Digitally sign and encapsulate the message content. i Get the edge server ES in the domain i The digital certificate of the edge server ES is extracted from it i Public Key PK ei , then use PK ei The encapsulated message is encrypted and sent to the edge server ES i ; If the current security domain is D i Using an identity password-based authentication system, IoT devices i Use your own private key SK di Digitally sign and encapsulate the message content. i Get the edge server ES in the domain i The identity of the domain and calculate its public key PK based on the system parameters in the domain ei , then use PK ei The encapsulated message is encrypted and sent to the edge server ES i .

[0037] S106: Local edge server ES i Verify the legitimacy of cross-domain access through multiple factors including timestamp, device identity, digital signature, request content, etc.

[0038] Specifically, the edge server ES i Use your own private key SK ei Decrypt the ciphertext message and then verify the digital signature in the message to ensure the integrity and authenticity of the message. Then, judge the legitimacy of the cross-domain request based on multiple factors such as the message timestamp, sender identity information, and cross-domain request content. If it is illegal, directly reject the cross-domain access request of the device. If the request is legal, determine the cross-domain channel.

[0039] S107: If the IoT device i The requested cross-domain data has been uploaded to the local edge server ES i Pull data directly from the blockchain and forward it back to the IoT device i , while the edge server ES i Upload cross-domain request records to the blockchain for storage.

[0040] Specifically, the edge server ES i Retrieve from the blockchain local data summary, if the IoT device De i The requested data has been uploaded to the chain. i Extract the corresponding data directly from the blockchain, encrypt it and send it back to De i And upload the device's cross-domain access records to the blockchain for evidence storage.

[0041] S108: If the IoT device i The requested cross-domain data is off-chain, local edge server ES i Reconstruct the cross-domain request message and forward it to the target domain edge server ES j .

[0042] Specifically, if the IoT device i The requested data is off-chain, ES i Pull the target domain D from the blockchain j Internal Edge Server ES j Identity information, according to the target domain D j The identity authentication system used is based on the blockchain evidence information to extract or calculate the target domain D j Internal Edge Server ES j The public key PK ej , followed by ES i Use your own private key SK ei Digitally sign and encapsulate the cross-domain message plaintext, and then use the public key PK ej After encrypting the encapsulated message, it is sent to the target domain D j Internal Edge Server ES j .

[0043] S109: Target domain edge server ES i Verify the legitimacy of the cross-domain request through multiple factors such as message timestamp, identity proof, and cross-domain request content. After verification, ES j From the domain database DB j Read the corresponding data from ES i Forwarded to De i , the last edge server ES i Upload device cross-domain access records to the blockchain for evidence storage.

[0044] Specifically, receiving the i After the cross-domain access request, the edge server ES j Use your own private key SK ej Decrypt the plaintext of the cross-domain request message, then verify the digital signature in the message to ensure the integrity and authenticity of the source of the message, and then comprehensively judge the legitimacy of the cross-domain request based on multiple factors such as the message timestamp, sender identity information, and cross-domain request content. If it is illegal, the cross-domain access request of the device is directly rejected. If the request is legal, the edge server ES j From the domain database DB j Read the corresponding data, organize it into a cross-domain response message, digitally sign and encapsulate it, and use the security domain D i Internal Edge Server ES iAfter encrypting with the public key, the ciphertext response message is sent to ES i Forwarded back to IoT device i , the last edge server ES i Upload device cross-domain access records to the blockchain for evidence storage.

[0045] In order to facilitate the understanding of the present invention, Figure 2 The flowchart of hybrid cross-domain data channel negotiation based on blockchain is shown, which involves cross-domain trust construction of various security domains, cross-domain series of smart contract deployment, cross-domain data sharing channel division and shared channel division record storage.

[0046] like Figure 2 The figure shows the hybrid cross-domain data channel negotiation process based on blockchain, which specifically includes:

[0047] S201: Each security zone D i Internal Edge Server ES i Based on the intra-domain identity authentication system, identity credentials are uploaded to the blockchain to conduct identity mutual recognition and establish cross-domain trust. i Internal Edge Server ES i Based on the intra-domain identity authentication system, the identity certificate is uploaded to the blockchain. If the current security domain D i Using the public key infrastructure authentication system, edge server ES i You need to upload your own digital certificate. If the current security domain is D i Using an identity-based password authentication system, the edge server ES i You need to upload your own identity and related system parameters; after verification and consensus by the blockchain nodes, the identity credentials will be recorded on the blockchain; then each edge server ES i Query other security domains D through blockchain j Internal Edge Server ES j identity credentials to complete cross-domain identity mutual recognition and establish a cross-domain trust relationship based on the immutability and transparency of the blockchain.

[0048] S202: Determine the smart contract, define data access rights, sharing rules and privacy protection policies, and negotiate the symmetric key K for cross-domain data encryption and decryption on the chain b Specifically, each security domain D i Through negotiation, the content of the smart contract for cross-domain data sharing is determined, the scope of data access permissions (such as read and write permissions, time limits, etc.), sharing rules (such as data format, transmission protocol, etc.) and privacy protection strategies (such as data encryption, anonymization, etc.) are clarified, and after the smart contract is deployed to the blockchain, it is automatically executed and ensures the compliance and security of cross-domain data sharing; then the ES edge servers of each security domain are iNegotiate the symmetric key K used for cross-domain data encryption and decryption on the chain b .

[0049] S203: Each security domain D i A consensus is reached based on the division of cross-domain data sharing channels. Specifically, each security domain D i According to data sensitivity, sharing frequency and scale requirements, cross-domain data sharing channels are divided through negotiation. Data that requires high transparency, multi-party consensus and long-term storage will be uploaded to the blockchain for simultaneous sharing in multiple security domains. Other data such as large-scale, high-frequency updates and privacy-sensitive data will be shared through off-chain secure cross-domain communications. Through the consensus mechanism of the blockchain, each security domain D i Agree on the shared channel division plan to ensure the efficiency and consistency of cross-domain data sharing.

[0050] S204: Record each security domain D through blockchain i Share channel division information to form a consensus record that cannot be tampered with. i The shared channel division information determined by negotiation is recorded on the blockchain, and the distributed ledger technology of the blockchain is used to ensure the transparency and non-tamperability of the information; each security domain D i The configuration information of shared channels can be queried through the blockchain, providing reliable basic support for cross-domain data sharing.

[0051] The present invention proposes a cross-heterogeneous security domain hybrid identity authentication method and system based on blockchain. By constructing a heterogeneous cross-domain identity authentication mechanism based on blockchain, an on-chain-off-chain hybrid cross-domain sharing channel support is formed according to the sensitivity, sharing frequency and scale requirements of each security domain data, thereby realizing trusted mutual recognition of cross-domain identities, efficient collaboration of data sharing and flexible adaptation of privacy protection, thereby promoting the interconnection of various security domains in the industrial Internet and the safe and efficient sharing of industrial data.

Claims

1. A hybrid identity authentication method and system across heterogeneous security domains based on blockchain, characterized in that: The method and system involve a blockchain, a database, an IoT device, an edge server, and an intra-domain identity management agency (a certificate management agency or a key generation center). The method and system include the following steps: Step 1: Each heterogeneous security domain D i Initialize based on the domain identity authentication mechanism, and the domain identity management agency generates the system public key PK i and the system private key SK i , and configure system parameters, then the IoT device De i and edge server ES i Based on the domain identity authentication system, the De i Submit an identity registration request to the domain identity management agency, and obtain a legal identity within the domain after review and approval, ensuring secure access and communication of the device; Step 2: Each security domain D i Internal Edge Server ES i Join the blockchain, complete node registration and initial configuration, and participate in the consensus process and on-chain data synchronization as a consensus node; Step 3: Each security domain D i Internal Edge Server ES i Build cross-domain trust based on blockchain, reach consensus on a series of cross-domain access management smart contracts, negotiate the symmetric key Kb used for cross-domain data encryption and decryption on the chain, and write the cross-domain data sharing channel division range in each security domain into the blockchain; Step 4: Each security domain D i Based on the division of cross-domain data sharing channels, data is transferred to the database DB within the domain i Store or via edge server ES i After encryption, upload to the blockchain for synchronization; Step 5, Security Zone D i IoT devices i Send to target domain D j The cross-domain data access request message is sent to the edge server ES in the domain i ; Step 6: Local Edge Server ES i Verify the legitimacy of cross-domain access through multiple factors including timestamp, device identity, digital signature, and request content; Step 7: If the IoT device i The requested cross-domain data has been uploaded to the local edge server ES i Pull data directly from the blockchain and forward it back to the IoT device i , while the edge server ES i Upload cross-domain request records to blockchain for evidence storage; Step 8: If the IoT device i The requested cross-domain data is off-chain, local edge server ES i Reconstruct the cross-domain request message and forward it to the target domain edge server ES j ; Step 9: Target domain edge server ES j Verify the legitimacy of the cross-domain request through multiple factors such as message timestamp, identity proof, and cross-domain request content. After verification, ES j From the domain database DB j Read the corresponding data from ES i Forwarded to De i , the last edge server ES i Upload device cross-domain access records to blockchain for evidence storage.

2. A blockchain-based cross-heterogeneous security domain hybrid identity authentication method and system as claimed in claim 1, characterized in that: In step 1, each heterogeneous security domain D i Initialize based on the domain identity authentication mechanism, IoT devices De i and edge server ES i Identity registration is performed based on the intra-domain identity authentication system. Specifically, if the current security domain D i The public key infrastructure authentication system is adopted. The current identity management agency in the domain is the certificate management agency CA. i , by CA i Generate system public key PK i and the system private key SK i , formulate the current security domain D i Internal certificate policies and rules, configuration of related system parameters, IoT device De i Generate a pair of public and private keys (PK di , S.K. di ) and then send your identity information and public key PK di The registration request is sent to the domain certificate authority CA i , C.A. i After receiving the device registration request, the device identity information is reviewed. After the review is passed, CA i Use the system private key SK i Identity information and public key PK submitted by the device di Digital signature and IoT device De i Issue digital certificates, edge server ES i The registration process is the same; if the current security domain is D i Adopting an authentication system based on identity password, the current identity management agency in the domain is the key generation center KGC i , by KGC i Generate system public key PK i and the system private key SK i , and publish system parameters, IoT devices De i Domain Key Generation Center KGC i Submit your identity ID di , Key Generation Center KGC i Use the system private key SK i And a specific algorithm to calculate the device private key SK di , and send the generated private key SK through a secure channel di Send back to the IoT device i .

3. A blockchain-based cross-heterogeneous security domain hybrid identity authentication method and system as claimed in claim 1, characterized in that: In step 2, each security domain D i Internal Edge Server ES i Join the blockchain, specifically: Edge Server ES i Submit a node joining request to the blockchain network. After blockchain identity verification and permission review, obtain the blockchain node identity and corresponding key pair, establish a communication connection with other consensus nodes, and synchronize the initial data of the blockchain.

4. A blockchain-based cross-heterogeneous security domain hybrid identity authentication method and system as claimed in claim 1, characterized in that: In step 3, each security domain D i Internal Edge Server ES i Build cross-domain trust based on blockchain, determine smart contracts, and negotiate the symmetric key K for cross-domain data encryption and decryption on the chain b , and reached a consensus on the division of cross-domain data sharing channels within their respective security domains, specifically: Edge Server ES i Deploy a series of cross-domain data sharing smart contracts through the blockchain network to define data access rights, sharing rules and privacy protection strategies; each security domain edge server ES i Negotiate the symmetric key K used for cross-domain data encryption and decryption on the chain b ; Then each edge server ES i Divide cross-domain data sharing channels, upload data that requires high transparency, multi-party consensus, and long-term storage to the blockchain for simultaneous sharing in multiple security domains, and share other large-scale, high-frequency updated, privacy-sensitive, etc. data through off-chain secure cross-domain communication; each security domain D i Internal Edge Server ES i By recording the configuration information of the shared channel through the blockchain, an unalterable consensus record is formed, providing a trusted basis for cross-domain data sharing.

5. A blockchain-based cross-heterogeneous security domain hybrid identity authentication method and system as claimed in claim 1, characterized in that: In step 4, each security domain D i Based on the division of cross-domain data sharing channels, data is transferred to the database DB within the domain i Store or via edge server ES i After encryption, upload to the blockchain for synchronization, specifically: each security domain D i IoT devices i Send data to the edge server ES i , E.S. i Based on the division of cross-domain sharing channels for intra-domain data, data that requires high transparency, multi-party consensus, and long-term storage will be stored using a symmetric key K b After encryption, upload to the blockchain, and transfer large-scale, high-frequency updated, privacy-sensitive and other data to the domain database DB i .

6. A blockchain-based cross-heterogeneous security domain hybrid identity authentication method and system as claimed in claim 1, characterized in that: In step 5, the security domain D i IoT devices i Send to target domain D j The cross-domain data access request message is sent to the edge server ES in the current domain. i , specifically: If the current security domain D i Using the public key infrastructure authentication system, IoT devices i Use your own private key SK di Digitally sign and encapsulate the message content. i Get the edge server ES in the domain i The digital certificate of the edge server ES is extracted from it i Public Key PK ei , then use PK ei The encapsulated message is encrypted and sent to the edge server ES i ; If the current security domain is D i Using an identity password-based authentication system, IoT devices i Use your own private key SK di Digitally sign and encapsulate the message content. i Get the edge server ES in the domain i The identity of the domain and calculate its public key PK based on the system parameters in the domain ei , then use PK ei The encapsulated message is encrypted and sent to the edge server ES i .

7. A blockchain-based cross-heterogeneous security domain hybrid identity authentication method and system as claimed in claim 1, characterized in that: In step 6, the local edge server ES i Verify the legitimacy of cross-domain access and determine the cross-domain channel based on the cross-domain request message category, specifically: Edge Server ES i Use your own private key SK ei Decrypt the ciphertext message and then verify the digital signature in the message to ensure the integrity and authenticity of the message. Then, judge the legitimacy of the cross-domain request based on multiple factors such as the message timestamp, sender identity information, and cross-domain request content. If it is illegal, directly reject the cross-domain access request of the device. If the request is legal, determine the cross-domain channel.

8. A blockchain-based cross-heterogeneous security domain hybrid identity authentication method and system as claimed in claim 1, characterized in that: In step 7, if the IoT device De i The requested cross-domain data has been uploaded to the local edge server ES i Pull data directly from the blockchain and forward it back to the IoT device i , specifically: Edge Server ES i Retrieve from the blockchain local data summary, if the IoT device De i The requested data has been uploaded to the chain. i Extract the corresponding data directly from the blockchain locally, using the symmetric key K b After decryption, use the IoT device De i The public key PK di After encryption, it is sent back to De i And upload the device's cross-domain access records to the blockchain for evidence storage.

9. A blockchain-based cross-heterogeneous security domain hybrid identity authentication method and system as claimed in claim 1, characterized in that: In step 8, if the IoT device De i The requested cross-domain data is off-chain, local edge server ES i Reconstruct the cross-domain request message and forward it to the target domain edge server ES j , specifically: If the IoT device De i The requested data is off-chain, ES i Pull the target domain D from the blockchain j Internal Edge Server ES j Identity information, according to the target domain D j The identity authentication system used is based on the blockchain evidence information to extract or calculate the target domain D j Internal Edge Server ES j The public key PK ej , followed by ES i Use your own private key SK ei Digitally sign and encapsulate the cross-domain message plaintext, and then use the public key PK ej After encrypting the encapsulated message, it is sent to the target domain D j Internal Edge Server ES j .

10. A blockchain-based cross-heterogeneous security domain hybrid identity authentication method and system as claimed in claim 1, characterized in that: In step 9, the target domain edge server ES j Verify the legitimacy of the cross-domain request. After passing the verification, ES j From the domain database DB j Read the corresponding data from ES i Forwarded to De i , specifically: receiving the i After the cross-domain access request, the edge server ES j Use your own private key SK ej Decrypt the plaintext of the cross-domain request message, then verify the digital signature in the message to ensure the integrity and authenticity of the source of the message, and then comprehensively judge the legitimacy of the cross-domain request based on multiple factors such as the message timestamp, sender identity information, and cross-domain request content. If it is illegal, the cross-domain access request of the device is directly rejected. If the request is legal, the edge server ES j From the domain database DB j Read the corresponding data, organize it into a cross-domain response message, digitally sign and encapsulate it, and use the security domain D i Internal Edge Server ES i After encrypting with the public key, the ciphertext response message is sent to ES i Forwarded back to IoT device i , the last edge server ES i Upload device cross-domain access records to blockchain for evidence storage.

Images