Blockchain zero trust system and method for blockchain zero trust system

Abstract

The present disclosure relates to a blockchain zero-trust system and a method for the blockchain zero-trust system, wherein the system comprises multiple network entities, a distributed trust proxy node set consisting of multiple blockchain nodes in a blockchain network, and a distributed trusted verification node set consisting of multiple blockchain nodes, wherein any network entity accesses other network entities in the multiple network entities through the distributed trust proxy node set; the distributed trust proxy node set is used to, upon receiving a first access request from a first network entity to a target network entity, send a trusted verification request to the distributed trusted verification node set, wherein the first network entity is any network entity among the multiple network entities; the distributed trusted verification node set is used to, in response to the trusted verification request, perform trusted verification on the first network entity; and when the trusted verification passes, the first network entity accesses the target network entity.

Description

Technical Field

[0001] The present disclosure relates to the field of blockchain technology, and in particular, to a blockchain zero-trust system and a method for a blockchain zero-trust system. Background Art

[0002] In traditional network security, defense usually relies on physical boundaries such as firewalls. In this defense model, all office equipment and data resources of the enterprise are in the intranet, and the intranet is completely trustworthy. However, with the continuous rise of technologies such as cloud computing, big data, and the Internet of Things, the Internet architecture is changing from "bounded" to "borderless", and the traditional network security architecture cannot meet the new network security needs.

[0003] To this end, related technologies use a zero-trust architecture to perform network access control, but this architecture still has many security issues. Summary of the invention

[0004] The purpose of the present disclosure is to provide a blockchain zero-trust system and a method for a blockchain zero-trust system to solve the above-mentioned related technical problems.

[0005] In order to achieve the above-mentioned purpose, according to the first aspect of the embodiment of the present disclosure, a blockchain zero-trust system is provided, comprising a plurality of network entities, a distributed trust proxy node set consisting of a plurality of blockchain nodes in a blockchain network, and a distributed trusted verification node set consisting of a plurality of blockchain nodes, wherein any of the network entities accesses other network entities in the plurality of network entities through the distributed trust proxy node set;

[0006] The distributed trust proxy node set is used to send a trusted verification request to the distributed trusted verification node set when receiving a first access request from a first network entity for a target network entity, wherein the first network entity is any network entity among the multiple network entities;

[0007] The distributed trusted verification node set is used to perform trusted verification on the first network entity in response to the trusted verification request;

[0008] Wherein, when the trusted verification passes, the first network entity accesses the target network entity.

[0009] Optionally, the distributed trust proxy node set is further configured to forward the first access request to the target network entity if the trusted verification passes.

[0010] Optionally, it also includes a distributed authorization management node set consisting of multiple blockchain nodes, wherein the distributed authorization management node set is registered in the digital identity blockchain network.

[0011] The distributed authorization management node set is used to generate an access credential when the trusted verification passes, and send the access credential to the first network entity, wherein the access credential includes an access address of the digital identity blockchain network and signature information generated by the distributed authorization management node set based on a private key registered in the digital identity blockchain network;

[0012] The first network entity is used to send a second access request to the target network entity, where the second access request includes the access credential;

[0013] The target network entity is used to, after receiving the second access request, obtain the first digital identity information of the distributed authorization management node set based on the access address, and verify the access credential through the first digital identity information;

[0014] Wherein, when the access credential is verified successfully, the target network entity performs an operation corresponding to the second access request.

[0015] Optionally, a trusted verification smart contract is deployed in the blockchain network, and the distributed trusted verification node set is specifically used to perform trusted verification on the first network entity through the trusted verification smart contract.

[0016] Optionally, the first access request further includes second digital identity information obtained by registering the first network entity in the digital identity blockchain network, and an access address of the digital identity blockchain network, and the distributed trusted verification node set includes an identity authentication node set.

[0017] The identity authentication node set is used to, in response to the trusted verification request, obtain the target digital identity information of the first network entity, and perform trusted identity verification on the identity of the first network entity through the target digital identity information;

[0018] Among them, the target digital identity information is the digital identity information of the first network entity stored in the blockchain of the digital identity blockchain network.

[0019] Optionally, the distributed trusted verification node set further includes a trusted authentication node set, and the trusted authentication node set is used to perform the following steps:

[0020] In response to the trusted verification request, acquiring historical access data of the first network entity;

[0021] determining a historical access behavior of the first network entity according to the historical access data;

[0022] Calculating a trust description parameter of the first network entity based on the historical access behavior and trust weight parameters corresponding to various access behavior types;

[0023] Access trustworthiness verification is performed on the first network entity according to the trust description parameters and a preset trust authentication policy.

[0024] Optionally, the access behavior type is one or more types, the access behavior type includes multiple access behavior subcategories, and the trust weight parameter is determined in the following manner:

[0025] For multiple access behavior subcategories included in the same access behavior type, determine the access trust level of each access behavior subcategory;

[0026] Based on the access trust levels of multiple access behavior subcategories included in the same access behavior type, construct a fuzzy consistency matrix of the access behavior type;

[0027] The trust weight parameter of the access behavior type is calculated through the fuzzy consistency matrix.

[0028] Optionally, the trust authentication node set specifically calculates the trust description parameters of the first network entity in the following manner: constructing an access behavior matrix of the first network entity based on the historical access behavior of the first network entity and the access behavior subcategory to which the historical access behavior belongs; calculating the product of the access behavior matrix of the first network entity and the trust weight parameter to obtain a trust description matrix, and the trust description parameters include the trust description matrix;

[0029] The trust authentication node set specifically performs trustworthy verification on the first network entity in the following manner: calculating the determinant value of the trust description matrix to obtain the access trust of the first network entity; determining whether the access behavior of the first network entity is trustworthy based on the access trust and a preset access trust interval.

[0030] According to a second aspect of an embodiment of the present disclosure, a method for a blockchain zero-trust system is provided, which is applied to the blockchain zero-trust system described in any one of the first aspects above, and the method includes:

[0031] The distributed trust proxy node set sends a trusted verification request to the distributed trusted verification node set when receiving a first access request from a first network entity for a target network entity, wherein the first network entity is any network entity among the multiple network entities;

[0032] The distributed trusted verification node set performs trusted verification on the first network entity in response to the trusted verification request;

[0033] Wherein, when the trusted verification passes, the first network entity accesses the target network entity.

[0034] Optionally, the blockchain zero-trust system further includes a distributed authorization management node set consisting of multiple blockchain nodes, the distributed authorization management node set is registered in the digital identity blockchain network, and the method further includes:

[0035] When the trusted verification passes, the distributed authorization management node set generates an access credential and sends the access credential to the first network entity, wherein the access credential includes an access address of the digital identity blockchain network and signature information generated by the distributed authorization management node set based on a private key registered in the digital identity blockchain network;

[0036] The first network entity sends a second access request to the target network entity, wherein the second access request includes the access credential;

[0037] After receiving the second access request, the target network entity obtains the first digital identity information of the distributed authorization management node set based on the access address, and verifies the access credential through the first digital identity information;

[0038] Wherein, when the access credential is verified successfully, the target network entity performs an operation corresponding to the second access request.

[0039] Optionally, it also includes:

[0040] The distributed trust proxy node forwards the first access request to the target network entity if the trusted verification passes.

[0041] Optionally, a trusted verification smart contract is deployed in the blockchain network, and the distributed trusted verification node set performs trusted verification on the first network entity in response to the trusted verification request, including:

[0042] The distributed trusted verification node set responds to the trusted verification request and performs trusted verification on the first network entity through the trusted verification smart contract.

[0043] Optionally, the first access request further includes second digital identity information obtained by registering the first network entity in the digital identity blockchain network, and an access address of the digital identity blockchain network, the distributed trusted verification node set includes an identity authentication node set, and the distributed trusted verification node set performs trusted verification on the first network entity in response to the trusted verification request, including:

[0044] The identity authentication node set obtains the target digital identity information of the first network entity in response to the trusted verification request, and performs trusted identity verification on the identity of the first network entity through the target digital identity information;

[0045] Among them, the target digital identity information is the digital identity information of the first network entity stored in the blockchain of the digital identity blockchain network.

[0046] Optionally, the distributed trusted verification node set further includes a trust authentication node set, and the distributed trusted verification node set performs trusted verification on the first network entity in response to the trusted verification request, including:

[0047] The set of trusted authentication nodes obtains historical access data of the first network entity in response to the trusted verification request;

[0048] The trusted authentication node set determines the historical access behavior of the first network entity according to the historical access data;

[0049] The trust authentication node set calculates the trust description parameter of the first network entity based on the historical access behavior and the trust weight parameters corresponding to various access behavior types;

[0050] The trust authentication node set performs access trustworthiness verification on the first network entity according to the trust description parameters and a preset trust authentication policy.

[0051] Optionally, the access behavior type is one or more types, the access behavior type includes multiple access behavior subcategories, and the trust weight parameter is determined in the following manner:

[0052] For multiple access behavior subcategories included in the same access behavior type, determine the access trust level of each access behavior subcategory;

[0053] Based on the access trust levels of multiple access behavior subcategories included in the same access behavior type, construct a fuzzy consistency matrix of the access behavior type;

[0054] The trust weight parameter of the access behavior type is calculated through the fuzzy consistency matrix.

[0055] Optionally, the trust authentication node set calculates the trust description parameter of the first network entity based on the historical access behavior and the trust weight parameters corresponding to various access behavior types, including:

[0056] The trusted authentication node set constructs an access behavior matrix of the first network entity based on the historical access behavior of the first network entity and the access behavior subcategory to which the historical access behavior belongs;

[0057] The trust authentication node set calculates the product of the access behavior matrix of the first network entity and the trust weight parameter to obtain a trust description matrix, wherein the trust description parameter includes the trust description matrix;

[0058] The trust authentication node set performs access trustworthiness verification on the first network entity according to the trust description parameter and a preset trust authentication policy, including:

[0059] The trust authentication node set calculates the determinant value of the trust description matrix to obtain the access trust of the first network entity; and determines whether the access behavior of the first network entity is trustworthy based on the access trust and a preset access trust interval.

[0060] The above system includes multiple network entities, a distributed trust proxy node set and a distributed trusted verification node set. Among them, any of the network entities can access other network entities in the multiple network entities through the distributed trust proxy node set. The distributed trust proxy node set can forward the access request of each network entity to the distributed trusted verification node set for trusted verification. After the trusted verification is passed, the network entity can perform the corresponding access operation. The above technical solution constructs a zero-trust system, in which the access entrance of the network entity is a distributed trust proxy node set, and the trusted verification of the network entity is performed by a distributed trusted verification node set. Since the distributed trust proxy node set and the distributed trusted verification node set are composed of multiple blockchain nodes in the blockchain network, it can ensure that the processing results of the distributed trust proxy node set and the distributed trusted verification node set cannot be tampered with. In this way, the security and reliability of the blockchain zero-trust system can be improved.

[0061] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] The accompanying drawings are used to provide a further understanding of the present disclosure and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present disclosure but do not constitute a limitation of the present disclosure. In the accompanying drawings:

[0063] Figure 1 It is a block diagram of a zero trust model shown in an exemplary embodiment of the present disclosure.

[0064] Figure 2 It is a block diagram of a blockchain zero-trust system shown in an exemplary embodiment of the present disclosure.

[0065] Figure 3 It is a calculation flow chart of a trust weight parameter shown in an exemplary embodiment of the present disclosure.

[0066] Figure 4 It is a schematic diagram of an access behavior type shown in an exemplary embodiment of the present disclosure.

[0067] Figure 5 It is a block diagram of a blockchain zero-trust system shown in an exemplary embodiment of the present disclosure.

[0068] Figure 6 It is a flowchart of a method for a blockchain zero-trust system shown in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0069] The specific implementation of the present disclosure is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described herein is only used to illustrate and explain the present disclosure, and is not used to limit the present disclosure.

[0070] Before introducing the blockchain zero-trust system and the method for the blockchain zero-trust system of the present invention, the application scenarios of the present invention are first introduced.

[0071] Figure 1 It is a block diagram of a zero-trust model shown in the present disclosure, and the zero-trust model includes a data plane, a control plane, and an identity security infrastructure. Among them, the data plane includes a trust proxy component. The trust proxy component serves as an interactive entrance for various types of access subjects to perform secure access, and can be used to perform dynamic access control. For example, the trust proxy component can forward resource access requests to the dynamic access control engine of the control plane for processing, so that the dynamic access control engine can verify the legitimacy of the access subject through processes such as identity authentication and authority determination. In this way, after the legitimacy verification is passed, the business request is released. In some implementation scenarios, the trust proxy component also supports on-demand encryption of resources and access information, which helps to improve the security of the access process.

[0072] Still refer to Figure 1The control plane includes components such as a dynamic access control engine and a trust assessment engine. The dynamic access control engine can realize collaborative linkage with the trust proxy component based on infrastructure such as identity authentication, authorization services, and access control, thereby ensuring that all access requests are forcibly authenticated and dynamically trusted. The trust assessment engine supports linkage with the dynamic access control engine, thereby determining the authorization policies of various entities based on the trust assessment results.

[0073] In addition, the identity assurance infrastructure can provide identity management and permission service functions for various access entities, thereby providing support for the zero trust architecture.

[0074] The applicant has found that relevant components (such as the data plane) in the above-mentioned zero-trust model are still vulnerable to attacks, which makes the processing results of the relevant components unreliable, thereby reducing the security of the entire network architecture.

[0075] To this end, the present disclosure provides a blockchain zero-trust system. Figure 2 is a block diagram of a blockchain zero-trust system shown in the present disclosure, wherein the blockchain zero-trust system includes multiple network entities ( Figure 2 A distributed trust proxy node set consisting of multiple blockchain nodes in the blockchain network and a distributed trusted verification node set consisting of multiple blockchain nodes are provided.

[0076] The network entity may be a user, device, software, etc. in the network space, and any of the network entities may access other network entities in the plurality of network entities through the distributed trust proxy node set. Figure 2 In the example, when the first network entity needs to access the target network entity (or needs to initiate a transaction process to the target network entity), it can send a first access request to the distributed trust proxy node set, thereby performing a trust verification through the distributed trust proxy node set.

[0077] The distributed trust proxy node set is used to send a trusted verification request to the distributed trusted verification node set when receiving a first access request from the first network entity to the target network entity. It should be noted that the example for the first network entity here is also applicable to any network entity in the blockchain zero trust system.

[0078] The distributed trusted verification node set is used to perform trusted verification on the first network entity in response to the trusted verification request.

[0079] Here, the trusted verification may include trusted identity verification. For example, in one possible implementation, the first access request also includes the second digital identity information obtained by the first network entity registered in the digital identity blockchain network, and the access address of the digital identity blockchain network, and the distributed trusted verification node set includes an identity authentication node set. In this case, the identity authentication node set can be used to perform trusted identity verification on the first network entity.

[0080] The identity authentication node set is used to obtain the target digital identity information of the first network entity in response to the trusted verification request, and perform trusted identity verification on the identity of the first network entity through the target digital identity information.

[0081] For example, the identity authentication node set can access the digital identity blockchain network based on the access address, thereby obtaining the target digital identity information of the first network entity from the digital identity blockchain network. The target digital identity information is the digital identity information of the first network entity stored in the blockchain of the digital identity blockchain network.

[0082] In this way, by comparing the acquired digital identity information and the second digital identity information in the first access request, the trusted identity verification of the first network entity can be achieved. For example, when the acquired target digital identity information is the same as the second digital identity information in the first access request, the trusted identity verification of the first network entity passes; when the acquired target digital identity information is different from the second digital identity information in the first access request, the trusted identity verification of the first network entity fails.

[0083] In addition, in some implementation scenarios, the first access request may further include a digital signature of the first network entity. Here, the digital signature may be generated based on a registered private key of the first network entity in the digital identity blockchain. In this case, the identity authentication node set may also obtain a registered public key of the first network entity from the digital identity blockchain, thereby verifying the digital signature through the registered public key.

[0084] In this way, after the identity trust verification is passed, the first network entity can access the target network entity.

[0085] It is worth noting that in the traditional CA (Certification Authority) authentication method, different CAs constitute different identity systems and cannot authenticate each other. For example, the identity issued by CA 1 cannot be authenticated by CA 2. The above technical solution can authenticate the identity through the digital identity of the first network entity, because the digital identity has a unified composition form and is registered in the digital identity blockchain. Therefore, compared with the traditional CA authentication method, the above technical solution can provide a unified and verifiable digital identity, thereby solving the problem in the existing authentication method that different identity systems cannot communicate with each other and cannot be uniformly verified.

[0086] In addition, the trusted verification may also include access trusted verification. It is worth noting that the historical access behavior of the network entity may also reflect whether the network entity is trustworthy. For example, the first network entity may have multiple illegal operations (such as guessing the system key) during the historical access process. In this case, even if the first network entity has a trusted entity identity, the first network entity is not trustworthy.

[0087] To this end, in a possible implementation manner, the distributed trusted verification node set further includes a trusted authentication node set, and the trusted authentication node set is used to perform the following steps:

[0088] In response to the trusted verification request, historical access data of the first network entity is acquired; and historical access behavior of the first network entity is determined according to the historical access data.

[0089] Based on the historical access behaviors and trust weight parameters corresponding to various access behavior types, a trust description parameter of the first network entity is calculated.

[0090] The access behavior type may be one or more types, and the access behavior type includes multiple access behavior subcategories. Figure 3 A calculation flow chart of a trust weight parameter is shown. In some implementation scenarios, the trust weight parameter can be determined in the following manner:

[0091] S31, for a plurality of access behavior subcategories included in the same access behavior type, determining an access trust level of each access behavior subcategory.

[0092] For example, refer to Figure 4A schematic diagram of an access behavior type is shown, and the access behavior type may include, for example, regular access behavior, threatening access behavior, and gray access behavior. Among them, the regular access behavior type includes four access behavior subcategories: number of logins, number of queries, number of uploads, and number of downloads; the threatening access behavior type includes four access behavior subcategories: number of sensitive service accesses, number of illegal links, number of file permission modifications, and number of bypassing operations; the gray access behavior type includes four access behavior subcategories: number of created threads, number of password guesses, number of username guesses, and number of port scans.

[0093] In this way, the access trust level can be set for each access behavior subcategory according to application requirements. Figure 4 The access trust levels for each of the access behavior subcategories are as follows:

[0094] In the general access behavior type: number of logins < number of queries < number of uploads = number of downloads, then the access trust level is number of uploads = number of downloads, which is 3, number of queries is 2, and number of logins is 1.

[0095] In the threat access behavior type: the number of times sensitive services are accessed = the number of illegal links < the number of times file permissions are modified = the number of bypassing operations, then the access trust level is the number of times file permissions are modified = the number of bypassing operations is 2, and the number of times sensitive services are accessed = the number of illegal links is 1.

[0096] In the gray access behavior type: the number of created threads < the number of password guesses = the number of user name guesses < the number of port scans, then the trust level is 3 for the number of port scans, the number of password guesses = the number of user name guesses, and the number of created threads is 1.

[0097] Thus, in S32, based on the access trust levels of a plurality of access behavior subcategories included in the same access behavior type, a fuzzy consistency matrix of the access behavior type is constructed.

[0098] Continue to use Figure 4 For example, the constructed fuzzy consistency matrix is ​​as follows:

[0099] Fuzzy consistency matrix Q of regular access behavior types A :

[0100]

[0101] Fuzzy consistency matrix Q of threat access behavior types B :

[0102]

[0103] The fuzzy consistency matrix Q of grey access behavior types C :

[0104]

[0105] For the construction method of the fuzzy consistency matrix, please refer to the description in the related art. For the sake of brevity of the description, this disclosure will not elaborate on it here.

[0106] S33, calculating the trust weight parameter of the access behavior type through the fuzzy consistency matrix.

[0107] For example, the trust weight parameter may be calculated by the following formula:

[0108]

[0109] Among them, ω i is the trust weight parameter of the i-th access behavior type, m is the matrix order of the fuzzy consistency matrix, which is 4 in the above example, and q ij is the jth element in the ith row of the fuzzy consistency matrix Q of the ith access behavior type.

[0110] Using the above example, the trust weight parameter calculated by the above formula is:

[0111] Weight parameter ω of general access behavior type A ,ω A =(0.131.0.331,0.331,0.207);

[0112] Threat access behavior type weight parameter ω B ,ω B =(0.1875,0.3125,0.1875,0.3125);

[0113] Grey access behavior type weight parameter ω C ,ω C =(0.236,0.236,0.146,0.382).

[0114] In this way, the trust description parameter of the first network entity can be calculated according to the historical access behavior of the first network entity and the trust weight parameters corresponding to various access behavior types.

[0115] For example, in a possible implementation manner, the trust authentication node set specifically calculates the trust description parameter of the first network entity in the following manner:

[0116] An access behavior matrix of the first network entity is constructed based on the historical access behavior of the first network entity and the access behavior subcategory to which the historical access behavior belongs; and a product of the access behavior matrix of the first network entity and the trust weight parameter is calculated to obtain a trust description matrix.

[0117] For example, the access behavior matrix U of the first network entity constructed based on the historical access behavior of the first network entity and the access behavior subcategory to which the historical access behavior belongs is as follows:

[0118]

[0119] In this way, the product of the access behavior matrix and the trust weight parameter can be calculated to obtain a trust description matrix, and the trust description parameter includes the trust description matrix.

[0120] After obtaining the trust description parameters, the trust authentication node set may perform access trustworthiness verification on the first network entity according to the trust description parameters and a preset trust authentication policy.

[0121] For example, in a possible implementation manner, the set of trusted authentication nodes performs trustworthy authentication on the first network entity in the following manner:

[0122] The determinant value of the trust description matrix is ​​calculated to obtain the access trust of the first network entity; and whether the access behavior of the first network entity is trustworthy is determined according to the access trust and a preset access trust interval.

[0123] Here, the access trust interval range can be set according to application requirements. When the access trust does not meet the access trust interval range, it can be determined that the access behavior of the first network entity is untrustworthy. When the access trust meets the access trust interval range, it can be determined that the access behavior of the first network entity is credible. In some implementation scenarios, the trust authentication node set can also obtain a trust authentication policy from the blockchain (for example, it can include an access trust interval range, authorization validity period, permission content, etc.), and grant relevant access rights to the first network entity according to the trust authentication policy.

[0124] In some implementation scenarios, the trust interval range may also be multiple. When the access trust of the first network entity is in different trust interval ranges, the trust authentication node set may grant different permissions to the first network entity according to the trust authentication policy. For example, when the access trust of the first network entity is in a first trust interval range with lower trustworthiness, the trust authentication node set may grant data reading permission to the first network entity; when the access trust of the first network entity is in a second trust interval range with higher trustworthiness, the trust authentication node set may grant data reading permission and data writing permission to the first network entity. In this way, permissions can be dynamically allocated to the first network entity according to the access trust of the first network entity, which is helpful for permission management.

[0125] In some implementation scenarios, the access trustworthiness judgment of the first network entity may also be performed based on the diagonal elements of the trust description matrix. A ,ω B ,ω C By multiplying the constructed matrices, a 3×3 trust description matrix can be obtained. The first element of the first row of the trust description matrix is ​​the regular access behavior data of the first network entity and the trust weight parameter ω A The second element of the second row of the trust description matrix is ​​the threat access behavior data of the first network entity and the trust weight parameter ω B The third element of the third row of the trust description matrix is ​​the gray access behavior data of the first network entity and the trust weight parameter ω C Therefore, in some implementations, the diagonal elements of the trust description matrix may be taken, and by comparing the diagonal elements with the corresponding preset value range, it is determined whether the access behavior of the first network entity is trustworthy. The preset value range may be obtained, for example, by pre-calibration.

[0126] The above technical solution can measure the access behavior of the first access entity based on the historical access behavior of the first network entity to obtain the access trust of the first network entity. In this way, it is possible to judge whether the access behavior of the first network entity is trustworthy by the access trust and the access trust interval. In this way, the first network entity can be trusted from the perspective of access behavior, thereby improving the dimension of network entity trustworthiness verification and helping to improve the recognition rate of untrustworthy network entities.

[0127] Then, after the access trust verification is passed, the first network entity can access the target network entity.

[0128] The above technical solution constructs a zero-trust system, in which the access entrance of the network entity is a distributed trust proxy node set, and the trusted verification of the network entity is performed by a distributed trusted verification node set. Since the distributed trust proxy node set and the distributed trusted verification node set are composed of multiple blockchain nodes in the blockchain network, it is possible to ensure that the processing results of the distributed trust proxy node set and the distributed trusted verification node set cannot be tampered with. In this way, the security and reliability of the blockchain zero-trust system can be improved.

[0129] In addition, it is worth noting that the above embodiments respectively describe the trusted verification process of the first network entity from the perspectives of trusted identity verification and trusted access verification. However, those skilled in the art know that in specific implementation, the above-mentioned trusted identity verification process and trusted access verification process may also be applied simultaneously. In this case, the first network entity needs to pass trusted identity verification and trusted access verification before it can access the target network entity.

[0130] For example, in a possible implementation, the distributed trust proxy node set is further configured to forward the first access request to the target network entity if the trusted verification (the identity trusted verification and the access trusted verification) passes.

[0131] That is, after the trust verification of the first network entity is passed, the first access request can be forwarded to the target network entity by the distributed trust proxy node set. In this way, temporary access authorization to the first network entity is achieved.

[0132] In a possible implementation manner, access authorization may also be performed on the first network entity based on the access credential.

[0133] In this case, the blockchain zero-trust system also includes a distributed authorization management node set consisting of multiple blockchain nodes, and the distributed authorization management node set is registered in the digital identity blockchain network. The distributed authorization management node set is used to generate access credentials and send the access credentials to the first network entity when the trusted verification passes.

[0134] The access credential includes the access address of the digital identity blockchain network and the signature information generated by the distributed authorization management node set based on the private key registered in the digital identity blockchain network. In some implementation scenarios, the access credential may also include authorization information, such as the data read permission, data write permission and validity period of each permission obtained by the first network entity.

[0135] The first network entity is used to send a second access request to the target network entity, where the second access request includes the access credential.

[0136] The target network entity is used to, after receiving the second access request, obtain the first digital identity information of the distributed authorization management node set based on the access address, and verify the access credential through the first digital identity information.

[0137] For example, the target network entity may access the digital identity blockchain network based on the access address, thereby obtaining the first digital identity information of the distributed authorization management node set from the digital identity blockchain network.

[0138] In this way, the registration public key of the distributed authorization management node set can be obtained based on the first digital identity information, and the access credential can be verified by the registration public key. In this way, when the access credential is verified, the target network entity performs an operation corresponding to the second access request. For example, when the second access request is used to request to obtain target data, the target network entity can feedback the target data to the first network entity.

[0139] In addition, in some implementation scenarios, the second access request may also include the digital identity information registered by the first network entity in the digital identity blockchain. In this case, the target network entity may also access the digital identity blockchain network based on the access address to verify the digital identity information of the first network entity in the second access request, and the present disclosure does not limit this.

[0140] The above technical solution can generate access credentials through the digital identity information of the distributed authorization management node set. Since the digital identity has a unified composition form and is registered in the digital identity blockchain. Therefore, each network entity can obtain the digital identity of the distributed authorization management node set from the digital identity blockchain, thereby verifying the access credentials issued by the distributed authorization management node set. Compared with the traditional CA authentication method, the above technical solution can provide a unified and verifiable digital identity, thereby solving the problem in the existing authentication method that different identity systems cannot communicate with each other and cannot be uniformly verified.

[0141] In addition, it is worth noting that, in some possible implementations, a trusted verification smart contract is deployed in the blockchain network, and the distributed trusted verification node set is specifically used to perform trusted verification on the first network entity through the trusted verification smart contract. The trusted verification node set may be composed of each endorsement node of the trusted verification smart contract.

[0142] Of course, the steps performed by other distributed node sets (such as distributed trust proxy node sets and distributed authorization management node sets) in the blockchain zero-trust system described in the above embodiments can also be implemented based on smart contracts. In this case, each blockchain node in each distributed node set can, for example, be an endorsement node of the corresponding smart contract.

[0143] For example, Figure 5 It is a block diagram of a blockchain zero-trust system shown in the present disclosure, in which a trust proxy smart contract, a trust assessment smart contract, an identity authentication smart contract and an authorization management smart contract are deployed.

[0144] The first network entity may register a digital identity in a distributed digital identity blockchain. When access to a target network entity is required, the first network entity may send an access request to a trust proxy smart contract deployed in the trust proxy blockchain. The access request may also include the digital identity information of the first network entity and the access address of the digital identity blockchain.

[0145] After receiving the access request from the first network entity, the trust proxy smart contract can access the digital identity blockchain based on the access address to request the digital identity information of the first network entity. After obtaining the digital identity information of the first network entity, the trust proxy smart contract can also save the digital identity information of the first network entity to the trust proxy blockchain.

[0146] In addition, the trust proxy smart contract can also request the trust authentication smart contract to perform trusted access verification on the first network entity. The trust proxy smart contract can also request the identity authentication smart contract to perform trusted identity authentication on the first network entity. In the case where the digital identity information of the first network entity is saved to the trust proxy blockchain, the identity authentication smart contract can obtain the digital identity information of the first network entity from the trust proxy blockchain and perform trusted identity verification. Among them, please refer to the above-mentioned embodiment description of the trust authentication node set for the process of trusted access verification, and please refer to the above-mentioned embodiment description of the identity authentication node set for the process of trusted identity verification, which will not be elaborated in this disclosure.

[0147] Then, when both the access trusted verification and the identity trusted verification are passed, the authorization management smart contract can issue an access credential for the first network entity, and the first network entity can access the target network entity based on the access credential.

[0148] After receiving the access request from the first network entity, the target network entity may verify the access credentials in the access request through the digital identity blockchain. If the verification is successful, the target network entity responds to the access request from the first network entity.

[0149] In some implementation scenarios, the results of the above steps can also be saved in the trust proxy blockchain (such as the identity trusted verification results of the identity authentication smart contract, the access trusted verification results of the trust authentication smart contract, etc.) to facilitate subsequent auditing and tracing.

[0150] The above technical solution constructs a zero-trust system, in which the access entry of the network entity is the trust proxy smart contract, and the trusted verification of the network entity is performed by the identity authentication smart contract and the trust authentication smart contract. Since the smart contract is stored in the blockchain, it can ensure that the processing results of the trust proxy smart contract, the identity authentication smart contract and the trust authentication smart contract cannot be tampered with. In this way, the security and reliability of the blockchain zero-trust system can be improved.

[0151] Based on the same inventive concept, the present disclosure also provides a method for a blockchain zero-trust system, which can be applied to the blockchain zero-trust system described in any of the above embodiments. Figure 6 is a flowchart of a method for a blockchain zero-trust system shown in the present disclosure, referring to Figure 6 , the method comprising:

[0152] In step S61, upon receiving a first access request from a first network entity to a target network entity, the distributed trust proxy node set sends a trusted verification request to the distributed trusted verification node set, where the first network entity is any network entity among multiple network entities.

[0153] In step S62, the distributed trusted verification node set performs trusted verification on the first network entity in response to the trusted verification request.

[0154] Here, the trusted verification may include trusted identity verification. For example, in one possible implementation, the first access request also includes the second digital identity information obtained by the first network entity registered in the digital identity blockchain network, and the access address of the digital identity blockchain network, the distributed trusted verification node set includes an identity authentication node set, and the distributed trusted verification node set responds to the trusted verification request to perform trusted verification on the first network entity, including:

[0155] The identity authentication node set obtains the target digital identity information of the first network entity in response to the trusted verification request, and performs trusted identity verification on the identity of the first network entity through the target digital identity information;

[0156] Among them, the target digital identity information is the digital identity information of the first network entity stored in the blockchain of the digital identity blockchain network.

[0157] For example, the identity authentication node set can access the digital identity blockchain network based on the access address, thereby obtaining the target digital identity information of the first network entity from the digital identity blockchain network. The target digital identity information is the digital identity information of the first network entity stored in the blockchain of the digital identity blockchain network.

[0158] In this way, by comparing the acquired digital identity information and the second digital identity information in the first access request, the trusted identity verification of the first network entity can be achieved. For example, when the acquired target digital identity information is the same as the second digital identity information in the first access request, the trusted identity verification of the first network entity passes; when the acquired target digital identity information is different from the second digital identity information in the first access request, the trusted identity verification of the first network entity fails.

[0159] In addition, in some implementation scenarios, the first access request may further include a digital signature of the first network entity. Here, the digital signature may be generated based on a registered private key of the first network entity in the digital identity blockchain. In this case, the identity authentication node set may also obtain a registered public key of the first network entity from the digital identity blockchain, thereby verifying the digital signature through the registered public key.

[0160] In this way, after the identity trust verification is passed, the first network entity can access the target network entity.

[0161] It is worth noting that in the traditional CA authentication method, different CAs constitute different identity systems and cannot authenticate each other. For example, the identity authenticated by CA 1 cannot be authenticated by CA 2. The above technical solution can authenticate the identity through the digital identity of the first network entity, because the digital identity has a unified composition form and is registered in the digital identity blockchain. Therefore, compared with the traditional CA authentication method, the above technical solution can provide a unified and verifiable digital identity, thereby solving the problem in the existing authentication method that different identity systems cannot communicate with each other and cannot be uniformly verified.

[0162] In addition, the trusted verification may also include access trusted verification. For example, in a possible implementation, the distributed trusted verification node set also includes a trust authentication node set, and the distributed trusted verification node set performs trusted verification on the first network entity in response to the trusted verification request, including:

[0163] The trusted authentication node set obtains historical access data of the first network entity in response to the trusted verification request, and the trusted authentication node set determines historical access behavior of the first network entity according to the historical access data.

[0164] The trust authentication node set calculates the trust description parameter of the first network entity based on the historical access behavior and the trust weight parameters corresponding to various access behavior types;

[0165] The trust authentication node set performs access trustworthiness verification on the first network entity according to the trust description parameters and a preset trust authentication policy.

[0166] Optionally, the access behavior type is one or more types, the access behavior type includes multiple access behavior subcategories, and the trust weight parameter is determined in the following manner:

[0167] For multiple access behavior subcategories included in the same access behavior type, determine the access trust level of each access behavior subcategory;

[0168] Based on the access trust levels of multiple access behavior subcategories included in the same access behavior type, construct a fuzzy consistency matrix of the access behavior type;

[0169] The trust weight parameter of the access behavior type is calculated through the fuzzy consistency matrix.

[0170] Optionally, the trust authentication node set calculates the trust description parameter of the first network entity based on the historical access behavior and the trust weight parameters corresponding to various access behavior types, including:

[0171] The trusted authentication node set constructs an access behavior matrix of the first network entity based on the historical access behavior of the first network entity and the access behavior subcategory to which the historical access behavior belongs;

[0172] The trust authentication node set calculates the product of the access behavior matrix of the first network entity and the trust weight parameter to obtain a trust description matrix, wherein the trust description parameter includes the trust description matrix;

[0173] The trust authentication node set performs access trustworthiness verification on the first network entity according to the trust description parameter and a preset trust authentication policy, including:

[0174] The trust authentication node set calculates the determinant value of the trust description matrix to obtain the access trust of the first network entity; and determines whether the access behavior of the first network entity is trustworthy based on the access trust and a preset access trust interval.

[0175] For the implementation method of access to trusted verification, please refer to the above-mentioned blockchain zero-trust system embodiment. For the sake of brevity, this disclosure will not go into details.

[0176] The above technical solution can measure the access behavior of the first access entity based on the historical access behavior of the first network entity to obtain the access trust of the first network entity. In this way, it is possible to judge whether the access behavior of the first network entity is trustworthy by the access trust and the access trust interval. In this way, the first network entity can be trusted from the perspective of access behavior, thereby improving the dimension of network entity trustworthiness verification and helping to improve the recognition rate of untrustworthy network entities.

[0177] Then, after the access trust verification is passed, the first network entity can access the target network entity.

[0178] The above technical solution constructs a zero-trust system, in which the access entrance of the network entity is a distributed trust proxy node set, and the trusted verification of the network entity is performed by a distributed trusted verification node set. Since the distributed trust proxy node set and the distributed trusted verification node set are composed of multiple blockchain nodes in the blockchain network, it is possible to ensure that the processing results of the distributed trust proxy node set and the distributed trusted verification node set cannot be tampered with. In this way, the security and reliability of the blockchain zero-trust system can be improved.

[0179] Optionally, the blockchain zero-trust system further includes a distributed authorization management node set consisting of multiple blockchain nodes, the distributed authorization management node set is registered in the digital identity blockchain network, and the method further includes:

[0180] When the trusted verification passes, the distributed authorization management node set generates an access credential and sends the access credential to the first network entity, wherein the access credential includes an access address of the digital identity blockchain network and signature information generated by the distributed authorization management node set based on a private key registered in the digital identity blockchain network;

[0181] The first network entity sends a second access request to the target network entity, wherein the second access request includes the access credential;

[0182] After receiving the second access request, the target network entity obtains the first digital identity information of the distributed authorization management node set based on the access address, and verifies the access credential through the first digital identity information;

[0183] Wherein, when the access credential is verified successfully, the target network entity performs an operation corresponding to the second access request.

[0184] Optionally, it also includes:

[0185] The distributed trust proxy node forwards the first access request to the target network entity if the trusted verification passes.

[0186] Optionally, a trusted verification smart contract is deployed in the blockchain network, and the distributed trusted verification node set performs trusted verification on the first network entity in response to the trusted verification request, including:

[0187] The distributed trusted verification node set responds to the trusted verification request and performs trusted verification on the first network entity through the trusted verification smart contract.

[0188] Regarding the above method embodiment, the specific implementation method of each step has been described in detail in the system embodiment. Please refer to the description of the system component that executes the step for details, and will not be elaborated here.

[0189] In another exemplary embodiment, a computer program product is also provided, which includes a computer program that can be executed by a programmable device, and the computer program has a code portion for executing the above-mentioned method for a blockchain zero-trust system when executed by the programmable device.

[0190] The preferred embodiments of the present disclosure are described in detail above in conjunction with the accompanying drawings; however, the present disclosure is not limited to the specific details in the above embodiments. Within the technical concept of the present disclosure, a variety of simple modifications can be made to the technical solution of the present disclosure, and these simple modifications all fall within the protection scope of the present disclosure.

[0191] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present disclosure will not further describe various possible combinations.

[0192] In addition, various embodiments of the present disclosure may be arbitrarily combined, and as long as they do not violate the concept of the present disclosure, they should also be regarded as the contents disclosed by the present disclosure.

Claims

1. A blockchain zero-trust system, characterized in that: It includes a plurality of network entities, a distributed trust proxy node set consisting of a plurality of blockchain nodes in a blockchain network, and a distributed trusted verification node set consisting of a plurality of blockchain nodes, wherein any of the network entities accesses other network entities in the plurality of network entities through the distributed trust proxy node set; The distributed trust proxy node set is used to send a trusted verification request to the distributed trusted verification node set when receiving a first access request from a first network entity for a target network entity, wherein the first network entity is any network entity among the multiple network entities; The distributed trusted verification node set is used to perform trusted verification on the first network entity in response to the trusted verification request; Wherein, when the trusted verification passes, the first network entity accesses the target network entity; The distributed trust proxy node set is further used to forward the access request to the target network entity when the trusted verification passes; The blockchain zero-trust system also includes a distributed authorization management node set consisting of multiple blockchain nodes, and the distributed authorization management node set is registered in the digital identity blockchain network. The distributed authorization management node set is used to generate an access credential when the trusted verification passes, and send the access credential to the first network entity, wherein the access credential includes an access address of the digital identity blockchain network and signature information generated by the distributed authorization management node set based on a private key registered in the digital identity blockchain network; The first network entity is used to send a second access request to the target network entity, where the second access request includes the access credential; The target network entity is used to, after receiving the second access request, obtain the first digital identity information of the distributed authorization management node set based on the access address, and verify the access credential through the first digital identity information; Wherein, when the access credential is verified successfully, the target network entity performs an operation corresponding to the second access request.

2. The blockchain zero-trust system according to claim 1, characterized in that: A trusted verification smart contract is deployed in the blockchain network, and the distributed trusted verification node set is specifically used to perform trusted verification on the first network entity through the trusted verification smart contract.

3. The blockchain zero-trust system according to claim 1 or 2, characterized in that: The first access request also includes second digital identity information obtained by registering the first network entity in the digital identity blockchain network, and an access address of the digital identity blockchain network, and the distributed trusted verification node set includes an identity authentication node set. The identity authentication node set is used to, in response to the trusted verification request, obtain the target digital identity information of the first network entity, and perform trusted identity verification on the identity of the first network entity through the target digital identity information; Among them, the target digital identity information is the digital identity information of the first network entity stored in the blockchain of the digital identity blockchain network.

4. The blockchain zero-trust system according to claim 1 or 2, characterized in that: The distributed trusted verification node set also includes a trusted authentication node set, and the trusted authentication node set is used to perform the following steps: In response to the trusted verification request, acquiring historical access data of the first network entity; determining a historical access behavior of the first network entity according to the historical access data; Calculating a trust description parameter of the first network entity based on the historical access behavior and trust weight parameters corresponding to various access behavior types; Access trustworthiness verification is performed on the first network entity according to the trust description parameters and a preset trust authentication policy.

5. The blockchain zero-trust system according to claim 4, characterized in that: The access behavior type is one or more types, and the access behavior type includes multiple access behavior subcategories. The trust weight parameter is determined in the following manner: For multiple access behavior subcategories included in the same access behavior type, determine the access trust level of each access behavior subcategory; Based on the access trust levels of multiple access behavior subcategories included in the same access behavior type, construct a fuzzy consistency matrix of the access behavior type; The trust weight parameter of the access behavior type is calculated through the fuzzy consistency matrix.

6. The blockchain zero-trust system according to claim 5, characterized in that: The trust authentication node set specifically calculates the trust description parameter of the first network entity in the following manner: constructing an access behavior matrix of the first network entity based on the historical access behavior of the first network entity and the access behavior subcategory to which the historical access behavior belongs; Calculate the product of the access behavior matrix of the first network entity and the trust weight parameter to obtain a trust description matrix, wherein the trust description parameter includes the trust description matrix; The trust authentication node set specifically performs trustworthy verification on the first network entity in the following manner: calculating the determinant value of the trust description matrix to obtain the access trust of the first network entity; determining whether the access behavior of the first network entity is trustworthy based on the access trust and a preset access trust interval.

7. A method for a blockchain zero-trust system, characterized in that: Applied to the blockchain zero-trust system according to any one of claims 1 to 6, the method comprising: The distributed trust proxy node set sends a trusted verification request to the distributed trusted verification node set when receiving a first access request from a first network entity for a target network entity, wherein the first network entity is any network entity among the multiple network entities; The distributed trusted verification node set performs trusted verification on the first network entity in response to the trusted verification request; wherein, if the trusted verification passes, the first network entity accesses the target network entity; The distributed trust proxy node set forwards the access request to the target network entity when the trusted verification passes.

8. The method according to claim 7, characterized in that The blockchain zero-trust system further includes a distributed authorization management node set consisting of a plurality of blockchain nodes, the distributed authorization management node set being registered in a digital identity blockchain network, and the method further including: When the trusted verification passes, the distributed authorization management node set generates an access credential and sends the access credential to the first network entity, wherein the access credential includes an access address of the digital identity blockchain network and signature information generated by the distributed authorization management node set based on a private key registered in the digital identity blockchain network; The first network entity sends a second access request to the target network entity, wherein the second access request includes the access credential; After receiving the second access request, the target network entity obtains the first digital identity information of the distributed authorization management node set based on the access address, and verifies the access credential through the first digital identity information; Wherein, when the access credential is verified successfully, the target network entity performs an operation corresponding to the second access request.

Images