Cloud server access authentication method, device, equipment and storage medium

Abstract

The application provides a cloud server access authentication method and device, equipment and a storage medium. The method authenticates a public key of an authentication initiating node on a blockchain network, initiates an authentication request to a node to be authenticated, collects biological feature data of a user corresponding to the node to be authenticated, encrypts the biological feature data, the current time and the public key of the authentication initiating node through a public key of a second storage node, and sends the user identifier of the node to be authenticated to the authentication initiating node through the public key of the authentication initiating node. The authentication initiating node decrypts the encrypted user features through a private key of the authentication initiating node, obtains the user identifier of the node to be authenticated, queries the first storage node through the user identifier of the node to be authenticated, and obtains a storage address. The second storage node determines a feature comparison result according to the encrypted authentication features and the storage address. The authentication initiating node determines an authentication result according to the feature comparison result.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a cloud server access authentication method, apparatus, device and storage medium. Background Technology

[0002] Elastic Compute Service (ECS) is a simple, efficient, secure, reliable computing service with elastically scalable processing power. Its management is simpler and more efficient than that of physical servers. Users can quickly create or release any number of cloud servers without having to purchase hardware in advance.

[0003] During the use of cloud servers, user access authentication is required to ensure the security and reliability of computing services. Currently, authentication is typically achieved using user private keys or passwords. Existing technologies can also authenticate user identities using biometrics, which are stored directly on a server and retrieved during authentication.

[0004] However, existing blockchain-based cloud server access authentication methods are prone to leakage and loss of private keys, passwords, or biometric data used for authentication, resulting in low security for cloud server access authentication. Summary of the Invention

[0005] This application provides a cloud server access authentication method, apparatus, device, and storage medium to solve the technical problem of low security in cloud server access authentication in the prior art.

[0006] Firstly, this application provides a cloud server access authentication method, including:

[0007] The authentication initiating node publishes its public key on the blockchain network;

[0008] The authentication initiating node sends an authentication request to the node to be authenticated;

[0009] After receiving the authentication request, the node to be authenticated collects the biometric data of the user corresponding to the node to be authenticated, encrypts the biometric data, the current time, and the public key of the authentication initiating node using the public key of the second storage node to obtain encrypted authentication features, and encrypts the user identifier of the node to be authenticated using the public key of the authentication initiating node to obtain encrypted user features.

[0010] The node to be authenticated sends the encrypted authentication feature and the encrypted user feature to the authentication initiating node;

[0011] The authentication initiating node decrypts the encrypted user features using its private key to obtain the user identifier of the node to be authenticated. It then queries the first storage node using the user identifier of the node to be authenticated to obtain the storage address. The storage address is the address where the second storage node stores the pre-stored biometric data of the user corresponding to the node to be authenticated. The first storage node stores the user identifier of the user corresponding to the node to be authenticated and the storage address.

[0012] The authentication initiating node sends the storage address and the encryption authentication feature to the second storage node;

[0013] The second storage node determines the feature comparison result based on the encrypted authentication feature and the storage address, encrypts the feature comparison result using the public key of the authentication initiating node to obtain the encrypted matching result, and sends the encrypted matching result to the authentication initiating node;

[0014] The authentication initiating node performs identification processing on the encrypted matching result. If the identification is successful, the encrypted matching result is decrypted according to the private key of the authentication initiating node to obtain the feature comparison result, and the authentication result is determined according to the feature comparison result.

[0015] Here, the cloud server access authentication method provided in this application allows the authentication initiating node, as a public service provider, to publish its own public key. The node to be authenticated (the user) can use the public key of the authentication initiating node (service provider) as an identifier for the authentication initiating node, and simultaneously use this public key to encrypt the user identifier of the node to be authenticated. Only the correct authentication initiating node can decrypt and obtain the user identifier, thereby obtaining the storage address from the first storage node for subsequent authentication. To prevent inaccurate authentication initiating node identification, the public key of the authentication initiating node is used as an identification code, improving the accuracy of the authentication result and further enhancing the security of cloud server access authentication.

[0016] Optionally, the second storage node determines the feature comparison result based on the encrypted authentication feature and the storage address, including: the second storage node obtaining the pre-stored biometric data based on the storage address; the second storage node decrypting the encrypted authentication feature using its private key to obtain the biometric data, the current time, and the public key of the authentication initiating node; the second storage node performing time authentication on the current time, and if the authentication is successful, comparing the biometric data with the pre-stored biometric data to determine the feature comparison result.

[0017] In this application, the pre-stored biometric data used for comparison and verification is stored in a second storage node. The second storage node can perform user authentication based on the pre-stored biometric data and biometric data in the storage address, thereby achieving feature comparison and making the authentication secure and reliable.

[0018] Optionally, the authentication initiating node performs identification processing on the encrypted matching result, including: the authentication initiating node identifying whether the encrypted public key of the encrypted matching result is the public key of the authentication initiating node; if it is determined that the encrypted public key of the encrypted matching result is the public key of the authentication initiating node, then the identification is successful.

[0019] In this application, the authentication initiating node performs identification processing on the encrypted matching results to accurately identify whether they are matching results corresponding to the authentication initiating node, thereby improving the accuracy and security of authentication.

[0020] Optionally, before the node to be authenticated collects the biometric data of the user corresponding to the node to be authenticated after receiving the authentication request, the method further includes: the node to be authenticated obtaining the public key of the authentication initiating node through the blockchain network.

[0021] Optionally, before the authentication initiating node publishes its public key on the blockchain network, the method further includes:

[0022] The node to be authenticated registers its user identifier and pre-stored biometric data on the first and second storage nodes, and associates the first and second storage nodes through the storage address of the pre-stored biometric data.

[0023] Optionally, the node to be authenticated registers a user identifier and pre-stored biometric data on a first storage node and a second storage node, and associates the first storage node and the second storage node through the storage address of the pre-stored biometric data. This includes: the node to be authenticated uploading the pre-stored biometric data to the second storage node and obtaining the storage address of the second storage node where the pre-stored biometric data is stored; and the node to be authenticated sending the storage address and the user identifier of the node to be authenticated to the first storage node.

[0024] Here, this application is used for user nodes to pre-register their user identifiers and pre-stored biometric data on the first and second storage nodes, making it difficult for user node data to be stolen and improving authentication security.

[0025] Secondly, this application provides a cloud server access authentication device, comprising:

[0026] The public key publishing module is used to authenticate the initiating node to publish its public key on the blockchain network.

[0027] An authentication request initiation module is used by the authentication initiation node to initiate an authentication request to the node to be authenticated.

[0028] The first processing module is used to collect the biometric data of the user corresponding to the node to be authenticated after receiving the authentication request, encrypt the biometric data, the current time and the public key of the authentication initiating node with the public key of the second storage node to obtain encrypted authentication features, and encrypt the user identifier of the node to be authenticated with the public key of the authentication initiating node to obtain encrypted user features.

[0029] The first sending module is used for the node to be authenticated to send the encrypted authentication feature and the encrypted user feature to the authentication initiating node;

[0030] The second processing module is used by the authentication initiating node to decrypt the encrypted user features using its private key to obtain the user identifier of the node to be authenticated, and to perform a query on the first storage node using the user identifier of the node to be authenticated to obtain a storage address. The storage address is the address where the second storage node stores the pre-stored biometric data of the user corresponding to the node to be authenticated, and the first storage node stores the user identifier of the user corresponding to the node to be authenticated and the storage address.

[0031] The second sending module is used for the authentication initiating node to send the storage address and the encryption authentication feature to the second storage node;

[0032] The third processing module is used by the second storage node to determine the feature comparison result based on the encryption authentication feature and the storage address, encrypt the feature comparison result using the public key of the authentication initiating node to obtain the encryption matching result, and send the encryption matching result to the authentication initiating node.

[0033] The fourth processing module is used for the authentication initiating node to perform identification processing on the encrypted matching result. If the identification is successful, the encrypted matching result is decrypted according to the private key of the authentication initiating node to obtain the feature comparison result, and the authentication result is determined according to the feature comparison result.

[0034] Optionally, the third processing module is specifically used for:

[0035] The second storage node obtains the pre-stored biometric data according to the storage address; the second storage node decrypts the encrypted authentication feature using its private key to obtain the biometric data, the current time, and the public key of the authentication initiating node; the second storage node performs time authentication on the current time, and if the authentication is successful, it compares the biometric data with the pre-stored biometric data to determine the feature comparison result.

[0036] Optionally, the fourth processing module is specifically used for:

[0037] The authentication initiating node identifies whether the public key of the encryption matching result is the public key of the authentication initiating node; if it is determined that the public key of the encryption matching result is the public key of the authentication initiating node, then the identification is successful.

[0038] Optionally, before the first processing module collects the biometric data of the user corresponding to the node to be authenticated after receiving the authentication request, the above-mentioned device further includes:

[0039] The acquisition module is used by the node to be authenticated to obtain the public key of the authentication initiating node through the blockchain network.

[0040] Optionally, before the public key publishing module authenticates the initiating node's public key published on the blockchain network, the above apparatus further includes:

[0041] The registration module is used for the node to be authenticated to register user identifiers and pre-stored biometric data on the first storage node and the second storage node, and to associate the first storage node and the second storage node through the storage address of the pre-stored biometric data.

[0042] Optionally, the registration module is specifically used for:

[0043] The node to be authenticated uploads the pre-stored biometric data to the second storage node and obtains the storage address where the second storage node stores the pre-stored biometric data; the node to be authenticated sends the storage address and the user identifier of the node to be authenticated to the first storage node.

[0044] Thirdly, this application provides a cloud server access authentication device, including: at least one processor and a memory;

[0045] The memory stores computer-executed instructions;

[0046] The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the cloud server access authentication method as described in the first aspect and various possible designs of the first aspect.

[0047] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the cloud server access authentication method described in the first aspect and various possible designs of the first aspect.

[0048] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the cloud server access authentication method described in the first aspect and various possible designs of the first aspect.

[0049] The cloud server access authentication method, apparatus, device, and storage medium provided in this application allow the authentication initiating node, as a public service provider, to publish its own public key. The node to be authenticated can use the authentication initiating node's public key as an identifier for the initiating node, and simultaneously use this public key to encrypt the user identifier of the node to be authenticated. Only the correct authentication initiating node can decrypt and obtain the user identifier, thereby obtaining the storage address from the first storage node for subsequent authentication. To prevent inaccurate identification of the authentication initiating node, the authentication initiating node's public key is used as an identification code, improving the accuracy of the authentication result and further enhancing the security of cloud server access authentication. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This application provides a schematic diagram of a cloud server access authentication system architecture.

[0052] Figure 2 A flowchart illustrating a cloud server access authentication method provided in this application embodiment;

[0053] Figure 3 A flowchart illustrating another cloud server access authentication method provided in this application embodiment;

[0054] Figure 4 This is a schematic diagram of the structure of a cloud server access authentication device provided in an embodiment of this application;

[0055] Figure 5 This is a schematic diagram of the structure of a cloud server access authentication device provided in an embodiment of this application.

[0056] The accompanying drawings have illustrated specific embodiments of this disclosure, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concepts of this disclosure to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0057] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0058] The terms “first,” “second,” “third,” and “fourth,” etc. (if present), in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0059] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0060] Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Cloud servers often act as nodes in the blockchain to implement various functions. During the use of cloud servers, user access authentication is required to ensure the security and reliability of the computing service. Currently, authentication is typically achieved using the user's private key or password. Existing technologies can also authenticate user identity through biometrics, which are stored directly on a server and retrieved during authentication. However, existing blockchain-based cloud server access authentication methods are prone to leakage and loss of private keys, passwords, or biometrics, resulting in low security for cloud server access authentication.

[0061] To address the aforementioned technical issues, this application provides a cloud server access authentication method, apparatus, device, and storage medium. The authentication initiating node, as a public service provider, can publish its own public key. The node to be authenticated can use the authentication initiating node's public key as an identifier for the initiating node, and simultaneously use this public key to encrypt the user identifier of the node to be authenticated. Only the correct authentication initiating node can decrypt and obtain the user identifier, thereby obtaining the storage address from the first storage node for subsequent authentication.

[0062] Optionally, Figure 1 This is a schematic diagram of a cloud server access authentication system architecture provided in an embodiment of this application. Figure 1 As shown, the above architecture includes a node to be authenticated 101, a first storage node 102, a second storage node 103, and an authentication initiating node 104.

[0063] It is understandable that the number and specific structure of the aforementioned user nodes, first storage nodes, second storage nodes, and authentication initiation nodes can be determined based on actual circumstances. Figure 1 This is merely illustrative; the embodiments in this application do not impose a specific limitation on the number of nodes mentioned above.

[0064] All of the above nodes are registered in the blockchain, and any nodes in the blockchain can communicate with each other through the blockchain network.

[0065] The user node, the first storage node, the second storage node, and the authentication initiation node can be set on a server or a terminal device, or the user node, the first storage node, the second storage node, and the authentication initiation node can be the server or the terminal device itself.

[0066] It is understood that the structure illustrated in the embodiments of this application does not constitute a specific limitation on the architecture of the cloud server access authentication system. In other feasible embodiments of this application, the above architecture may include more or fewer components than illustrated, or combine some components, or split some components, or arrange different components, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown can be implemented in hardware, software, or a combination of both.

[0067] Furthermore, the network architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0068] The technical solutions of this application are described below using several embodiments as examples. The same or similar concepts or processes may not be repeated in some embodiments.

[0069] Figure 2 This is a flowchart illustrating a cloud server access authentication method provided in an embodiment of this application. This embodiment can be applied to... Figure 1 The cloud server access authentication system or its processor can be a server, a terminal device, or a system composed of multiple servers or terminal devices. The specific implementing entity can be determined based on the actual application scenario. Figure 2 As shown, the method includes the following steps:

[0070] S201: The authentication initiating node publishes its public key on the blockchain network.

[0071] S202: The authentication initiating node sends an authentication request to the node to be authenticated.

[0072] S203: After receiving the authentication request, the node to be authenticated collects the biometric data of the user corresponding to the node to be authenticated, encrypts the biometric data, the current time, and the public key of the authentication initiating node using the public key of the second storage node to obtain the encrypted authentication feature, and encrypts the user identifier of the node to be authenticated using the public key of the authentication initiating node to obtain the encrypted user feature.

[0073] In one possible implementation, the node to be authenticated first collects its own biometric data, FingerPrint1', and encrypts it together with the current time T0 and the public key PKIsp of the authentication initiating node using the public key PKb of a second storage node to obtain the encrypted authentication feature Enc(FingerPrint1', T0, PKIsp). The node to be authenticated then encrypts its own user identifier ID1 using the public key of the authentication initiating node and sends it along with the encrypted authentication feature Enc(FingerPrint1', T0, PKIsp) to the authentication initiating node.

[0074] Optionally, before collecting the biometric data of the user corresponding to the node to be authenticated after receiving the authentication request, the method further includes: the node to be authenticated obtaining the public key of the authentication initiating node through the blockchain network.

[0075] S204: The node to be authenticated sends the encrypted authentication feature and encrypted user feature to the authentication initiating node.

[0076] S205: The authentication initiating node decrypts the encrypted user characteristics using its private key to obtain the user identifier of the node to be authenticated. It then uses the user identifier of the node to be authenticated to query the first storage node and obtain the storage address.

[0077] In one possible implementation, the authentication initiating node uses its own private key to decrypt and obtain the extraction ID1, and then uses ID1 to query the first storage node to obtain the DataID. The DataID and Enc(FingerPrint1', T0, PKIsp) are then sent to the second intermediate node.

[0078] The storage address is the address where the second storage node stores the pre-stored biometric data of the user corresponding to the node to be authenticated, and the first storage node stores the user identifier and storage address of the user corresponding to the node to be authenticated.

[0079] S206: The authentication initiating node sends the storage address and encryption authentication features to the second storage node.

[0080] S207: The second storage node determines the feature comparison result based on the encryption authentication feature and the storage address, encrypts the feature comparison result using the public key of the authentication initiating node to obtain the encryption matching result, and sends the encryption matching result to the authentication initiating node.

[0081] Optionally, the second storage node determines the feature comparison result based on the encrypted authentication features and the storage address, including: the second storage node obtains the pre-stored biometric data based on the storage address; the second storage node decrypts the encrypted authentication features using its private key to obtain the biometric data, the current time, and the public key of the authentication initiating node; the second storage node performs time authentication on the current time, and if the authentication is successful, it compares the biometric data with the pre-stored biometric data to determine the feature comparison result.

[0082] In one possible implementation, the second storage node decrypts using its private key to obtain FingerPrint1', T0, and PKISP. First, it checks if T0 is within the allowed time frame relative to the current time. Then, it retrieves FingerPrint1 using DataID, compares it with FingerPrint1', encrypts the matching result using the service provider's public key, signs it with the second storage node's public key, and returns it to the authentication initiating node.

[0083] In this embodiment of the application, the pre-stored biometric data used for comparison and verification is stored in a second storage node. The second storage node can perform user identity authentication based on the pre-stored biometric data and biometric data in the storage address, thereby achieving feature comparison and making the authentication secure and reliable.

[0084] S208: The authentication initiating node performs identification processing on the encrypted matching result. If the identification is successful, the encrypted matching result is decrypted according to the private key of the authentication initiating node to obtain the feature comparison result, and the authentication result is determined according to the feature comparison result.

[0085] Optionally, the authentication initiating node performs identification processing on the encryption matching result, including: the authentication initiating node identifying whether the encryption public key of the encryption matching result is the public key of the authentication initiating node; if it is determined that the encryption public key of the encryption matching result is the public key of the authentication initiating node, then the identification is successful.

[0086] In this embodiment, the authentication initiating node performs identification processing on the encrypted matching result, thereby accurately identifying whether it is a matching result corresponding to the authentication initiating node, thus improving the accuracy and security of authentication.

[0087] Here, the cloud server access authentication method provided in this application embodiment allows the authentication initiating node, as a public service provider, to publish its own public key. The node to be authenticated (user) can use the public key of the authentication initiating node (service provider) as an identifier for the authentication initiating node, and simultaneously use this public key to encrypt the user identifier of the node to be authenticated. Only the correct authentication initiating node can decrypt and obtain the user identifier, thereby obtaining the storage address from the first storage node for subsequent authentication. To prevent inaccurate authentication initiating node identification, the public key of the authentication initiating node is used as an identification code, improving the accuracy of the authentication result and further enhancing the security of cloud server access authentication.

[0088] Optionally, the user nodes in this embodiment of the application may also be pre-registered with features, and accordingly, Figure 3 This is a flowchart illustrating another cloud server access authentication method provided in an embodiment of this application, as shown below. Figure 3 As shown, the method includes:

[0089] S301: The node to be authenticated registers user identifiers and pre-stored biometric data on the first and second storage nodes, and associates the first and second storage nodes through the storage address of the pre-stored biometric data.

[0090] Optionally, the node to be authenticated registers its user identifier and pre-stored biometric data on the first and second storage nodes, and associates the first and second storage nodes through the storage address of the pre-stored biometric data. This includes: the node to be authenticated uploading the pre-stored biometric data to the second storage node and obtaining the storage address of the second storage node where the pre-stored biometric data is stored; and the node to be authenticated sending the storage address and its user identifier to the first storage node.

[0091] S302: The authentication initiating node publishes its public key on the blockchain network.

[0092] S303: The authentication initiating node sends an authentication request to the node to be authenticated.

[0093] S304: After receiving the authentication request, the node to be authenticated collects the biometric data of the user corresponding to the node to be authenticated, encrypts the biometric data, the current time, and the public key of the authentication initiating node using the public key of the second storage node to obtain the encrypted authentication feature, and encrypts the user identifier of the node to be authenticated using the public key of the authentication initiating node to obtain the encrypted user feature.

[0094] S305: The node to be authenticated sends the encrypted authentication feature and encrypted user feature to the authentication initiating node.

[0095] S306: The authentication initiating node decrypts the encrypted user characteristics using its private key to obtain the user identifier of the node to be authenticated. It then uses the user identifier of the node to be authenticated to query the first storage node and obtain the storage address.

[0096] The storage address is the address where the second storage node stores the pre-stored biometric data of the user corresponding to the node to be authenticated, and the first storage node stores the user identifier and storage address of the user corresponding to the node to be authenticated.

[0097] S307: The authentication initiating node sends the storage address and encryption authentication features to the second storage node.

[0098] S308: The second storage node determines the feature comparison result based on the encryption authentication feature and the storage address, encrypts the feature comparison result using the public key of the authentication initiating node to obtain the encryption matching result, and sends the encryption matching result to the authentication initiating node.

[0099] S309: The authentication initiating node performs identification processing on the encrypted matching result. If the identification is successful, the encrypted matching result is decrypted according to the private key of the authentication initiating node to obtain the feature comparison result, and the authentication result is determined according to the feature comparison result.

[0100] The implementation methods of steps S302-S309 are similar to those of steps S201-S208, and will not be described in detail here.

[0101] Here, this application is used for user nodes to pre-register their user identifiers and pre-stored biometric data on the first and second storage nodes, making it difficult for user node data to be stolen and improving authentication security.

[0102] This application also provides a cloud server access authentication device.

[0103] Figure 4 This application provides a schematic diagram of the structure of a cloud server access authentication device, applied to a user node, such as... Figure 4As shown, the apparatus in this embodiment includes: a public key publishing module 401, an authentication request initiation module 402, a first processing module 403, a first sending module 404, a second processing module 405, a second sending module 406, a third processing module 407, and a fourth processing module 408. The cloud server access authentication device here can be a server or a terminal device, or a chip or integrated circuit that implements the functions of a server or terminal device. It should be noted that the division of the public key publishing module 401, authentication request initiation module 402, first processing module 403, first sending module 404, second processing module 405, second sending module 406, third processing module 407, and fourth processing module 408 is only a logical functional division; physically, any two can be integrated or independent.

[0104] Among them, the public key publishing module 401 is used for the authentication initiating node to publish the public key of the authentication initiating node on the blockchain network;

[0105] The authentication request initiation module 402 is used by the authentication initiation node to initiate an authentication request to the node to be authenticated.

[0106] The first processing module 403 is used to collect the biometric data of the user corresponding to the node to be authenticated after receiving the authentication request, encrypt the biometric data, the current time and the public key of the authentication initiating node with the public key of the second storage node to obtain the encrypted authentication feature, and encrypt the user identifier of the node to be authenticated with the public key of the authentication initiating node to obtain the encrypted user feature.

[0107] The first sending module 404 is used for the node to be authenticated to send the encrypted authentication feature and the encrypted user feature to the authentication initiating node;

[0108] The second processing module 405 is used for the authentication initiating node to decrypt the encrypted user features using the authentication initiating node's private key to obtain the user identifier of the node to be authenticated, and to perform a query on the first storage node using the user identifier of the node to be authenticated to obtain the storage address. The storage address is the address where the second storage node stores the pre-stored biometric data of the user corresponding to the node to be authenticated, and the first storage node stores the user identifier and storage address of the user corresponding to the node to be authenticated.

[0109] The second sending module 406 is used for the authentication initiating node to send the storage address and encryption authentication features to the second storage node;

[0110] The third processing module 407 is used by the second storage node to determine the feature comparison result based on the encryption authentication feature and the storage address, encrypt the feature comparison result with the public key of the authentication initiating node to obtain the encryption matching result, and send the encryption matching result to the authentication initiating node.

[0111] The fourth processing module 408 is used for the authentication initiating node to perform identification processing on the encrypted matching result. If the identification is successful, the encrypted matching result is decrypted according to the private key of the authentication initiating node to obtain the feature comparison result, and the authentication result is determined according to the feature comparison result.

[0112] Optionally, the third processing module 407 is specifically used for:

[0113] The second storage node retrieves pre-stored biometric data based on the storage address; the second storage node decrypts the encrypted authentication features using its private key to obtain the biometric data, the current time, and the public key of the authentication initiating node; the second storage node performs time authentication on the current time, and if the authentication is successful, it compares the biometric data with the pre-stored biometric data to determine the feature comparison result.

[0114] Optionally, the fourth processing module 408 is specifically used for:

[0115] The authentication initiating node identifies whether the public key of the encryption matching result is the public key of the authentication initiating node; if it is determined that the public key of the encryption matching result is the public key of the authentication initiating node, then the identification is successful.

[0116] Optionally, before the first processing module 403 collects the biometric data of the user corresponding to the node to be authenticated after receiving the authentication request, the above-mentioned device further includes:

[0117] The acquisition module is used by the node to be authenticated to obtain the public key of the authentication initiating node through the blockchain network.

[0118] Optionally, before the public key publishing module 401 publishes the public key of the authentication initiating node on the blockchain network, the above-mentioned apparatus further includes:

[0119] The registration module is used for nodes to be authenticated to register user identifiers and pre-stored biometric data on the first and second storage nodes, and to associate the first and second storage nodes through the storage address of the pre-stored biometric data.

[0120] Optionally, the registration module is specifically used for:

[0121] The node to be authenticated uploads the pre-stored biometric data to the second storage node and obtains the storage address where the second storage node stores the pre-stored biometric data; the node to be authenticated sends the storage address and the user identifier of the node to be authenticated to the first storage node.

[0122] This application also provides a cloud server access authentication device.

[0123] refer to Figure 5 The diagram illustrates a structure suitable for implementing an embodiment of the present disclosure of a cloud server access authentication device 500, which can be a terminal device or a server. The terminal device can include, but is not limited to, mobile terminals such as mobile phones, laptops, digital radio receivers, personal digital assistants (PDAs), portable Android devices (PADs), portable media players (PMPs), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 5 The cloud server access authentication device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments disclosed herein.

[0124] like Figure 5 As shown, the cloud server access authentication device 500 may include a processing unit (such as a central processing unit, graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 502 or a program loaded from storage device 508 into random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of the cloud server access authentication device 500. The processing unit 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0125] Typically, the following devices can be connected to I / O interface 505: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 508 including, for example, magnetic tapes, hard drives, etc.; and communication devices 509. Communication device 509 allows the cloud server to connect to authentication device 500 and other devices to exchange data wirelessly or via wired communication. Although... Figure 5 A cloud server access authentication device 500 with various devices is shown; however, it should be understood that implementation or possession of all the devices shown is not required. More or fewer devices may be implemented alternatively.

[0126] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, it performs the functions defined in the methods of embodiments of this disclosure.

[0127] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0128] The aforementioned computer-readable medium may be included in the aforementioned cloud server access authentication device; or it may exist independently and not be assembled into the cloud server access authentication device.

[0129] The aforementioned computer-readable medium carries one or more programs, which, when executed by the cloud server access authentication device, cause the cloud server access authentication device to perform the method shown in the above embodiments.

[0130] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0131] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the cloud server access authentication method described above.

[0132] This application also provides a computer program product, including a computer program, which, when executed by a processor, is used to implement the cloud server access authentication method described above.

[0133] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0134] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0135] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the application disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0136] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A cloud server access authentication method, characterized by, The method comprises the following steps: An authentication initiating node publishes a public key of the authentication initiating node on a blockchain network; The authentication initiating node initiates an authentication request to a node to be authenticated; After receiving the authentication request, the node to be authenticated collects biological feature data of a user corresponding to the node to be authenticated, encrypts the biological feature data, a current time and the public key of the authentication initiating node through a public key of a second storage node to obtain encrypted authentication features, and encrypts a user identifier of the user of the node to be authenticated through the public key of the authentication initiating node to obtain encrypted user features; The node to be authenticated sends the encrypted authentication features and the encrypted user features to the authentication initiating node; The authentication initiating node decrypts the encrypted user features through a private key of the authentication initiating node to obtain the user identifier of the node to be authenticated, and performs query processing on a first storage node through the user identifier to obtain a storage address, wherein the storage address is an address at which the second storage node stores pre-stored biological feature data of the user corresponding to the node to be authenticated, and the first storage node stores the user identifier of the user corresponding to the node to be authenticated and the storage address; The authentication initiating node sends the storage address and the encrypted authentication features to the second storage node; The second storage node determines a feature comparison result according to the encrypted authentication features and the storage address, encrypts the feature comparison result through the public key of the authentication initiating node to obtain an encrypted matching result, and sends the encrypted matching result to the authentication initiating node; The authentication initiating node performs identification recognition processing on the encrypted matching result, and if the recognition is successful, decrypts the encrypted matching result through the private key of the authentication initiating node to obtain the feature comparison result, and determines an authentication result according to the feature comparison result.

2. The method of claim 1, wherein, The second storage node determines a feature comparison result according to the encrypted authentication features and the storage address, comprising: The second storage node acquires the pre-stored biological feature data according to the storage address; The second storage node decrypts the encrypted authentication features through a private key of the second storage node to obtain the biological feature data, the current time and the public key of the authentication initiating node; The second storage node performs time authentication on the current time, and if the authentication is passed, compares the biological feature data with the pre-stored biological feature data to determine a feature comparison result.

3. The method of claim 1, wherein, The authentication initiating node performs identification recognition processing on the encrypted matching result, comprising: The authentication initiating node identifies whether an encryption public key of the encrypted matching result is the public key of the authentication initiating node; If it is determined that the encryption public key of the encrypted matching result is the public key of the authentication initiating node, it is determined that the recognition is successful.

4. The method according to any one of claims 1 to 3, characterized in that, Before the node to be authenticated collects biological feature data of a user corresponding to the node to be authenticated after receiving the authentication request, the method further comprises the following step: The node to be authenticated acquires the public key of the authentication initiating node through the blockchain network.

5. The method according to any one of claims 1 to 3, characterized in that, Before the authentication initiating node publishes the public key of the authentication initiating node on the blockchain network, further comprising: The to-be-authenticated node registers a user identifier and pre-stored biometric data at the first storage node and the second storage node, and associates the first storage node and the second storage node through a storage address of the pre-stored biometric data.

6. The method of claim 5, wherein, The to-be-authenticated node registers a user identifier and pre-stored biometric data at the first storage node and the second storage node, and associates the first storage node and the second storage node through a storage address of the pre-stored biometric data. The to-be-authenticated node uploads the pre-stored biometric data to the second storage node and obtains a storage address at which the second storage node saves the pre-stored biometric data; The to-be-authenticated node sends the storage address and the user identifier of the to-be-authenticated node to the first storage node.

7. A cloud server access authentication apparatus characterized by comprising: Comprise: A public key publishing module for publishing the public key of the authentication initiating node on the blockchain network by the authentication initiating node; An authentication request initiating module for initiating an authentication request by the authentication initiating node to the to-be-authenticated node; A first processing module for collecting biometric data of a user corresponding to the to-be-authenticated node after the to-be-authenticated node receives the authentication request, encrypting the biometric data, the current time, and the public key of the authentication initiating node through the public key of the second storage node to obtain encrypted authentication features, and encrypting the user identifier of the to-be-authenticated node through the public key of the authentication initiating node to obtain encrypted user features; A first sending module for sending the encrypted authentication features and the encrypted user features to the authentication initiating node by the to-be-authenticated node; A second processing module for decrypting the encrypted user features through the private key of the authentication initiating node to obtain the user identifier of the to-be-authenticated node, and querying the first storage node through the user identifier of the to-be-authenticated node to obtain a storage address, wherein the storage address is an address at which the second storage node saves pre-stored biometric data of a user corresponding to the to-be-authenticated node, and the first storage node saves the user identifier of the user corresponding to the to-be-authenticated node and the storage address; A second sending module for sending the storage address and the encrypted authentication features to the second storage node by the authentication initiating node; A third processing module for determining a feature comparison result according to the encrypted authentication features and the storage address by the second storage node, encrypting the feature comparison result through the public key of the authentication initiating node to obtain an encrypted matching result, and sending the encrypted matching result to the authentication initiating node; A fourth processing module for performing identification recognition processing on the encrypted matching result by the authentication initiating node, and if the recognition is successful, performing decryption processing on the encrypted matching result according to the private key of the authentication initiating node to obtain the feature comparison result, and determining an authentication result according to the feature comparison result.

8. A cloud server access authentication device, characterized by, Comprise: At least one processor; And A memory in communication connection with the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the cloud server access authentication method of any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the cloud server access authentication method of any one of claims 1 to 6.

Images