Cross-domain authentication method and system

Abstract

The present application relates to the field of cross-domain authentication, and provides a cross-domain authentication method and system. The method includes: downloading and authenticating the information of the first trust domain from the blockchain; issuing a trust certificate for the information of the first trust domain, and uploading the trust certificate to the blockchain; receiving the information to be processed sent by the first trust domain; and verifying the information to be processed using the information of the first trust domain and the information of the second trust domain. The cross-domain authentication method and system provided in the embodiment of the present application can decentralized store the privacy information in the interaction process when two domains belonging to different systems interact with each other, ensure the security of the interaction information, and realize cross-domain trusted authentication.

Description

Technical Field

[0001] The present application relates to the field of cross-domain authentication technology, and in particular to a cross-domain authentication method and system. Background Art

[0002] At present, a large number of systems are built on the Public Key Infrastructure (PKI) and Identity-Based Cryptograph (IBC) systems. When a domain based on the IBC system needs to interact with a domain based on the PKI system, the mutual trust between the two cannot be guaranteed because they have independent trust systems. However, data sharing and collaboration in a distributed environment have high requirements for security, privacy protection and efficiency. Therefore, if the two systems do not trust each other, direct cross-domain mutual recognition cannot be achieved. Summary of the invention

[0003] The embodiments of the present application provide a cross-domain authentication method and system to solve the technical problem that direct cross-domain mutual recognition cannot be achieved when two systems do not trust each other.

[0004] In a first aspect, an embodiment of the present application provides a cross-domain authentication method, which is applied to a second trust domain, including:

[0005] Download and authenticate the information of the first trust domain from the blockchain;

[0006] issuing a trust certificate for the information of the first trust domain, and uploading the trust certificate to the blockchain;

[0007] receiving information to be processed sent by the first trust domain;

[0008] The information to be processed is verified using the information of the first trust domain and the information of the second trust domain.

[0009] In one embodiment, if the first trust domain belongs to a PKI system, and the second trust domain belongs to an IBC system, the information of the first trust domain includes a system root certificate of the first trust domain;

[0010] If the first trust domain belongs to an IBC system, and the second trust domain belongs to a PKI system, the information of the first trust domain includes a system master public key of the first trust domain;

[0011] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the IBC system, the information of the first trust domain includes the system master public key of the first trust domain.

[0012] In one embodiment, if the first trust domain belongs to a PKI system and the second trust domain belongs to an IBC system, the information to be processed includes a signature value and the trust credential;

[0013] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the PKI system, the information to be processed includes the signature value and the identity identifier of the first trust domain;

[0014] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the IBC system, the information to be processed includes the signature value and the trust credential;

[0015] The signature value is generated after the first trust domain signs the information to be sent.

[0016] In one embodiment, if the first trust domain belongs to an IBC system and the second trust domain belongs to a PKI system, before verifying the information to be processed by using the information of the first trust domain and the information of the second trust domain, the method includes:

[0017] The trust credential is queried using the identity identifier of the first trust domain.

[0018] In one embodiment, the verifying the information to be processed by using the information of the first trust domain and the information of the second trust domain includes:

[0019] If the first trust domain belongs to the PKI system, and the second trust domain belongs to the IBC system, the legitimacy of the trust credential is verified using the identity identifier of the second trust domain, and the legitimacy of the signature value is verified using the system root certificate;

[0020] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the PKI system, the legitimacy of the trust credential is verified using the identity identifier of the second trust domain, and the legitimacy of the signature value is verified using the IBC signature verification mechanism and the system master public key;

[0021] If the first trust domain belongs to the IBC system and the second trust domain belongs to the IBC system, the legitimacy of the trust credential is verified using the identity identifier of the second trust domain, and the legitimacy of the signature value is verified using the system master public key.

[0022] In a second aspect, an embodiment of the present application provides a cross-domain authentication method, which is applied to a first trust domain, including:

[0023] Upload the information of the first trust domain to the blockchain;

[0024] Downloading from the blockchain a trust certificate issued by a second trust domain for information of the first trust domain;

[0025] Generate and send the information to be processed to the second trust domain so that the second trust domain can perform cross-domain authentication.

[0026] In one embodiment, if the first trust domain belongs to a PKI system, and the second trust domain belongs to an IBC system, the information of the first trust domain includes a system root certificate of the first trust domain;

[0027] If the first trust domain belongs to an IBC system, and the second trust domain belongs to a PKI system, the information of the first trust domain includes a system master public key of the first trust domain;

[0028] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the IBC system, the information of the first trust domain includes the system master public key of the first trust domain.

[0029] In one embodiment, if the first trust domain belongs to an IBC system and the second trust domain belongs to a PKI system, then after downloading the trust certificate issued by the second trust domain for the information of the first trust domain from the blockchain, the steps include:

[0030] The trust credential is issued.

[0031] In one embodiment, the generating and sending the to-be-processed information to the second trust domain includes:

[0032] If the first trust domain belongs to the PKI system, and the second trust domain belongs to the IBC system, signing the information to be sent, generating a signature value, and sending the signature value and the trust certificate as the information to be processed to the second trust domain;

[0033] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the PKI system, signing the information to be sent, generating a signature value, and sending the signature value and the identity identifier of the first trust domain as the information to be processed to the second trust domain;

[0034] If the first trust domain belongs to the IBC system and the second trust domain belongs to the IBC system, the information to be sent is signed to generate a signature value, and the signature value and the trust certificate are sent to the second trust domain as the information to be processed.

[0035] In a third aspect, an embodiment of the present application provides a cross-domain authentication system, including:

[0036] a first trust domain and a second trust domain;

[0037] The first trust domain is used for:

[0038] Upload the information of the first trust domain to the blockchain;

[0039] Downloading from the blockchain a trust certificate issued by a second trust domain for information of the first trust domain;

[0040] Generate and send the information to be processed to the second trust domain so that the second trust domain can perform cross-domain authentication;

[0041] The second trust domain is used for:

[0042] Download and authenticate the information of the first trust domain from the blockchain;

[0043] issuing a trust certificate for the information of the first trust domain, and uploading the trust certificate to the blockchain;

[0044] receiving information to be processed sent by the first trust domain;

[0045] The information to be processed is verified using the information of the first trust domain and the information of the second trust domain.

[0046] The cross-domain authentication method and system provided by the embodiment of the present application, the second trust domain downloads and authenticates the information of the first trust domain from the blockchain, then issues a trust certificate for the information of the first trust domain, and uploads the trust certificate to the blockchain, then receives the pending information sent by the first trust domain, and uses the information of the first trust domain and the information of the second trust domain to verify the pending information. When the first trust domain and the second trust domain belong to different cryptographic systems, since data sharing and collaboration in a distributed environment have high requirements for security, privacy protection and efficiency, therefore, the information interaction between two domains belonging to different systems requires the introduction of a third-party identity / certificate management system, decentralized storage of a large amount of private identity information in the two systems, and the two systems have strong trust in the third-party identity / certificate management system. The present application introduces a blockchain, which can decentralized store the private information in the interaction process when two domains belonging to different systems interact with each other, ensure the security of the interactive information, and realize cross-domain trusted authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0048] Figure 1This is one of the flow charts of the cross-domain authentication method provided in the embodiment of the present application;

[0049] Figure 2 It is a schematic diagram of the IBC system trust PKI system in the cross-domain authentication method provided in the embodiment of the present application;

[0050] Figure 3 It is a schematic diagram of the PKI system trust IBC system in the cross-domain authentication method provided in the embodiment of the present application;

[0051] Figure 4 It is a schematic diagram of internal trust of the IBC system in the cross-domain authentication method provided in the embodiment of the present application;

[0052] Figure 5 This is the second flow chart of the cross-domain authentication method provided in the embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0054] Figure 1 This is one of the flow charts of the cross-domain authentication method provided in the embodiment of the present application; refer to Figure 1 The embodiment of the present application provides a cross-domain authentication method, which is applied to the second trust domain and may include:

[0055] 101. Download and authenticate information of the first trust domain from the blockchain;

[0056] 102. Issue a trust certificate for the information of the first trust domain, and upload the trust certificate to the blockchain;

[0057] 103. Receive information to be processed sent by the first trust domain;

[0058] 104. Verify the information to be processed using the information of the first trust domain and the information of the second trust domain.

[0059] In step 102, a trust certificate may be issued for the information of the first trust domain using the signature private key of the second trust domain.

[0060] It should be noted that the first trust domain and the second trust domain may belong to the same cryptographic system or different cryptographic systems, which is not limited here. In this embodiment, the first trust domain and the second trust domain may have the following three situations:

[0061] Case 1: The first trust domain belongs to the PKI system, and the second trust domain belongs to the IBC system;

[0062] Case 2: The first trust domain belongs to the IBC system, and the second trust domain belongs to the PKI system;

[0063] The third case: the first trust domain belongs to the IBC system, and the second trust domain belongs to the IBC system.

[0064] Among them, the PKI system usually uses multi-level certificates for identity management and is widely used in various mainstream business systems; the IBC system performs encryption and decryption based on user identity information, and users can complete cryptographic authentication without having to store the corresponding public and private keys separately.

[0065] When the first trust domain belongs to the IBC system and the second trust domain belongs to the IBC system, since both the first trust domain and the second trust domain belong to the IBC system, the information interaction between the two trust domains already has a high degree of trust. However, data sharing and collaboration in a distributed environment have high requirements for security, privacy protection and efficiency. Therefore, this embodiment introduces blockchain to store privacy information in a decentralized manner during information interaction between two different domains, thereby further improving the security of the interactive information and achieving more reliable cross-domain authentication.

[0066] In the cross-domain authentication method provided in this embodiment, the second trust domain downloads and authenticates the information of the first trust domain from the blockchain, then issues a trust certificate for the information of the first trust domain, and uploads the trust certificate to the blockchain, then receives the pending information sent by the first trust domain, and uses the information of the first trust domain and the information of the second trust domain to verify the pending information. When the first trust domain and the second trust domain belong to different cryptographic systems, since data sharing and collaboration in a distributed environment have high requirements for security, privacy protection and efficiency, the information interaction between two domains belonging to different systems requires the introduction of a third-party identity / certificate management system, which decentrally stores a large amount of private identity information in the two systems, and the two systems have strong trust in the third-party identity / certificate management system. This embodiment introduces a blockchain, which can decentrally store the private information in the interaction process when two domains belonging to different systems interact with each other, ensure the security of the interactive information, and realize cross-domain trusted authentication.

[0067] Figure 2 It is a schematic diagram of the IBC system trust PKI system in the cross-domain authentication method provided in the embodiment of the present application;

[0068] The first trust domain uploads its own identity and system root certificate to the blockchain. After the second trust domain downloads the identity and system root certificate, it issues a trust certificate for the identity and system root certificate and uploads the trust certificate to the blockchain. After the first trust domain downloads the trust certificate from the blockchain, it signs the information to be sent, generates a signature value, and sends the signature value and the trust certificate to the second trust domain for the second trust domain to perform cross-domain authentication.

[0069] Figure 3 It is a schematic diagram of the PKI system trust IBC system in the cross-domain authentication method provided in the embodiment of the present application;

[0070] The first trust domain uploads its own identity and system master public key to the blockchain. After the second trust domain downloads the identity and system master public key, it issues a trust certificate for the identity and system master public key and uploads the trust certificate to the blockchain. After the first trust domain downloads and publishes the trust certificate from the blockchain, it signs the information to be sent, generates a signature value, and sends the signature value and its own identity to the second trust domain for cross-domain authentication by the second trust domain.

[0071] Figure 4 It is a schematic diagram of internal trust of the IBC system in the cross-domain authentication method provided in the embodiment of the present application;

[0072] The first trust domain uploads its own identity and system master public key to the blockchain. After the second trust domain downloads the identity and system master public key, it issues a trust certificate for the identity and system master public key, and uploads the trust certificate to the blockchain. After the first trust domain downloads the trust certificate from the blockchain, it signs the information to be sent, generates a signature value, and sends the signature value and the trust certificate to the second trust domain for the second trust domain to perform cross-domain authentication.

[0073] Reference Figure 1-Figure 4 , in one embodiment, if the first trust domain belongs to a PKI system, and the second trust domain belongs to an IBC system, the information of the first trust domain includes a system root certificate of the first trust domain;

[0074] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the PKI system, the information of the first trust domain includes the system master public key of the first trust domain;

[0075] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the IBC system, the information of the first trust domain includes the system master public key of the first trust domain.

[0076] It should be noted that, in the above three cases, the information of the first trust domain may also include an identity identifier of the first trust domain.

[0077] In this embodiment, the content included in the information of the first trust domain is limited according to the different systems to which the first trust domain and the second trust domain belong, which helps to use different information of the first trust domain to perform cross-domain authentication in a targeted manner according to different situations later.

[0078] Reference Figure 1-Figure 4 In one embodiment, if the first trust domain belongs to the PKI system and the second trust domain belongs to the IBC system, the information to be processed includes a signature value and a trust credential. In this case, a specific node in the second trust domain may receive a signature value and a trust credential sent by a specific node in the first trust domain, and the signature value is generated by the specific node in the first trust domain after signing the information to be sent;

[0079] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the PKI system, the information to be processed includes the signature value and the identity of the first trust domain. In this case, a specific node in the second trust domain may receive the signature value and the identity of the first trust domain sent by a specific node in the first trust domain, and the signature value is generated after the specific node in the first trust domain signs the information to be sent;

[0080] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the IBC system, the information to be processed includes a signature value and a trust credential. In this case, a specific node in the second trust domain may receive the signature value and the trust credential sent by a specific node in the first trust domain. The signature value is generated by the specific node in the first trust domain after signing the information to be sent.

[0081] It should be noted that when the first trust domain belongs to the PKI system and the second trust domain belongs to the IBC system, or when the first trust domain belongs to the IBC system and the second trust domain belongs to the IBC system, the second trust domain can also accept the query request sent by the first trust domain, and query the trust status of the first trust domain in the trust domain of the second trust domain itself, and use the identity of the second trust domain to verify the legitimacy of the trust status, without receiving the trust certificate sent by the first trust domain.

[0082] This embodiment limits the content of the information to be processed according to the different systems to which the first trust domain and the second trust domain belong, which helps to use different information to be processed for cross-domain authentication in a targeted manner according to different situations. At the same time, it can realize information interaction between nodes of the two domains.

[0083] Reference Figure 1 and Figure 3 In one embodiment, if the first trust domain belongs to the IBC system and the second trust domain belongs to the PKI system, before verifying the information to be processed using the information of the first trust domain and the information of the second trust domain, the following may be included:

[0084] The trust credential is queried using the identity identifier of the first trust domain.

[0085] The specific node of the second trust domain may query the trust credential using the identity identifier of the first trust domain.

[0086] This embodiment uses the identity identifier of the first trust domain to query the corresponding trust credential, which is helpful for subsequent verification of the trust credential.

[0087] Reference Figure 1-Figure 4 In one embodiment, verifying the information to be processed by using the information of the first trust domain and the information of the second trust domain may include:

[0088] If the first trust domain belongs to the PKI system, and the second trust domain belongs to the IBC system, the legitimacy of the trust certificate is verified using the identity identifier of the second trust domain, and the legitimacy of the signature value is verified using the system root certificate. In this case, a specific node of the second trust domain may verify the legitimacy of the trust certificate using the identity identifier of the second trust domain, that is, verify whether the trust certificate is issued by the second trust domain; and the specific node of the second trust domain may verify the legitimacy of the signature value using the system root certificate, that is, verify whether the system root certificate matches the signature value.

[0089] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the PKI system, the legitimacy of the trust certificate is verified using the identity identifier of the second trust domain, and the legitimacy of the signature value is verified using the IBC signature verification mechanism and the system master public key. In this case, a specific node of the second trust domain may verify the legitimacy of the trust certificate using the identity identifier of the second trust domain, that is, verify whether the trust certificate is issued by the second trust domain; and the specific node of the second trust domain may verify the legitimacy of the signature value using the IBC signature verification mechanism and the system master public key, that is, verify whether the system master public key matches the signature value.

[0090] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the IBC system, the legitimacy of the trust certificate is verified using the identity identifier of the second trust domain, and the legitimacy of the signature value is verified using the system master public key. In this case, a specific node of the second trust domain may verify the legitimacy of the trust certificate using the identity identifier of the second trust domain, that is, verify whether the trust certificate is issued by the second trust domain; and the specific node of the second trust domain may verify the legitimacy of the signature value using the system master public key, that is, verify whether the system master public key matches the signature value.

[0091] This embodiment limits the verification method of the information to be processed according to the different systems to which the first trust domain and the second trust domain belong respectively, and can perform information verification on different combinations of the systems to which the first trust domain and the second trust domain belong in a targeted manner, and at the same time, can realize information authentication between nodes of the two domains.

[0092] Figure 5 This is the second flow chart of the cross-domain authentication method provided in the embodiment of the present application; refer to Figure 2-Figure 5 The embodiment of the present application provides a cross-domain authentication method, which is applied to a first trust domain and may include:

[0093] 501. Upload the information of the first trust domain to the blockchain;

[0094] 502. Downloading from the blockchain a trust certificate issued by the second trust domain for information of the first trust domain;

[0095] 503. Generate and send the information to be processed to the second trust domain, so that the second trust domain can perform cross-domain authentication.

[0096] In step 502, the trust certificate may be issued by the second trust domain using its own signature private key for the information of the first trust domain.

[0097] It should be noted that the first trust domain and the second trust domain may belong to the same cryptographic system or different cryptographic systems, which is not limited here. In this embodiment, the first trust domain and the second trust domain may have the following three situations:

[0098] Case 1: The first trust domain belongs to the PKI system, and the second trust domain belongs to the IBC system;

[0099] Case 2: The first trust domain belongs to the IBC system, and the second trust domain belongs to the PKI system;

[0100] The third case: the first trust domain belongs to the IBC system, and the second trust domain belongs to the IBC system.

[0101] When the first trust domain belongs to the IBC system and the second trust domain belongs to the IBC system, since both the first trust domain and the second trust domain belong to the IBC system, the information interaction between the two trust domains already has a high degree of trust. However, data sharing and collaboration in a distributed environment have high requirements for security, privacy protection and efficiency. Therefore, this embodiment introduces blockchain to store privacy information in a decentralized manner during information interaction between two different domains, thereby further improving the security of the interactive information and achieving more reliable cross-domain authentication.

[0102] The cross-domain authentication method provided in this embodiment uploads the information of the first trust domain to the blockchain, and downloads the trust certificate issued by the second trust domain for the information of the first trust domain from the blockchain, and then generates and sends the information to be processed to the second trust domain for the second trust domain to perform cross-domain authentication. When the first trust domain and the second trust domain belong to different cryptographic systems, since data sharing and collaboration in a distributed environment have high requirements for security, privacy protection and efficiency, the information interaction between two domains belonging to different systems requires the introduction of a third-party identity / certificate management system, which decentrally stores a large amount of private identity information in the two systems, and the two systems have strong trust in the third-party identity / certificate management system. This embodiment introduces a blockchain, which can decentrally store the private information in the interaction process when two domains belonging to different systems interact with each other, ensure the security of the interactive information, and realize cross-domain trusted authentication.

[0103] Reference Figure 2-Figure 5 , in one embodiment, if the first trust domain belongs to a PKI system, and the second trust domain belongs to an IBC system, the information of the first trust domain includes a system root certificate of the first trust domain;

[0104] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the PKI system, the information of the first trust domain includes the system master public key of the first trust domain;

[0105] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the IBC system, the information of the first trust domain includes the system master public key of the first trust domain.

[0106] It should be noted that, in the above three cases, the information of the first trust domain may also include an identity identifier of the first trust domain.

[0107] In this embodiment, the content included in the information of the first trust domain is limited according to the different systems to which the first trust domain and the second trust domain belong, which helps to use different information of the first trust domain to perform cross-domain authentication in a targeted manner according to different situations later.

[0108] Reference Figure 3 and Figure 5 In one embodiment, if the first trust domain belongs to the IBC system and the second trust domain belongs to the PKI system, after downloading the trust certificate issued by the second trust domain for the information of the first trust domain from the blockchain, it may include:

[0109] Issue a trust certificate.

[0110] After downloading the trust certificate, the first trust domain can publish the trust certificate through its own certificate publishing system.

[0111] This embodiment publishes the trust credential, which helps the subsequent second trust domain to query the trust credential.

[0112] Reference Figure 2-Figure 5 In one embodiment, generating and sending the information to be processed to the second trust domain may include:

[0113] If the first trust domain belongs to the PKI system, and the second trust domain belongs to the IBC system, the information to be sent is signed to generate a signature value, and the signature value and the trust credential are sent to the second trust domain as the information to be processed. In this case, the specific node of the first trust domain may sign the information to be sent and generate a signature value; the specific node of the first trust domain may send the signature value and the trust credential as the information to be processed to the specific node of the second trust domain, so that the specific node of the second trust domain can perform cross-domain authentication.

[0114] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the PKI system, the information to be sent is signed to generate a signature value, and the signature value and the identity identifier of the first trust domain are sent to the second trust domain as the information to be processed. In this case, the specific node of the first trust domain may sign the information to be sent and generate a signature value; the specific node of the first trust domain may send the signature value and the identity identifier of the first trust domain as the information to be processed to the specific node of the second trust domain, so that the specific node of the second trust domain can perform cross-domain authentication.

[0115] If the first trust domain belongs to the IBC system, and the second trust domain belongs to the IBC system, the information to be sent is signed to generate a signature value, and the signature value and the trust credential are sent to the second trust domain as the information to be processed. In this case, a specific node of the first trust domain may sign the information to be sent and generate a signature value; a specific node of the first trust domain may send the signature value and the trust credential as the information to be processed to a specific node of the second trust domain, so that the specific node of the second trust domain can perform cross-domain authentication.

[0116] It should be noted that when the first trust domain belongs to the PKI system and the second trust domain belongs to the IBC system, or when the first trust domain belongs to the IBC system and the second trust domain belongs to the IBC system, the first trust domain may also send a query request to the second trust domain, requesting the second trust domain to query the trust status of the first trust domain in its own trust domain, so that the second trust domain can use its own identity to verify the legitimacy of the trust status, without sending a trust certificate to the second trust domain.

[0117] This embodiment limits the content of the information to be processed according to the different systems to which the first trust domain and the second trust domain belong, which helps to use different information to be processed for cross-domain authentication in a targeted manner according to different situations. At the same time, it can realize information interaction between nodes of the two domains.

[0118] Reference Figure 1-Figure 5 , an embodiment of the present application provides a cross-domain authentication system, which may include: a first trust domain and a second trust domain;

[0119] The first trust domain is used for:

[0120] Upload the information of the first trust domain to the blockchain;

[0121] Downloading from the blockchain a trust certificate issued by the second trust domain for information of the first trust domain;

[0122] The trust certificate may be issued by the second trust domain using its own signature private key for the information of the first trust domain;

[0123] Generate and send the information to be processed to the second trust domain so that the second trust domain can perform cross-domain authentication;

[0124] The second trust domain is used for:

[0125] Download and authenticate the information of the first trust domain from the blockchain;

[0126] Issue a trust certificate for the information in the first trust domain and upload the trust certificate to the blockchain;

[0127] The signature private key of the second trust domain may be used to issue a trust certificate for the information of the first trust domain;

[0128] Receiving information to be processed sent by the first trust domain;

[0129] The information to be processed is verified using the information of the first trust domain and the information of the second trust domain.

[0130] It should be noted that the first trust domain and the second trust domain may belong to the same cryptographic system or different cryptographic systems, which is not limited here. In this embodiment, the first trust domain and the second trust domain may have the following three situations:

[0131] Case 1: The first trust domain belongs to the PKI system, and the second trust domain belongs to the IBC system;

[0132] Case 2: The first trust domain belongs to the IBC system, and the second trust domain belongs to the PKI system;

[0133] The third case: the first trust domain belongs to the IBC system, and the second trust domain belongs to the IBC system.

[0134] When the first trust domain belongs to the IBC system and the second trust domain belongs to the IBC system, since both the first trust domain and the second trust domain belong to the IBC system, the information interaction between the two trust domains already has a high degree of trust. However, data sharing and collaboration in a distributed environment have high requirements for security, privacy protection and efficiency. Therefore, this embodiment introduces blockchain to store privacy information in a decentralized manner during information interaction between two different domains, thereby further improving the security of the interactive information and achieving more reliable cross-domain authentication.

[0135] The cross-domain authentication system provided in this embodiment, when the first trust domain and the second trust domain belong to different cryptographic systems, since data sharing and collaboration in a distributed environment have high requirements for security, privacy protection and efficiency, therefore, the two domains belonging to different systems need to introduce a third-party identity / certificate management system for information exchange, and decentralized storage of a large amount of private identity information in the two systems, and both systems have strong trust in the third-party identity / certificate management system. This embodiment introduces blockchain, which can decentralized store private information in the interaction process when two domains belonging to different systems interact with each other, thereby ensuring the security of the interactive information and realizing cross-domain trusted authentication.

[0136] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A cross-domain authentication method, characterized in that: Applied to the second trust domain, the second trust domain belongs to the IBC system, including: Downloading and authenticating information of a first trust domain from a blockchain; the first trust domain belongs to a PKI system, and the information of the first trust domain includes a system root certificate of the first trust domain; issuing a trust certificate for the information of the first trust domain, and uploading the trust certificate to the blockchain; receiving information to be processed sent by the first trust domain; the information to be processed includes a signature value and the trust credential; Verifying the information to be processed by using the information of the first trust domain and the information of the second trust domain includes: Verifying the legitimacy of the trust credential using the identity identifier of the second trust domain, and verifying the legitimacy of the signature value using the system root certificate; The signature value is generated after the first trust domain signs the information to be sent.

2. The cross-domain authentication method according to claim 1, characterized in that: If the first trust domain belongs to an IBC system, and the second trust domain belongs to a PKI system, the information of the first trust domain includes a system master public key of the first trust domain; If the first trust domain belongs to the IBC system, and the second trust domain belongs to the IBC system, the information of the first trust domain includes the system master public key of the first trust domain.

3. The cross-domain authentication method according to claim 2, characterized in that: If the first trust domain belongs to the IBC system, and the second trust domain belongs to the PKI system, the information to be processed includes the signature value and the identity identifier of the first trust domain; If the first trust domain belongs to the IBC system and the second trust domain belongs to the IBC system, the information to be processed includes the signature value and the trust certificate.

4. The cross-domain authentication method according to claim 3, characterized in that: If the first trust domain belongs to an IBC system, and the second trust domain belongs to a PKI system, before verifying the information to be processed by using the information of the first trust domain and the information of the second trust domain, the method includes: The trust credential is queried using the identity identifier of the first trust domain.

5. The cross-domain authentication method according to claim 4, characterized in that: The verifying the information to be processed by using the information of the first trust domain and the information of the second trust domain includes: If the first trust domain belongs to the IBC system, and the second trust domain belongs to the PKI system, the legitimacy of the trust credential is verified using the identity identifier of the second trust domain, and the legitimacy of the signature value is verified using the IBC signature verification mechanism and the system master public key; If the first trust domain belongs to the IBC system and the second trust domain belongs to the IBC system, the legitimacy of the trust credential is verified using the identity identifier of the second trust domain, and the legitimacy of the signature value is verified using the system master public key.

6. A cross-domain authentication method, characterized in that: Applied to a first trust domain, the first trust domain belongs to a PKI system, including: Uploading information of the first trust domain to the blockchain; the information of the first trust domain includes a system root certificate of the first trust domain; Downloading from the blockchain a trust certificate issued by a second trust domain for information of the first trust domain; the second trust domain belongs to the IBC system; Generating and sending the information to be processed to the second trust domain for the second trust domain to perform cross-domain authentication, including: Sign the information to be sent, generate a signature value, and send the signature value and the trust credential as information to be processed to the second trust domain, so that the second trust domain can verify the legitimacy of the trust credential using the identity identifier of the second trust domain, and verify the legitimacy of the signature value using the system root certificate.

7. The cross-domain authentication method according to claim 6, characterized in that: If the first trust domain belongs to an IBC system, and the second trust domain belongs to a PKI system, the information of the first trust domain includes a system master public key of the first trust domain; If the first trust domain belongs to the IBC system, and the second trust domain belongs to the IBC system, the information of the first trust domain includes the system master public key of the first trust domain.

8. The cross-domain authentication method according to claim 7, characterized in that: If the first trust domain belongs to an IBC system, and the second trust domain belongs to a PKI system, then after downloading from the blockchain the trust certificate issued by the second trust domain for the information of the first trust domain, the method further includes: The trust credential is issued.

9. The cross-domain authentication method according to claim 8, characterized in that: The generating and sending the to-be-processed information to the second trust domain comprises: If the first trust domain belongs to the IBC system, and the second trust domain belongs to the PKI system, signing the information to be sent, generating a signature value, and sending the signature value and the identity identifier of the first trust domain as the information to be processed to the second trust domain; If the first trust domain belongs to the IBC system and the second trust domain belongs to the IBC system, the information to be sent is signed to generate a signature value, and the signature value and the trust certificate are sent to the second trust domain as the information to be processed.

10. A cross-domain authentication system, characterized in that: include: a first trust domain and a second trust domain; The first trust domain belongs to the PKI system, and the second trust domain belongs to the IBC system; The first trust domain is used for: Upload the information of the first trust domain to the blockchain; The information of the first trust domain includes a system root certificate of the first trust domain; Downloading from the blockchain a trust certificate issued by a second trust domain for information of the first trust domain; Generating and sending the information to be processed to the second trust domain for the second trust domain to perform cross-domain authentication, including: Signing the information to be sent, generating a signature value, and sending the signature value and the trust credential as information to be processed to the second trust domain; The second trust domain is used for: Download and authenticate the information of the first trust domain from the blockchain; issuing a trust certificate for the information of the first trust domain, and uploading the trust certificate to the blockchain; receiving information to be processed sent by the first trust domain; Verifying the information to be processed by using the information of the first trust domain and the information of the second trust domain includes: The legitimacy of the trust credential is verified using the identity identifier of the second trust domain, and the legitimacy of the signature value is verified using the system root certificate.

Images