Internet of Things signature authentication method, system and storage medium based on blockchain

Abstract

The present invention discloses a blockchain-based Internet of Things signature authentication method, system and storage medium, which are applied to the field of Internet of Things technology, can alleviate the potential safety hazards of Internet of Things platform signature authentication, and improve the security and reliability of Internet of Things platform data calls. The method includes: obtaining a first call authentication request including a user identity, obtaining a first encrypted string from a blockchain query and returning it to an application client; obtaining a second call authentication request; the application client performs private key decryption on the first encrypted string to obtain decrypted data, and initiates a second call authentication request; when the first encrypted string is verified to meet a preset condition according to the second call authentication request, an authentication result is obtained, and returned to the application client; obtaining an interface call request; the application client initiates an interface call request according to the authentication result; when the signature algorithm is verified according to the interface call request, an application call response result is returned.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to a blockchain-based Internet of Things signature authentication method, system and storage medium. Background Art

[0002] In IoT applications, the application system issues commands to control devices by calling the interface of the IoT platform. When the application system calls the interface of the IoT platform, the IoT platform will use a signature mechanism for verification. In related technologies, the commonly used signature mechanism mainly uses key and secret for signature authentication. As long as the key and secret are obtained, the application system can successfully call the interface of the IoT platform. This leads to a large security risk in the interface calling process, and it is easy to have problems such as illegal calls. Therefore, how to alleviate the security risks of signature authentication of the IoT platform and improve the security and reliability of data calls on the IoT platform has become an urgent problem to be solved. Summary of the invention

[0003] In order to solve at least one of the above technical problems, the present invention proposes a blockchain-based Internet of Things signature authentication method, system and storage medium, which can alleviate the security risks of signature authentication in the Internet of Things platform and effectively improve the security and reliability of data calls on the Internet of Things platform.

[0004] On the one hand, an embodiment of the present invention provides an Internet of Things signature authentication method based on blockchain, comprising the following steps:

[0005] Obtaining a first call authentication request; wherein the first call authentication request includes a user identity identifier;

[0006] Obtain a corresponding first encrypted string from the blockchain according to the user identity, and return the first encrypted string to the application client;

[0007] Obtaining a second call authentication request; wherein the application client performs private key decryption on the first encrypted string to obtain decrypted data, and initiates the second call authentication request, wherein the second call authentication request includes the decrypted data;

[0008] When verifying that the first encrypted string meets the preset conditions according to the second calling authentication request, an authentication pass result is obtained, and the authentication pass result is returned to the application client; wherein the preset conditions include that the first encrypted string matches the preset encrypted string, and the encryption string change mark is an unchanged mark;

[0009] Obtaining an interface call request; wherein the application client initiates the interface call request according to the authentication result; the interface call request includes the application unique identifier, the application interface public key and the interface call parameter;

[0010] When the signature algorithm verification is passed according to the interface call request, the application call response result is returned.

[0011] According to an embodiment of the present invention, a blockchain-based Internet of Things signature authentication method has at least the following beneficial effects: after obtaining a first call request containing a user identity, the embodiment obtains a corresponding first encrypted string from the blockchain according to the user identity, and returns the first encrypted string to the application client. Then, after the application client performs private key decryption on the first encrypted string to obtain decrypted data, a second call authentication request is initiated. This embodiment verifies whether the first encrypted string meets the preset conditions through the second call authentication request. When the verification shows that the first encrypted string matches the preset encrypted string and the encrypted string change mark is an unchanged mark, the verification is passed and an authentication result is obtained. This embodiment can effectively alleviate the problem of illegal user login by querying the first encrypted string corresponding to the user identity through the blockchain. At the same time, by verifying whether the encrypted string change mark is an unchanged mark, it verifies whether the application user account corresponding to the user identity is valid, thereby alleviating the security problem caused by logging in through an invalid application user account. Further, after receiving the authentication result, the application client initiates an interface call request according to the authentication result. After obtaining an interface call request including a user identity, an application interface public key, and an interface call parameter, this embodiment performs signature algorithm verification according to the interface call request. When the signature authentication is performed according to the interface call request, the application call response result is returned through the exemption to realize the interface call. This embodiment uses the signature algorithm verification method to alleviate the problem of interface calls by external personnel, thereby further improving the security performance of interface calls. This embodiment optimizes the signature authentication process of the Internet of Things platform by verifying the first encrypted string and the double authentication method of signature algorithm verification, alleviates the security risks of signature authentication of the Internet of Things platform, improves the security of application interface calls, and effectively improves the security and reliability of data calls of the Internet of Things platform.

[0012] According to some embodiments of the present invention, initiating the interface call request according to the authentication result includes:

[0013] When the authentication result is received, the application unique identifier, the application interface public key and the interface call parameter are encoded by a preset encoding algorithm to obtain encoded data;

[0014] Digesting the encoded data using a preset keyed hash algorithm according to the application interface private key to obtain signature digest data;

[0015] The interface call request is initiated according to the signature summary data.

[0016] According to some embodiments of the present invention, encoding the application unique identifier, the application interface public key, and the interface call parameter by a preset encoding algorithm to obtain the encoded data includes:

[0017] The user identity, the application interface public key and the interface call parameters are encoded using the UTF-8 encoding algorithm to obtain the encoded data.

[0018] According to some embodiments of the present invention, the method further comprises:

[0019] Obtain a first application creation request;

[0020] Generate the user identity according to the first application creation request; wherein the user identity is associated with preset associated data, the preset associated data includes a user state parameter and the encryption string change flag, initialize the user state parameter to a valid state, and initialize the encryption string change flag to an unchanged flag;

[0021] Sending the user identity to the application client;

[0022] Obtaining user public key data; wherein the application client generates user public key data and user private key data according to the user identity identifier;

[0023] Encrypting the user status parameter according to the user public key data to obtain the first encrypted string;

[0024] Binding the first encrypted string and the user identity identifier to store in the blockchain, and returning the stored result to the application client; wherein the application client initiates a second application creation request according to the stored result;

[0025] Obtain a second application creation request, create an application according to the second application creation request and generate application authentication parameters; wherein the application authentication parameters include the application unique identifier, the application interface public key and the application interface private key;

[0026] The application authentication parameters are sent to the application client.

[0027] According to some embodiments of the present invention, the method further comprises:

[0028] Obtaining a user status change request; wherein the user status change request includes the user identity identifier;

[0029] Changing the user status parameter associated with the user identity to obtain status change data;

[0030] Encrypting the state change data by using the user public key data to obtain a second encrypted string;

[0031] Setting the encrypted string change mark associated with the user identity according to the state change data; wherein the encrypted string change mark includes a changed mark and an unchanged mark;

[0032] The user identity and the second encrypted string are updated in the blockchain, and the update result is returned to the application client.

[0033] According to some embodiments of the present invention, during the step of verifying that the first encrypted string satisfies a preset condition according to the second calling authentication request to obtain an authentication pass result, the method further includes:

[0034] When the first encryption string does not match the preset encryption string according to the second calling authentication request, or the encryption string change mark is changed to a changed mark, an authentication failure result is obtained.

[0035] According to some embodiments of the present invention, the state change data includes the valid state and the invalid state;

[0036] The step of setting the encrypted string change flag associated with the user identity according to the state change data includes:

[0037] When the state change data is in a valid state, setting the encryption string change flag to the unchanged flag;

[0038] Alternatively, when the state change data is in an invalid state, the encryption string change flag is set to a changed flag.

[0039] On the other hand, an embodiment of the present invention further provides an Internet of Things signature authentication system based on blockchain, comprising:

[0040] A first acquisition module, configured to acquire a first call authentication request; wherein the first call authentication request includes a user identity identifier;

[0041] A query module, configured to query the blockchain according to the user identity to obtain a corresponding first encrypted string, and return the first encrypted string to the application client;

[0042] A second acquisition module is used to acquire a second call authentication request; wherein the application client performs private key decryption on the first encrypted string to obtain decrypted data, and initiates the second call authentication request, wherein the second call authentication request includes the decrypted data;

[0043] A first verification module, configured to verify that the first encrypted string satisfies a preset condition according to the second calling authentication request, obtain an authentication result, and return the authentication result to the application client; wherein the preset condition includes that the first encrypted string matches a preset encrypted string, and the encrypted string change mark is an unchanged mark;

[0044] A third acquisition module is used to obtain an interface call request; wherein the application client initiates the interface call request according to the authentication result; the interface call request includes the application unique identifier, the application interface public key and the interface call parameter;

[0045] The second verification module is used to return an application call response result when the signature algorithm verification is passed according to the interface call request.

[0046] On the other hand, an embodiment of the present invention further provides an Internet of Things signature authentication system based on blockchain, comprising:

[0047] at least one processor;

[0048] at least one memory for storing at least one program;

[0049] When the at least one program is executed by the at least one processor, the at least one processor implements the blockchain-based Internet of Things signature authentication method as described in the above embodiment.

[0050] On the other hand, an embodiment of the present invention further provides a computer storage medium, which stores a program executable by a processor, and the program executable by the processor is used to implement the blockchain-based Internet of Things signature authentication method as described in the above embodiment when executed by the processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 This is a flow chart of a blockchain-based IoT signature authentication method provided by an embodiment of the present invention;

[0052] Figure 2 It is a principle block diagram of the blockchain-based Internet of Things signature authentication system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The embodiments described in the embodiments of this application should not be regarded as limitations of this application. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0054] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it can be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0055] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0056] In IoT applications, the application system issues instructions to control devices by calling the interface of the IoT platform. When the application system calls the interface of the IoT platform, in order to ensure the security of data, the IoT platform usually uses a signature mechanism for call authentication, and the corresponding interface call can be made only after the call authentication. At present, the commonly used signature mechanism is mainly to perform signature authentication through key and secret, that is, as long as the key and secret are obtained, the application system can successfully call the interface of the IoT platform. In the related art, the method of performing signature authentication through key and secret to achieve call authentication has improved the data security of the IoT platform to a certain extent. However, this authentication method has certain limitations. For example, when a person holding a key and secret leaves the company, he can still use the key and secret to make an interface call to obtain the corresponding data, which also creates a security risk for the IoT platform data. Since most of the IoT business is a scenario where multiple application client systems call the IoT platform interface, if the entire application parameters are directly updated, such as directly updating the key and secret, some applications may not be able to obtain the changed parameters in real time and the call fails. Therefore, how to alleviate the security risks of signature authentication in the IoT platform and improve the security and reliability of data calls on the IoT platform has become an urgent problem to be solved.

[0057] Based on this, an embodiment of the present invention provides an IoT signature authentication method based on blockchain, which alleviates the potential security risks of IoT platform signature authentication and effectively improves the security and reliability of IoT platform data calls. Figure 1 The method of the embodiment of the present invention includes but is not limited to step S110, step S120, step S130, step S140, step S150 and step S160.

[0058] Specifically, the method application process of the embodiment of the present invention includes but is not limited to the following steps:

[0059] S110: Obtain a first call authentication request, wherein the first call authentication request includes a user identity.

[0060] S120: Obtain a corresponding first encrypted string from the blockchain according to the user identity, and return the first encrypted string to the application client.

[0061] S130: Obtain a second call authentication request, wherein the application client performs private key decryption on the first encrypted string to obtain decrypted data, and initiates a second call authentication request, wherein the second call authentication request includes the decrypted data.

[0062] S140: When the first encrypted string meets the preset condition according to the second call authentication request, an authentication result is obtained, and the authentication result is returned to the application client, wherein the preset condition includes that the first encrypted string matches the preset encrypted string, and the encrypted string change mark is the unchanged mark.

[0063] S150: Obtain an interface call request. The application client initiates an interface call request according to the authentication result. The interface call request includes an application unique identifier, an application interface public key, and interface call parameters.

[0064] S160: When the signature algorithm verification is passed according to the interface call request, the application call response result is returned.

[0065] During the working process of this specific embodiment, this embodiment first obtains a first call authentication request. Specifically, the first call authentication request includes a user identity, such as a user ID. The application client initiates a first call authentication request to the Internet of Things platform and carries the user ID, that is, the user identity, as an input parameter. Then, this embodiment obtains the corresponding first encrypted string from the blockchain query according to the user identity, and returns the first encrypted string obtained by the query to the application client. Specifically, after receiving the first call request, the Internet of Things platform in this embodiment initiates an encrypted string query of the caller, and queries the encrypted string data corresponding to the user identity in the first call request from the blockchain, that is, the first encrypted string. Then, this embodiment returns the first encrypted string obtained by the query to the application client for private key decryption. After the application client receives the first encrypted string fed back by the Internet of Things platform, it decrypts the first encrypted string with a private key to obtain the corresponding decrypted data. At the same time, the application client initiates a second call authentication request to the Internet of Things platform according to the decrypted data obtained by decryption. Further, this embodiment obtains a second call authentication request, and verifies whether the first encrypted string meets the preset conditions according to the second call authentication request. Specifically, after the Internet of Things platform obtains the second call authentication request in this embodiment, it verifies whether the first encrypted string matches the preset encrypted string according to the decoded data obtained by decoding the first encrypted string. At the same time, this embodiment also verifies whether the encrypted string change mark is an unchanged mark. This embodiment indicates the validity of the application user account corresponding to the user identity through the encrypted string change mark. For example, when the encrypted string change mark is an unchanged mark, it means that the user identity is valid, and when the encrypted string change mark is a changed mark, it means that the user identity has expired. When it is verified that the first encrypted string matches the preset encrypted string, and the encrypted string change mark is an unchanged mark, the verification is passed, the authentication result is obtained, and the authentication result is returned to the application client. It is easy to understand that when it is verified that the first encrypted string does not match the preset encrypted string, it means that the identity authentication of the initiator of the call has failed. When it is verified that the encrypted string change mark is a changed mark, the user's ID has expired, and the calling authority of the user ID has been restricted, for example, the corresponding personnel have resigned or been demoted. Therefore, this embodiment needs to verify the matching of the encrypted string data and the encrypted string change mark at the same time to optimize the IoT signature authentication process and alleviate the security risks of IoT platform signature authentication.

[0066] Further, when the application client receives the authentication result, an interface call request is initiated. Specifically, the interface call request includes an application unique identifier, an application interface public key, and interface call parameters, such as application ID, application key, and other parameters required for the interface call. In addition, when the application client receives the authentication failure result, the process is terminated. Then, after the Internet of Things platform receives the interface call request initiated by the application client, this embodiment performs signature algorithm verification according to the relevant parameters of the interface call request. When the signature algorithm verification is passed according to the interface call request, the application call response result is returned, and the application call is successful. On the contrary, when the signature algorithm verification fails, the call response failure is returned. This embodiment sets a user identity identification identifier and an encrypted string change mark to verify whether the initiator of the call is an illegal user or whether the user status is valid. When an illegal user wants to obtain interface information, the illegal user ID cannot obtain the corresponding encrypted string from the blockchain or does not have a private key and cannot decrypt the obtained encrypted string, so that the corresponding interface data cannot be obtained through authentication, thereby improving the security of the interface data. At the same time, when there is a job change on the application side, by adjusting the corresponding encryption string change mark, the permission control is performed through the encryption string generated by the user's valid state, which alleviates the problem of controlling the interface through the original account password and further improves the security of the interface data. In addition, after the user identity identification and the encryption string change mark are verified, the interface call parameters are further signed by using application ID, application key, application secret and other parameters to perform signature verification, thereby further improving the security performance of the interface call, achieving accurate authentication and control of security permissions, effectively alleviating the security risks of signature authentication on the Internet of Things platform, and effectively improving the security and reliability of data calls on the Internet of Things platform.

[0067] Exemplarily, in this embodiment, the Internet of Things platform includes an application management module, a user management module, and a blockchain service module. When the application client initiates a first call authentication request to the user management module, it carries a user ID, that is, a user identity identifier, as an input parameter. After receiving the first call authentication request, the user management module initiates an application to query the caller's encrypted string to the blockchain service module according to the user ID. Then, after the blockchain service module obtains the corresponding first encrypted string according to the user ID query, it returns the first encrypted string to the application client. The application client performs private key decryption on the first encrypted string returned by the blockchain service module, obtains the corresponding decrypted data, and then initiates a second call authentication request to the user management module. The user management module first verifies whether the encrypted string matches, that is, whether the first encrypted string matches the preset encrypted string, and at the same time verifies whether the encrypted string has changed through the encrypted string change mark. Accordingly, this embodiment returns the authentication result or the authentication failure result to the application client. When the application client receives the authentication failure result, the process ends. When the application client receives the authentication result, an interface call request is initiated to the application management module. The application management module performs signature algorithm authentication based on the interface call request, and returns the application call response result when the authentication is successful, and returns failure when the authentication is unsuccessful.

[0068] In some embodiments of the present invention, an interface call request is initiated according to the authentication result, including but not limited to:

[0069] When the authentication result is received, the application unique identifier, application interface public key and interface call parameters are encoded using a preset encoding algorithm to obtain encoded data.

[0070] The encoded data is summarized using a preset keyed hash algorithm according to the application interface private key to obtain signature summary data.

[0071] Initiate an interface call request based on the signature summary data.

[0072] In this specific embodiment, after the application client receives the authentication result, it initiates an interface call request to the Internet of Things platform. Specifically, in this embodiment, when the authentication result is received, the application client encodes the application unique identifier, the application interface public key and the interface call parameter using a preset encoding algorithm to obtain the encoded data. Then, this embodiment uses the application interface private key to summarize the encoded data through a preset keyed hash algorithm to obtain signature summary data, thereby initiating an interface call request based on the signature summary data. Among them, the preset keyed hash algorithm includes the HMAC-SHA1 algorithm. HMAC-SHA1 is a keyed hash algorithm constructed from the SHA1 hash function and is used as HMAC (hash-based message authentication code). The HMAC process mixes the key with the information data, uses the hash function to hash the mixed result, and mixes the obtained hash value with the application interface private key, and then applies the hash function again. The SHA1 algorithm (secure hash algorithm) is a cryptographic hash algorithm that generates a 160-bit hash value from a string of any length. Therefore, the HMAC-SHA1 algorithm accepts encoded data of any size and generates a 160-bit hash sequence to summarize the data.

[0073] In some embodiments of the present invention, the user identity, the application interface public key and the interface call parameters are encoded by a preset encoding algorithm to obtain encoded data, including but not limited to:

[0074] The user identity, application interface public key and interface call parameters are encoded using the UTF-8 encoding algorithm to obtain encoded data.

[0075] In this specific embodiment, this embodiment encodes the encoded data by using the UTF-8 encoding algorithm. Specifically, the UTF-8 (8-bit Unicode Transformation Format) encoding algorithm is a character encoding method of the Unicode character set. It is characterized by using variable-length bytes, that is, variable-length code element sequences or variable-width code element sequences, for encoding. This embodiment encodes the user identity, application interface public key, and interface call parameters by using the UTF-8 encoding algorithm, so that the obtained encoded data occupies less space and is easy to transmit.

[0076] In some embodiments of the present invention, the blockchain-based IoT signature authentication method provided in this embodiment also includes but is not limited to:

[0077] Get the first application creation request.

[0078] A user identity is generated according to the first application creation request, wherein the user identity is associated with preset associated data, the preset associated data includes a user state parameter and an encryption string change flag, the user state parameter is initialized to a valid state, and the encryption string change flag is initialized to an unchanged flag.

[0079] Send the user identity to the application client.

[0080] Obtain user public key data. The application client generates user public key data and user private key data based on the user identity;

[0081] Encrypting the user state parameter according to the user public key data to obtain a first encrypted string;

[0082] The first encrypted string is bound to the user identity and stored in the blockchain, and the storage result is returned to the application client. The application client initiates a second application creation request based on the storage result.

[0083] Obtain a second application creation request, create an application according to the second application creation request and generate application authentication parameters, wherein the application authentication parameters include an application unique identifier, an application interface public key and an application interface private key.

[0084] Send application authentication parameters to the application client.

[0085] In this specific embodiment, this embodiment first obtains a first application creation request. Among them, the first application creation request is initiated by the application client to the Internet of Things platform. Then, this embodiment generates a user identity according to the first application creation request. Specifically, the Internet of Things platform randomly generates the required number of user IDs, that is, user identity. Correspondingly, when this embodiment generates the user identity, the corresponding preset associated data is set to match the user identity, and the preset associated data includes a user state parameter and an encrypted string change mark, and the preset associated data is associated and matched with the user identity. The user state parameter indicates the validity of the corresponding user identity, that is, the validity of the user ID. The encrypted string change mark indicates the change of the first encrypted string. In this embodiment, the user state parameters associated with each user identity are initialized to a valid state, and the encrypted string change mark is initialized to an unchanged mark. Further, this embodiment sends the corresponding user identity to the application client. After receiving the user identity, the application client generates the corresponding user public key data and user private key data according to the user identity initialization, and stores the user private key data locally in the application client, and then transmits the user public key data to the Internet of Things platform. Then, when the Internet of Things platform obtains the user public key data, the user state parameter is encrypted according to the user public key data to obtain the first encrypted string. Further, the present embodiment binds the first encrypted string to the corresponding user identity identifier and transmits it to the blockchain for storage. It should be noted that in the process of storing the user identity identifier and the first encrypted string through the blockchain in the present embodiment, the preset associated data associated with the user identity identifier is also stored. When the blockchain storage is completed, the storage result is fed back to the application client. Then, the application client initiates a second application creation request to the Internet of Things platform. The present embodiment generates corresponding application authentication parameters according to the second application creation request. Specifically, the application authentication parameters include an application unique identifier, an application interface public key, and an application interface private key. For example, after receiving the second application creation request, the Internet of Things platform generates a corresponding application ID, an application key, and an application secret. Further, the present embodiment sends the generated application authentication parameters to the application client for storage, thereby completing the application creation and the interaction of the basic user ID and related information.

[0086] Exemplarily, in this embodiment, the Internet of Things platform includes an application management module, a user management module and a blockchain service module. When the application client initiates a first application creation request to the Internet of Things platform, the user management module randomly generates a corresponding number of user IDs, i.e., user identity identifiers, and initializes the user status parameters to a valid state, and initializes the encrypted string change mark to an unchanged mark, such as recording the encrypted string change mark as 0. Next, this embodiment transmits the user ID to the application client, and the application client initializes and generates the corresponding user public key and user private key. At the same time, the user private key is stored locally on the application client, and the user public key is transmitted to the user management module. Then, the user management module encrypts the user status parameter corresponding to the user ID with the user public key to obtain an encrypted string, i.e., a first encrypted string, and transmits the user ID and the corresponding first encrypted string to the blockchain service module. Further, the blockchain service module binds and stores the user ID and the first encrypted string, and replies a successful storage response to the application client. After receiving the successful storage response, the application client sends a second application creation request to the application management module. The application management module creates an application and generates a corresponding application ID, application key and application secret. At the same time, the generated application ID, application key, and application secret are returned to the application client for storage, thereby completing the creation of the application.

[0087] In some embodiments of the present invention, the blockchain-based IoT signature authentication method provided in this embodiment also includes but is not limited to:

[0088] Obtain a user status change request, wherein the user status change request includes a user identity.

[0089] The user status parameters associated with the user identity are changed to obtain status change data.

[0090] The state change data is encrypted using the public key data to obtain a second encrypted string.

[0091] The encrypted string change mark associated with the user identity is set according to the state change data, wherein the encrypted string change mark includes a changed mark and an unchanged mark.

[0092] Update the user identity and the second encrypted string to the blockchain, and return the update result to the application client.

[0093] In this specific embodiment, this embodiment optimizes the permission configuration by updating the encryption string. Specifically, this embodiment first obtains a user status change request. The application client initiates a user status change request to the Internet of Things platform, and the user status change request includes a user identity identification, that is, a user ID. Further, this embodiment changes the user status parameter associated with the user identity to obtain status change data. Then, this embodiment encrypts the obtained status change data by public key data to obtain a second encrypted string. At the same time, this embodiment sets an encryption string change mark associated with the user's surrounding identification according to the status change data. Specifically, the encryption string change mark includes a changed mark and an unchanged mark. For example, this embodiment sets the changed mark to 1 and the unchanged mark to 0. By judging the encryption string change mark, it can be known whether the encryption string has changed. Further, this embodiment updates the user identity and the second encryption string after binding them to the blockchain, and returns the update result to the application client. It should be noted that in the process of storing the user identity and the second encryption string through the blockchain, the preset associated data associated with the user identity is also stored.

[0094] Exemplarily, in this embodiment, when the application client initiates a user status change request, such as changing the user ID status parameter to an invalid request, and carries the user ID as an input parameter. The user management module of the Internet of Things platform changes the user status parameter corresponding to the user ID to obtain the status change data. Next, this embodiment uses the user public key to encrypt the new user status parameter, that is, the status change data, to obtain a new encrypted string, that is, the second encrypted string. At the same time, this embodiment sets the encrypted string change mark to 1, that is, sets it to a changed mark. Further, the user management module uploads the user ID and its updated encrypted string to the blockchain service module. Then, the blockchain service module updates the encrypted string corresponding to the user ID, and returns a successful change response to the application client, thereby realizing the update of the encrypted string.

[0095] In some embodiments of the present invention, during the step of verifying that the first encrypted string satisfies a preset condition according to the second call authentication request to obtain an authentication pass result, the blockchain-based IoT signature authentication method provided in this embodiment also includes but is not limited to:

[0096] When the first encrypted string does not match the preset encrypted string according to the second calling authentication request, or the encrypted string change mark is changed to a changed mark, an authentication failure result is obtained.

[0097] In this specific embodiment, this embodiment obtains the authentication result by verifying the matching of the encryption string and the encryption string change mark. Specifically, when the first encryption string is verified to match the preset encryption string according to the second call authentication request, and the encryption string change mark is an unchanged mark, the authentication is passed and the authentication is passed. At the same time, in this embodiment, when it is verified that the first encryption string does not match the preset encryption string, or the encryption string change mark is a changed mark, the authentication fails and the authentication failure result is obtained. It is easy to understand that when the first encryption string does not match the preset encryption string, it means that the decrypted data obtained by decrypting the user private key of the initiator of the call is incorrect, that is, the initiator of the call is an illegal user. At the same time, when the encryption string change mark is a changed mark, it means that the validity of the user identity has been changed to an invalid state. Therefore, when it is verified that the first encryption string does not match the preset encryption string, or the encryption string change mark is one of the changed marks, the authentication fails.

[0098] In some embodiments of the present invention, the state change data includes a valid state and an invalid state. Accordingly, the encrypted string change flag associated with the user identity is set according to the state change data, including but not limited to:

[0099] When the state change data is in a valid state, the encryption string change flag is set to an unchanged flag.

[0100] Alternatively, when the state change data is in an invalid state, the encryption string change flag is set to a changed flag.

[0101] In this specific embodiment, the state change data includes a valid state and an invalid state. Specifically, when the state change data is in a valid state, the encrypted string change mark is set to an unchanged mark accordingly. In addition, when the state change data is in an invalid state, the encrypted string change mark is set to a changed mark. Exemplarily, after obtaining a user state change request, this embodiment updates the user state parameters associated with the user identity identifier to obtain new user state parameters, i.e., the state change data. When the updated state change data is in a valid state, the encrypted string change mark associated with the user identity identifier is set to an unchanged mark, and when the updated user state parameter is in an invalid state, the corresponding encrypted string change mark is set to a changed mark, so that the validity of the user identity identifier can be judged according to the encrypted string change mark.

[0102] An embodiment of the present invention further provides an Internet of Things signature authentication system based on blockchain, comprising:

[0103] The first acquisition module is used to acquire a first call authentication request, wherein the first call authentication request includes a user identity.

[0104] The query module is used to query the blockchain according to the user identity to obtain the corresponding first encrypted string, and return the first encrypted string to the application client.

[0105] The second acquisition module is used to acquire a second call authentication request, wherein the application client performs private key decryption on the first encrypted string to obtain decrypted data, and initiates a second call authentication request, wherein the second call authentication request includes the decrypted data.

[0106] The first verification module is used to verify that the first encrypted string meets the preset conditions according to the second call authentication request to obtain an authentication result, and return the authentication result to the application client. The preset conditions include that the first encrypted string matches the preset encrypted string, and the encrypted string change mark is the unchanged mark.

[0107] The third acquisition module is used to acquire an interface call request. The application client initiates an interface call request according to the authentication result. The interface call request includes an application unique identifier, an application interface public key, and interface call parameters.

[0108] The second verification module is used to return the application call response result when the signature algorithm verification is passed according to the interface call request.

[0109] Reference Figure 2 , an embodiment of the present invention also provides an Internet of Things signature authentication system based on blockchain, comprising:

[0110] At least one processor 210 .

[0111] At least one memory 220 is used to store at least one program.

[0112] When at least one program is executed by at least one processor 210, at least one processor 210 implements the blockchain-based Internet of Things signature authentication method as described in the above embodiment.

[0113] An embodiment of the present invention further provides a computer-readable storage medium, which stores computer-executable instructions. The computer-executable instructions are executed by one or more control processors, for example, to execute the steps described in the above embodiment.

[0114] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0115] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above-mentioned implementation mode. Technical personnel familiar with the field can also make various equivalent deformations or substitutions without violating the spirit of the present invention. These equivalent deformations or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. A blockchain-based IoT signature authentication method, characterized in that: The following steps are involved: Obtaining a first call authentication request; wherein the first call authentication request includes a user identity identifier; Obtain a corresponding first encrypted string from the blockchain according to the user identity, and return the first encrypted string to the application client; Obtaining a second call authentication request; wherein the application client performs private key decryption on the first encrypted string to obtain decrypted data, and initiates the second call authentication request, wherein the second call authentication request includes the decrypted data; When verifying that the first encrypted string meets the preset conditions according to the second calling authentication request, an authentication pass result is obtained, and the authentication pass result is returned to the application client; wherein the preset conditions include that the first encrypted string matches the preset encrypted string, and the encryption string change mark is an unchanged mark; Obtaining an interface call request; wherein the application client initiates the interface call request according to the authentication result; the interface call request includes an application unique identifier, an application interface public key, and an interface call parameter; When the signature algorithm verification is passed according to the interface call request, the application call response result is returned; The initiating the interface call request according to the authentication result includes: When the authentication result is received, the application unique identifier, the application interface public key and the interface call parameter are encoded by a preset encoding algorithm to obtain encoded data; Digesting the encoded data using a preset keyed hash algorithm according to the application interface private key to obtain signature summary data; The interface call request is initiated according to the signature summary data.

2. The blockchain-based IoT signature authentication method according to claim 1 is characterized in that: The method further comprises: Obtain a first application creation request; Generate the user identity according to the first application creation request; wherein the user identity is associated with preset associated data, the preset associated data includes a user state parameter and the encryption string change flag, initialize the user state parameter to a valid state, and initialize the encryption string change flag to an unchanged flag; Sending the user identity to the application client; Obtaining user public key data; wherein the application client generates user public key data and user private key data according to the user identity identifier; Encrypting the user status parameter according to the user public key data to obtain the first encrypted string; Binding the first encrypted string and the user identity identifier to store in the blockchain, and returning the stored result to the application client; wherein the application client initiates a second application creation request according to the stored result; Obtain a second application creation request, create an application according to the second application creation request and generate application authentication parameters; wherein the application authentication parameters include the application unique identifier, the application interface public key and the application interface private key; The application authentication parameters are sent to the application client.

3. The blockchain-based IoT signature authentication method according to claim 2 is characterized in that: The method further comprises: Obtaining a user status change request; wherein the user status change request includes the user identity identifier; Changing the user status parameter associated with the user identity to obtain status change data; Encrypting the state change data by using the user public key data to obtain a second encrypted string; Setting the encrypted string change mark associated with the user identity according to the state change data; wherein the encrypted string change mark includes a changed mark and an unchanged mark; The user identity and the second encrypted string are updated in the blockchain, and the update result is returned to the application client.

4. The blockchain-based IoT signature authentication method according to claim 1, characterized in that: During the step of verifying that the first encrypted string satisfies a preset condition according to the second calling authentication request and obtaining an authentication pass result, the method further includes: When the first encryption string does not match the preset encryption string according to the second calling authentication request, or the encryption string change mark is changed to a changed mark, an authentication failure result is obtained.

5. The blockchain-based IoT signature authentication method according to claim 3 is characterized in that: The state change data includes the valid state and the invalid state; The step of setting the encrypted string change flag associated with the user identity according to the state change data includes: When the state change data is in a valid state, setting the encryption string change flag to the unchanged flag; Alternatively, when the state change data is in an invalid state, the encryption string change flag is set to a changed flag.

6. A blockchain-based IoT signature authentication system, characterized in that: include: A first acquisition module, configured to acquire a first call authentication request; wherein the first call authentication request includes a user identity identifier; A query module, configured to query the blockchain according to the user identity to obtain a corresponding first encrypted string, and return the first encrypted string to the application client; A second acquisition module is used to acquire a second call authentication request; wherein the application client performs private key decryption on the first encrypted string to obtain decrypted data, and initiates the second call authentication request, wherein the second call authentication request includes the decrypted data; A first verification module, configured to verify that the first encrypted string satisfies a preset condition according to the second calling authentication request, obtain an authentication result, and return the authentication result to the application client; wherein the preset condition includes that the first encrypted string matches a preset encrypted string, and the encrypted string change mark is an unchanged mark; A third acquisition module is used to obtain an interface call request; wherein the application client initiates the interface call request according to the authentication result; the interface call request includes an application unique identifier, an application interface public key, and an interface call parameter; A second verification module is used to return an application call response result when the signature algorithm verification is passed according to the interface call request; The initiating the interface call request according to the authentication result includes: When the authentication result is received, the application unique identifier, the application interface public key and the interface call parameter are encoded by a preset encoding algorithm to obtain encoded data; Digesting the encoded data using a preset keyed hash algorithm according to the application interface private key to obtain signature summary data; The interface call request is initiated according to the signature summary data.

7. A blockchain-based IoT signature authentication system, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the blockchain-based Internet of Things signature authentication method as described in any one of claims 1 to 5.

8. A computer storage medium storing a program executable by a processor, characterized in that: The program executable by the processor is used to implement the blockchain-based Internet of Things signature authentication method as described in any one of claims 1 to 5 when executed by the processor.

Images