Lightweight data management method and apparatus for cross-domain authentication

Abstract

This invention provides a lightweight data management method and apparatus for cross-domain authentication. The method includes: constructing a Merkle network corresponding to the data to be managed; storing the hash value stored in the root node of the Merkle network in the corresponding leaf node of the Merkle tree; and performing data management based on the Merkle network and the Merkle tree. The Merkle network is stored in the storage layer of the cross-domain authentication system, and the Merkle tree is stored in the blockchain layer of the cross-domain authentication system. The lightweight data management method and apparatus for cross-domain authentication provided by this invention saves storage overhead in the cross-domain authentication process by constructing a Merkle network corresponding to the data to be managed and storing it in the storage layer, and storing the hash value stored in the root node of the Merkle network in the Merkle tree in the blockchain layer.

Description

Technical Field

[0001] This invention relates to the field of information network security technology, and in particular to a lightweight data management method and apparatus for cross-domain authentication. Background Technology

[0002] In recent years, with the surge in the number of IoT devices, blockchain technology and integrated data management solutions have been widely applied in areas such as cross-domain authentication. Currently, existing data management solutions are limited by the storage capacity and throughput of blockchain, which means that these solutions require additional storage overhead and latency when used for cross-domain authentication. Summary of the Invention

[0003] To address the problems existing in the prior art, the present invention provides a lightweight data management method and apparatus for cross-domain authentication.

[0004] In a first aspect, the present invention provides a lightweight data management method for cross-domain authentication, comprising:

[0005] Construct the Merkel network corresponding to the data to be managed;

[0006] The hash value stored in the root node of the Merkle net is stored in the corresponding leaf node of the Merkle tree;

[0007] Data management is performed based on the Merkle net and the Merkle tree;

[0008] The Merkel network is stored in the storage layer of the cross-domain authentication system, and the Merkel tree is stored in the blockchain layer of the cross-domain authentication system.

[0009] Optionally, the data management based on the Merkel network and the Merkel tree includes:

[0010] Determine the leaf nodes corresponding to the row and column directions of the data to be verified in the Merkel network;

[0011] Based on the leaf node corresponding to the data to be verified in the Merkel network, determine the path from the leaf node corresponding to the data to be verified in the Merkel network to the root node of the Merkel network, as well as the sibling node corresponding to each node on the path.

[0012] The data to be verified is verified based on each node on the path and the sibling nodes corresponding to each node on the path.

[0013] Optionally, the step of verifying the data to be verified based on each node on the path and the sibling nodes corresponding to each node on the path includes:

[0014] Starting from the leaf node corresponding to the data to be verified in the Merkel network, the hash values ​​stored in each pair of sibling nodes are concatenated and hashed to obtain the hash value stored in the root node corresponding to the data to be verified; wherein, when performing the hash value concatenation operation, the hash value of the data to be verified is used as the hash value stored in the leaf node corresponding to the data to be verified in the Merkel network.

[0015] The hash value stored in the root node corresponding to the data to be verified is compared with the hash value stored in the corresponding leaf node in the Merkle tree to verify the data to be verified.

[0016] Optionally, constructing the Merkel network corresponding to the data to be managed includes:

[0017] Based on the amount of data to be managed, determine the number of leaf nodes in the Merkel network in both the row and column directions;

[0018] The hash values ​​stored in the leaf nodes of the Merkel network correspond one-to-one with the data to be managed;

[0019] The hash value stored in the root node of the Merkel network is determined based on the hash value stored in the leaf nodes of the Merkel network.

[0020] Optionally, determining the hash value stored in the root node of the Merkel network based on the hash values ​​stored in the leaf nodes of the Merkel network includes: starting from the leaf nodes of the Merkel network, concatenating and hashing the hash values ​​stored in each pair of sibling nodes along the row and column directions respectively, and using the result as the hash value stored in each branch node.

[0021] Based on the hash value stored in each branch node, the hash value stored in the root node of the Merkel network is obtained.

[0022] Optionally, determining the number of leaf nodes in the Merkel network in the row and column directions based on the amount of data to be managed includes:

[0023] If the first value is an integer, the first value is taken as the number of leaf nodes in the Merkle net in both the row and column directions;

[0024] If the first value is not an integer, the first value is rounded down to obtain the number of leaf nodes in the Merkle net in the row direction, and the first value is rounded down and then incremented by one to obtain the number of leaf nodes in the Merkle net in the column direction.

[0025] Wherein, the first value is the arithmetic square root of the number of data to be managed.

[0026] Secondly, the present invention also provides a lightweight data management device for cross-domain authentication, comprising:

[0027] The building module is used to construct the Merkel network corresponding to the data to be managed;

[0028] The storage module is used to store the hash value stored in the root node of the Merkle net in the corresponding leaf node of the Merkle tree;

[0029] The data management module is used for data management based on the Merkle network and the Merkle tree;

[0030] The Merkel network is stored in the storage layer of the cross-domain authentication system, and the Merkel tree is stored in the blockchain layer of the cross-domain authentication system.

[0031] Thirdly, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the lightweight data management method for cross-domain authentication as described in the first aspect above.

[0032] Fourthly, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the lightweight data management method for cross-domain authentication as described in the first aspect above.

[0033] Fifthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the lightweight data management method for cross-domain authentication as described above.

[0034] The lightweight data management method and apparatus for cross-domain authentication provided by this invention manages data by constructing the Merkle network corresponding to the data to be managed and storing it in the storage layer, and storing the hash value stored in the root node of the Merkle network in the Merkle tree in the blockchain layer, thereby saving storage overhead in the cross-domain authentication process. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0036] Figure 1 This is a flowchart illustrating the lightweight data management method for cross-domain authentication provided by the present invention.

[0037] Figure 2 This is an example diagram of the Merkel tree-network hybrid structure provided by the present invention;

[0038] Figure 3 This is a structural example diagram of the Merkle tree and Merkle net provided by the present invention;

[0039] Figure 4 This is a flowchart illustrating the Merkel proof generation and verification process provided by the present invention.

[0040] Figure 5 This is a flowchart illustrating the public key management process for cross-domain authentication using the Merkle tree-network hybrid structure provided by this invention.

[0041] Figure 6 This is a comparison chart of the storage overhead of the data management method provided by this invention and existing data management methods;

[0042] Figure 7 This is a comparison chart of the Merkel proof length and computational complexity of the data management method provided by this invention and existing data management methods;

[0043] Figure 8 This is a structural example diagram of the lightweight data management device for cross-domain authentication provided by the present invention;

[0044] Figure 9 This is a structural example diagram of the electronic device provided by the present invention. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0046] To facilitate a clearer understanding of the technical solutions of the various embodiments of the present invention, some technical contents related to the present invention will be introduced first.

[0047] In recent years, with the surge in the number of IoT devices, blockchain technology and integrated data management solutions have been widely applied in areas such as cross-domain authentication. Currently, existing data management solutions are limited by the storage capacity and throughput of blockchain, which results in additional storage overhead and time latency when used for cross-domain authentication.

[0048] To overcome the limitations of existing data management solutions, this invention designs a highly efficient, low-overhead data management scheme, thereby achieving lightweight cross-domain authentication. The data management scheme provided by this invention can reduce the storage overhead of the blockchain and its corresponding storage servers, while also reducing the computational overhead of the blockchain during data verification.

[0049] Figure 1 This is a flowchart illustrating the lightweight data management method for cross-domain authentication provided by the present invention, as shown below. Figure 1 As shown, the method includes the following steps:

[0050] Step 100: Construct the Merkel network corresponding to the data to be managed.

[0051] Step 101: Store the hash value stored in the root node of the Merkle net in the corresponding leaf node of the Merkle tree.

[0052] Step 102: Perform data management based on Merkle nets and Merkle trees.

[0053] The Merkel network is stored in the storage layer of the cross-domain authentication system, while the Merkel tree is stored in the blockchain layer of the cross-domain authentication system.

[0054] Specifically, before constructing the Merkle net corresponding to the data to be managed, the server in the storage layer of the cross-domain authentication system can collect the data to be managed. The data to be managed can be public keys, certificates, etc., used in the cross-domain authentication process. The Merkle net is an optimization of the traditional Merkle tree, which can reduce storage overhead. In the Merkle net, data is arranged in a grid format, and the row and column of data are stored and verified using row hash values ​​and column hash values, respectively.

[0055] The size of the Merkel network corresponding to the data to be managed can be determined based on the amount of data to be managed. After collecting the data to be managed, only one Merkel network can be constructed, or the data to be managed can be divided into multiple groups and multiple Merkel networks can be constructed.

[0056] After the Merkel network is constructed, it can be stored in the storage layer of the cross-domain authentication system, and the hash value stored in the root node of the Merkel network can be stored in the corresponding leaf node of the Merkel tree. When only one Merkel network is constructed, it corresponds to a leaf node in the Merkel tree; when multiple Merkel networks are constructed, the root node of each Merkel network corresponds to a leaf node in the Merkel tree. If the Merkel tree has other leaf nodes that do not store the hash value stored in the root node of the Merkel network, default hash values ​​can be filled into these leaf nodes.

[0057] When data needs to be verified, cross-domain authentication can be completed by using Merkel networks and Merkel trees to manage the data based on its hash value and its corresponding position in the Merkel network.

[0058] The lightweight data management method for cross-domain authentication provided by this invention manages data by constructing the Merkle network corresponding to the data to be managed and storing it in the storage layer, and storing the hash value stored in the root node of the Merkle network in the Merkle tree in the blockchain layer, thereby saving storage overhead in the cross-domain authentication process.

[0059] Optionally, data management can be performed based on Merkel networks and Merkel trees, including:

[0060] Determine the leaf nodes in the Merkle net corresponding to the row and column directions of the data to be verified;

[0061] Based on the leaf node corresponding to the data to be verified in the Merkel network, determine the path from the leaf node corresponding to the data to be verified in the Merkel network to the root node of the Merkel network, as well as the sibling node corresponding to each node on the path.

[0062] The data to be verified is verified based on each node on the path and its corresponding sibling nodes.

[0063] Specifically, when managing data based on Merkle nets and Merkle trees, we can first determine the leaf node corresponding to the data to be verified in the Merkle net, then find the path from the leaf node to the root node in the Merkle net, and determine the sibling node corresponding to each node on the path. Finally, we can verify the data to be verified based on each node on the path and the sibling node corresponding to each node on the path.

[0064] Optionally, validating the data to be validated based on each node in the path and its corresponding sibling nodes may include:

[0065] Starting from the leaf node corresponding to the data to be verified in the Merkel network, the hash values ​​stored in each pair of sibling nodes are concatenated and hashed to obtain the hash value stored in the root node corresponding to the data to be verified; wherein, when performing the hash value concatenation operation, the hash value of the data to be verified is used as the hash value stored in the leaf node corresponding to the data to be verified in the Merkel network.

[0066] The hash value stored in the root node corresponding to the data to be verified is compared with the hash value stored in the corresponding leaf node in the Merkle tree to verify the data.

[0067] In one implementation, during data verification, the hash value of the data to be verified is used as the hash value stored in the corresponding leaf node of the Merkel tree. Starting from that leaf node, the hash values ​​stored in each pair of sibling nodes are concatenated and then hashed again until the hash value stored in the root node of the Merkel tree is obtained. The hash value stored in the root node of the Merkel tree is compared with the hash value stored in the corresponding leaf node of the Merkel tree. If the two hash values ​​are the same, the verification is successful; if the two hash values ​​are different, the verification fails.

[0068] Optionally, a Merkel network corresponding to the data to be managed is constructed, including:

[0069] Based on the amount of data to be managed, determine the number of leaf nodes in the Merkel network in both the row and column directions;

[0070] The hash values ​​stored in the leaf nodes of the Merkel network correspond one-to-one with the data to be managed;

[0071] The hash value stored in the root node of the Merkel network is determined based on the hash value stored in the leaf nodes of the Merkel network.

[0072] Specifically, when constructing the Merkel network corresponding to the data to be managed, the quantity of data to be managed can be determined first. Then, based on the quantity of data to be managed, the number of leaf nodes in the Merkel network in the row and column directions can be determined. The hash values ​​stored in the leaf nodes of the Merkel network correspond one-to-one with the data to be managed. For example, the data to be managed can be arranged into a grid shape with an equal number of rows and columns, and the hash values ​​of the data to be managed can be written into the corresponding leaf nodes one by one. If there are other leaf nodes in the Merkel network that have not yet had hash values ​​of the data to be managed written, default hash values ​​can be written into these leaf nodes.

[0073] After determining the hash value stored in each leaf node of the Merkel network, the hash values ​​of each row and column can be concatenated and then hashed again to obtain the hash values ​​stored in the branch nodes of the Merkel network. This process of concatenation and hashing is then repeated for each pair of sibling nodes in the branch nodes until the hash value stored in the root node of the Merkel network is determined.

[0074] Optionally, the hash value stored in the root node of the Merkel network is determined based on the hash values ​​stored in the leaf nodes of the Merkel network, including:

[0075] Starting from the leaf nodes in the Merkel network, the hash values ​​stored in each pair of sibling nodes are concatenated and hashed along the row and column directions, respectively, and the result is used as the hash value stored in each branch node.

[0076] Based on the hash value stored in each branch node, the hash value stored in the root node of the Merkel network is obtained.

[0077] Specifically, after determining the hash value stored in the leaf nodes of the Merkel network, starting from the leaf nodes, the hash values ​​stored in each pair of sibling nodes are concatenated and hashed along the row and column directions, respectively. The result is used as the hash value stored in each branch node. The above operation is repeated until the hash value stored in the root node of the Merkel network is obtained.

[0078] Optionally, determining the number of leaf nodes in the Merkel network in the row and column directions based on the arithmetic square root of the amount of data to be managed can include:

[0079] If the first value is an integer, the first value is used as the number of leaf nodes in the Merkle net in both the row and column directions;

[0080] If the first value is not an integer, the value of the first value rounded down is taken as the number of leaf nodes in the Merkle net in the row direction, and the value of the first value rounded down plus one is taken as the number of leaf nodes in the Merkle net in the column direction.

[0081] The first value is the square root of the number of data to be managed.

[0082] For example, if the number of data to be managed is N, then... If it is an integer, then a file containing integers in both the row and column directions can be created. A Merkel net with leaf nodes, if If it is not an integer, then let The constructed Merkel network contains a total of M1×M2≥N nodes, where extra nodes can be placed using virtual nodes.

[0083] The method provided by this invention will be illustrated with specific application scenarios below.

[0084] To address the problems existing in the prior art, this invention designs a multi-layered Merkel tree network hybrid structure.

[0085] Figure 2 An example diagram of the Merkel tree-network hybrid structure provided by the present invention is shown below. Figure 2 As shown, the bottom layer of this Merkel tree-network hybrid structure is a Merkel hash network, located in the storage layer, which stores the original data and the hash values ​​of the original data; the top layer is a Merkel hash tree, located in the blockchain layer, which stores the root node of the bottom Merkel network.

[0086] Figure 3 Example diagrams of the structures of Merkle trees and Merkle networks provided by this invention, such as... Figure 3As shown, the hash value stored in the root node of both Merkle trees and Merkle networks is determined by starting from the leaf nodes, concatenating the hash values ​​stored in each pair of sibling nodes, and then performing a hash operation.

[0087] The specific steps for constructing the Merkle tree-network hybrid structure are as follows:

[0088] 1. The server in the storage layer collects N data that need to be integrated and managed. Usually, N is an even power of 2. The purpose is to make the square root of N exactly an integer. Also, the Merkle tree is a full binary tree and does not need to add any extra virtual nodes.

[0089] 2. Calculate the length M1 and width M2 of the bottom Merkle net. Usually, let M1 = M2 and be equal to the square root of N. Then create a Merkle net with M1 and M2 leaf nodes in the row and column directions, respectively.

[0090] 3. Arrange the integrated management data into an M1×M2 grid, and for each location's data a ij Calculate its hash value h ij =Hash(a ij And store it in the corresponding location in the underlying Merkel network.

[0091] 4. Concatenate or aggregate the hash values ​​of each row and each column, and then hash them again to obtain M1 row hash values ​​and M2 column hash values. Store the hash values ​​on the corresponding leaf nodes of the underlying Merkle net.

[0092] 5. For each branch node of the underlying Merkle network, the hash value is calculated by first using a certain aggregation function f to aggregate the hash values ​​stored in the left and right child nodes, and then hashing them again. The aggregation method can be to directly concatenate the two values ​​A and B into binary strings, or to first perform bit shifting, flipping, or other bit operations on A and B before performing an XOR operation (to avoid the situation where the XOR result is 0 because A and B store the same data), or other aggregation functions that can achieve similar effects can be used.

[0093] 6. Write the hash value stored in the root node of the underlying Merkle network into the leaf node of the Merkle tree located in the blockchain layer, update the hash values ​​stored in the branch nodes and root node of the Merkle tree, and complete the construction of the hybrid structure of the Merkle tree network.

[0094] Figure 4 This is a flowchart illustrating the Merkel proof generation and verification process provided by the present invention, as shown below. Figure 4 As shown, the Merkel proof generation and verification process includes the following steps:

[0095] 1. For b data points to be integrated and verified, first find the set μ of leaf nodes in the row and column of these data points in the underlying Merkle network.

[0096] 2. For each leaf node in the set μ, find the path from that node to the root node in the underlying Merkle net, and denote the set of all the nodes on all the paths as ρ.

[0097] 3. For each node in set ρ, find its corresponding sibling node in the underlying Merkle net to form set σ.

[0098] 4. Calculate Merkel's proof π = σρ, where "\" represents the set difference operation.

[0099] 5. After receiving the Merkel proof π, the blockchain layer first infers the structure of the underlying Merkel network and the hierarchical relationship between nodes based on the proof π, constructs a virtual Merkel network for verification, and marks the nodes contained in the proof π, as well as the set of leaf nodes μ' to be verified.

[0100] 6. Starting from the leaf node to be verified, concatenate the hash values ​​stored in each pair of sibling nodes, and then perform hash operation again to obtain the hash value stored in the parent node.

[0101] 7. Repeat the above steps until the hash value stored in the root node of the Merkel network is obtained.

[0102] 8. Compare the calculated root node hash value with the root node hash value stored in the leaf node of the upper Merkle tree. If the hash values ​​are the same, the verification is successful.

[0103] During cross-domain authentication, each trusted domain needs to store the public keys of authenticated users and verify these public keys using a blockchain. The lightweight data management method for cross-domain authentication provided by this invention enables integrated verification of public keys.

[0104] Figure 5 This is a flowchart illustrating the public key management process for cross-domain authentication using the Merkle tree-network hybrid structure provided by this invention, as shown below. Figure 5 As shown, the public key management steps in the cross-domain authentication process are as follows:

[0105] 1. Collect N public keys of users to be integrated and managed, and create a system containing public keys in both the row and column directions. A Merkle net with leaf nodes arranges the N user public keys that need to be managed into an M1×M2 grid shape. For each user public key, its hash value is calculated and stored in the corresponding position in the underlying Merkle net. If it is not an integer, then let The constructed Merkel network contains a total of M1×M2≥M nodes, where extra nodes can be placed using virtual nodes.

[0106] 2. Concatenate the hash values ​​of each row and column to obtain the hash values ​​stored in the leaf nodes of the underlying Merkel network. Calculate the hash values ​​stored in each branch node of the underlying Merkel network in a recursive manner. Finally, write the hash values ​​stored in the root node into the leaf nodes of the upper-level Merkel tree located in the blockchain layer to complete the construction of the Merkel tree network hybrid structure.

[0107] 3. In the process of generating the corresponding Merkel proof, firstly, b user public keys are randomly selected, and the rows and columns where these public keys are located are marked in the underlying Merkel network. Then, the set of leaf nodes corresponding to the marked rows and columns is denoted as μ. Starting from each leaf node, a path to the root node is found, and the set of nodes on all paths (including the leaf nodes themselves) is denoted as ρ. Then, for each node in the set ρ, its sibling node set σ is found, and the Merkel proof π = σ\ρ is calculated, where "\" is the set subtraction operation.

[0108] 4. In the process of verifying the Merkel proof, the underlying Merkel network is first reconstructed based on the Merkel network structure information contained in the proof π. Then, starting from the leaf node to be verified, the hash values ​​stored in each pair of sibling nodes are concatenated and hashed again to finally obtain the hash value stored in the root node. This hash value is then compared with the hash value stored in the leaf node of the upper Merkel tree in the blockchain. If the hash values ​​are equal, it is considered that the N user public keys stored in the underlying Merkel network have passed the integrated verification.

[0109] In the authentication process based on Identity Based Cryptography (IBC), the user's identity information is directly used as the public key, thus requiring the storage and verification of this information. The lightweight data management method for cross-domain authentication provided by this invention enables integrated verification of user identity information.

[0110] The specific steps for integrated verification of user identity information are as follows:

[0111] 1. Collect the identity information of N users to be integrated and managed, and create a system containing information in both the row and column directions. The Merkle net with leaf nodes arranges the N user identity information that needs to be managed into an M1×M2 grid shape. For each user identity information, its hash value is calculated and stored in the corresponding position in the underlying Merkle net. If the user identity information contains multiple fields, they are concatenated first and then the hash value is calculated.

[0112] 2. Aggregate the hash values ​​of each row and column to obtain the hash values ​​stored in the leaf nodes of the underlying Merkel network. Then, recursively calculate the hash values ​​stored in each branch node of the underlying Merkel network from bottom to top. Finally, write the hash values ​​stored in the root node into the leaf nodes of the upper Merkel tree located in the blockchain layer to complete the construction of the Merkel tree network hybrid structure.

[0113] 3. In the process of generating the corresponding Merkel proof, firstly, b user identity information are randomly selected, and the rows and columns where these identity information is located are marked in the underlying Merkel network. Then, the set of leaf nodes corresponding to the marked rows and columns is denoted as μ. Starting from each leaf node, the path to the root node is found, and the set of all nodes on the path and the leaf nodes themselves is denoted as ρ. Then, for each node in the set ρ, its sibling node set σ is found, and the Merkel proof π = σ ρ is calculated.

[0114] 4. In the process of verifying the Merkel proof, the underlying Merkel network is first reconstructed based on the Merkel network structure information contained in the proof π. Then, starting from the leaf node to be verified, the hash values ​​stored in each pair of sibling nodes are concatenated and hashed again to finally obtain the hash value stored in the root node. This hash value is then compared with the hash value stored in the leaf node of the upper Merkel tree in the blockchain. If the hash values ​​are equal, it is considered that the N user identity information stored in the underlying Merkel network has passed the integrated verification.

[0115] In the authentication process based on Public Key Infrastructure (PKI), the Certificate Authority (CA) needs to store each user's certificate. The lightweight data management method for cross-domain authentication provided in this invention can also achieve integrated verification of certificates.

[0116] The specific steps for integrated certificate verification are as follows:

[0117] 1. Collect N certificates to be integrated and managed, and create a system containing certificates in both the row and column directions. The Merkle net with leaf nodes arranges the N certificates that need to be managed into an M1×M2 grid shape. For the user certificate information at each location, its hash value is calculated and stored in the corresponding location in the underlying Merkle net.

[0118] 2. Concatenate the hash values ​​of each row and column to obtain the hash values ​​stored in the leaf nodes of the underlying Merkel network. Then, calculate the hash values ​​stored in each branch node of the underlying Merkel network from bottom to top. Finally, write the hash values ​​stored in the root node into the leaf nodes of the upper Merkel tree located in the blockchain layer to complete the construction of the Merkel tree network hybrid structure.

[0119] 3. In the process of generating the Merkel proof for the certificates, firstly, b certificates are randomly selected, and the rows and columns where these certificates are located are marked in the underlying Merkel network. Then, the set of leaf nodes corresponding to the marked rows and columns is denoted as μ. Starting from each leaf node, a path to the root node is found, and the set of all nodes on the path and the leaf nodes themselves is denoted as ρ. Then, for each node in the set ρ, its sibling node set σ is found, and the Merkel proof π = σ ρ is calculated.

[0120] 4. In the process of verifying Merkel proofs, the underlying Merkel network is first reconstructed based on the Merkel network structure information contained in the proof π. Then, starting from the leaf node to be verified, the hash values ​​stored in each pair of sibling nodes are concatenated and hashed again to finally obtain the hash value stored in the root node. This hash value is then compared with the hash value stored in the leaf node of the upper Merkel tree in the blockchain. If the hash values ​​are equal, it is considered that the N certificates stored in the underlying Merkel network have passed the integrated verification.

[0121] To evaluate the storage overhead of the data management scheme proposed in this invention, this invention tested the additional storage overhead (i.e. the overhead for storing information such as hash values ​​other than the original data) under different leaf node numbers N, and compared it with existing data management schemes.

[0122] Figure 6 A comparison chart of storage overhead between the data management method provided by this invention and existing data management methods is shown below. Figure 6 As shown, the additional storage overhead of the solution provided by this invention is lower than that of existing solutions, and the percentage reduction in storage overhead achieved by the solution increases with the increase in the number of leaf nodes. When the number of leaf nodes N = 256, the additional storage overhead of the existing solution is 15.97KB, while the additional storage overhead required by the solution provided by this invention to manage this data is 9.97KB, a reduction of 37.6%. When the number of leaf nodes N = 1024, the additional storage overhead of the existing solution is 63.97KB, while the additional storage overhead required by the solution provided by this invention to manage this data is 35.97KB, a reduction of 43.7%. Theoretically, the upper limit of the reduction in additional storage overhead achieved by using a Merkle tree-network hybrid structure is 50%, as demonstrated below:

[0123] The additional storage overhead of the existing solution is approximately The additional storage overhead of the solution provided by this invention is approximately As N approaches positive infinity, the ratio of the two additional storage overheads mentioned above is:

[0124]

[0125] To evaluate the computational overhead of the data management scheme proposed in this invention, this invention tested the length of the Merkel proof generated for integrated data verification and the computational complexity of the verification process under different leaf node numbers N, and compared them with existing technologies.

[0126] Figure 7 A comparison chart of the Merkel proof length and computational complexity of the data management method provided by this invention and existing data management methods is shown below. Figure 7 As shown, the length and computational complexity of the Merkel proof both exhibit a linear growth trend with the increase in the number of leaf nodes. Compared with existing schemes, the data management scheme provided by this invention has lower computational overhead. When the number of leaf nodes N = 64, the scheme provided by this invention reduces the proof length by 41.6% and the verification complexity by 55.6%. When the number of leaf nodes N = 1024, the scheme provided by this invention reduces the proof length by 31.2% and the verification complexity by 43.6%. Experimental results fully demonstrate that the scheme provided by this invention is beneficial for achieving lightweight data verification in cross-domain authentication.

[0127] The lightweight data management device for cross-domain authentication provided by the present invention will be described below. The lightweight data management device for cross-domain authentication described below and the lightweight data management method for cross-domain authentication described above can be referred to in correspondence.

[0128] Figure 8 Here is a structural example diagram of the lightweight data management device for cross-domain authentication provided by the present invention, as shown below. Figure 8 As shown, the device includes:

[0129] Module 800 is used to build the Merkel network corresponding to the data to be managed;

[0130] Storage module 810 is used to store the hash value stored in the root node of the Merkel net in the corresponding leaf node of the Merkel tree;

[0131] Data management module 820 is used for data management based on Merkle nets and Merkle trees;

[0132] The Merkel network is stored in the storage layer of the cross-domain authentication system, while the Merkel tree is stored in the blockchain layer of the cross-domain authentication system.

[0133] Optionally, data management can be performed based on Merkel networks and Merkel trees, including:

[0134] Determine the leaf nodes in the Merkle net corresponding to the row and column directions of the data to be verified;

[0135] Based on the leaf node corresponding to the data to be verified in the Merkel network, determine the path from the leaf node corresponding to the data to be verified in the Merkel network to the root node of the Merkel network, as well as the sibling node corresponding to each node on the path.

[0136] The data to be verified is verified based on each node on the path and its corresponding sibling nodes.

[0137] Optionally, the data to be validated is validated based on each node on the path and its corresponding sibling nodes, including:

[0138] Starting from the leaf node corresponding to the data to be verified in the Merkel network, the hash values ​​stored in each pair of sibling nodes are concatenated and hashed to obtain the hash value stored in the root node corresponding to the data to be verified; wherein, when performing the hash value concatenation operation, the hash value of the data to be verified is used as the hash value stored in the leaf node corresponding to the data to be verified in the Merkel network.

[0139] The hash value stored in the root node corresponding to the data to be verified is compared with the hash value stored in the corresponding leaf node in the Merkle tree to verify the data.

[0140] Optionally, a Merkel network corresponding to the data to be managed is constructed, including:

[0141] Based on the amount of data to be managed, determine the number of leaf nodes in the Merkel network in both the row and column directions;

[0142] The hash values ​​stored in the leaf nodes of the Merkel network correspond one-to-one with the data to be managed;

[0143] The hash value stored in the root node of the Merkel network is determined based on the hash value stored in the leaf nodes of the Merkel network.

[0144] Optionally, the hash value stored in the root node of the Merkel network is determined based on the hash values ​​stored in the leaf nodes of the Merkel network, including:

[0145] Starting from the leaf nodes in the Merkel network, the hash values ​​stored in each pair of sibling nodes are concatenated and hashed along the row and column directions, respectively, and the result is used as the hash value stored in each branch node.

[0146] Based on the hash value stored in each branch node, the hash value stored in the root node of the Merkel network is obtained.

[0147] Optionally, based on the amount of data to be managed, the number of leaf nodes in the Merkel network in the row and column directions is determined, including:

[0148] If the first value is an integer, the first value is used as the number of leaf nodes in the Merkle net in both the row and column directions;

[0149] If the first value is not an integer, the value of the first value rounded down is taken as the number of leaf nodes in the Merkle net in the row direction, and the value of the first value rounded down plus one is taken as the number of leaf nodes in the Merkle net in the column direction.

[0150] The first value is the square root of the number of data to be managed.

[0151] It should be noted that the device provided by the present invention can implement all the method steps implemented in the above method embodiments and can achieve the same technical effect. Therefore, the parts and beneficial effects that are the same as those in the method embodiments will not be described in detail here.

[0152] Figure 9 Example diagram of the structure of the electronic device provided by the present invention, such as Figure 9 As shown, the electronic device may include a processor 910, a communications interface 920, a memory 930, and a communication bus 940, wherein the processor 910, the communications interface 920, and the memory 930 communicate with each other via the communication bus 940. The processor 910 can call logical instructions in the memory 930 to execute any of the lightweight data management methods for cross-domain authentication provided in the above embodiments.

[0153] Furthermore, the logical instructions in the aforementioned memory 930 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0154] It should be noted that the electronic device provided by the present invention can implement all the method steps implemented in the above method embodiments and can achieve the same technical effect. Therefore, the parts and beneficial effects that are the same as those in the method embodiments will not be described in detail here.

[0155] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform any of the lightweight data management methods for cross-domain authentication provided in the above embodiments.

[0156] It should be noted that the non-transitory computer-readable storage medium provided by the present invention can implement all the method steps implemented in the above method embodiments and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail.

[0157] In another aspect, the present invention also provides a computer program product, the computer program product including a computer program that can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer is able to execute any of the lightweight data management methods for cross-domain authentication provided in the above embodiments.

[0158] It should be noted that the computer program product provided by the present invention can implement all the method steps implemented in the above method embodiments and can achieve the same technical effect. Therefore, the parts and beneficial effects that are the same as those in the method embodiments will not be described in detail here.

[0159] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0160] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0161] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A lightweight data management method for cross-domain authentication, characterized in that, include: Construct the Merkel network corresponding to the data to be managed; The hash value stored in the root node of the Merkle net is stored in the corresponding leaf node of the Merkle tree; Determine the leaf nodes corresponding to the row and column directions of the data to be verified in the Merkel network; Based on the leaf node corresponding to the data to be verified in the Merkel network, determine the path from the leaf node corresponding to the data to be verified in the Merkel network to the root node of the Merkel network, as well as the sibling node corresponding to each node on the path. The verification of the data to be verified is performed based on each node on the path and its corresponding sibling nodes. This includes: starting from the leaf node corresponding to the data to be verified in the Merkel network, concatenating and performing hash operations on the hash values ​​stored in each pair of sibling nodes to obtain the hash value stored in the root node corresponding to the data to be verified; wherein, during the hash value concatenation operation, the hash value of the data to be verified is used as the hash value stored in the leaf node corresponding to the data to be verified in the Merkel network; and comparing the hash value stored in the root node corresponding to the data to be verified with the hash value stored in the leaf node corresponding to the Merkel tree to verify the data to be verified. The Merkel network is stored in the storage layer of the cross-domain authentication system, and the Merkel tree is stored in the blockchain layer of the cross-domain authentication system.

2. The lightweight data management method for cross-domain authentication according to claim 1, characterized in that, The construction of the Merkel network corresponding to the data to be managed includes: Based on the amount of data to be managed, determine the number of leaf nodes in the Merkel network in both the row and column directions; The hash values ​​stored in the leaf nodes of the Merkel network correspond one-to-one with the data to be managed; The hash value stored in the root node of the Merkel network is determined based on the hash value stored in the leaf nodes of the Merkel network.

3. The lightweight data management method for cross-domain authentication according to claim 2, characterized in that, Determining the hash value stored in the root node of the Merkel network based on the hash values ​​stored in the leaf nodes of the Merkel network includes: Starting from the leaf nodes in the Merkel network, the hash values ​​stored in each pair of sibling nodes are concatenated and hashed along the row and column directions, respectively, and the result is used as the hash value stored in each branch node. Based on the hash value stored in each branch node, the hash value stored in the root node of the Merkel network is obtained.

4. The lightweight data management method for cross-domain authentication according to claim 2, characterized in that, Determining the number of leaf nodes in the Merkel network in both row and column directions based on the amount of data to be managed includes: If the first value is an integer, the first value is taken as the number of leaf nodes in the Merkle net in both the row and column directions; If the first value is not an integer, the value of the first value rounded down is taken as the number of leaf nodes in the Merkle net in the row direction, and the value of the first value rounded down plus one is taken as the number of leaf nodes in the Merkle net in the column direction. Wherein, the first value is the arithmetic square root of the number of data to be managed.

5. A lightweight data management device for cross-domain authentication, characterized in that, include: The building module is used to construct the Merkel network corresponding to the data to be managed; The storage module is used to store the hash value stored in the root node of the Merkle net in the corresponding leaf node of the Merkle tree; The data management module is used to determine the leaf nodes corresponding to the row and column directions of the data to be verified in the Merkel network; The data management module is also used to determine, based on the leaf node corresponding to the data to be verified in the Merkel network, the path from the leaf node to the root node of the Merkel network and the sibling node corresponding to each node on the path. The data management module further verifies the data to be verified based on each node on the path and its corresponding sibling nodes. This includes: starting from the leaf node corresponding to the data to be verified in the Merkel network, concatenating and performing hash operations on the hash values ​​stored in each pair of sibling nodes to obtain the hash value stored in the root node corresponding to the data to be verified; wherein, during the hash value concatenation operation, the hash value of the data to be verified is used as the hash value stored in the leaf node corresponding to the data to be verified in the Merkel network; and comparing the hash value stored in the root node corresponding to the data to be verified with the hash value stored in the leaf node corresponding to the Merkel tree to verify the data to be verified. The Merkel network is stored in the storage layer of the cross-domain authentication system, and the Merkel tree is stored in the blockchain layer of the cross-domain authentication system.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the program, it implements the lightweight data management method for cross-domain authentication as described in any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the lightweight data management method for cross-domain authentication as described in any one of claims 1 to 4.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the lightweight data management method for cross-domain authentication as described in any one of claims 1 to 4.

Images