A parallel blockchain-oriented node identity management method

Abstract

The present application relates to a kind of parallel block chain-oriented node identity management method, belong to blockchain and network security technical field.The present application proposes a technical solution for ensuring identity security problem when new node joins network while solving multi-department cooperation.The identity security problem of node is solved by using parallel chain technology, and the certificate authority in identity authentication system is split into two independent certificate registration and approval agency and certificate issuing agency.The present application proposes to split the certificate authority into two independent certificate registration agency and certificate issuing agency, avoids malicious node to join parallel blockchain, can better adapt to multi-department system cooperation scene, by introducing parallel chain architecture, different departments can realize cross-department access data, and the proxy node of each parallel subchain maintains the database of the department, and cross-department access data can be realized by only proxy node verification legality.

Description

Technical Field

[0001] This invention relates to a node identity management method for parallel blockchains, belonging to the field of blockchain and network security technology. Background Technology

[0002] Blockchain is a decentralized, distributed database based on a consensus mechanism and a peer-to-peer network. A complete blockchain system integrates multiple key technologies, supported by blocks that store data, and internally includes a chain structure, timestamps, Merkle trees, hash functions, etc. Consensus algorithms ensure that all nodes reach a consensus, digital signatures and asymmetric encryption guarantee the security and privacy of information, and smart contracts provide each node with predetermined execution rules. The convergence and interweaving of these technologies enable the entire decentralized network to operate smoothly and continuously.

[0003] Public Key Infrastructure (PKI) is a widely used technology architecture for network security and encrypted communications. It manages digital certificates, public keys, and private keys to ensure the confidentiality, integrity, and authentication of communications. PKI has a wide range of applications, providing comprehensive security services for data exchange in networks such as online finance, online banking, online securities, e-commerce, and e-government.

[0004] As a type of blockchain technology, parachains offer unique advantages over other blockchains in terms of scalability, privacy, and efficiency. Parachains allow for the parallel processing of multiple transactions and blocks, increasing the overall throughput of the blockchain; they can distribute transactions across different chains, reducing congestion in the blockchain network; and they can use zero-knowledge proofs or other cryptographic techniques to make transactions more anonymous and secure, providing better privacy protection. Based on these advantages, adopting a parachain architecture is undoubtedly a better choice in the context of multi-departmental collaboration. However, when malicious nodes join the parachain network, it can cause serious harm to the entire parachain system.

[0005] Therefore, PKI technology is needed to authenticate node identities by issuing digital certificates. However, due to the open and anonymous nature of networks, unauthorized users can forge certificates and impersonate others through technical means, causing significant harm to the system. Summary of the Invention

[0006] The purpose of this invention is to address the technical issues of identity authentication in parallel blockchains by creatively proposing a node identity management method for parallel blockchains.

[0007] This invention proposes a technical solution to ensure identity security when a new node joins the network in a multi-department collaboration context. This is achieved by using parachain technology and splitting the certificate management authority in the identity authentication system into two independent registration authorities and certificate authorities, thus addressing the aforementioned identity security issue of individual nodes.

[0008] Beneficial effects

[0009] Compared with the prior art, the present invention has the following advantages:

[0010] 1. This invention proposes a novel node identity authentication technology. Unlike traditional PKI technology, this invention splits the certificate management authority into two independent certificate registration authorities and certificate issuing authorities, preventing malicious nodes from joining parallel blockchains.

[0011] 2. This invention can better adapt to multi-department system collaboration scenarios. By introducing a parallel chain architecture, different departments can access data across departments. The proxy node of each parallel sub-chain maintains the database of that department. Cross-department data access can be achieved simply by the proxy node verifying the validity. Attached Figure Description

[0012] Figure 1 This is a schematic diagram of the architecture of a parallel chain system.

[0013] Figure 2 This is a flowchart of a new node joining a parachain. Detailed Implementation

[0014] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings.

[0015] First, the concepts and entities involved in this invention will be explained and described.

[0016] Identity information: This is the identity proof that identifies each node. Specifically, it includes a public key used to verify the identity, a digital certificate issued by an authoritative institution to prove the authenticity of the identity information, a timestamp of the last update of this identity information, and some basic information and contact information related to reality.

[0017] Proxy node: An entity that packages the identity information uploaded by peer nodes into a block as a transaction, uploads it to the blockchain network, and reaches a consensus with other nodes.

[0018] Peer nodes: These nodes upload their own identity information to the blockchain as a transaction, sign it with their own private key, and send it to the proxy node entity in this parachain.

[0019] Certificate registration and approval agency: responsible for identity verification, receiving identity information sent by applicants, and checking whether the identity is genuine and legal through manual verification / company identity system and other relevant systems.

[0020] Certificate Authority: Responsible for issuing certificates to new identities and managing certificate renewals.

[0021] Parallel chains: Nodes in each department are interconnected to form a blockchain, and multiple blockchains from regulatory departments and other departments constitute parallel chains.

[0022] The relay chain is the entity that stores the latest block headers of parachains. As parachain blocks are generated, the relay chain tracks the latest block headers of each parachain. When a relay chain block is finalized, the parachain blocks that have completed the verification process are also finalized. Through cross-consensus messaging protocols, the relay chain facilitates communication between parachains.

[0023] like Figure 1 As shown. A node access method based on a parachain architecture includes the following steps:

[0024] Step 1: Each department initiates one proxy node and several peer nodes, which communicate with each other to form a parachain. As the genesis block is generated, the proxy nodes of the parachain submit the latest block header of their own block to the relay chain for verification.

[0025] Step 2: The Certificate Authority (RA) verifies the user's identity information and aggregates the authentication results into a signature.

[0026] Suppose a certification authority has N RAs (Registrants) for identity authentication. When an RA (the initial RA) receives an identity message from a peer node, it randomly selects G RAs (excluding itself) for authentication, where N-1 > G > 1 / 2(N-1). The RA then forwards the identity information to the G RAs for authentication. If the authentication is successful, the RA signs the identity information, returning the signature S, a random number R, and its own public key P to the initial RA. If the authentication fails, the RA only returns its own public key.

[0027] After receiving G return messages initially, RA integrates all returned signatures into an aggregate signature, combines all random numbers R into an aggregate random number R′, and returns the peer node's aggregate signature S′=R′+e(P1+P2+...+P n R′ and public key list Where e represents the hash value of the message, P i This represents the public key of the i-th RA.

[0028] Step 3: The peer node integrates the aggregate signature S', aggregate random number R', public key list L, its own node public key, and real identity information to form a certificate request. It then signs the request with its own MSP private key and submits it to the CA, where MSP represents the signature. The CA verifies the aggregate signature S' using the public key list L and the aggregate random number R'. If successful, the CA issues a certificate to the peer node.

[0029] Step 4: The new peer node signs the issued digital certificate using its own private key, and then uploads the signed digital certificate to the corresponding proxy node for the transaction. The proxy node verifies the transaction and submits it to the ledger to check the correctness of the transaction message format (including RA aggregate signature, public key list, certificate, etc.) and the legality of the signature. After successful verification, the proxy node uses the PBFT protocol (Practical Byzantine Fault Tolerance) to achieve consensus among all nodes within the parachain. Simultaneously, the proxy node maintains the parachain database, updating certificate status information (e.g., registration, update) using the certificate sequence number as the key. Afterwards, the proxy node submits the block header of the newly generated block to the relay chain for verification. Figure 2 As shown.

[0030] Step 5: Update node identity information.

[0031] This process is basically the same as the new node access process. The node needs to submit an update information request to the certification authority, which then issues a new certificate based on the updated identity information; however, the certificate serial number key remains unchanged.

[0032] Step 6: When a node in a department queries the identity information of nodes in other departments, the node first signs the transaction generated by the identity information query using its own private key, then submits the signed identity information query transaction to the corresponding proxy node. The smart contract deployed on the proxy node checks the legality and executes the query, and finally returns the query result.

Claims

1. A node access method based on a parallel chain architecture, characterized in that, Includes the following steps: Step 1: Each department starts a proxy node and several peer nodes, which communicate with each other to form a parachain; as the genesis block is generated, the proxy nodes of the parachain submit the latest block header of their own block to the relay chain for verification. Step 2: The Certificate Authority (RA) verifies the user's identity information and aggregates the authentication results into a signature; Suppose that a certain certification authority has N RAs to perform identity authentication; after receiving an identity message from a peer node, an initial RA randomly selects G RA nodes other than itself for identity authentication, where N-1>G>1 / 2(N-1), and forwards the identity information to the G RAs for authentication; if the verification is successful, the identity information is signed, and the signature S, random number R, and its own public key P are returned to the initial RA; If the verification fails, only its own public key will be returned; After receiving G return messages initially, RA integrates all returned signatures into an aggregate signature, combines all random numbers R into an aggregate random number R′, and returns the peer node's aggregate signature S′=R′+e(P1+P2+...+P n R′ and public key list Where e represents the hash value of the message, P i Represents the public key of the i-th RA; Step 3: The peer node integrates the aggregate signature S', aggregate random number R', public key list L, its own node public key, and real identity information to form a certificate application, signs it with its own MSP private key, and submits it to the CA. MSP represents the signature. The CA verifies the aggregate signature S' using the public key list L and aggregate random number R'. If it passes, the CA issues a certificate to the peer node. Step 4: The new peer node signs the issued digital certificate using its own private key, and then uploads the signed digital certificate to the corresponding proxy node for the transaction; the proxy node verifies the transaction and submits it to the ledger to check the correctness of the transaction message format and the legality of the signature; after verification, the proxy node uses the Byzantine fault tolerance protocol to achieve consensus among all nodes within the parachain; at the same time, the proxy node maintains the parachain database, which updates the certificate status information using the certificate serial number as the key; afterwards, the proxy node submits the block header of the newly generated block to the relay chain, which then verifies it; Step 5: Update node identity information; In this process, the node needs to submit an update information application to the certification authority, which will then issue a new certificate based on the updated identity information, but the certificate serial number key will not change. Step 6: When a node in a department queries the identity information of nodes in other departments, the node first signs the transaction generated by the identity information query using its own private key, then submits the signed identity information query transaction to the corresponding proxy node. The smart contract deployed on the proxy node checks the legality and executes the query, and finally returns the query result.

Images