A safe and reliable distributed industrial internet identification resolution method and device

Abstract

The application discloses a safe and credible distributed industrial internet identification analysis method and device, wherein the method comprises the following steps: identifier structure setting; trusted identity authentication; trusted identification registration; identification security analysis. The application firstly provides trusted authentication for the identity and identification of the nodes in the identification analysis system through the ordered multiple group signature technology, ensures the safe and credible identification source data, secondly improves the identifier structure setting by introducing the IPFS technology, thereby realizing the strong correlation of the identification and the source data, and finally realizes the safe storage and safe transmission of the identity certificate, the identification and the source data through the block chain and the asymmetric encryption technology. The application utilizes the block chain and the ordered multiple group signature algorithm, ensures the safe and credible industrial internet identification analysis system process, binds the identification and the source data, realizes the source safety of the industrial internet identification, and prevents the malicious modification of the enterprises on the industrial internet identification and the source data.

Description

Technical Field

[0001] This invention relates to a secure and reliable distributed industrial internet identifier resolution method and device, belonging to the fields of network security and blockchain technology. Background Technology

[0002] With the deepening of a new round of global technological revolution and industrial transformation, the Industrial Internet has emerged as a new model for industrial development. The Industrial Internet is not merely a simple "industry + internet," but rather a comprehensive transformation of the entire industry towards informatization, digitalization, and intelligentization. It is also an application model that deeply integrates the internet, big data, artificial intelligence, and the real economy. The Industrial Internet Identifier Resolution System is a crucial component of the Industrial Internet, serving as a vital engine for promoting data interoperability across the industrial chain and enhancing its resilience and security. In recent years, blockchain technology has been widely applied in fields such as finance, healthcare, and supply chain management. Through its decentralized, tamper-proof, and transparent characteristics, it aims to address issues in the Industrial Internet Identifier Resolution System such as severe centralization, deletion or alteration of source identifier data, uneven distribution of benefits among multiple parties, and single points of failure.

[0003] Existing blockchain-based industrial internet identifier resolution solutions typically leverage the immutability of blockchain to securely store data digests of identifiers and source data. However, identifiers may have been altered before being uploaded to the blockchain, and blockchain cannot guarantee the security and trustworthiness of identifiers before upload. Group signature technology, with its non-repudiation and anonymity protection features, can achieve trusted authentication of identifier source data. If a problem arises with an identifier or product, relevant organizations can quickly trace and hold the source accountable. However, traditional group signature technology only categorizes members into two classes, which cannot adapt to the unique environment of unequal protection capabilities among nodes at different levels within the identifier resolution system. Furthermore, there is often no actual mapping relationship between the identifier and its source data. Summary of the Invention

[0004] To address the problems and shortcomings of existing technologies, this invention proposes a secure and reliable distributed industrial internet identifier resolution method and apparatus. This method first provides trusted authentication for node identities and identifiers within the identifier resolution system through ordered multi-group signature technology, ensuring the security and reliability of the identifier source data. Second, it improves the identifier structure by introducing IPFS technology, thereby achieving a strong correlation between the identifier and its source data. Finally, it uses blockchain and asymmetric encryption technology to achieve secure storage and transmission of identity certificates, identifiers, and their source data. This invention utilizes blockchain and ordered multi-group signature algorithms to ensure the security and reliability of the industrial internet identifier resolution system process, binding identifiers to source data to achieve source security of industrial internet identifiers and preventing malicious tampering of industrial internet identifiers and source data by enterprises.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] A secure and reliable distributed industrial internet identifier resolution method includes the following steps:

[0007] Step 1: Identifier structure setting, setting the identifier structure based on the hierarchical identifier resolution structure;

[0008] Step 2: Trusted Identity Authentication. Generate the identity certificate of the trusted node in the enterprise alliance in the distributed industrial internet identifier resolution system, and generate the parameters required for signature authentication. The enterprise alliance signs the digital certificate through the ordered multi-group signature algorithm.

[0009] Step 3: Trusted Identifier Registration. The identity-authenticated identifier registration node in the enterprise alliance registers a trusted identifier in the system. The enterprise alliance verifies the reliability of the identifier and signs the registered identifier through ordered multi-group signature.

[0010] Step 4: Identity Security Resolution. The identity holder confirms the identity of the registered node and the trustworthiness of the identity through the blockchain, and completes the identity security resolution using cryptographic technology.

[0011] Furthermore, in step 1, each identifier includes two parts: an identity identifier and a product identifier separated by a separator. The identity identifier is obtained by enterprises participating in the identifier resolution system by registering their identities in the enterprise alliance, and includes a first-level node code, a second-level node code, and an enterprise node code separated by a separator. The product identifier includes a serial number code, an IPFS mapping code, and a security code separated by a separator.

[0012] Furthermore, step 2 specifically includes the following process:

[0013] The system initializes by generating the necessary parameters for enterprise nodes to join the enterprise consortium and participate in signature authentication; it generates a key; the enterprise node sends its certificate information for registration to the enterprise consortium, and after verifying the enterprise's identity, the enterprise consortium sends a registration request to its superior node; then the superior node generates a public-private key pair (PK) for the enterprise. n SK n The digital certificate (DC) is then returned to the enterprise consortium; subsequently, the enterprise consortium performs an ordered multi-group signature (Sig) on ​​the certificate. a Finally, it is packaged into block Tx a Upload the identity authentication chain.

[0014] Furthermore, step 2 specifically includes the following sub-steps:

[0015] Sub-step 2-1: System initialization, generating the necessary parameters for enterprise nodes to join the enterprise alliance and participate in signature authentication, set 1. KK is a safety parameter. G0 is a bilinear multiplicative group of prime order p. The parameter K determines the size of the multiplicative group. e: G0 × G0 = G1 is a bilinear mapping. We choose g = {g1,...,g...} n} serves as the generator in G0; the parent node sets the security parameter K and constructs a random hash function H:{0,1}. * →Z p Select a random number x as the private key for each group, and calculate the public key PK for each group. Finally, the upper-level node publishes the system parameter param, with some parameters initialized as follows:

[0016] x = {x1,...,x} n}∈Z p (1)

[0017] PK = {PK1 = x1·g1,...,PK} n =x n ·g n} (2)

[0018] param={G0,G1,e,g,H,PK} (3)

[0019] Sub-step 2-2: Key generation. Member u generates a public-private key pair for signing when joining group m. u selects a random number SK. u =r∈Z p Use it as the private key, and generate the public key PK. u =r·g m Before generating the key, first check if the current public key in group m has not been registered. If it has not been registered, the parent node generates a public-private key pair {SK} for member u. u PK u};

[0020] Sub-steps 2-3: Identity Signature Authentication. First, the enterprise node submits relevant authentication materials to the enterprise consortium; then, the enterprise consortium submits a certificate generation request to the superior node; the superior node requests the CI information required for certificate creation from the enterprise node, generating the public / private key pair PK used by the enterprise node. n and SK n The upstream node will send the digital certificate (DC) and public key (PK). n A joint delivery enterprise alliance;

[0021] The enterprise consortium signed the content related to the digital certificate using an ordered multi-group signature algorithm:

[0022] The message Msg to be signed is as follows:

[0023] Msg = {PK n ,ts h ,DC} (4)

[0024] The first group is signed by member 'a', who obtains the hash value h = H(Msg) from the message to be signed, Msg, and then selects a random value r. s ∈Z p and generate group signature. as follows:

[0025]

[0026] parameter The calculation process is as follows:

[0027]

[0028]

[0029] In the second group, member b is responsible for signing. Similarly, the hash value h = H(Msg) is obtained from the message Msg. First, it checks if member a is a user of the first group. If so, it checks if member a is on the revocation list. If not, member a is a legitimate user, and its public key PK is used. a and signature Verification of signatures is required; the verification process is as follows:

[0030]

[0031] If the signature verification is successful, the ordered multi-signature process continues, and member b selects a random value r. s ∈Z p and generate group signature. as follows:

[0032]

[0033] parameter The calculation process is as follows:

[0034]

[0035]

[0036] The third group is signed by member c, who performs the same operation as member b, until the last group n, where member d is responsible for signing, thus obtaining the group signature.

[0037] Sub-steps 2-4: Certificate on-chain storage, and finally, packaging the relevant data into a block Tx. a After consensus-based accounting, the certificate is stored on the blockchain; at this point, the enterprise node has successfully passed identity authentication and joined the enterprise alliance; the identity authentication block Tx a as follows:

[0038] Txa ={PK n ,ts h ,DC,Sig a ,tid a} (12)

[0039] Among them, PK n For enterprise node public keys, ts h For timestamps, DC represents the information related to the enterprise node's digital certificate, and Sig... a For the ordered multi-group signature of the identity authentication block by the enterprise consortium, tid a This is the hash value of the first four items in the block.

[0040] Furthermore, step 3 specifically includes the following process:

[0041] First, the data collector gathers the identifier source data. r The identifier is then submitted to the identifier registration node for identifier registration; secondly, the identifier registration node generates the identifier key K. i And encrypt the source data to obtain encrypted source data Data. e The encrypted source data is uploaded to the IPFS server to obtain the returned mapping value CID; then, the identifier registration node combines the identifier public and private keys generated by the superior node to form the PK. i SK i A trusted identifier I is constructed and returned to the enterprise consortium; subsequently, the enterprise consortium performs an ordered multi-group signature Sig on the identifier. i Finally, it is packaged into block Tx i Upload the identifier registration chain.

[0042] Furthermore, step 3 specifically includes the following sub-steps:

[0043] Sub-step 3-1: Collect source data; all nodes within the enterprise alliance possess key pairs (PK). n and SK n Let its key pair be PK. rg and SK rg Each identifier has an identifier key pair (PK) for secure transmission. i and SK i First, the data collector gathers source data for the identified object and encapsulates it to obtain the identified source data (Data). r Subsequently, the Data r Uploaded to the identifier registration node; Identifier source data. r as follows:

[0044] Data r ={A d ,S d C d,F d Sig d} (13)

[0045] Among them, A d To identify the basic attributes of data, S d For serial number, C d To identify the specific content of an object, F d To identify object characteristics, Sig d For the data collector's signature on the data;

[0046] Sub-step 3-2: Trusted identifier generation, where the identifier registration node generates an identifier key K based on a symmetric encryption algorithm for the identifier. i and the source data Data r The data is encrypted using a symmetric key and uploaded to the IPFS server; the IPFS server stores the data and returns a mapped CID; the mapped CID is as follows:

[0047]

[0048] Identifying and registering nodes based on their own node identity and original data (Data) r Generate a relative prefix containing the identity code and serial number; identify the registered node by combining the relative prefix, CID, and identifier private key SK. i Generate a trusted identifier I and register it with the enterprise alliance; the trusted identifier I is as follows:

[0049] I = (prefix||CID||SK) i (15)

[0050] Sub-step 3-3: Identifier signature authentication. The enterprise alliance verifies the reliability of the identifier and signs the registered identifier Sig using an ordered multi-group signature based on elliptic curves. i The message Msg to be signed is as follows:

[0051] Msg = {PK rg ,ts h ,CID} (16)

[0052] The first group is signed by member 'a', who obtains the hash value h = H(Msg) from the message to be signed, Msg, and then selects a random value r. s ∈Z p and generate group signature. as follows:

[0053]

[0054] parameter The calculation process is as follows:

[0055]

[0056]

[0057] The second group is signed by member b. Similarly, the hash value h = H(Msg) is obtained from the message Msg. First, it is checked whether member a is a user of the first group. If so, member a is checked whether they belong to the revocation list. If not, member a is a legitimate user, and their public key PK is used. a and signature Verification of signatures is required; the verification process is as follows:

[0058]

[0059] If the signature verification is successful, the ordered multi-signature process continues, and member b selects a random value r. s ∈Z p and generate group signature. as follows:

[0060]

[0061] parameter The calculation process is as follows:

[0062]

[0063]

[0064] The third group is signed by member c, who performs the same operation as member b, until the last group n, where member d is responsible for signing, thus obtaining the group signature.

[0065] Sub-steps 3-4: The identifier is stored on the blockchain; finally, the enterprise consortium registers the identifier in block Tx. i Uploaded to the identifier registration chain; Identifier registration block Tx i as follows:

[0066] Tx i ={PK rg ,ts h ,CID,sig i ,tid i} (twenty four)

[0067] Among them, PK rg The public key that identifies the registered node, CID is the mapping value, and Sig... i For the ordered multi-group signature of the identifier registration block by the enterprise consortium, tid i This is the hash value of the first four items in the block.

[0068] Furthermore, step 4 specifically includes the following process:

[0069] First, the identifier resolution node verifies the legitimacy of existing identifiers through the identifier registration chain. Then, the identifier resolution node performs recursive resolution through recursive resolution nodes, which verify the identity legitimacy of the identifier resolution node through the identity authentication chain and simultaneously query the address of the identifier registration node. Finally, the identifier registration node uses the identifier public key PK... i Encryption identifier key K i Returns the parsing result, the identifier key K encrypted with the public key. t The identifier resolution node uses the identifier private key SK in the identifier. i Decrypt the parsing result to obtain the identification key K. i Simultaneously, it downloads encrypted identifier source data from the IPFS server using the CID in the identifier, and uses the identifier key K. i Decrypt to obtain the source identification data.

[0070] Furthermore, step 4 specifically includes the following sub-steps:

[0071] Sub-step 4-1: Blockchain confirmation. After the identifier resolution node receives the identifier, it first quickly queries the block Tx in the identifier storage chain based on the CID part of the identifier. i And obtain the public key PK of the registered node from it. rg After the identifier resolution node confirms the identifier's validity, it uses the node's private key SK. rs Perform the signature and send a resolution request (Request) to the recursive resolution node; the resolution request (Request) is as follows:

[0072]

[0073] In this process, the identifier resolution node performs hash encryption on the trusted identifier I in the resolution request to obtain H(I), thus preventing identifier data leakage. To identify the signature of the parsing node for this request;

[0074] Recursive parsing nodes will quickly query block Tx through the identity authentication chain. a Confirm the public key PK of the identifier resolution node. rs and identification registration node public key PK rg ;

[0075] Sub-step 4-2: Identity security resolution. The recursive resolution node obtains the location of the identity registration node through recursive resolution and sends a resolution request to it; the identity registration node will use the identity public key PK. i For the identification key K i Encryption yields the parsing result K. tFinally, the parsing result K is returned to the recursive parsing node. t ;Analysis result K t as follows:

[0076]

[0077] Sub-step 4-3: Obtain the identifier source data. After obtaining the parsed data, the identifier resolution node uses the security code SK. i Decryption yields the identification key K i And obtain encrypted data from the IPFS server using the CID. e Finally, the encrypted data is decrypted to obtain the source identification data (Data). r Identifier Source Data r as follows:

[0078]

[0079] This invention also provides a secure and reliable distributed industrial internet identifier resolution device, including an identifier structure setting module, a trusted identity authentication module, a trusted identifier registration module, and an identifier security resolution module. The identifier structure setting module is used to set the identifier structure based on a hierarchical identifier resolution structure, specifically implementing step 1. The trusted identity authentication module is used to generate identity certificates for trusted nodes in the enterprise alliance within the distributed industrial internet identifier resolution system, and to generate the parameters required for signature authentication, specifically implementing step 2. The trusted identifier registration module is used for identifier registration nodes in the enterprise alliance that have undergone identity authentication to register trusted identifiers within the system, specifically implementing step 3. The identifier security resolution module is used to confirm the identity of the registered nodes and the trustworthiness of the identifiers through blockchain, and to complete the identifier security resolution using cryptographic technology, specifically implementing step 4.

[0080] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0081] 1. This invention proposes an ordered multi-group signature algorithm suitable for industrial internet scenarios. Compared with traditional signature algorithms, it reduces the risk of system collapse caused by collusion or attack of a large number of low-level nodes in the industrial internet identifier resolution system at a lower cost.

[0082] 2. This invention proposes to add a reliable authentication mechanism to the industrial internet identifier resolution system to ensure the trustworthiness of the identifier registration nodes and identifier resolution nodes within the system, thereby reducing the risk of privacy data being leaked or tampered with within the system.

[0083] 3. This invention combines IPFS technology with encryption algorithms to store the identification source data in encrypted off-chain format. Compared with cloud storage or local storage, this makes the storage of the identification source data more secure and less susceptible to leakage or tampering.

[0084] 4. This invention achieves secure transmission of resolution results in the industrial internet identifier resolution system through an asymmetric encryption algorithm, which can effectively alleviate the problem of privacy data leakage during identifier resolution compared to plaintext transmission.

[0085] 5. By improving the identifier structure, this invention achieves a deep association between the identifier and its source data, which can effectively alleviate the problem of collusion between identifier registration nodes to forge identifiers. Attached Figure Description

[0086] Figure 1 The overall flowchart of the secure and reliable distributed industrial internet identifier resolution method provided in the embodiments of the present invention is shown.

[0087] Figure 2 This is a schematic diagram of the identifier structure according to an embodiment of the present invention.

[0088] Figure 3 This is a flowchart illustrating the trusted identity authentication process according to an embodiment of the present invention.

[0089] Figure 4 This is a flowchart illustrating the trusted identifier registration process according to an embodiment of the present invention.

[0090] Figure 5 This is a flowchart illustrating the identifier security parsing process according to an embodiment of the present invention. Detailed Implementation

[0091] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0092] This invention provides a secure and reliable distributed industrial internet identifier resolution method, the overall process of which is as follows: Figure 1 As shown. The first step of this method is to set up as follows: Figure 2 The identifier structure shown; see step two. Figure 3 Enterprise nodes submit certificate information to the enterprise consortium, which then initiates an authentication request to its superior node. The superior node generates a certificate and public / private keys for the enterprise node. The enterprise consortium performs ordered multi-factor group signatures on the certificate and public / private keys, packages the relevant information, and uploads it to the identity authentication chain. (See step 3 for further details.) Figure 4 The data collector first collects the source identification data. Then, the identification registration node generates an identification key to encrypt the source identification data and uploads the encrypted data to the IPFS server to obtain the mapping value CID. Subsequently, it combines this with the public and private keys provided by the upstream node to generate a trusted identification. Afterward, it registers the trusted identification with the enterprise consortium. The enterprise consortium performs ordered multi-signature processing on the trusted identification and packages the relevant information, uploading it to the identification registration chain. See step four for details. Figure 5The identifier resolution node first verifies the identifier's legitimacy through the identifier registration chain. After verification, it initiates a recursive request to the recursive resolution node. The recursive resolution node verifies its identity through the identity authentication chain and obtains the identifier registration node address. It then obtains the resolution result through recursive resolution. The identifier resolution node decrypts the result using the identifier's private key within the trusted identifier, downloads the encrypted identifier source data from the IPFS server using the CID within the trusted identifier, and finally decrypts the data using the resolution structure to obtain the identifier source data. Detailed implementation steps are as follows:

[0093] Step 1: Identifier structure setup, specifically based on a hierarchical identifier resolution structure. Each identifier can be divided into two parts: an identity identifier and a product identifier, separated by a " / ".

[0094] The first part is the identity identifier, which is obtained by participating enterprises registering their identities within the enterprise alliance. Each enterprise's identity identifier is unique, specifically consisting of three parts: a first-level node code, a second-level node code, and an enterprise node code, separated by ".". The first-level node code represents the country / region of the identifier owner and is represented by a three-digit fixed-length string; the second-level node code represents the industry domain of the identifier owner and is also represented by a three-digit fixed-length string; the enterprise node code represents the identifier owner's unique identity ID, which, to ensure the scalability of this invention, is represented by a variable-length string.

[0095] The second part is the product identifier, which can be divided into three parts: the serial number code, the IPFS mapping code, and the security code, separated by ".". The serial number code is a unique identifier for the identified object and also contains some product information, such as the current product quantity, device number, date, and timestamp. The IPFS mapping code is the returned mapping value obtained after encrypting and uploading the identifier source data to the IPFS server. This field binds the identifier to the source data; the code length is determined by the CID format of the mapping value returned by the IPFS server. The security code is the identifier's private key used when transmitting the identifier parsing result. During parsing, the identifier registration node encrypts the parsing result using the identifier's public key and transmits it. The result can be decrypted using the private key; the code length depends on the private key length.

[0096] Step 2: Trusted Identity Authentication. This step generates identity certificates for trusted nodes within the enterprise consortium in the distributed industrial internet identifier resolution system, and generates the parameters required for signature authentication. It includes the following sub-steps:

[0097] Sub-step 2-1: System initialization, generating the necessary parameters for enterprise nodes to join the enterprise alliance and participate in signature authentication, set 1. KK is a safety parameter, where G0 is a bilinear multiplicative group of prime order p. The parameter K determines the size of the multiplicative group. e: G0 × G0 = G1 is a bilinear mapping, and g = {g1,...,g...} is chosen. n} serves as the generator in G0. The parent node sets the security parameter K and constructs a random hash function H:{0,1}. * →Z p Z p It is a finite field of order p. A random number x is selected as the private key for each group, and the public key PK for each group is calculated. Finally, the parent node publishes the system parameter param. Some parameters are initialized as follows:

[0098] x = {x1,...,x} n}∈Z p (1)

[0099] PK = {PK1 = x1·g1,...,PK} n =x n ·g n} (2)

[0100] param={G0,G1,e,g,H,PK} (3)

[0101] Sub-step 2-2: Key generation. When member u joins group m, a public-private key pair needs to be generated for signing. u selects a random number SK. u =r∈Z p Use it as the private key, and generate the public key PK. u =r·g m Before generating the key, first check if the current public key has not been registered in group m. If NotRegister(L) is not registered, then... m PK u If ) = True, then the parent node generates a public / private key pair {SK} for member u. u PK u}, L m This represents the list of users in group m.

[0102] Sub-steps 2-3: Identity Signature Authentication. First, the enterprise node submits relevant authentication materials to the enterprise consortium. Then, the enterprise consortium submits a certificate generation request to the superior node. The superior node requests the necessary information (CI) from the enterprise node to generate the public-private key pair (PK) used by the enterprise node. n and SK n The upstream node will send the digital certificate (DC) and public key (PK). n A joint delivery enterprise alliance.

[0103] The enterprise consortium signed the content related to this digital certificate using an ordered multi-group signature algorithm. The message to be signed, Msg, is as follows:

[0104] Msg = {PK n ,ts h ,DC} (4)

[0105] The first group is signed by member 'a', who obtains the hash value h = H(Msg) from the message to be signed, Msg, and then selects a random value r. s ∈Z p and generate group signature. as follows:

[0106]

[0107] parameter The calculation process is as follows:

[0108]

[0109]

[0110] in, SK represents the ordinate of point P1 on the elliptic curve. a This is the private key that member a obtained after registering within the system;

[0111] The second group is signed by member b. Similarly, the hash value h = H(Msg) is obtained from the message Msg. First, it is checked whether member a is a user of the first group. If IsUser(L1,PK) is a user of the first group, then... a If NotRevoke(L1, PK) = True, then check if member a belongs to the revocation list. a If ) = True, then member a is a legitimate user, and member a's public key PK is used. a and signature Verification of the signature is required. The verification process is as follows:

[0112]

[0113] If the signature verification is successful, the ordered multi-signature process continues, and member b selects a random value r. s ∈Z p and generate group signature. as follows:

[0114]

[0115] parameter The calculation process is as follows:

[0116]

[0117]

[0118] The third group is signed by member c, who performs the same operation as member b, until the last group n, where member d is responsible for signing, thus obtaining the group signature.

[0119] Sub-steps 2-4: Certificate on-chain storage, and finally, packaging the relevant data into a block Tx. a After consensus-based accounting, the certificate is stored on the blockchain. At this point, the enterprise node has successfully passed identity authentication and joined the enterprise consortium. Identity authentication block Tx a as follows:

[0120] Tx a ={PK n ,ts h ,DC,Sig a ,tid a} (12)

[0121] Among them, PK n For enterprise node public keys, ts h For timestamps, DC represents the information related to the enterprise node's digital certificate, and Sig... a For the ordered multi-group signature of the identity authentication block by the enterprise consortium, tid a This is the hash value of the first four items in the block.

[0122] Step 3: Trusted Identifier Registration. This step involves the identity-authenticated identifier registration node within the enterprise alliance registering trusted identifiers within the system. Its implementation consists of the following sub-steps:

[0123] Sub-step 3-1: Collect source data; all nodes within the enterprise alliance possess key pairs (PK). n and SK n To distinguish and identify registered nodes, let their key pair be PK. rg and SK rg Each identifier has an identifier key pair (PK) for secure transmission. i and SK i First, the data collector gathers source data for the identified object and encapsulates it to obtain the identified source data (Data). r Subsequently, the Data r Uploaded to the identifier registration node. Identifier source data. r as follows:

[0124] Data r ={A d ,S d C d ,F d Sig d} (13)

[0125] Among them, Ad To identify basic data attributes, it can be used in industrial processes, including object classification, object name, and model specifications. d This is a serial number used to ensure the uniqueness of the identified object. Enterprises can add timestamps, production location, and other semantic information to it as needed. d To identify the specific content of the object. F d To identify object characteristics, different products will extract key features as needed to ensure a strong link between the identifier and the object. d This signature by the data collector can be used to detect whether the data has been tampered with. If a data problem is found, the responsible parties can be quickly held accountable.

[0126] Sub-step 3-2: Trusted identifier generation, where the identifier registration node generates an identifier key K based on a symmetric encryption algorithm for the identifier. i and the source data Data r The encrypted source data (Data) is obtained by encrypting with a symmetric key. e The data is then uploaded to the IPFS server. The IPFS server stores the data and returns a mapped CID. The mapped CID is as follows:

[0127]

[0128] in, This refers to encryption using a common symmetric encryption algorithm (such as AES), with the symmetric key being K. i .

[0129] Identifying and registering nodes based on their own node identity and original data (Data) r Generate a relative prefix containing the identity code and serial number. Identify the registered node by combining the relative prefix, CID, and identifier private key SK. i Generate a trusted identifier I and register it with the enterprise alliance. The trusted identifier I is as follows:

[0130] I = (prefix||CID||SK) i (15)

[0131] Sub-step 3-3: Identifier signature authentication. The enterprise alliance verifies the reliability of the identifier and signs the registered identifier Sig using an ordered multi-group signature based on elliptic curves. i The message Msg to be signed is as follows:

[0132] Msg = {PK rg ,ts h ,CID} (16)

[0133] The first group is signed by member 'a', who obtains the hash value h = H(Msg) from the message to be signed, Msg, and then selects a random value r. s ∈Z p and generate group signature. as follows:

[0134]

[0135] parameter The calculation process is as follows:

[0136]

[0137]

[0138] The second group is signed by member b. Similarly, the hash value h = H(Msg) is obtained from the message Msg. First, it is checked whether member a is a user of the first group. If IsUser(L1,PK) is a user of the first group, then... a If NotRevoke(L1, PK) = True, then check if member a belongs to the revocation list. a If ) = True, then member a is a legitimate user, and member a's public key PK is used. a and signature Verification of the signature is required. The verification process is as follows:

[0139]

[0140] If the signature verification is successful, the ordered multi-signature process continues, and member b selects a random value r. s ∈Z p and generate group signature. as follows:

[0141]

[0142] parameter The calculation process is as follows:

[0143]

[0144]

[0145] The third group is signed by member c, who performs the same operation as member b, until the last group n, where member d is responsible for signing, thus obtaining the group signature.

[0146] Sub-steps 3-4: The identifier is stored on the blockchain; finally, the enterprise consortium registers the identifier in block Tx. i Uploaded to the identifier registration chain. Identifier registration block Tx i as follows:

[0147] Tx i ={PK rg ,ts h ,CID,sig i ,tid i} (twenty four)

[0148] Among them, PK rg The public key that identifies the registered node; CID is the mapped value. Sig i For the ordered multi-group signature of the identifier registration block by the enterprise consortium, tid i This is the hash value of the first four items in the block.

[0149] Step 4: Identity Security Resolution. In this step, the identity holder confirms the identity of the registered node and the trustworthiness of the identity through the blockchain, and completes the identity security resolution using cryptographic technology. Its implementation consists of the following sub-steps:

[0150] Sub-step 4-1: Blockchain confirmation. After the identifier resolution node receives the identifier, it first quickly queries the block Tx in the identifier storage chain based on the CID part of the identifier. i And obtain the public key PK of the registered node from it. rg After the identifier resolution node confirms the identifier's validity, it uses the node's private key SK. rs Perform the signature and send a resolution request (Request) to the recursive resolution node. The resolution request is as follows:

[0151]

[0152] In this process, the identifier resolution node performs hash encryption on the trusted identifier I in the resolution request to obtain H(I), thus preventing identifier data leakage. This is used to identify the signature of the request from the parsing node.

[0153] Recursive parsing nodes will quickly query block Tx through the identity authentication chain. a Confirm the identity PK of the identifier resolution node. rs And the identity comparison of the registered node rg .

[0154] Sub-step 4-2: Identity security resolution. The recursive resolution node obtains the location of the identity registration node through recursive resolution and sends a resolution request to it. The identity registration node will use the identity public key PK... i For the identification key K i Encryption yields the parsing result K t Finally, the parsing result K is returned to the recursive parsing node. t Analysis result K t as follows:

[0155]

[0156] Sub-step 4-3: Obtain the identifier source data. After obtaining the parsed data, the identifier resolution node uses the security code SK. i Decryption yields the identification key K i And obtain encrypted data from the IPFS server using the CID. e Finally, the encrypted data is decrypted to obtain the source identification data (Data). r Identifier Source Data r as follows:

[0157]

[0158] Based on the same inventive concept, the present invention provides a secure and reliable distributed industrial internet identifier resolution device, comprising an identifier structure setting module, a trusted identity authentication module, a trusted identifier registration module, and an identifier security resolution module. The identifier structure setting module is used to set the identifier structure based on a hierarchical identifier resolution structure, specifically implementing step 1; the trusted identity authentication module is used to generate identity certificates for trusted nodes in the enterprise alliance within the distributed industrial internet identifier resolution system, and to generate the parameters required for signature authentication, specifically implementing step 2; the trusted identifier registration module is used for identifier registration nodes in the enterprise alliance that have undergone identity authentication to register trusted identifiers within the system, specifically implementing step 3; the identifier security resolution module is used to confirm the identity of the registered nodes and the trustworthiness of the identifiers through blockchain, and to complete the identifier security resolution using cryptographic technology, specifically implementing step 4.

[0159] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. A secure and reliable distributed industrial internet identifier resolution method, characterized in that, Includes the following steps: Step 1: Identifier structure setting, setting the identifier structure based on the hierarchical identifier resolution structure; Step 2: Trusted Identity Authentication. This involves generating identity certificates for trusted nodes within the enterprise consortium within the distributed industrial internet identifier resolution system, and generating the parameters required for signature authentication. The enterprise consortium then signs the digital certificate using an ordered multi-group signature algorithm. Step 2 specifically... Includes the following processes: The system initializes and generates the necessary parameters for enterprise nodes to join the enterprise alliance and participate in signature authentication. Generate a key; The enterprise node sends the certificate information for registration to the enterprise consortium. After verifying the enterprise identity, the enterprise consortium sends a registration request to the superior node. Then the upstream node generates a public-private key pair for the enterprise. , and digital certificates It is then returned to the enterprise consortium; subsequently, the enterprise consortium performs ordered multi-signature group signing on the certificate. Finally, package it into blocks. Upload the identity verification chain; Specifically, it includes the following sub-steps: Sub-step 2-1: System initialization, generating the necessary parameters for enterprise nodes to join the enterprise alliance and participate in signature authentication. It is a safety parameter. It has prime order Bilinear multiplicative group, parameters Determine the size of the multiplication group. It is a bilinear mapping, choose As Generators in; Setting security parameters for the parent node And construct a random hash function , It is a finite field of order p; Select random number Given the private keys of each group, calculate the public keys of each group. Ultimately, the superior node publishes the system parameters. Some parameters are initialized as follows: Sub-step 2-2: Key generation. Member u generates a public-private key pair for signing when joining group m. u selects a random number. Used as the private key, and used to generate the public key. Before generating the key, first check if the current public key in group m has not been registered. If it has not been registered, the parent node generates a public-private key pair for member u. , This represents the list of users in group m. Sub-steps 2-3: Identity Signature Authentication. First, the enterprise node submits relevant authentication materials to the enterprise alliance. Then, the enterprise consortium submits a certificate generation request to the superior node; The upstream node requests the necessary CI information from the enterprise node to create the certificate, and generates the public / private key pair used by the enterprise node. and ; The upper-level node will use the digital certificate and public key A joint delivery enterprise alliance; The enterprise consortium signed the content related to the digital certificate using an ordered multi-group signature algorithm: message awaiting signature as follows: The first group is signed by member A, who uses the information to be signed. Get hash value Then select a random value and generate group signature. as follows: parameter The calculation process is as follows: The second group is signed by member b, also via message. Get hash value First, check if member 'a' is a user of the first group. If so, check if member 'a' is on the revocation list. If not, member 'a' is a legitimate user, and member 'a''s public key is used. and signature Verification of signatures is required; the verification process is as follows: If the signature verification is successful, the ordered multi-signature process continues, and member b selects a random value. and generate group signature. as follows: parameter The calculation process is as follows: The third group is signed by member c, who performs the same operation as member b, until the last group n, where member d is responsible for signing, thus obtaining the group signature. ; Sub-steps 2-4: Certificates are stored on the blockchain, and finally, the relevant data is packaged into blocks. After consensus-based accounting, the certificate is stored on the blockchain; at this point, the enterprise node has successfully passed identity authentication and joined the enterprise alliance; the identity authentication block... as follows: in, For enterprise node public keys, For timestamps, This pertains to the enterprise's node digital certificate. For enterprise consortiums to perform ordered multi-group signatures on identity authentication blocks, This is the hash value of the first four items in the block; Step 3: Trusted Identifier Registration. The identity-authenticated identifier registration node in the enterprise alliance registers a trusted identifier in the system. The enterprise alliance verifies the reliability of the identifier and signs the registered identifier through ordered multi-group signature. Step 4: Identity Security Resolution. The identity holder confirms the identity of the registered node and the trustworthiness of the identity through the blockchain, and completes the identity security resolution using cryptographic technology.

2. The secure and reliable distributed industrial internet identifier resolution method according to claim 1, characterized in that, In step 1, each identifier includes two parts: an identity identifier and a product identifier, separated by a separator. The identity identifier is obtained by enterprises participating in the identifier resolution system by registering their identities in the enterprise alliance, and includes a first-level node code, a second-level node code, and an enterprise node code, separated by a separator. The product identifier includes a serial number code, an IPFS mapping code, and a security code, separated by a separator.

3. The secure and reliable distributed industrial internet identifier resolution method according to claim 1, characterized in that, Step 3 is specifically... Includes the following processes: First, the data collectors collect the identifier source data. And submit it to the identifier registration node for identifier registration; Secondly, the identifier registration node generates the identifier key. The source data is then encrypted to obtain encrypted source data. Upload the encrypted source data to the IPFS server to obtain the returned mapping value. Then, the identifier registration node combines the identifier public / private key pair generated by the superior node. , Building Trusted Identifiers And then return it to the enterprise alliance; the enterprise alliance then performs ordered multi-group signatures on the identifier. Finally, package it into blocks. Upload the identifier registration chain.

4. The secure and reliable distributed industrial internet identifier resolution method according to claim 3, characterized in that, Step 3 specifically includes the following sub-steps: Sub-step 3-1: Collect source data; all nodes within the enterprise alliance possess key pairs. and Let its key pair be and Each identifier has an identifier key pair for secure transmission. and First, the data collector gathers source data for the identified object and encapsulates it to obtain the identified source data. ; then, Uploaded to the identifier registration node; Identifier source data as follows: in, To identify the basic attributes of the data, For serial number, To identify the specific content of the object, To identify object characteristics, For the data collector's signature on the data; Sub-step 3-2: Trusted identifier generation, where the identifier registration node generates an identifier key based on a symmetric encryption algorithm for the identifier. and the source data The data is encrypted using a symmetric key and uploaded to the IPFS server; the IPFS server stores the data and returns a mapping. Mapping value as follows: Identifying and registering nodes based on their own node identity and original data Generate a relative prefix containing the identity code and serial number. ; Identifying the registration node combined with the relative prefix , and identification private key Generate trusted identifiers And register the identifier with the enterprise alliance; trusted identifier. as follows: Sub-step 3-3: Identifier signature authentication. The enterprise alliance verifies the reliability of the identifier and signs the registered identifier using an ordered multi-group signature based on elliptic curves. Message pending signature as follows: The first group is signed by member A, who uses the information to be signed. Get hash value Then select a random value and generate group signature. as follows: parameter The calculation process is as follows: The second group is signed by member b; the hash value is also obtained through the message Msg. First, check if member 'a' is a user of the first group. If so, check if member 'a' is on the revocation list. If not, member 'a' is a legitimate user, and member 'a''s public key is used. and signature Verification of signatures is required; the verification process is as follows: If the signature verification is successful, the ordered multi-signature process continues, and member b selects a random value. and generate group signature. as follows: parameter The calculation process is as follows: The third group is signed by member c, who performs the same operation as member b, until the last group n, where member d is responsible for signing, thus obtaining the group signature. ; Sub-steps 3-4: Identifying and storing the identifier on the blockchain; finally, the enterprise consortium registers the identifier in the blockchain. Uploaded to the identifier registration chain; identifier registration block as follows: in, The public key used to identify the registered node, For mapping values, For the enterprise consortium to perform ordered multi-group signatures on the identifier registration block. This is the hash value of the first four items in the block.

5. The secure and reliable distributed industrial internet identifier resolution method according to claim 1, characterized in that, Step 4 specifically includes the following process: First, the identifier resolution node verifies the legitimacy of existing identifiers through the identifier registration chain; then, the identifier resolution node performs recursive resolution through the recursive resolution node, which verifies the legitimacy of the identifier resolution node's identity through the identity authentication chain, and at the same time queries the address of the identifier registration node; Identifying the registration node through the identifier public key Encryption identification key Returns the parsing result, the identifier key encrypted with the public key. The identifier resolution node uses the identifier's private key within the identifier. Decrypt the parsing result to obtain the identification key. At the same time, through the sign Download encrypted identifier source data from the IPFS server and use the identifier key. Decrypt to obtain the source identification data.

6. The secure and reliable distributed industrial internet identifier resolution method according to claim 5, characterized in that, Step 4 specifically includes the following sub-steps: Sub-step 4-1: Blockchain confirmation. After the identifier resolution node receives the identifier, it first confirms the identifier based on the information in the identifier. Some blocks are quickly queried in the identifier storage chain. And obtain the public key of the registered node from it. ; After the identifier resolution node confirms the identifier's validity, it uses the node's private key. Perform the signature and send a resolution request to the recursive resolution node. ; Parse request as follows: In this process, the identifier resolution node obtains the trusted identifier I through hash encryption in the resolution request. To prevent the leakage of identification data, To identify the signature of the parsing node for this request; Recursive parsing nodes will quickly query blocks through the identity authentication chain. Confirm the public key of the identifier resolution node. and the public key of the identification registration node ; Sub-step 4-2: Identity security resolution. The recursive resolution node obtains the location of the identity registration node through recursive resolution and sends a resolution request to it; the identity registration node will use the identity public key... For identification key Encryption is performed to obtain the parsing result. Finally, the parsing result is returned to the recursive parsing node. ; Analysis results as follows: Sub-step 4-3: Obtain the identifier source data. After obtaining the parsed data, the identifier resolution node uses the security code. Decryption yields the identification key. And obtain encrypted data from the IPFS server via CID. Finally, the encrypted data is decrypted to obtain the source identification data. ; Identifier source data as follows: 。 7. A secure and reliable distributed industrial internet identifier resolution device, characterized in that, The system includes an identifier structure setting module, a trusted identity authentication module, a trusted identifier registration module, and an identifier security parsing module. The identifier structure setting module is used to set the identifier structure based on a hierarchical identifier parsing structure, specifically implementing step 1 of the secure and trusted distributed industrial internet identifier parsing method described in any one of claims 1-6. The trusted identity authentication module is used to generate identity certificates for trusted nodes in the enterprise alliance within the distributed industrial internet identifier parsing system and generate parameters required for signature authentication, specifically implementing step 2 of the secure and trusted distributed industrial internet identifier parsing method described in any one of claims 1-6. The trusted identifier registration module is used for identifier registration nodes in the enterprise alliance that have undergone identity authentication to register trusted identifiers within the system, specifically implementing step 3 of the secure and trusted distributed industrial internet identifier parsing method described in any one of claims 1-6. The identifier security parsing module is used to confirm the identity of the registered node and the trustworthiness of the identifier through blockchain and to complete the identifier security parsing using cryptographic technology, specifically implementing step 4 of the secure and trusted distributed industrial internet identifier parsing method described in any one of claims 1-6.

Images