End node authentication method and apparatus, electronic device, and storage medium

Abstract

The application provides an end node authentication method and device, electronic equipment and a storage medium, and belongs to the technical field of communication. The method is applied to a trusted agent edge node and includes receiving an authentication request sent by any to-be-authenticated end node and carrying a first area identifier of an area authentication network domain where the to-be-authenticated end node is located, checking the first area identifier, and returning an authentication pass response carrying an authentication certificate to the to-be-authenticated end node when the checking is passed. When authenticating the end node to join a computing power network, the application no longer checks by a unified authentication center, but checks by the end node to the trusted agent node in the distributed area authentication network domain corresponding to the computing power network intended to be joined, overcomes the performance challenge brought by the unified verification to the authentication center in a complex computing power network environment, improves the speed of end node authentication, and avoids the adverse effect of slow authentication speed on the computing performance of the computing power network.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to an end node authentication method and device, electronic equipment and a storage medium. BACKGROUND

[0002] With the substantial increase in the demand for data resource storage, calculation and application in society, the computing power network is continuously developing. At this time, the computing power network stores a large amount of sensitive data including personal identity information, financial data, transaction records, traffic management and the like. However, in the process of joining the computing power network by the end nodes in various application scenarios, threat sources such as hacker attacks, data leakage, malicious software and network viruses continuously threaten the security of the computing power network, bringing serious security risks to the entire computing power network system.

[0003] Among them, the identity authentication of the end node when joining the computing power network as the first door of security protection is a key step to ensure access control and security protection.

[0004] At present, when the end node joins the computing power network, it often undergoes authentication by a unified identity authentication center, that is, after designing a unified identity authentication center, permission authentication is performed by using a C / S structure.

[0005] However, this end node authentication method cannot meet the complex computing power network environment, because in the huge computing power network environment, if all end nodes undergo authentication and authorization by a unified identity authentication center, it will inevitably bring great performance challenges to the authentication center, slow down the speed of end node authentication, and even affect the computing performance of the computing power network. SUMMARY

[0006] The present application provides an end node authentication method, device, electronic equipment and storage medium to solve the defects of authentication and authorization of end nodes by a unified identity authentication center in the prior art, and to realize a method of authenticating end nodes by a trusted proxy edge node.

[0007] In a first aspect, the present application provides an end node authentication method applied to a trusted proxy edge node, comprising:

[0008] receiving an authentication request sent by any to-be-authenticated end node, the authentication request carrying at least a first regional identifier of a regional authentication network domain where the to-be-authenticated end node is located;

[0009] verifying the first regional identifier, and if the verification is passed, returning an authentication pass response to the to-be-authenticated end node, the authentication pass response carrying an authentication certificate;

[0010] The regional authentication network domain is determined according to an end node set of each edge node in a network region where the to-be-authenticated end node is located, and the end node set is a set of all end nodes establishing node association with the edge node.

[0011] According to the end node authentication method provided by the application, the first regional identifier is verified, and the verification includes:

[0012] A first comparison result of the first regional identifier and a second regional identifier of a regional authentication network domain where the trusted proxy edge node is located is obtained.

[0013] If the first comparison result is consistent, it is determined that the verification is passed.

[0014] According to the end node authentication method provided by the application, if the first comparison result is inconsistent, a third regional identifier is called from the authentication request of the to-be-authenticated end node, and the third regional identifier is a regional identifier of a regional authentication network domain where the to-be-authenticated end node is located last time.

[0015] A second comparison result of the third regional identifier and a fourth regional identifier is obtained, and the fourth regional identifier is a regional identifier of a regional authentication network domain where the trusted proxy edge node is located last time.

[0016] If the second comparison result is consistent, it is determined that the verification is passed.

[0017] According to the end node authentication method provided by the application, the regional authentication network domain is constructed in advance by using the following steps, and the steps include:

[0018] It is determined whether a preset trigger condition is met.

[0019] When it is determined that the preset trigger condition is met, a hash value of identity information of all end nodes establishing node association with the trusted proxy edge node is calculated, and an end node set of the trusted proxy edge node is constructed.

[0020] Authentication network domain reconstruction information is broadcasted in the network region, and the authentication network domain reconstruction information at least carries a current timestamp, reconstruction notification information, a fingerprint ID and an end node set of the trusted proxy edge node.

[0021] Response information broadcasted by any other edge node in the network region in response to the authentication network domain reconstruction information is received, and the response information at least includes a current timestamp, reconstruction feedback information, a fingerprint ID and an end node set of the any other edge node.

[0022] A proportion of the reconstruction feedback information in the response information that agrees to reconstruct the authentication network domain is counted.

[0023] If the proportion is greater than a first threshold, a maximum intersection of all the end node sets is obtained, the regional authentication network domain is constructed, and a local end node list is generated.

[0024] According to the end node authentication method provided by the application, after the regional authentication network domain is constructed and the local end node list is generated, the method further comprises:

[0025] An authentication application for the regional authentication network domain is submitted to an authentication center, and the authentication application comprises a regional identifier of the regional authentication network domain and the local end node list.

[0026] An authentication certificate returned by the authentication center is received, and the authentication certificate comprises a session key between nodes in the regional authentication network domain.

[0027] A hash digest of the local end node list, a fingerprint ID of the trusted proxy edge node, a current time stamp and the authentication certificate are broadcasted to be synchronized to other edge nodes and end nodes in the network region.

[0028] According to the end node authentication method provided by the application, after the hash digest of the local end node list, the fingerprint ID of the trusted proxy edge node, the current time stamp and the authentication certificate are broadcasted to be synchronized to other edge nodes and end nodes in the network region, the method further comprises:

[0029] An encrypted conversation between any two end nodes in the same regional authentication network domain is performed by using the session key.

[0030] According to the end node authentication method provided by the application, the method further comprises:

[0031] Before any end node initiates a session request to another end node in a different regional authentication network domain, an entry domain authentication request is sent to a trusted proxy edge node in the regional authentication network domain where the another end node is located.

[0032] After the entry domain authentication request, an encrypted conversation between the any end node and the another end node is performed by using a session key of the regional authentication network domain where the another end node is located.

[0033] According to the end node authentication method provided by the application, the trusted proxy edge node is elected from all edge nodes in the network region periodically.

[0034] According to the end node authentication method provided by the application, all edge nodes in the network region are registered in a registration center in advance, and a registration process of any edge node comprises:

[0035] The edge node sends an edge node registration request to the registration center, the edge node registration request at least including identity information of the edge node;

[0036] The registration center generates registration information based on a bilinear mapping after checking that the identity information is correct, and sends the registration information to the edge node and synchronizes the registration information to the authentication center;

[0037] The edge node generates an edge node private key and an edge node public key based on the registration information, and sends the edge node private key, the edge node public key, and a current timestamp to the registration center;

[0038] The registration center generates a digital certificate according to a private key of the registration center, the edge node public key, and the identity information of the edge node, and sends the digital certificate to the edge node and synchronizes the digital certificate to a blockchain.

[0039] According to the end node authentication method provided by the application, all end nodes in the network area are pre-registered in the registration center, and the registration process of any end node includes:

[0040] The end node sends an end node registration request to the registration center, the end node registration request at least including identity information of the end node, and the identity information at least including information about whether the end node is a fixed end node;

[0041] The registration center responds to the end node registration request, hashes the identity information of the end node to obtain a first hash value, hashes a random number using a private key of the registration center to obtain a second hash value, and determines a chaotic mapping value according to the first hash value and the second hash value;

[0042] The registration center uploads the chaotic mapping value and the identity information of the end node to a blockchain, and synchronizes the chaotic mapping value and the identity information of the end node to the end node.

[0043] According to the end node authentication method provided by the application, the determination of whether the preset trigger condition is met includes:

[0044] Determining a proportion of edge nodes whose number of end nodes in a network area is greater than a second threshold value;

[0045] If the proportion is greater than a third threshold value, calculating a benefit value of all end nodes;

[0046] If the benefit value is greater than a fourth threshold value, it is determined that the preset trigger condition is met;

[0047] The benefit value is determined based on a regional authentication energy of all end nodes and a time delay benefit value.

[0048] In a second aspect, the application further provides an end node authentication method applied to a to-be-authenticated end node, and the method includes:

[0049] sending an authentication request to a trusted proxy edge node, the authentication request carrying at least a first region identifier of a region authentication network domain in which the to-be-authenticated end node is located;

[0050] receiving an authentication pass response returned by the trusted proxy edge node, the authentication pass response carrying an authentication certificate, the authentication pass response being returned by the trusted proxy edge node after the first region identifier is verified to pass;

[0051] The region authentication network domain is determined according to an end node set of each edge node in a network region in which the to-be-authenticated end node is located, and the end node set is a set of all end nodes establishing node association with the edge node.

[0052] In a third aspect, the present application provides an end node authentication device, comprising:

[0053] An authentication request receiving unit is configured to receive an authentication request sent by any to-be-authenticated end node, the authentication request carrying at least a first region identifier of a region authentication network domain in which the to-be-authenticated end node is located;

[0054] A region identifier verifying unit is configured to verify the first region identifier, and return an authentication pass response to the to-be-authenticated end node if the verification passes, the authentication pass response carrying an authentication certificate;

[0055] The region authentication network domain is determined according to an end node set of each edge node in a network region in which the to-be-authenticated end node is located, and the end node set is a set of all end nodes establishing node association with the edge node.

[0056] In a fourth aspect, the present application provides an end node authentication device, comprising:

[0057] An authentication request sending unit is configured to send an authentication request to a trusted proxy edge node, the authentication request carrying at least a first region identifier of a region authentication network domain in which the to-be-authenticated end node is located;

[0058] An authentication pass response receiving unit is configured to receive an authentication pass response returned by the trusted proxy edge node, the authentication pass response carrying an authentication certificate, the authentication pass response being returned by the trusted proxy edge node after the first region identifier is verified to pass;

[0059] The region authentication network domain is determined according to an end node set of each edge node in a network region in which the to-be-authenticated end node is located, and the end node set is a set of all end nodes establishing node association with the edge node.

[0060] In a fifth aspect, the present application also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the end node authentication method according to any one of the above aspects when executing the program.

[0061] In a sixth aspect, the present application also provides a non-transitory computer readable storage medium, having stored thereon a computer program, wherein the computer program is executable on a processor to implement the end node authentication method according to any one of the above aspects.

[0062] The end node authentication method, device, electronic device, and storage medium provided by the present application can overcome the performance challenge brought by the unified authentication center in the complex computing power network environment, improve the speed of end node authentication, and avoid the adverse effect of slow authentication speed on the computing performance of the computing power network. BRIEF DESCRIPTION OF DRAWINGS

[0063] In order to more clearly illustrate the technical solutions in the present application or prior art, the following will briefly introduce the drawings needed in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0064] Figure 1 is one of the flowcharts of the end node authentication method provided by the present application;

[0065] Figure 2 is another flowchart of the end node authentication method provided by the present application;

[0066] Figure 3 is the flowchart of constructing the regional authentication network domain provided by the present application;

[0067] Figure 4 is the flowchart of the regional authentication network domain authenticating to the authentication center provided by the present application;

[0068] Figure 5 is the timing diagram of the edge node registration provided by the present application;

[0069] Figure 6 is the timing diagram of the end node registration provided by the present application;

[0070] Figure 7 is the third flowchart of the end node authentication method provided by the present application;

[0071] Figure 8 is a structural schematic diagram of an end node authentication device provided by the present application;

[0072] Figure 9 is a structural schematic diagram of an end node authentication device provided by the present application;

[0073] Figure 10 is a structural schematic diagram of an electronic device provided by the present application. DETAILED DESCRIPTION

[0074] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below in combination with the drawings in the present application. Obviously, the described embodiments are some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the present application.

[0075] It should be noted that in the description of the present application, the terms “comprise”, “contain” or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitation, the element defined by the statement “comprises a” does not exclude the presence of another identical element in the process, method, article or device comprising the element. The specific meaning of the above terms in the present application can be understood by those skilled in the art according to specific circumstances.

[0076] The terms “first”, “second” and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by “first”, “second” and the like are generally of a kind, and are not limited to the number of objects, for example, the first object can be one or more.

[0077] The end node authentication method, device, electronic device and storage medium provided by the present application will be described below in combination with Figures 1-10 The end node authentication method, device, electronic device and storage medium provided by the present application will be described below in combination with

[0078] With the penetration of new technologies such as 5G, artificial intelligence and Internet of Things into various fields, the demand for data resource storage, calculation and application in the society has greatly increased, and the computing power network has been continuously developed and widely applied in various fields.

[0079] At the same time, the computing power network stores a large amount of sensitive data including personal identity information, financial data, transaction records, traffic management and the like. However, in the process of joining the computing power network by the end nodes in various application scenarios, threat sources such as hacker attacks, data leakage, malicious software and network viruses continuously threaten the security of the computing power network, which brings serious security risks to the entire computing power network system.

[0080] Therefore, in order to ensure the security of the computing power network, comprehensive security measures and strategies must be taken. Among them, the identity authentication of the end node when joining the computing power network is the first door of security protection, which is a key step to ensure access control and security protection.

[0081] In the computing power network architecture, the computing power network nodes can be divided into cloud nodes, edge nodes and end nodes according to levels and regions.

[0082] The end nodes can be divided into location-fixed end nodes and location-movable end nodes, and the location-movable end nodes include but are not limited to mobile phones, notebooks, intelligent networked vehicles and the like, and the location-fixed end nodes include but are not limited to desktop computers, servers placed in data centers or machine rooms and the like. In the case of the existence of location-fixed nodes and location-movable nodes, the network composed of the end nodes is a topology network structure that changes dynamically at any time.

[0083] The edge nodes include but are not limited to one or more of roadside computing nodes, regional computing nodes, edge computing nodes and the like.

[0084] The cloud node refers to a node providing cloud resource services, including video, text, voice, computing power and the like.

[0085] In addition, the computing power network architecture also includes a unified identity registration center and an authentication center, and the corresponding registration center can be used for the registration of the cloud nodes, the edge nodes and the end nodes, and the authentication center is used for the verification and authentication of the end nodes when joining the computing power network.

[0086] At present, when the end node joins the computing power network, it often needs to pass through the authentication of the unified identity authentication center, that is, after designing a unified identity authentication center, the C / S structure is adopted for permission authentication.

[0087] However, this end node authentication method cannot meet the complex computing power network environment, because in the case of a huge computing power network environment, if all the end nodes are authenticated and authorized by the unified identity authentication center, it will inevitably bring great performance challenges to the authentication center, slow down the speed of end node authentication, and even affect the computing performance of the computing power network.

[0088] Figure 1 is one of the flowcharts of the end node authentication method provided by the present application, asFigure 1 As shown, the end node authentication method is applied to a trusted proxy edge node, and includes but is not limited to the following steps:

[0089] Step 101: receiving an authentication request sent by any to-be-authenticated end node. The authentication request carries at least a first regional identifier of a regional authentication network domain in which the to-be-authenticated end node is located. The regional authentication network domain is determined according to an end node set of each edge node in a network region in which the to-be-authenticated end node is located, and the end node set is a set of all end nodes that establish node association with the edge node.

[0090] Any one of the edge nodes in a network region can be a trusted proxy edge node and complete the authentication of the end node.

[0091] It should be noted that in the present application, the cloud nodes in the computing power network region, the edge nodes including the trusted proxy edge nodes, and the end nodes including the to-be-authenticated end nodes have all completed registration in the registration center in advance.

[0092] Among them, the to-be-authenticated end node refers to an end node that wants to join a certain computing power network, and the trusted proxy edge node refers to an edge node that performs the authentication operation on the to-be-authenticated end node in a certain computing power network.

[0093] Specifically, the to-be-authenticated end node sends an authentication request to the trusted proxy node in the computing power network region in which it is located, and the authentication request carries at least a first regional identifier of a regional authentication network domain in which the to-be-authenticated end node is currently located.

[0094] For a to-be-authenticated end node, the to-be-authenticated end node is located in at least a network region, so that the to-be-authenticated end node can send an authentication request to the trusted proxy edge node in the network region. However, the to-be-authenticated end node does not necessarily belong to a regional authentication network domain, that is, the to-be-authenticated end node does not necessarily join a certain computing power network.

[0095] If the to-be-authenticated end node has currently joined a certain regional authentication network domain, the authentication request sent by the to-be-authenticated end node carries the regional identifier of the regional authentication network domain in which it is currently located, which is referred to as a first regional identifier. If the to-be-authenticated end node has not joined any regional authentication network, the first regional identifier is an empty character.

[0096] Meanwhile, the trusted proxy edge node currently in the network area where the to-be-authenticated end node is located is necessarily in a regional authentication network domain, but the regional authentication network domain where the trusted proxy edge node is currently located and the regional authentication network domain where the to-be-authenticated end node is currently located are not necessarily the same. Therefore, when the to-be-authenticated end node wants to join the computing power network where the trusted proxy edge node is located, the trusted proxy edge node needs to authenticate and verify the to-be-authenticated end node, that is, to verify whether the trusted proxy edge node and the to-be-authenticated end node are uniquely located in the same regional authentication network domain.

[0097] Further, the regional authentication network domain refers to a network formed by all edge nodes in a certain computing power network and all end nodes that join the computing power network through authentication and verification of the trusted proxy edge node.

[0098] Generally, a regional authentication network domain includes a plurality of edge nodes and a plurality of end nodes, each edge node establishes node association with a plurality of end nodes, that is, the end nodes that have joined the corresponding computing power network are in the network communication range of each other. An end node can also establish node association with a plurality of edge nodes.

[0099] Therefore, the regional authentication network domain is also determined by the end node set of each edge node in the network area where the to-be-authenticated end node is located, that is, the set of all end nodes that establish node association with each edge node in the regional authentication network domain.

[0100] Step 102: verifying the first area identifier, and returning an authentication pass response to the to-be-authenticated end node if the verification is passed, the authentication pass response carrying an authentication certificate.

[0101] The authentication certificate includes the number of the regional authentication network domain where the trusted proxy edge node is located when the authentication center is registered and the initial group session key .

[0102] Specifically, after receiving the authentication request sent by any to-be-authenticated end node, the trusted proxy edge node verifies the first area identifier carried in the authentication request, that is, whether the regional authentication network domain where the to-be-authenticated end node is currently located is consistent with the regional authentication network domain where the trusted proxy edge node is currently located. If the verification is passed, the trusted proxy edge node returns an authentication pass response carrying an authentication certificate to the to-be-authenticated end node.

[0103] The end node authentication method provided by the application does not check by a unified authentication center when authenticating the end node to join the computing power network, but authenticates the end node to the trusted proxy node in the distributed regional authentication network domain corresponding to the computing power network to be joined, overcomes the performance challenge of the unified authentication center in the complex computing power network environment, improves the speed of end node authentication, and avoids the adverse effect of slow authentication speed on the computing performance of the computing power network.

[0104] Figure 2 is a flowchart of the end node authentication method provided by the application, as shown in Figure 2 The first area identifier is checked, including:

[0105] obtaining a first comparison result of the first area identifier and a second area identifier of the regional authentication network domain where the trusted proxy edge node is located;

[0106] If the first comparison result is consistent, it is determined that the check is passed.

[0107] The area identifier of the regional authentication network domain where the trusted proxy edge node is located is called the second area identifier.

[0108] Specifically, after receiving the authentication request sent by the end node to be authenticated, the trusted proxy edge node obtains the first area identifier representing the regional authentication network domain where the end node to be authenticated is located from the authentication request, compares the first area identifier with the second area identifier representing the regional authentication network domain where the trusted proxy edge node is located, and determines whether the regional authentication network domain where the end node to be authenticated is located is consistent with the regional authentication network domain where the trusted proxy edge node is located.

[0109] If the first comparison result is consistent, it means that the end node to be authenticated has joined the regional authentication network domain where the trusted proxy edge node is located, and the check is determined to be passed. An authentication pass response carrying an authentication certificate is sent to the end node to be authenticated, allowing the end node to be authenticated to join the computing power network. The end node to be authenticated can communicate with other nodes in the regional authentication network domain and exchange data through the number and the initial group session key of the regional authentication network domain, so as to join the corresponding computing power network.

[0110] If the first comparison result is inconsistent, the next check step or the check is ended, and the next authentication request sent by the end node to be authenticated to the trusted proxy edge node is waited.

[0111] In an embodiment, if the end node to be authenticated is not in any regional authentication network domain, i.e., the first area identifier of the end node to be authenticated is an empty character.

[0112] Correspondingly, when checking the first area identifier and the second area identifier, the trusted proxy edge node obtains a first comparison result that is inconsistent.

[0113] The end node authentication method provided by the application compares the area authentication network domain identifier carried in the authentication request sent by the to-be-authenticated end node with the identifier of the area authentication network domain in which the trusted proxy edge node is located, thereby checking whether the to-be-authenticated end node and the trusted proxy edge node have joined the same area authentication network domain, and after the checking is passed, the trusted proxy edge node returns an authentication certificate used for data interaction of each node in the computing power network to the to-be-authenticated end node, so that all the checked end nodes in the same area authentication network domain can perform data interaction through the unified authentication certificate.

[0114] As shown in Figure 2 As an optional embodiment based on the above embodiment, if the first comparison result is inconsistent, a third area identifier is called from the authentication request of the to-be-authenticated end node, and the third area identifier is the area identifier of the area authentication network domain in which the to-be-authenticated end node is located last time.

[0115] A second comparison result of the third area identifier and a fourth area identifier is obtained, and the fourth area identifier is the area identifier of the area authentication network domain in which the trusted proxy edge node is located last time.

[0116] If the second comparison result is consistent, it is determined that the checking is passed.

[0117] Specifically, when the first comparison result obtained by the trusted proxy edge node is inconsistent, that is, the area authentication network domain in which the trusted proxy edge node and the to-be-authenticated end node are currently located is different, the area identifier of the area authentication network domain in which the to-be-authenticated end node is located last time is called from the authentication request, which is called the third area identifier.

[0118] Then, the trusted proxy edge node takes the area identifier of the area authentication network domain in which the trusted proxy edge node is located last time as the fourth area identifier, compares the third area identifier and the fourth area identifier, obtains a second comparison result, and when the second comparison result is consistent, it is confirmed that the checking is passed, and an authentication certificate including the number of the area authentication network domain in which the trusted proxy edge node is currently located and the initial group session key and the initial group session key is returned to the to-be-authenticated end node, so that the to-be-authenticated node can communicate and interact with other nodes in the area authentication network domain according to the authentication certificate, thereby joining the corresponding computing power network.

[0119] If the second comparison result is inconsistent, the next checking step or the checking is ended, and the to-be-authenticated end node waits to send an authentication request to the trusted proxy edge node next time.

[0120] The end node authentication method provided by the application verifies whether the regional authentication network domain where the trusted proxy edge node and the end node to be authenticated last located is the same as the regional authentication network domain where the trusted proxy edge node currently locates when the trusted proxy edge node and the end node to be authenticated do not currently locate in the same regional authentication network domain. If the regional authentication network domain where the trusted proxy edge node and the end node to be authenticated last located is the same as the regional authentication network domain where the trusted proxy edge node currently locates, it means that the trusted proxy edge node and the end node to be authenticated locate in the same regional authentication network domain before the regional authentication network domain where the trusted proxy edge node last located is reconfigured to the regional authentication network domain where the trusted proxy edge node currently locates, and the end node does not join the reconfigured regional authentication network domain due to some reasons (such as the mobile end node leaving the physical range where the end node can communicate with all edge nodes in the regional authentication network domain, the fixed end node being powered off for maintenance, etc.). At this time, it is considered that the security and reliability of the end node to be authenticated can be directly trusted, and the end node to be authenticated is allowed to join the regional authentication network domain where the trusted proxy edge node currently locates.

[0121] Based on the above embodiment, as an optional embodiment, if the second comparison result is inconsistent, the trusted proxy edge node retrieves first encrypted information from the authentication request of the end node to be authenticated, and decrypts the first encrypted information to obtain first decrypted information; obtains a third comparison result of the first encrypted information and the first decrypted information, and if the third comparison result is consistent, sends second encrypted information to the end node to be authenticated;

[0122] After the end node to be authenticated receives the second encrypted information, the end node to be authenticated decrypts the second encrypted information to obtain second decrypted information; obtains a fourth comparison result of the second encrypted information and the second decrypted information, and if the fourth comparison result is consistent, sends third encrypted information to the trusted proxy edge node;

[0123] After the trusted proxy edge node receives the third encrypted information, the trusted proxy edge node decrypts the third encrypted information to obtain third decrypted information; obtains a fifth comparison result of the third encrypted information and the third decrypted information, and if the fifth comparison result is consistent, confirms that the verification is passed.

[0124] It should be noted that if any one of the third comparison result, the fourth comparison result or the fifth comparison result is inconsistent, the verification is ended, and the next authentication request sent by the end node to be authenticated to the trusted proxy edge node is waited.

[0125] In an embodiment, when the end node to be authenticated sends an authentication request to the trusted proxy edge node P, the end node to be authenticated calculates the first encrypted information and sends the first encrypted information as part of the authentication request to the trusted proxy edge node P.

[0126] Specifically, when the end node to be authenticated sends an authentication request to the trusted proxy edge node P, the end node to be authenticated calculates the first encrypted information and sends the first encrypted information as part of the authentication request to the trusted proxy edge node P. ​First, a random number is generated locally, and the temporary public key of the trusted proxy edge node P is inquired from the P node, and parameter calculation is performed according to the following formulas (1) to (6):

[0127] (1)

[0128] (2)

[0129] (3)

[0130] (4)

[0131] (5)

[0132] (6)

[0133] wherein, is a Chebyshev chaotic mapping, is the to-be-authenticated end node, is the to-be-authenticated end node the locally generated random number, is the temporary private key of the to-be-authenticated end node , is the public key of the to-be-authenticated end node , is the current timestamp, is the identity information of the to-be-authenticated end node , is the temporary public key of the trusted proxy edge node P, is a secure large prime number, is an intermediate parameter for calculating the first encrypted information, is a chaotic mapping value determined by the to-be-authenticated end node when registering with the registration center, is a hash value obtained by hashing , , , , are parameters that collectively constitute the first encrypted information.

[0134] Then, the to-be-authenticated end node sends as the first encrypted information to the trusted proxy edge node P.

[0135] When the second comparison result is inconsistent, the trusted proxy edge node P obtains the first encrypted information from the to-be-authenticated end node The first encrypted information is called in the authentication request, and the first encrypted information is decrypted to obtain the first decrypted information. Wherein, the trusted proxy edge node P decrypts the first encrypted information to obtain the first decrypted information as follows:

[0136] Firstly, the trusted proxy edge node P recovers the identity information and timestamp of the to-be-authenticated end node using the following formulas (7) (8):

[0137] ; (7)

[0138] ; (8)

[0139] Wherein, is the identity information of the to-be-authenticated end node recovered in the process of decrypting the first encrypted information, is the timestamp recovered in the process of decrypting the first encrypted information.

[0140] Then, the trusted proxy edge node P looks up the corresponding in the combination of end nodes in the network area, and further decrypts the first encrypted information using the following formulas (9) (10):

[0141] ; (9)

[0142] ; (10)

[0143] Wherein, is the public key value of the to-be-authenticated end node obtained after decrypting the first encrypted information, is the value of obtained after decrypting the first encrypted information, is the value of obtained after decrypting the first encrypted information, is the hash value obtained after hashing .

[0144] The trusted proxy edge node P takes the decrypted as the first decrypted information, and compares it with in the first encrypted information to obtain the third comparison result of whether and are the same, and if they are the same, the second encrypted information is sent to the to-be-authenticated end node .

[0145] Wherein, the trusted proxy edge node P generates the second encrypted information according to the following formulas (11) (12):​

[0146] (11)

[0147] (12)

[0148] wherein, , is an encryption parameter constituting the second encryption information together, is a random number generated by the trusted proxy edge node P locally, is identity information of the trusted proxy edge node P.

[0149] The trusted proxy edge node P sends to the end node to be authenticated as the second encryption information.

[0150] After receiving the second encryption information, the end node to be authenticated decrypts the second encryption information according to the following formula (13):

[0151] (13)

[0152] wherein, is a value obtained by decrypting the second encryption information.

[0153] The end node to be authenticated sends to the trusted proxy edge node P as the second decryption information obtained by decrypting the second encryption information, and judges whether a fourth comparison result between and is consistent, and if so, sends third encryption information to the trusted proxy edge node.

[0154] The end node to be authenticated calculates the formula (14) of the third encryption information as follows:

[0155] (14)

[0156] wherein, is a parameter constituting the third encryption information.

[0157] The end node to be authenticated sends to the trusted proxy edge node P as the third encryption information, and the trusted proxy edge node P decrypts the third encryption information according to the following formula (15) after receiving the third encryption information,

[0158] (15)

[0159] ​​​​​wherein, is the third encrypted information decrypted.

[0160] The trusted proxy edge node P compares with If the fifth comparison result is consistent, it is confirmed that the verification is passed.

[0161] Figure 3 is the flowchart of constructing the regional authentication network domain provided by the application, as shown in Figure 3 The regional authentication network domain is constructed in advance by the following steps, including:

[0162] determining whether the preset triggering condition is met;

[0163] If it is determined that the preset triggering condition is met, the identity information hash values of all end nodes associated with the trusted proxy edge node are calculated, and an end node set of the trusted proxy edge node is constructed.

[0164] The authentication network domain reconstruction information is broadcasted in the network region, and the authentication network domain reconstruction information at least carries a current timestamp, reconstruction notification information, and a fingerprint ID and an end node set of the trusted proxy edge node.

[0165] The response information broadcasted by any other edge node in the network region in response to the authentication network domain reconstruction information is received, and the response information at least includes a current timestamp, reconstruction feedback information, and a fingerprint ID and an end node set of the any other edge node.

[0166] The proportion of the reconstruction feedback information in the response information that contains the agreed reconstruction authentication network domain information is counted.

[0167] If the proportion is greater than a first threshold value, the maximum intersection of all the end node sets is obtained, the regional authentication network domain is constructed, and a local end node list is generated.

[0168] Specifically, when the trusted proxy edge node determines that the preset triggering condition is met, the identity information hash values of all end nodes associated with the trusted proxy edge node are calculated, and the end node set of the trusted proxy edge node is constructed by using the identity information hash values of all the end nodes.

[0169] ​Afterwards, the trusted proxy edge node broadcasts the authentication network domain reconstruction information to all edge nodes in the network region, and the authentication network domain reconstruction information at least carries the current timestamp, the reconstruction notification information, and the fingerprint ID and the end node set of the trusted proxy edge node. The reconstruction notification information mentioned here refers to the message that is sent by all edge nodes (including the trusted proxy edge node) in the regional network when the trusted proxy edge node meets the preset trigger condition, and triggers other edge nodes in the regional network to perform a certain response operation.

[0170] Any other edge node in the regional network broadcasts the current timestamp, the reconstruction feedback information, and the fingerprint ID and the end node set of the any other edge node as the response message after receiving the authentication network domain reconstruction information broadcast by the trusted proxy edge node. The reconstruction feedback information mentioned here refers to the message generated after a certain operation is performed in response to the reconstruction notification information by all edge nodes (including the trusted proxy edge node) in the regional network.

[0171] The formation method of the end node set of the any other edge node is the same as that of the end node set of the trusted proxy edge node, and will not be described again.

[0172] The trusted proxy edge node receives the response information broadcast by any other edge node in the receiving network region, and counts the proportion of the reconstruction feedback information in the response information that contains the agreed reconstruction authentication network domain information.

[0173] If the proportion of the reconstruction feedback information in the response information broadcast by all edge nodes in the network region that contains the agreed reconstruction authentication network domain information is greater than the threshold value, the regional authentication network domain is constructed and the local end node list is generated, and the local end node list is the maximum intersection list of the end node set of all edge nodes in the regional network.

[0174] The first threshold value can be set to , or and the like according to actual needs.

[0175] In an embodiment, the reconstruction feedback information is divided into agreed reconstruction authentication network domain information and opposed reconstruction authentication network domain information.

[0176] The yield value of the end node set that establishes node association with any other edge node is greater than the rated yield value, the reconstruction feedback information is the agreed reconstruction authentication network domain information, otherwise it is the opposed reconstruction authentication network domain information.

[0177] The calculation formula of the yield value of the end node set that establishes node association with any other edge node is as follows:

[0178] (16)

[0179] wherein, is a benefit value of a set of end nodes establishing node association with any other edge node, is a number of end nodes establishing node association with any other edge node, is a regional authentication energy, is a latency benefit value, is a regulation coefficient corresponding to the regional authentication energy, is a regulation coefficient corresponding to the latency benefit value.

[0180] In another embodiment, when any edge node in the regional network satisfies a preset trigger condition, the edge node satisfying the preset trigger condition broadcasts authentication network domain reconstruction information to other edge nodes (excluding trusted agent edge nodes) in the network region where it is located, and the other edge nodes respond and broadcast reconstruction feedback information. The trusted agent edge nodes in the regional network listen to the reconstruction feedback information broadcast by the other edge nodes, and determine whether the proportion of the reconstruction feedback information containing agreed reconstruction authentication network domain information in the received reconstruction feedback information is greater than a first threshold value. If the proportion is greater than the first threshold value, the maximum intersection of all the set of end nodes is obtained, the regional authentication network domain is constructed, and a local end node list is generated.

[0181] Based on the above embodiment, as an optional embodiment, the determination of whether the preset trigger condition is satisfied includes:

[0182] determining the proportion of edge nodes in the network region whose number of end nodes is greater than a second threshold value;

[0183] if the proportion is greater than a third threshold value, calculating a benefit value of all end nodes;

[0184] if the benefit value is greater than a fourth threshold value, it is determined that the preset trigger condition is satisfied;

[0185] The benefit value is determined based on the regional authentication energy and the latency benefit value of all end nodes.

[0186] For example, the second threshold value is 50, the third threshold value is .

[0187] The trusted agent node regularly counts the edge nodes in the network region where it is currently located, specifically the number of edge nodes whose number of end nodes establishing node association is greater than 50. When the ratio of this number of edge nodes to the total number of edge nodes in the regional network exceeds When the benefit value of all end nodes exceeds the fourth threshold value, it is determined that the preset triggering condition is met.

[0188] In an embodiment, the preset triggering condition refers to the number of end nodes establishing node association with any edge node in the network region exceeding a preset threshold value. For example, when the number of end nodes establishing node association with any edge node in the network region exceeds the preset threshold value of 50, it is considered that the preset triggering condition is met.

[0189] In an embodiment, the preset triggering condition refers to the number of position mobile end nodes currently establishing node association with any edge node in the network region being greater than the sum of the number of position fixed end nodes establishing node association with the any edge node and the reconstruction duration of the regional authentication network domain in which the trusted proxy edge node is located.

[0190] For example, when the regional authentication network domain in which the trusted proxy edge node is located is constructed for the first time, the number of position mobile end nodes establishing node association with edge node A is 10, and the number of position fixed end nodes is 10. After 30 minutes, the number of position mobile end nodes establishing node association with edge node A is 50, and the number of position fixed end nodes is 10. The number of position mobile end nodes is greater than the sum of 10, the number of position fixed end nodes, and 30, the reconstruction duration, that is, greater than 40. At this time, the preset triggering condition is met, triggering the regional authentication network domain in which the trusted proxy edge node is located to be reconstructed.

[0191] The end node authentication method provided by the application sets the preset triggering condition to be greater than a static preset threshold value or a dynamic relationship condition between the number of end nodes and the reconstruction duration when judging whether the regional authentication network domain needs to be reconstructed. When the number of end nodes attempting to join the regional authentication network domain is increasing, it can be considered that the reconstructed regional authentication network domain will obtain higher latency benefits and regional authentication energy, which is beneficial to form a more optimal computing power network. At the same time, the reconstruction of the regional authentication network domain is performed only when the number of end nodes meets a certain threshold condition, which can avoid frequent triggering of the reconstruction of the regional authentication network domain.

[0192] The end node authentication method provided by the application triggers the reconstruction operation of the authentication network domain to start when any edge node in the network region meets the preset triggering condition, and triggers other edge nodes in the network region to calculate and respond whether their own network conditions meet the conditions of the authentication network domain reconstruction. Then, the trusted proxy edge node listens to the feedback information of whether all edge nodes in the network region agree to reconstruct the authentication network domain, and finally constructs or reconstructs the regional authentication network domain and generates a local end node list when the agreement ratio is greater than a first threshold value, so as to obtain a regional authentication network domain with better network performance and computing performance.

[0193] Figure 4 is a flowchart of the process of the regional authentication network domain to the authentication center for authentication provided by the present application, as shown in Figure 4 After the regional authentication network domain is constructed and the local end node list is generated, it further includes:

[0194] submitting an authentication application for the regional authentication network domain to the authentication center, the authentication application including the regional identification of the regional authentication network domain and the local end node list;

[0195] receiving the authentication certificate returned by the authentication center, the authentication certificate including the session key between each node in the regional authentication network domain;

[0196] broadcasting the hash digest of the local end node list, the fingerprint ID of the trusted proxy edge node, the current timestamp and the authentication certificate to synchronize to other edge nodes and each end node in the network region.

[0197] Specifically, after the regional authentication network domain is constructed and the local end node list is generated, the trusted proxy edge node in the regional authentication network domain submits an authentication application for the constructed regional authentication network domain to the authentication center, wherein the authentication application includes the regional identification of the constructed regional authentication network domain and the local end node list.

[0198] After receiving the authentication application submitted by the trusted proxy edge node, the authentication center saves the regional identification in the authentication application to the authentication center as the number of the regional authentication network domain, and generates an authentication certificate including the session key between each node in the regional authentication network domain and returns it to the trusted proxy edge node.

[0199] The trusted proxy edge node receives the authentication certificate returned by the authentication center, and broadcasts the hash digest of the local end node list, the fingerprint ID of the trusted proxy edge node, the current timestamp and the authentication certificate returned by the authentication center to other edge nodes and end nodes in the regional authentication network domain.

[0200] From this point of view, the regional authentication network domain is a collection of edge nodes and end nodes that can communicate and interact data using the same session key.

[0201] The end node authentication method provided by the present application saves the regional identification of the regional authentication network domain in the authentication center after the regional authentication network domain is constructed, and obtains the session key between each node in the regional authentication network domain from the authentication center, and synchronizes to other edge nodes and each end node in the network region, to realize the communication and data interaction between each node in the authentication network domain.

[0202] In another aspect, the application can adapt to the complex network environment of dynamic changes of nodes in the computing power network by dynamically dividing the end nodes according to the network area where the edge node is located while dynamically constructing the regional authentication network domain in real time.

[0203] Based on the above embodiment, as an optional embodiment, after the hash digest of the local end node list, the fingerprint ID of the trusted proxy edge node, the current timestamp and the authentication certificate are broadcasted to be synchronized to other edge nodes and each end node in the network area, the following steps are further included:

[0204] The session key is used for encrypted conversation between any two end nodes in the same regional authentication network domain.

[0205] Specifically, in the case that the regional authentication network domain after authentication by the authentication center is constructed, and the authentication certificate containing the session key between each node in the regional authentication network domain is returned to the trusted proxy edge node, and the authentication certificate is broadcasted by the trusted proxy edge node, the session key can be used for encrypted conversation between any two end nodes in the same regional authentication network domain, the encrypted communication content is realized, the security of the communication is ensured, the conversation content is prevented from being eavesdropped, and finally the secure communication and data interaction in the same regional authentication network domain are realized.

[0206] Based on the above embodiment, as an optional embodiment, the end node authentication method provided by the application further includes the following steps:

[0207] Before any end node initiates a session request to another end node located in a different regional authentication network domain, an entry domain authentication request is sent to the trusted proxy edge node in the regional authentication network domain where the other end node is located;

[0208] After the entry domain authentication request, the session key of the regional authentication network domain where the other end node is located is used for encrypted conversation between the any end node and the other end node.

[0209] For example, if the end node X located in the regional authentication network domain A wants to have a conversation with the end node Y located in the regional authentication network domain B, before initiating the session request, the entry domain authentication request is sent by the end node X to the trusted proxy edge node P in the regional authentication network domain B. After receiving the entry domain authentication request, the trusted proxy edge node P performs the steps of verifying the end node by comparing the regional identifier, and after the verification, the trusted proxy edge node P sends the session key of the regional authentication network domain B to the end node X, so that the end node X can use the session key of the regional authentication network domain B to have a conversation with the end node Y.

[0210] Figure 5 is the timing diagram of the edge node registration provided by the application, as Figure 5As shown, all edge nodes within the network area are pre-registered with the registration center, and the registration process for any edge node includes:

[0211] The edge node sends an edge node registration request to the registration center, and the edge node registration request includes at least the identity information of the edge node;

[0212] After verifying that the identity information is correct, the registration center generates registration information based on bilinear mapping, sends it to the edge node, and synchronizes it to the authentication center.

[0213] The edge node generates a private key and a public key based on the registration information, and sends the private key, the public key, and the current timestamp to the registration center;

[0214] The registration center generates a digital certificate based on its own private key, the edge node's public key, and the edge node's identity information, sends it to the edge node, and synchronizes it to the blockchain.

[0215] In one embodiment, the registration of the edge nodes is implemented by the registration center based on elliptic curve cryptography. While ensuring the same level of security, edge node registration based on elliptic curve cryptography requires a shorter key, making it more suitable for node authentication scenarios in computing power networks.

[0216] First, the edge node sends an edge node registration request to the registry center, which includes at least the edge node's identity information.

[0217] After verifying that the identity information is correct, the registration center generates registration information based on bilinear mapping. , and ,in, , It is a bilinear group based on elliptic curve cryptography. for arrive isomorphic mapping, , and The relationship between them is a bilinear mapping. .

[0218] The registration center randomly selects from Select , and calculate and Then the parameters Send it to the edge node and synchronize it to the authentication center.

[0219] Edge nodes based on parameters Generate edge node private keys and edge node public keys and the edge node private key edge node public key Send the current timestamp to the registry center.

[0220] The registry center then uses the edge node's private key. edge node public key A digital certificate is generated based on the identity information of the edge nodes, sent to the edge nodes, and synchronized to the blockchain.

[0221] The end-node authentication method provided by this invention pre-registers all edge nodes within the network area in the registration center before performing end-node authentication, and saves the digital certificates of the edge nodes after registration to the blockchain, thereby ensuring the security of the edge nodes during end-node authentication.

[0222] Figure 6 This is a timing diagram of end node registration provided by the present invention, such as... Figure 6 As shown, all end nodes within the network area are pre-registered with the registration center, and the registration process for any of the end nodes includes:

[0223] The end node sends an end node registration request to the registration center. The end node registration request includes at least the identity information of the end node, and the identity information includes at least the information of whether the end node is a fixed end node.

[0224] The registration center responds to the end node registration request by hashing the end node's identity information to obtain a first hash value, hashing a random number using its own private key to obtain a second hash value, and determining a chaotic mapping value based on the first hash value and the second hash value.

[0225] The registration center uploads the chaotic mapping value and the identity information of the end node to the blockchain and synchronizes them to the end node.

[0226] In one embodiment, an unregistered end node first sends an end node registration request to the registration center. The end node registration request includes at least the end node's identity information, such as identification information that identifies each end node. The end node's identity information also includes at least information on whether the end node is a fixed end node (i.e., a fixed-location end node).

[0227] Then, after receiving the end node registration request, the registration center hashes the end node's identity information using the formula... Get the first hash value Simultaneously, a random number is generated, and the random number is hashed using its own private key, using the formula... Obtain the second hash value ,in, For the generated random numbers, a private key for the registration center itself, Chebyshev chaotic mapping, a public parameter set for the registration center, and then according to the first hash value and the second hash value determining a chaotic mapping value .

[0228] Finally, the registration center uploads the chaotic mapping value obtained and the identity information of the end node to the blockchain and synchronizes to the end node.

[0229] The end node authentication method provided by the application completes the registration of all end nodes in the network area in the registration center in advance before the end node authentication, and saves the chaotic mapping value after the end node registration and the identity information of the end node to the blockchain, thereby ensuring the security of the end node in the end node authentication.

[0230] With the completion of the registration of the end node in the registration center, in the process of joining the regional authentication network domain, the identity of the to-be-authenticated end node is no longer verified by the unified authentication center, but an anonymous authentication method is adopted, and the information encryption and decryption between the trusted proxy edge node and the to-be-authenticated end node can effectively ensure the privacy security of the user and prevent the leakage of identity information.

[0231] Moreover, after the registration of the edge node and the end node in the registration center, the relevant registration information and identity information are saved to the blockchain, the information saved to the chain cannot be tampered with, the node authenticity in the process of joining the regional network authentication domain of the end node is ensured, and the authenticity verification of the end node identity is no longer needed, so that the end node authentication method provided by the application is simpler and more efficient than other methods.

[0232] In an embodiment, the trusted proxy edge node is elected periodically from all edge nodes in the network area.

[0233] For example, the running state, performance index, network connection quality and other parameters related to network security and reliability of the edge node are defined as the conditions for electing the trusted proxy edge node, and then each edge node in the network area periodically sends information related to the aforementioned defined election conditions to other edge nodes, and each edge node also receives and stores the messages sent by other edge nodes. According to the aforementioned defined election conditions, the credibility or priority of the edge node is calculated using weighted average method, exponential weighted moving average method, prediction algorithm based on historical data or machine learning algorithm, and the edge nodes are sorted in descending order according to the credibility or priority,

[0234] By regularly electing a trusted proxy edge node from all edge nodes in the network area, the security and reliability of the trusted proxy edge node can be ensured, and the dynamic changes of nodes in the network area can be adapted.

[0235] Figure 7 is a flowchart of the third end node authentication method provided by the application, as shown in Figure 7 The end node authentication method provided by the application is applied to a to-be-authenticated end node and includes but is not limited to the following steps:

[0236] Step 701: An authentication request is sent to a trusted proxy edge node, and the authentication request carries at least a first area identifier of an area authentication network domain in which the to-be-authenticated end node is located;

[0237] Step 702: An authentication pass response returned by the trusted proxy edge node is received, and the authentication pass response carries an authentication certificate and is returned by the trusted proxy edge node after the first area identifier is verified to pass.

[0238] The area authentication network domain is determined according to an end node set of each edge node in a network area in which the to-be-authenticated end node is located, and the end node set is a set of all end nodes that establish node association with the edge node.

[0239] It should be noted that the end node authentication method provided by the present embodiment and applied to the to-be-authenticated end node corresponds to the end node authentication method provided by the preceding embodiments and applied to the trusted proxy edge node, and the present embodiment will not be described here.

[0240] The end node authentication method provided by the application does not perform verification by a unified authentication center when authenticating an end node to join a computing power network, but performs authentication verification by the end node to a trusted proxy node in a distributed area authentication network domain corresponding to the computing power network to which the end node intends to join. The method overcomes the performance challenge brought to the authentication center by unified verification in a complex computing power network environment, improves the speed of end node authentication, and avoids the adverse effects of slow authentication speed on the computing performance of the computing power network.

[0241] Figure 8 is a structural schematic diagram of an end node authentication device provided by the application, as shown in Figure 8 The end node authentication device includes but is not limited to the following structures:

[0242] The authentication request receiving unit 810 is configured to receive an authentication request sent by any to-be-authenticated end node, and the authentication request carries at least a first area identifier of an area authentication network domain in which the to-be-authenticated end node is located.

[0243] The regional identity verification unit 820 is configured to verify the first regional identity, and return an authentication pass response to the to-be-authenticated end node if the verification is passed, wherein the authentication pass response carries an authentication certificate.

[0244] The regional authentication network domain is determined according to an end node set of each edge node in a network region where the to-be-authenticated end node is located, and the end node set is a set of all end nodes establishing node association with the edge node.

[0245] In an embodiment, the regional identity verification unit 820 further comprises a first comparison unit 821 configured to obtain a first comparison result of the first regional identity and a second regional identity of a regional authentication network domain where the trusted proxy edge node is located.

[0246] If the first comparison result is consistent, it is determined that the verification is passed.

[0247] In an embodiment, the regional identity verification unit 820 further comprises a second comparison unit 822 configured to, if the first comparison result is inconsistent, call a third regional identity from the authentication request of the to-be-authenticated end node, wherein the third regional identity is a regional identity of a regional authentication network domain where the to-be-authenticated end node is located last time.

[0248] Obtain a second comparison result of the third regional identity and a fourth regional identity, wherein the fourth regional identity is a regional identity of a regional authentication network domain where the trusted proxy edge node is located last time.

[0249] If the second comparison result is consistent, it is determined that the verification is passed.

[0250] It should be noted that the end node authentication device provided by the application can execute the end node authentication method applied to the trusted proxy edge node in any of the above embodiments when it is actually operated, and the present embodiment will not be described here.

[0251] The end node authentication device provided by the application no longer verifies by a unified authentication center when authenticating the end node to join the computing power network, but authenticates the trusted proxy node in the distributed regional authentication network domain corresponding to the computing power network to be joined by the end node, overcomes the performance challenge brought by the unified verification to the authentication center in the complex computing power network environment, improves the speed of end node authentication, and avoids the adverse effect of slow authentication speed on the computing performance of the computing power network.

[0252] Figure 9 is a structure schematic diagram of the end node authentication device provided by the application, as shown in Figure 9 including but not limited to the following structure:

[0253] The authentication request sending unit 910 is configured to send an authentication request to a trusted proxy edge node, wherein the authentication request carries at least a first area identifier of an area authentication network domain in which the to-be-authenticated end node is located.

[0254] The authentication pass response receiving unit 920 is configured to receive an authentication pass response returned by the trusted proxy edge node, wherein the authentication pass response carries an authentication certificate, and the authentication pass response is returned by the trusted proxy edge node after the first area identifier is verified to be passed.

[0255] The area authentication network domain is determined according to an end node set of each edge node in a network area in which the to-be-authenticated end node is located, and the end node set is a set of all end nodes that establish node association with the edge node.

[0256] It should be noted that the end node authentication device provided by the application can execute the end node authentication method applied to the to-be-authenticated end node as described in any of the above embodiments, and the present embodiment will not be described here.

[0257] The end node authentication device provided by the application can no longer be verified by a unified authentication center when authenticating the end node to join the computing power network, but can be authenticated by the end node to the trusted proxy node in the distributed area authentication network domain corresponding to the computing power network intended to be joined. The performance challenge brought by the unified verification to the authentication center in the complex computing power network environment is overcome, the speed of end node authentication is improved, and the adverse effect of slow authentication speed on the computing performance of the computing power network is avoided.

[0258] Figure 10 is a structural schematic diagram of an electronic device provided by the application, as Figure 10 shown, the electronic device can include a processor (Processor) 1010, a communication interface (Communications Interface) 1020, a memory (Memory) 1030 and a communication bus 1040, wherein the processor 1010, the communication interface 1020 and the memory 1030 complete mutual communication through the communication bus 1040. The processor 1010 can call the logical instructions in the memory 1030 to execute the end node authentication method applied to the trusted proxy edge node, which includes but is not limited to: receiving an authentication request sent by any to-be-authenticated end node, wherein the authentication request carries at least a first area identifier of an area authentication network domain in which the to-be-authenticated end node is located;

[0259] verifying the first area identifier, and returning an authentication pass response to the to-be-authenticated end node if the verification is passed, wherein the authentication pass response carries an authentication certificate;

[0260] The regional authentication network domain is determined according to an end node set of each edge node in a network region where the end node to be authenticated is located, and the end node set is a set of all end nodes establishing node association with the edge node.

[0261] Or performing an end node authentication method applied to the end node to be authenticated, the method including but not limited to:

[0262] Sending an authentication request to the trusted proxy edge node, the authentication request carrying at least a first regional identifier of a regional authentication network domain where the end node to be authenticated is located;

[0263] Receiving an authentication pass response returned by the trusted proxy edge node, the authentication pass response carrying an authentication certificate, and the authentication pass response being returned by the trusted proxy edge node after verifying the first regional identifier;

[0264] The regional authentication network domain is determined according to an end node set of each edge node in a network region where the end node to be authenticated is located, and the end node set is a set of all end nodes establishing node association with the edge node.

[0265] In addition, the logical instructions in the memory 1030 described above can be implemented in the form of a software function unit and sold or used as an independent product, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0266] In yet another aspect, the present application also provides a non-transitory computer readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement an end node authentication method applied to a trusted proxy edge node provided by the above-mentioned embodiments, the method including but not limited to: receiving an authentication request sent by any end node to be authenticated, the authentication request carrying at least a first regional identifier of a regional authentication network domain where the end node to be authenticated is located;

[0267] Verifying the first regional identifier, and if the verification is passed, returning an authentication pass response to the end node to be authenticated, the authentication pass response carrying an authentication certificate.

[0268] The regional authentication network domain is determined according to an end node set of each edge node in a network region where the end node to be authenticated is located, and the end node set is a set of all end nodes establishing node association with the edge node.

[0269] Or, an end node authentication method applied to the end node to be authenticated is executed according to any one of the above embodiments, and the method includes but is not limited to:

[0270] An authentication request is sent to the trusted proxy edge node, and the authentication request carries at least a first regional identifier of a regional authentication network domain where the end node to be authenticated is located;

[0271] An authentication pass response returned by the trusted proxy edge node is received, and the authentication pass response carries an authentication certificate, and the authentication pass response is returned by the trusted proxy edge node after the first regional identifier is verified to pass;

[0272] The regional authentication network domain is determined according to an end node set of each edge node in a network region where the end node to be authenticated is located, and the end node set is a set of all end nodes establishing node association with the edge node.

[0273] The device embodiments described above are only schematic, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, that is, they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment scheme. Those skilled in the art can understand and implement without creative labor.

[0274] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be realized by means of software and necessary general hardware platform, and of course, it can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of software product, which can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes a plurality of instructions to make a computer device (which can be a personal computer, server, or network device, etc.) execute the method described in each embodiment or some parts of the embodiment.

[0275] It should be pointed out finally that the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit the same; and although the present application has been described in detail with reference to the foregoing embodiments, it should be appreciated by those skilled in the art that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features thereof can be replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An end-node authentication method, characterized in that, Applied to trusted proxy edge nodes, including: Receive an authentication request sent by any node to be authenticated, wherein the authentication request carries at least a first area identifier of the area authentication network domain where the node to be authenticated is located. Verify the first region identifier. If the verification passes, return an authentication pass response to the end node to be authenticated. The authentication pass response carries the authentication certificate. The regional authentication network domain is determined based on the set of end nodes of each edge node within the network region where the end node to be authenticated is located. The set of end nodes is the set of all end nodes that have established node associations with the edge node. The regional authentication network domain is pre-built using the following steps: Determine whether a preset trigger condition is met; if it is, calculate the hash values ​​of the identity information of all end nodes that have established node associations with the trusted proxy edge node, and construct the end node set of the trusted proxy edge node; broadcast authentication network domain reconstruction information within the network area, the authentication network domain reconstruction information carrying at least the current timestamp, reconstruction notification information, and the fingerprint ID and end node set of the trusted proxy edge node; receive response information broadcast by any other edge node within the network area after responding to the authentication network domain reconstruction information, the response information including at least the current timestamp, reconstruction feedback information, and the fingerprint ID and end node set of the other edge node; count the proportion of the received response information containing the reconstruction feedback information agreeing to the reconstruction of the authentication network domain; if the proportion is greater than a first threshold, obtain the maximum intersection of all the end node sets, construct the regional authentication network domain, and generate a local end node list.

2. The end-node authentication method according to claim 1, characterized in that, The verification of the first region identifier includes: Obtain the first comparison result between the first region identifier and the second region identifier of the region authentication network domain where the trusted proxy edge node is located; If the first comparison result is consistent, then the verification is deemed successful.

3. The end-node authentication method according to claim 2, characterized in that, If the first comparison result is inconsistent, the third region identifier is retrieved from the authentication request of the end node to be authenticated. The third region identifier is the region identifier of the network domain where the end node to be authenticated was most recently authenticated. Obtain a second comparison result between the third region identifier and the fourth region identifier, wherein the fourth region identifier is the region identifier of the region authentication network domain in which the trusted proxy edge node was most recently located. If the second comparison result is consistent, then the verification is considered successful.

4. The end-node authentication method according to claim 1, characterized in that, After constructing the regional authentication network domain and generating the local end-node list, the process also includes: Submit an authentication application for the regional authentication network domain to the authentication center. The authentication application includes the regional identifier of the regional authentication network domain and the list of local end nodes. Receive the authentication certificate returned by the authentication center, the authentication certificate including the session key between nodes within the regional authentication network domain; The hash digest of the local end node list, the fingerprint ID of the trusted proxy edge node, the current timestamp, and the authentication certificate are broadcast to synchronize with other edge nodes and end nodes within the network area.

5. The end-node authentication method according to claim 4, characterized in that, After broadcasting the hash digest of the local end node list, the fingerprint ID of the trusted proxy edge node, the current timestamp, and the authentication certificate to synchronize with other edge nodes and end nodes within the network area, the method further includes: The session key is used to conduct encrypted conversations between any two end nodes located in the same regional authentication network domain.

6. The end-node authentication method according to claim 5, characterized in that, Also includes: Before any end node initiates a session request to another end node located in a different regional authentication network domain, it sends an inbound authentication request to the trusted proxy edge node in the regional authentication network domain where the other end node is located. After the domain entry authentication request, the two end nodes conduct encrypted communication using the session key of the regional authentication network domain where the other end node is located.

7. The end-node authentication method according to claim 1, characterized in that, The trusted proxy edge node is periodically elected from all edge nodes within the network area.

8. The end-node authentication method according to claim 1, characterized in that, All edge nodes within the network area are pre-registered with the registration center. The registration process for any edge node includes: The edge node sends an edge node registration request to the registration center, and the edge node registration request includes at least the identity information of the edge node; After verifying that the identity information is correct, the registration center generates registration information based on bilinear mapping, sends it to the edge node, and synchronizes it to the authentication center. The edge node generates a private key and a public key based on the registration information, and sends the private key, the public key, and the current timestamp to the registration center; The registration center generates a digital certificate based on its own private key, the edge node's public key, and the edge node's identity information, sends it to the edge node, and synchronizes it to the blockchain.

9. The end-node authentication method according to claim 1, characterized in that, All end nodes within the network area are pre-registered with the registration center, and the registration process for any of the end nodes includes: The end node sends an end node registration request to the registration center. The end node registration request includes at least the identity information of the end node, and the identity information includes at least the information of whether the end node is a fixed end node. The registration center responds to the end node registration request by hashing the end node's identity information to obtain a first hash value, hashing a random number using its own private key to obtain a second hash value, and determining a chaotic mapping value based on the first hash value and the second hash value. The registration center uploads the chaotic mapping value and the identity information of the end node to the blockchain and synchronizes them to the end node.

10. The end-node authentication method according to claim 1, characterized in that, The determination of whether the preset triggering condition is met includes: Determine the percentage of edge nodes in a network region whose number of edge nodes exceeds a second threshold; If the percentage is greater than the third threshold, then calculate the revenue value of all end nodes; If the revenue value is greater than the fourth threshold, then the preset triggering condition is determined to be met; The revenue value is determined based on the regional authentication energy and latency revenue values ​​of all end nodes.

11. An end-node authentication method, characterized in that, Applied to the end nodes to be authenticated, including: Send an authentication request to the trusted proxy edge node, the authentication request carrying at least the first area identifier of the area authentication network domain where the end node to be authenticated is located; Receive the authentication pass response returned by the trusted proxy side node. The authentication pass response carries an authentication certificate. The authentication pass response is returned by the trusted proxy side node after verifying the first region identifier. The regional authentication network domain is determined based on the set of end nodes of each edge node within the network region where the end node to be authenticated is located. The set of end nodes is the set of all end nodes that have established node associations with the edge node. The regional authentication network domain is pre-built using the following steps: Determine whether a preset trigger condition is met; if it is, calculate the hash values ​​of the identity information of all end nodes that have established node associations with the trusted proxy edge node, and construct the end node set of the trusted proxy edge node; broadcast authentication network domain reconstruction information within the network area, the authentication network domain reconstruction information carrying at least the current timestamp, reconstruction notification information, and the fingerprint ID and end node set of the trusted proxy edge node; receive response information broadcast by any other edge node within the network area after responding to the authentication network domain reconstruction information, the response information including at least the current timestamp, reconstruction feedback information, and the fingerprint ID and end node set of the other edge node; count the proportion of the received response information containing the reconstruction feedback information agreeing to the reconstruction of the authentication network domain; if the proportion is greater than a first threshold, obtain the maximum intersection of all the end node sets, construct the regional authentication network domain, and generate a local end node list.

12. An end-node authentication device, characterized in that, include: An authentication request receiving unit is used to receive an authentication request sent by any end node to be authenticated, wherein the authentication request carries at least a first area identifier of the area authentication network domain where the end node to be authenticated is located. The region identifier verification unit is used to verify the first region identifier. If the verification passes, it returns an authentication pass response to the end node to be authenticated. The authentication pass response carries an authentication certificate. The regional authentication network domain is determined based on the set of end nodes of each edge node within the network region where the end node to be authenticated is located. The set of end nodes is the set of all end nodes that have established node associations with the edge node. The regional authentication network domain is pre-built using the following methods: Determine whether a preset trigger condition is met; if it is, calculate the hash values ​​of the identity information of all end nodes that have established node associations with the trusted proxy edge node, and construct the end node set of the trusted proxy edge node; broadcast authentication network domain reconstruction information within the network area, the authentication network domain reconstruction information carrying at least the current timestamp, reconstruction notification information, and the fingerprint ID and end node set of the trusted proxy edge node; receive response information broadcast by any other edge node within the network area after responding to the authentication network domain reconstruction information, the response information including at least the current timestamp, reconstruction feedback information, and the fingerprint ID and end node set of the other edge node; count the proportion of the received response information containing the reconstruction feedback information agreeing to the reconstruction of the authentication network domain; if the proportion is greater than a first threshold, obtain the maximum intersection of all the end node sets, construct the regional authentication network domain, and generate a local end node list.

13. An end-node authentication device, characterized in that, include: An authentication request sending unit is used to send an authentication request to a trusted proxy edge node, wherein the authentication request carries at least the first area identifier of the area authentication network domain where the end node to be authenticated is located. The authentication pass response receiving unit is used to receive the authentication pass response returned by the trusted proxy side node. The authentication pass response carries an authentication certificate and is returned by the trusted proxy side node after verifying the first region identifier. The regional authentication network domain is determined based on the set of end nodes of each edge node within the network region where the end node to be authenticated is located. The set of end nodes is the set of all end nodes that have established node associations with the edge node. The regional authentication network domain is pre-built using the following methods: Determine whether a preset trigger condition is met; if it is, calculate the hash values ​​of the identity information of all end nodes that have established node associations with the trusted proxy edge node, and construct the end node set of the trusted proxy edge node; broadcast authentication network domain reconstruction information within the network area, the authentication network domain reconstruction information carrying at least the current timestamp, reconstruction notification information, and the fingerprint ID and end node set of the trusted proxy edge node; receive response information broadcast by any other edge node within the network area after responding to the authentication network domain reconstruction information, the response information including at least the current timestamp, reconstruction feedback information, and the fingerprint ID and end node set of the other edge node; count the proportion of the received response information containing the reconstruction feedback information agreeing to the reconstruction of the authentication network domain; if the proportion is greater than a first threshold, obtain the maximum intersection of all the end node sets, construct the regional authentication network domain, and generate a local end node list.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the end-node authentication method as described in any one of claims 1 to 11.

15. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the end-node authentication method as described in any one of claims 1 to 11.

Images