A blockchain-based identity authentication system and method

Abstract

This invention discloses a blockchain-based identity authentication system. Utilizing blockchain technology, the system authenticates the identity of information nodes when they reconnect to the network, ensuring the uniqueness of each node's identity. Simultaneously, after authentication, each information node can obtain information relationships (related configuration information) with other information nodes through the blockchain, thus establishing these information (business) relationships.

Description

Technical Field

[0001] This invention relates to the field of identity authentication, and in particular to a blockchain-based identity authentication system and method. Background Technology

[0002] In today's information society, all kinds of organizations face the need to acquire, transmit, process, and regenerate their own business information. Currently, these needs are met using information systems. Observation reveals that the nodes responsible for acquisition, transmission, processing, and regeneration in the information systems used by various organizations are generally not located in the same place, but are scattered across different geographical locations within the organization. These information nodes and the information relationships between them constitute the organization's network information system. Therefore, when an organization needs to adapt to certain requirements, and the nodes or information relationships within its network information system must be transformed or changed, the information nodes will face the problem of reconnecting to the network information system and establishing information relationships with other nodes.

[0003] Identity authentication is a crucial security mechanism for ensuring information security. Identity authentication technology refers to the process and methods of identifying and auditing the identities of executors on the internet. Traditional identity authentication methods include local password authentication, where users store pre-set passwords on their local terminal devices; and remote password authentication, where users send their locally entered passwords to a remote centralized server for verification. In recent years, many new verification methods have emerged: 1) SMS verification. Random verification codes are sent to users via SMS, which they enter during verification or transaction authentication to ensure the correctness of system identity authentication; 2) Dynamic passwords. Currently, the mainstream method is based on time synchronization, where the terminal application randomly generates a serial number as the user's verification password at regular intervals; 3) Biometrics. Biometrics refer to the measurement of human characteristics and are an emerging means of human identification and access control in computer science. This method uses sensors or detectors to acquire physiological or behavioral characteristics of organisms, further converting them into serialized information for verification. Human biometrics include physiological and behavioral characteristics. Physiological characteristics relate to physical measurements of the body, such as fingerprints, palm veins, and facial recognition; behavioral characteristics relate to behavioral patterns, including gait and signatures. However, regardless of the verification scheme, passwords or user biometric information must be stored on a local terminal or remote server. If this authentication information is intercepted during transmission or the centralized server is attacked, attackers can forge user identities to launch deceptive attacks, ultimately leading to the leakage of user privacy and loss of assets.

[0004] Public Key Infrastructure (PKI)-based authentication is currently a mature and widely used technology. It binds a user's public key to their identity in the form of a public key certificate. However, PKI introduces a trusted third-party Certificate Authority (CA) for authentication, which incurs costs in certificate management, storage, and computation. Large-scale key management typically involves physically adding CAs, but cross-authentication and trust management issues arise between users of different CAs. Furthermore, crashing the provider's central server is a primary target for hackers, making user data vulnerable to attack. In distributed environments, organizations set up authentication servers to form relatively independent trust domains for easier user management. However, a single independent trust domain cannot provide multiple services, requiring users to access multiple domains, leading to cross-domain authentication problems. Therefore, the aforementioned authentication mechanisms suffer from maintenance difficulties and the vulnerability of centralized servers to attacks. Thus, providing a decentralized, reliable, and easily maintainable authentication system is a pressing issue that needs to be addressed. Summary of the Invention

[0005] To address the aforementioned problems, this invention proposes a blockchain-based identity authentication system and method. It utilizes the decentralized structure and immutability of blockchain to solve the potential centralized single point of failure and privacy data leakage problems in traditional identity management mechanisms.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] A blockchain-based identity authentication system, characterized in that the system comprises, from top to bottom, an application layer, a business layer, a service layer, a data layer, and a foundation layer, wherein:

[0008] The application layer is mainly used for business logic processing, manipulating data on the front end, and dynamically displaying the data in a visual way;

[0009] The business layer is used to provide the algorithms required for business implementation, complete business functions through relevant algorithms, and interact with the data layer and application layer.

[0010] The service layer is used to provide reusable services;

[0011] The data layer is used for data storage and access, and to realize data synchronization between blockchain data and MySQL database. The blockchain data includes node data, authorization data, transaction records, and access records, while the data in the MySQL database includes basic data and business data.

[0012] The base layer provides the infrastructure for system operation.

[0013] Furthermore, the services provided by the service layer include blockchain services, authentication services, and access control and restriction services;

[0014] Blockchain services include basic services, key services, committee voting services, consortium node management, and smart contract-related services.

[0015] The authentication service includes user authentication service and token authentication service.

[0016] Furthermore, the application layer includes:

[0017] The data dashboard module is used to monitor the relationship status of various business terminals, server operating resources, and blockchain operation status.

[0018] The data operation module provides a management interface for various functions and services of the control terminal.

[0019] Furthermore, the business layer includes:

[0020] The system node management module is used to call the blockchain to add, modify, and deactivate basic information, firmware information, and identity identifiers of each node terminal, and to complete node identity registration.

[0021] The business relationship management module is used to create transaction pending tasks for each front-end node;

[0022] The access control proxy module is a middleware deployed on the application terminal. It is used to obtain the unique firmware information of the node it is located on, and to parse the identity key generated after identity registration when resetting or initializing the access control proxy module, and to configure it to the access control proxy module, and to realize long-connection communication service with the control management terminal.

[0023] The user management module is responsible for the basic management of system users and roles.

[0024] The access log query module is used to query the logs generated by system access;

[0025] The transaction record query module is used to query transaction records in the system;

[0026] The log management module is used to manage and query the system's daily operation and operation records;

[0027] The access control module is used to control the permissions of system users.

[0028] Furthermore, the access control proxy module includes a node firmware information unit, a node identity setting unit, and a node connection service unit;

[0029] The node firmware information unit is used to obtain the hardware serial number and unique hardware information of the information terminal it belongs to.

[0030] The node identity setting unit is used to configure the identity key generated after the system node management module completes identity registration;

[0031] The node connection service unit is used for long-term communication with the control and management terminal.

[0032] Furthermore, the service layer includes:

[0033] The blockchain service module is used to provide basic blockchain services;

[0034] The authentication service module is used to authenticate user information and token information;

[0035] The access control service module is used to proactively sever the communication connection between the user and the middleware when authentication fails.

[0036] Furthermore, the blockchain service module includes a blockchain basic service unit, a key service unit, a committee voting service unit, an alliance node management unit, and a smart contract unit.

[0037] Furthermore, the authentication service module includes:

[0038] The user authentication unit is used to identify, verify, and authenticate users or middleware long connections that log in to the system.

[0039] The token authentication unit is used to perform anti-counterfeiting and anti-borrowing identification processing on all communications between users and middleware.

[0040] A blockchain-based identity authentication method, implemented based on the identity authentication system as described in claim 1, is characterized by comprising the following steps:

[0041] Step 1: Deploy the access control proxy service module to the business nodes;

[0042] Step 2: Obtain the unique firmware information of the business node through the access control proxy service module;

[0043] Step 3: Register the node identity with the system node management module on the control end based on the obtained firmware information;

[0044] Step 4: After receiving the identity registration request, the system node management module calls the blockchain key service unit to generate the blockchain identity identifier for the node, associates the firmware information with the blockchain identity identifier, and stores it in the blockchain using the blockchain basic service to complete the node identity registration.

[0045] Step 5: The system node management module exports the identity key file of the business node and imports the identity key file into the access control proxy service module;

[0046] Step 6: After receiving the identity key import request, the access control proxy service module parses the encrypted identity key file according to the firmware information. If the parsing is successful, the key file is configured and the process proceeds to Step 7. Otherwise, it indicates that the key is invalid and the authentication process is terminated.

[0047] Step 7: The access control proxy service module automatically initiates a long connection to establish communication with the control end and sends a request message;

[0048] Step 8: After receiving the communication request, the control terminal calls the authentication service module to authenticate the identity carried in the request; if the authentication is successful, proceed to step 9; if the authentication fails, it means that the identity is invalid, and the access control service module actively disconnects the long connection communication and terminates the authentication process.

[0049] Step 9: The control terminal calls the blockchain service to query the middleware firmware information based on the identity identifier. If the query is successful, proceed to step 10. If the query fails, it means that the identity identifier is invalid, and the access control service module actively disconnects the long connection communication and terminates the authentication process.

[0050] Step 10: The control terminal decrypts the communication content based on the firmware information and the identity key of the access control proxy service module. If the decryption is successful, proceed to step 11. If the decryption fails, it means that the identity has been impersonated. The access control service module actively disconnects the long connection communication and terminates the authentication process.

[0051] Step 11: If the communication content is successfully decrypted, token authentication is passed.

[0052] The beneficial effects of this invention are:

[0053] The identity recognition system designed in this invention uses the FISCO BCOS blockchain platform as the underlying technology to realize the access identity recognition of business applications, and has the characteristics of high performance, high scalability, higher security and credibility. Attached Figure Description

[0054] Figure 1 A data block structure diagram suitable for identity authentication;

[0055] Figure 2 This is an architecture diagram of the identity authentication system proposed in this invention;

[0056] Figure 3 This is a flowchart illustrating the identity registration process of the identity authentication method proposed in this invention.

[0057] Figure 4A flowchart illustrating the information relationship establishment process for the identity authentication method proposed in this invention. Detailed Implementation

[0058] To enable those skilled in the art to better understand the technical solutions of the present invention, the technical solutions of the present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0059] This invention proposes an identity authentication system and method based on blockchain technology, firstly establishing a data block structure suitable for identity authentication.

[0060] 1. Based on the data block structure

[0061] like Figure 1 As shown, blockchain technology is a decentralized, distributed ledger technology with characteristics such as immutability, decentralization, and high reliability. This invention utilizes the FISCO BCOS consortium blockchain, an enterprise-level consortium blockchain platform based on blockchain technology. It is the first open-source blockchain platform in China, characterized by high efficiency, security, ease of development, and easy scalability. It has the following advantages:

[0062] (1) High performance: Fisco bcos adopts an asynchronous network communication model, which has high concurrency processing capability and low latency characteristics, and can meet the needs of large-scale identity authentication.

[0063] (2) High scalability: Fisco bcos supports horizontal scaling and can automatically perform load balancing and data sharding when cluster nodes are added.

[0064] (3) Support for national cryptographic algorithms: Fisco bcos adopts national cryptographic algorithms, which have higher security and reliability.

[0065] The identity recognition system is divided into three parts: a blockchain platform, a business system node control terminal (hereinafter referred to as the control terminal), and a business system node front-end (hereinafter referred to as the front-end).

[0066] II. Identity Authentication System Based on Blockchain Technology

[0067] Combination Figure 2 This invention proposes a blockchain-based identity authentication system, which includes, from top to bottom, an application layer, a business layer, a service layer, a data layer, and a foundation layer.

[0068] Application layer: mainly responsible for specific business logic processing, manipulating data on the front end, and dynamically displaying data in a visual way;

[0069] Business layer: Provides algorithms and calculation processes for business functions such as system node management, business relationship management, access control proxy, user management, access record query, transaction record query, log management, and permission management, and interacts with the data layer and application layer;

[0070] Service Layer: Primarily provides reusable services, including blockchain services, authentication services, and access control and restriction services; among which, blockchain services include basic services, key services, committee voting services, consortium node management, and smart contract-related services; authentication services include user authentication services and token authentication services;

[0071] Data Layer: Responsible for data storage and access, enabling data synchronization between blockchain data and the MySQL database; the blockchain data includes node data, authorization data, transaction records, and access records; the MySQL data in the MySQL database includes basic data and business data.

[0072] Infrastructure layer: Provides the infrastructure for system operation, such as computing servers and distributed storage.

[0073] (1) Application layer

[0074] The application layer includes a data dashboard module and a data operation module;

[0075] The data dashboard module is responsible for monitoring the relationship status of various business terminals, server operating resources, and blockchain operation status.

[0076] The data operation module provides a management interface for various functions and services of the control terminal.

[0077] (2) Business layer

[0078] The business layer includes a system node management module, a business relationship management module, an access control proxy module, a user management module, an access record query module, a transaction record query module, a log management module, and a permission management module;

[0079] The system node management module is responsible for calling the blockchain to manage the basic information, firmware information, and identity identifiers of each node terminal, such as adding, modifying, and deactivating them, thereby realizing node identity registration.

[0080] The business relationship management module is responsible for creating transaction pending tasks for each front-end node, such as creating new node business relationships, modifying node business relationships, adding configurations, and modifying configurations. After establishing a connection between the front-end and the control end and passing identity authentication, it automatically matches and executes the transactions.

[0081] The access control proxy module is a middleware deployed on the application terminal. It includes units such as node firmware information, node identity settings, and node connection services. It is responsible for obtaining the hardware serial codes such as CPU and MAC of the information terminal, as well as obtaining unique hardware information such as unique UID. When resetting or initializing the information middleware, it is responsible for parsing the identity key generated by the system node management module after completing identity registration and configuring it into the middleware, as well as providing long-connection communication services with the control management end.

[0082] The user management module is responsible for the basic management capabilities of the system, such as operating users and roles.

[0083] The access log query module is used to query the system's access logs;

[0084] The transaction record query module is used to query the system's transaction record logs;

[0085] The log management module is responsible for managing and querying the system's daily operations and operation records.

[0086] The access control module is responsible for controlling user permissions within the system.

[0087] (3) Service layer

[0088] The service layer includes blockchain service, authentication service, and access control service modules;

[0089] The blockchain service consists of a blockchain basic service unit, a key service unit, a committee voting service unit, a consortium node management unit, and a smart contract unit; the blockchain service is a general blockchain capability, and this invention uses the FISCOBCOS consortium blockchain.

[0090] The authentication service consists of a user authentication unit and a token authentication unit, and

[0091] The user authentication unit is responsible for identifying, verifying, and authenticating users or middleware long connections that log in to the system.

[0092] The token authentication unit is responsible for anti-counterfeiting and anti-borrowing identification processing of all communications between users and middleware;

[0093] The access control service module is responsible for proactively severing the communication connection when user or middleware authentication fails.

[0094] III. Identity Authentication Methods in Blockchain-Based Identity Authentication Systems

[0095] like Figure 3-4 The present invention also proposes an identity authentication method based on the above-mentioned identity authentication system, which includes the following steps:

[0096] Step 1: Deploy the access control proxy service module (middleware) to the business nodes;

[0097] Step 2: Obtain the unique firmware information (CPU sn, MACsn, UID, etc.) of the business node through the access control proxy service module;

[0098] Step 3: Register the node identity with the system node management module on the control end based on the firmware information obtained in Step 2;

[0099] Step 4: After receiving the identity registration request, the system node management module calls the blockchain key service unit to generate the blockchain identity identifier for the node, associates the firmware information with the blockchain identity identifier, and stores it in the blockchain using the blockchain basic service to complete the node identity registration.

[0100] Step 5: The system node management module exports the identity key file of the business node (the key file contains the encrypted blockchain identity identifier of the node by salting the middle few bits after concatenating the firmware information of the business node), and imports the identity key file into the access control proxy service module (middleware).

[0101] Step 6: After receiving the identity key import request, the access control proxy service module parses the encrypted identity key file according to the firmware information. If the parsing is successful, the key file is configured and the process proceeds to Step 7. Otherwise, it indicates that the key is invalid and the authentication process is terminated.

[0102] Step 7: The access control proxy service module automatically initiates a long connection to establish communication with the control end and sends request messages (including heartbeats, business messages, etc.);

[0103] Step 8: After receiving the communication request, the control terminal calls the authentication service module to authenticate the identity (user) identifier carried in the request; if the authentication is successful, proceed to step 9; if the authentication fails, it means that the identity identifier is invalid, and the access control service module actively disconnects the long connection communication and terminates the authentication process.

[0104] Step 9: The control terminal calls the blockchain service to query the middleware firmware information based on the identity identifier. If the query is successful, proceed to step 10. If the query fails, it means that the identity identifier is invalid, and the access control service module actively disconnects the long connection communication and terminates the authentication process.

[0105] Step 10: The control terminal decrypts the communication content based on the firmware information and the identity key of the access control proxy service module. If the decryption is successful, proceed to step 11. If the decryption fails, it means that the identity has been impersonated, and the access control service module actively disconnects the long connection communication and terminates the authentication process.

[0106] Step 11: If the communication content is successfully decrypted, token authentication is passed.

[0107] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A blockchain-based identity authentication system, characterized in that, This system consists of, from top to bottom, the application layer, business layer, service layer, data layer, and infrastructure layer, among which: The application layer is mainly used for business logic processing, manipulating data on the front end, and dynamically displaying the data in a visual way; The business layer is used to provide the algorithms required for business implementation, complete business functions through relevant algorithms, and interact with the data layer and application layer. The service layer is used to provide reusable services; The data layer is used for data storage and access, and to realize data synchronization between blockchain data and MySQL database. The blockchain data includes node data, authorization data, transaction records, and access records, while the data in the MySQL database includes basic data and business data. The base layer provides the infrastructure for system operation; The application layer includes: The data dashboard module is used to monitor the relationship status of various business terminals, server operating resources, and blockchain operation status. The data operation module provides a management interface for various functions and services of the control terminal. The business layer includes: The system node management module is used to call the blockchain to add, modify, and deactivate basic information, firmware information, and identity identifiers of each node terminal, and to complete node identity registration. The business relationship management module is used to create transaction pending tasks for each front-end node; The access control proxy module is a middleware deployed on the application terminal. It is used to obtain the unique firmware information of the node it is located on, and to parse the identity key generated after identity registration when resetting or initializing the access control proxy module, and to configure it to the access control proxy module, and to realize long-connection communication service with the control management terminal. The user management module is responsible for the basic management of system users and roles. The access log query module is used to query the logs generated by system access; The transaction record query module is used to query transaction records in the system; The log management module is used to manage and query the system's daily operation and operation records; The access control module is used to control the permissions of system users.

2. The blockchain-based identity authentication system as described in claim 1, characterized in that, The services provided by the service layer include blockchain services, authentication services, and access control and restriction services. Blockchain services include basic services, key services, committee voting services, consortium node management, and smart contract-related services. The authentication service includes user authentication service and token authentication service.

3. The blockchain-based identity authentication system as described in claim 2, characterized in that, The access control proxy module includes a node firmware information unit, a node identity setting unit, and a node connection service unit. The node firmware information unit is used to obtain the hardware serial number and unique hardware information of the information terminal it belongs to. The node identity setting unit is used to configure the identity key generated after the system node management module completes identity registration; The node connection service unit is used for long-term communication with the control and management terminal.

4. The blockchain-based identity authentication system as described in claim 3, characterized in that, The service layer includes: The blockchain service module is used to provide basic blockchain services; The authentication service module is used to authenticate user information and token information; The access control service module is used to proactively sever the communication connection between the user and the middleware when authentication fails.

5. The blockchain-based identity authentication system as described in claim 4, characterized in that, The blockchain service module includes a blockchain basic service unit, a key service unit, a committee voting service unit, an alliance node management unit, and a smart contract unit.

6. The blockchain-based identity authentication system as described in claim 5, characterized in that, The authentication service module includes: The user authentication unit is used to identify, verify, and authenticate users or middleware long connections that log in to the system. The token authentication unit is used to perform anti-counterfeiting and anti-borrowing identification processing on all communications between users and middleware.

7. A blockchain-based identity authentication method, implemented based on the identity authentication system as described in claim 1, characterized in that, Includes the following steps: Step 1: Deploy the access control proxy service module to the business nodes; Step 2: Obtain the unique firmware information of the business node through the access control proxy service module; Step 3: Register the node identity with the system node management module on the control end based on the obtained firmware information; Step 4: After receiving the identity registration request, the system node management module calls the blockchain key service unit to generate the blockchain identity identifier for the node, associates the firmware information with the blockchain identity identifier, and stores it in the blockchain using the blockchain basic service to complete the node identity registration. Step 5: The system node management module exports the identity key file of the business node and imports the identity key file into the access control proxy service module; Step 6: After receiving the identity key import request, the access control proxy service module parses the encrypted identity key file according to the firmware information. If the parsing is successful, the key file is configured and the process proceeds to Step 7. Otherwise, it indicates that the key is invalid and the authentication process is terminated. Step 7: The access control proxy service module automatically initiates a long connection to establish communication with the control end and sends a request message; Step 8: After receiving the communication request, the control terminal calls the authentication service module to authenticate the identity token carried in the request; If authentication is successful, proceed to step 9. If authentication fails, it indicates that the identity is invalid, and the access control service module will actively disconnect the long connection communication and terminate the authentication process. Step 9: The control terminal calls the blockchain service to query the middleware firmware information based on the identity identifier. If the query is successful, proceed to step 10. If the query fails, it means that the identity identifier is invalid, and the access control service module actively disconnects the long connection communication and terminates the authentication process. Step 10: The control terminal decrypts the communication content based on the firmware information and the identity key of the access control proxy service module. If the decryption is successful, proceed to step 11. If the decryption fails, it means that the identity has been impersonated. The access control service module actively disconnects the long connection communication and terminates the authentication process. Step 11: If the communication content is successfully decrypted, token authentication is passed.

Images