Blockchain-based two-way authentication method, device, equipment, medium and product

Abstract

The application discloses a kind of based on two-way authentication method, device, equipment, medium and product of blockchain, the method is executed by first gateway, the method includes: receiving terminal sent cross-domain network access request;Identity credential corresponding to the terminal is obtained from the cross-domain network access request in blockchain;Wherein, the identity credential is generated by the second gateway and stored in the blockchain after the terminal completes network registration in the second gateway by the second gateway;Based on the identity credential, the validity of the signature of the terminal is verified;If it is verified, it returns network access request confirmation to the terminal.The application combines the national secret SM2 signature technology and the distributed architecture of blockchain, realizes the two-way identity authentication between terminal and gateway, and the identity data is encrypted in the process of safe access, both sides do not need to exchange identity information again during cross-domain authentication, identity credential can be inquired through blockchain, authentication efficiency is higher, and user legality can also be ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a two-way authentication method and device based on a blockchain, equipment, medium and product. BACKGROUND

[0002] In the mobile Internet, when unauthorized devices or users access wireless networks, there are risks of user information leakage, data loss and network attacks. At the same time, in the traditional terminal access process, the business data is not encrypted, and the attacker can obtain sensitive information through eavesdropping. Based on the above security risks, researchers have proposed secure terminal access technology, such as SSL+VPN / IPsec, which provides user credentials through centralized management. However, this approach faces the risk of credential leakage, and a single point of failure will result in a large-scale threat attack. In addition, the security of the centralized server is limited, and the user's key information is stored on it, which is vulnerable to theft attacks. Moreover, when the user needs to switch between different networks, the identity authentication needs to be performed again, which is very time-consuming. SUMMARY

[0003] The technical problem to be solved by the present application is to provide a two-way authentication method, device, equipment, medium and product based on a blockchain, which combines the SM2 signature technology and the distributed architecture of the blockchain to realize two-way identity authentication between the terminal and the gateway, and encrypts the identity data in the secure access process. When cross-domain authentication is performed, the two parties do not need to exchange identity information again, and the identity credentials can be queried through the blockchain, which can ensure the user's legitimacy while improving the authentication efficiency.

[0004] To achieve the above purpose, the embodiment of the present application provides a two-way authentication method based on a blockchain, which is executed by a first gateway, and the method comprises:

[0005] Receiving a cross-domain network access request sent by a terminal;

[0006] Obtaining an identity credential corresponding to the terminal from the blockchain according to the cross-domain network access request; wherein the identity credential is generated by a second gateway and stored in the blockchain after the terminal completes network registration in the second gateway;

[0007] Verifying the validity of the terminal's signature based on the identity credential; if the verification is passed, returning a network access request confirmation to the terminal.

[0008] As an improvement of the above-mentioned scheme, the cross-domain network access request includes a terminal identity, network access request information, a terminal signature and a timestamp, and the identity credential corresponding to the terminal is obtained from the blockchain according to the cross-domain network access request, specifically:

[0009] According to the terminal identity in the cross-domain network access request, the identity credential corresponding to the terminal is obtained from the block chain based on RFID technology.

[0010] As an improvement of the above scheme, the identity credential is used to verify the validity of the signature of the terminal, including:

[0011] According to the identity credential, the signature information, identity information and historical network access behavior of the terminal are obtained.

[0012] The validity of the signature of the terminal is verified, and whether the request behavior of the terminal is normal is judged according to the historical network access behavior.

[0013] If the signature of the terminal is valid and the behavior of the terminal is normal, the verification is passed.

[0014] As an improvement of the above scheme, before the terminal sends the cross-domain network access request to the first gateway, the reputation of the first gateway is evaluated based on the historical data stored on the block chain.

[0015] If the reputation of the first gateway reaches a first preset threshold, the cross-domain network access request is sent to the first gateway.

[0016] The embodiment of the application also provides a two-way authentication method based on a block chain, which is executed by a second gateway, and the method comprises:

[0017] Receiving a network access registration request sent by a terminal;

[0018] Verifying the validity of the signature in the network access registration request, and generating a first public key and a first private key for the terminal, and transmitting the first public key and the first private key to the terminal in an encrypted manner.

[0019] Receiving a second public key, a second private key and a signature credential sent by the terminal;

[0020] Verifying the validity of the signature and the identity legality of the terminal based on the signature credential.

[0021] If the verification is passed, an identity credential is generated for the terminal, and the identity credential is sent to the terminal and uploaded to a block chain for storage.

[0022] As an improvement of the above scheme, the network access registration request comprises an internet reputation of the terminal, a terminal identity, a public key of the terminal, a terminal signature and a timestamp.

[0023] As an improvement of the above scheme, after receiving the network access registration request sent by the terminal, the method further comprises:

[0024] querying whether the terminal identity exists in the blockchain based on the RFID technology;

[0025] If yes, generating an identity credential for the terminal directly, sending the identity credential to the terminal, and uploading the identity credential to the blockchain for storage.

[0026] As an improvement of the above scheme, the method further comprises:

[0027] judging whether the Internet reputation of the terminal reaches a second preset threshold;

[0028] If yes, responding to the network registration request of the terminal;

[0029] If no, rejecting the network registration request of the terminal.

[0030] The embodiment of the application further provides a two-way authentication device based on a blockchain, which is applied to a first gateway and comprises:

[0031] a request receiving module configured to receive a cross-domain network access request sent by a terminal;

[0032] a credential obtaining module configured to obtain an identity credential corresponding to the terminal from a blockchain according to the cross-domain network access request, wherein the identity credential is generated by a second gateway and stored in the blockchain after the terminal completes network registration in the second gateway;

[0033] a signature verification module configured to verify the validity of a signature of the terminal based on the identity credential, and return a network access request confirmation to the terminal if the verification is passed.

[0034] The embodiment of the application further provides a two-way authentication device based on a blockchain, which is applied to a second gateway and comprises:

[0035] a request receiving module configured to receive a network registration request sent by a terminal;

[0036] a key generating module configured to verify the validity of a signature in the network registration request, and generate a first public key and a first private key for the terminal, and encrypt and transmit the first public key and the first private key to the terminal;

[0037] a key receiving module configured to receive a second public key, a second private key and a signature credential sent by the terminal;

[0038] an identity verification module configured to verify the validity of a signature and the legality of an identity of the terminal based on the signature credential;

[0039] A credential generation module is configured to generate an identity credential for the terminal if the verification is passed, and send the identity credential to the terminal and upload the identity credential to a blockchain for storage.

[0040] The embodiment of the present application also provides a terminal device, comprising a processor, a memory and a computer program stored in the memory and configured to be executed by the processor, and the processor implements the two-way authentication method based on the blockchain when the computer program is executed.

[0041] The embodiment of the present application also provides a computer readable storage medium, comprising a stored computer program, wherein the computer readable storage medium controls a device where the computer readable storage medium is located to execute the two-way authentication method based on the blockchain when the computer program is executed.

[0042] The embodiment of the present application also provides a computer program product, comprising a computer program or computer instructions, and the computer program or the computer instructions implement the two-way authentication method based on the blockchain when executed by a processor.

[0043] Compared with the prior art, the two-way authentication method based on the blockchain, the device, the equipment, the medium and the product provided by the embodiment of the present application have the beneficial effects that: a cross-domain network access request sent by a terminal is received through a first gateway; an identity credential corresponding to the terminal is obtained from a blockchain according to the cross-domain network access request; wherein the identity credential is generated by a second gateway and stored in the blockchain after the terminal completes network registration in the second gateway; the validity of a signature of the terminal is verified based on the identity credential; and a network access request confirmation is returned to the terminal if the verification is passed. The embodiment of the present application combines the national secret SM2 signature technology and the blockchain distributed architecture, realizes the two-way identity authentication between the terminal and the gateway, encrypts the identity data in the secure access process, and does not need to exchange identity information again during cross-domain authentication, can query the identity credential through the blockchain, and is high in authentication efficiency and can ensure the legality of the user. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 is a flowchart of one preferred embodiment of the two-way authentication method based on the blockchain provided by the present application;

[0045] Figure 2 is an interaction diagram of terminal cross-domain network access in the two-way authentication method based on the blockchain provided by the present application;

[0046] Figure 3 is a flowchart of another preferred embodiment of the two-way authentication method based on the blockchain provided by the present application;

[0047] Figure 4 is a schematic diagram of terminal network registration interaction in a two-way authentication method based on a blockchain provided by the present application;

[0048] Figure 5 is a structural schematic diagram of a preferred embodiment of a two-way authentication device based on a blockchain provided by the present application;

[0049] Figure 6 is a structural schematic diagram of another preferred embodiment of a two-way authentication device based on a blockchain provided by the present application;

[0050] Figure 7 is a structural schematic diagram of a preferred embodiment of a terminal device provided by the present application. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0052] Please refer to Figure 1 , Figure 1 is a flow schematic diagram of a preferred embodiment of a two-way authentication method based on a blockchain provided by the present application. The two-way authentication method based on a blockchain is executed by a first gateway, and the method comprises:

[0053] S101, receiving a cross-domain network access request sent by a terminal;

[0054] S102, obtaining an identity credential corresponding to the terminal from a blockchain according to the cross-domain network access request; wherein the identity credential is generated by a second gateway and stored in the blockchain after the terminal completes network registration in the second gateway;

[0055] S103, verifying the validity of the signature of the terminal based on the identity credential; if the verification is passed, returning a network access request confirmation to the terminal.

[0056] The SM2 algorithm is a non-symmetric encryption algorithm with high security and efficiency. The algorithm can be used to protect the confidentiality and integrity of data, prevent data from being tampered with or leaked. In addition, the SM2 algorithm can also be used in digital signature and identity authentication scenarios to ensure the security and reliability of network communication. At present, the SM2 algorithm has been widely used in the fields of finance, government affairs, e-commerce and other fields, and has become one of the important supporting technologies in the domestic information security field. The blockchain technology realizes the secure storage and transmission of data through the decentralized way, so as to effectively guarantee the network security. Because the data in the blockchain is distributed storage, there is no single center node, so it is difficult for attackers to tamper with the data. In addition, the transaction in the blockchain needs to be verified by the consensus mechanism before it can be confirmed, which also increases the security of the network. At present, due to the wide application of distributed wireless network architecture, more decentralized blockchain technology is used to meet the security access requirements of wireless terminals. The blockchain technology can prevent user data loss, tampering and malicious penetration attacks.

[0057] Based on this, the embodiment of the application provides a two-way authentication method based on a blockchain. For example, please refer to Figure 2 , Figure 2 is a schematic diagram of terminal cross-domain network access in a two-way authentication method based on a blockchain provided by the application. The embodiment of the application combines the demand for terminal security access in the mobile office scenario, wherein the terminal is a 5G network card (Network Card User, NU), and the gateway is a security gateway (Security Gateway, SG). The two-way authentication method based on the blockchain provided by the embodiment of the application is executed by a first gateway , the first gateway receives a cross-domain network access request sent by a terminal, and obtains an identity credential corresponding to the terminal from the blockchain according to the cross-domain network access request . The identity credential is generated by a second gateway and stored in the blockchain after the terminal completes network registration in the second gateway . It should be noted that after the terminal network access authentication is successful, it becomes a legal user on the blockchain, i.e. identity blockchain (Identity Blockchain, IBC), and can be authenticated with other gateways in the local network domain. When the terminal sends a network access application to the gateway , the gateway and the terminal do not need to exchange identity information again, but only need to check the identity credential through the identity blockchain IBC to complete the two-way authentication between the gateway and the terminal user. The first gateway based on the identity credential Verify the signature validity of the terminal, and if the verification is passed, return the network access request confirmation to the terminal. At the same time, record the detailed operation process on the identity alliance chain IBC, so as to trace back when problems occur.

[0058] The embodiment of the application combines the national SM2 signature technology and the block chain distributed architecture, encrypts the terminal security access request and the network access identity information in the wireless network, strictly controls the access of the authorized terminal user to the network resource, thereby reducing the risk of unauthorized terminal user or attacker invading the network. The national SM2 signature algorithm is used for identity authentication of the terminal user, so as to ensure that the signature information cannot be denied; the terminal user data privacy and integrity are protected through the encryption algorithm, and the generated identity credential follows the minimum disclosure principle and realizes self-control. When cross-domain authentication, the two parties do not need to exchange identity information again, and the identity credential can be queried through the block chain, so that the authentication efficiency is high, and the user legality can be ensured.

[0059] In another preferred embodiment, the cross-domain network access request includes a terminal identity, network access request information, a terminal signature, and a timestamp, and the identity credential corresponding to the terminal is obtained from the block chain according to the cross-domain network access request, specifically:

[0060] According to the terminal identity in the cross-domain network access request, the identity credential corresponding to the terminal is obtained from the block chain based on RFID technology.

[0061] Specifically, in the embodiment of the application, the terminal sends a cross-domain network access request to the first gateway , wherein , the terminal identity is the identity of the terminal, , the network access request information is the network access request information of the terminal, , the terminal signature is the terminal signature, , and the timestamp is the timestamp. That is, the cross-domain network access request sent by the terminal to the first gateway includes a terminal identity, network access request information, a terminal signature, and a timestamp. In the embodiment of the application, each terminal can be equipped with an RFID tag, and when the first gateway receives the cross-domain network access request sent by the terminal, the RFID tag of the terminal can be read through an RFID reader, and the terminal identity is verified on the identity alliance chain IBC to query the identity credential corresponding to the terminal . If the first gateway can directly provide services, the first gateway sends a reply to the terminal, and the terminal checks the validity of the timestamp and whether the services are provided.

[0062] In another preferred embodiment, the verifying the signature validity of the terminal based on the identity credential comprises:

[0063] obtaining the signature information, identity information and historical online behavior of the terminal based on the identity credential;

[0064] verifying the signature validity of the terminal, and judging whether the request behavior of the terminal is normal according to the historical online behavior;

[0065] if the signature of the terminal is valid and the behavior of the terminal is normal, the verification is passed.

[0066] Specifically, in the embodiment of the present application, the first gateway obtains the identity credential from the identity alliance chain IBC , and obtains the signature information, identity information and historical online behavior (such as service request frequency, request time, etc.) of the terminal. The first gateway verifies the signature validity of the terminal, and judges whether the request behavior of the terminal is normal according to the historical online behavior. If the signature of the terminal is valid and the behavior of the terminal is normal, the verification is passed, and the network access request confirmation is returned to the terminal.

[0067] In another preferred embodiment, before the terminal sends the cross-domain network access request to the first gateway, the credibility of the first gateway is evaluated based on the historical data stored on the blockchain;

[0068] if the credibility of the first gateway reaches a first preset threshold, the cross-domain network access request is sent to the first gateway.

[0069] Specifically, in the embodiment of the present application, before the terminal sends the cross-domain network access request to the first gateway , the validity of the gateway identity credential on the identity alliance chain IBC is checked, and the credibility of the first gateway is evaluated based on the historical data stored on the identity alliance chain IBC, such as historical transaction records or data of other trust scoring systems. If the credibility of the first gateway reaches a first preset threshold, the terminal will send the cross-domain network access request to the first gateway . If the credibility of the first gateway does not reach the first preset threshold, the terminal will not send the cross-domain network access request to the first gateway .

[0070] Please refer to Figure 3 , Figure 3 is another preferred embodiment of a two-way authentication method based on a blockchain provided by the present application. The two-way authentication method based on the blockchain is executed by a second gateway, and the method comprises:

[0071] S301, Receive network registration request sent by terminal;

[0072] S302, verify the validity of the signature in the network access registration request, generate a first public key and a first private key for the terminal, and encrypt and transmit the first public key and the first private key to the terminal;

[0073] S303, receive the second public key, the second private key, and the signature certificate sent by the terminal;

[0074] S304, Verify the signature validity and identity legitimacy of the terminal based on the signature credential;

[0075] S305, if the verification is successful, an identity credential is generated for the terminal, and the identity credential is sent to the terminal and simultaneously uploaded to the blockchain for storage.

[0076] For example, please refer to Figure 4 , Figure 4 This is a schematic diagram illustrating the terminal network registration interaction in a blockchain-based two-way authentication method provided by this invention. The blockchain-based two-way authentication method provided in this embodiment of the invention utilizes a second gateway. Execution, Second Gateway Receive the network registration request sent by the terminal, verify the validity of the signature in the network registration request, and generate the first public key for the terminal. and the first private key , the first public key and the first private key The data is transmitted to the terminal via a secure channel using encryption. The first public key... and the first private key This is not the complete public and private key. The terminal receives the second gateway. The first public key sent and the first private key Then, verify the first private key. The validity of the signature is checked. If valid, the terminal selects a random number based on the SM2 signature algorithm. Calculate the complete public and private keys, i.e., the second public key and the second private key are respectively and Meanwhile, the terminal uses and Generate signature and the signature certificate Send via 5G network to the second gateway .in, Includes the terminal's identity information and historical internet behavior score, and the terminal's signature. It contains information that is uniquely associated with the terminal. For timestamps. Second gateway. Based on the received signature credentials According to the terminal's second public key Verify the validity of the terminal's signature and The legitimacy of the terminal is verified through AI and big data technologies. Historical behavior is analyzed to help determine the terminal's credit rating. If verification is successful, an identity credential is generated for the terminal. .in, for signature, For the effective date of the certificate, Network domains registered for NU For the signature generation time, The issuer of the credential. Second gateway. Terminal identity credentials The data is sent to the terminal, which saves it after verifying the validity of the timestamp and signature. Simultaneously, the second gateway... Terminal identity credentials The data is uploaded to a blockchain for storage. The preferred blockchain is an Identity-Blockchain (IBC). The IBC records the NU's network access authentication process, including all submitted information and system responses, ensuring the transparency and traceability of the NU's network access information. At this point, the NU's network access authentication is complete, and subsequent business data transmission can begin. If verification fails, the terminal's network registration request is rejected.

[0077] This invention employs end-to-end encryption and authentication technologies to prevent attackers from connecting to the gateway and performing unauthorized operations, thus preventing the leakage of business data. It utilizes the national cryptographic SM2 signature algorithm and timestamps to design an anti-replay system, ensuring that each terminal request expires after being used once, without time limits, guaranteeing non-repudiation of authentication. An Identity-Blockchain (IBC) is used to store the network access authentication credentials of 5G data card users, enabling other entities to query these credentials. During the network access application stage, 5G data card users use the SM2 signature algorithm to generate valid identity credentials, ensuring non-repudiation of identity information. The identity credentials are stored on the blockchain, making them immutable.

[0078] In another preferred embodiment, the network registration request includes the terminal's internet credibility, terminal identity identifier, terminal public key, terminal signature, and timestamp.

[0079] Specifically, in this embodiment of the invention, the terminal sends a request to the second gateway. Sending network registration request ,in, an internet reputation of the NU, an identity of the NU, a public key of the NU, a signature of the NU to , a signature of the NU to , a signature of the NU to , a signature of the NU to

[0080] In yet another preferred embodiment, after receiving the network access registration request sent by the terminal, the method further comprises:

[0081] querying whether the identity of the terminal exists in the blockchain based on RFID technology;

[0082] if yes, generating an identity credential for the terminal directly, sending the identity credential to the terminal, and uploading the identity credential to the blockchain for storage.

[0083] Specifically, in the embodiment of the application, the second gateway after receiving the network access registration request sent by the terminal, introduces RFID, an Internet of Things device identification technology, to perform rapid and accurate identity verification, and queries whether the identity of the terminal exists in the identity blockchain (IBC) . If the identity of the terminal exists in the identity blockchain (IBC) , the second gateway generates an identity credential for the terminal directly, sends the identity credential to the terminal, and uploads the identity credential to the identity blockchain (IBC) for storage. If the identity of the terminal does not exist in the identity blockchain (IBC) , the second gateway performs network access registration for the terminal.

[0084] In yet another preferred embodiment, the method further comprises:

[0085] judging whether the internet reputation of the terminal reaches a second preset threshold;

[0086] if yes, responding to the network access registration request of the terminal;

[0087] if no, rejecting the network access registration request of the terminal.

[0088] Specifically, in the embodiment of the application, the second gateway after receiving the network access registration request sent by the terminal, judges whether the internet reputation of the terminal reaches a second preset threshold. If the internet reputation of the terminal reaches the second preset threshold, the second gateway The second gateway will only respond to the network registration request of the terminal if the Internet reputation of the terminal reaches a second preset threshold. The second gateway rejects the network registration request of the terminal.

[0089] Correspondingly, the application also provides a two-way authentication device based on a blockchain, which can implement all processes of the two-way authentication method based on a blockchain in the above embodiments.

[0090] Please refer to Figure 5 , Figure 5 is a structural schematic diagram of a preferred embodiment of a two-way authentication device based on a blockchain provided by the application. The two-way authentication device based on a blockchain is applied to a first gateway, and the device comprises:

[0091] The request receiving module 501 is configured to receive a cross-domain network access request sent by a terminal.

[0092] The credential obtaining module 502 is configured to obtain an identity credential corresponding to the terminal from a blockchain according to the cross-domain network access request.

[0093] The signature verification module 503 is configured to verify the validity of the signature of the terminal based on the identity credential, and return a network access request confirmation to the terminal if the verification is passed.

[0094] Preferably, the cross-domain network access request comprises a terminal identity, network access request information, a terminal signature, and a timestamp, and the identity credential corresponding to the terminal is obtained from the blockchain according to the cross-domain network access request, specifically as follows:

[0095] The identity credential corresponding to the terminal is obtained from the blockchain according to the terminal identity in the cross-domain network access request based on RFID technology.

[0096] Preferably, the verification of the validity of the signature of the terminal based on the identity credential comprises:

[0097] The signature information, identity information, and historical online behavior of the terminal are obtained based on the identity credential.

[0098] The validity of the signature of the terminal is verified, and whether the request behavior of the terminal is normal is determined according to the historical online behavior.

[0099] If the signature of the terminal is valid and the behavior of the terminal is normal, the verification is passed.

[0100] ​Preferably, the terminal evaluates the credibility of the first gateway based on historical data stored on the blockchain before sending the cross-domain onboarding request to the first gateway.

[0101] If the credibility of the first gateway reaches a first preset threshold, the cross-domain onboarding request is sent to the first gateway.

[0102] Please refer to Figure 6 , Figure 6 is another preferred embodiment of a structure of a two-way authentication device based on a blockchain provided by the application. The two-way authentication device based on a blockchain is applied to a second gateway, and the device comprises:

[0103] The request receiving module 601 is configured to receive an onboarding registration request sent by a terminal.

[0104] The key generating module 602 is configured to verify the validity of a signature in the onboarding registration request, and generate a first public key and a first private key for the terminal, and encrypt the first public key and the first private key and transmit them to the terminal.

[0105] The key receiving module 603 is configured to receive a second public key, a second private key and a signature credential sent by the terminal.

[0106] The identity verification module 604 is configured to verify the validity of the signature and the legality of the identity of the terminal based on the signature credential.

[0107] The credential generating module 605 is configured to generate an identity credential for the terminal if the verification is passed, and send the identity credential to the terminal and upload it to the blockchain for storage.

[0108] Preferably, the onboarding registration request comprises an internet credibility of the terminal, a terminal identity, a public key of the terminal, a terminal signature and a timestamp.

[0109] Preferably, the device further comprises an identity query module, which is configured to:

[0110] query whether the terminal identity exists in the blockchain based on RFID technology;

[0111] If yes, an identity credential is directly generated for the terminal, and the identity credential is sent to the terminal and uploaded to the blockchain for storage.

[0112] Preferably, the device further comprises a credibility judgment module, which is configured to:

[0113] determine whether the internet credibility of the terminal reaches a second preset threshold;

[0114] If yes, responding to the network registration request of the terminal;

[0115] If no, rejecting the network registration request of the terminal.

[0116] In specific implementation, the working principle, control flow and technical effects of the two-way authentication device based on the blockchain provided by the embodiments of the present application are the same as the two-way authentication method based on the blockchain in the above embodiments, and will not be repeated here.

[0117] Please refer to Figure 7 , Figure 7 is a structural schematic diagram of a preferred embodiment of a terminal device provided by the present application. The terminal device comprises a processor 701, a memory 702, and a computer program stored in the memory 702 and configured to be executed by the processor 701, and the processor 701 implements the two-way authentication method based on the blockchain described in any of the above embodiments when executing the computer program.

[0118] Preferably, the computer program can be divided into one or more modules / units (such as computer program 1, computer program 2, …), which are stored in the memory 702 and executed by the processor 701 to complete the present application. The one or more modules / units can be a series of computer program instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the terminal device.

[0119] The processor 701 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or the processor 701 can also be any conventional processor. The processor 701 is the control center of the terminal device, and connects various parts of the terminal device through various interfaces and lines.

[0120] The memory 702 mainly includes a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required by a function, and the like, and the data storage area can store related data and the like. In addition, the memory 702 can be a high-speed random access memory, and can also be a non-volatile memory such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, or the like, or the memory 702 can also be another volatile solid-state storage device.

[0121] It should be noted that the terminal device described above can include, but is not limited to, a processor and a memory, and those skilled in the art can understand that, Figure 7 The structural diagram is only an example of the terminal device described above, and does not constitute a limitation on the terminal device described above, and can include more or fewer components than the diagram, or combine certain components, or different components.

[0122] The embodiment of the application further provides a computer readable storage medium, the computer readable storage medium includes a stored computer program, wherein when the computer program runs, the computer readable storage medium controls the device where the computer readable storage medium is located to execute the two-way authentication method based on the blockchain described in any of the above embodiments.

[0123] The embodiment of the application further provides a computer program product, the computer program product includes a computer program or computer instructions, and the computer program or the computer instructions are executed by a processor to realize the two-way authentication method based on the blockchain described in any of the above embodiments.

[0124] The embodiment of the application provides a two-way authentication method and device based on a blockchain, a terminal sends a cross-domain network access request to a first gateway; identity credentials corresponding to the terminal are obtained from a blockchain according to the cross-domain network access request; wherein the identity credentials are generated by a second gateway and stored in the blockchain after the terminal completes network registration in the second gateway; the validity of the signature of the terminal is verified based on the identity credentials; if the verification is passed, the terminal is returned a network access request confirmation. The embodiment of the application combines the SM2 signature technology and the distributed architecture of the blockchain to realize two-way identity authentication between the terminal and the gateway, and the identity data is encrypted in the secure access process, and the identity information does not need to be exchanged again during cross-domain authentication, the identity credentials can be queried through the blockchain, the authentication efficiency is high, and the legality of the user can be ensured.

[0125] It should be noted that the system embodiments described above are only illustrative, wherein the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e. can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment according to actual needs. In addition, the connection relationship between the modules in the system embodiment provided by the present application indicates that there is a communication connection between them, which can be implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement it without creative labor.

[0126] The above is the preferred embodiment of the present application. It should be noted that those skilled in the art can make several improvements and refinements without departing from the principles of the present application, and these improvements and refinements are also considered within the scope of protection of the present application.

Claims

1. A two-way authentication method based on blockchain, characterized in that, The method is executed by a first gateway, and the method comprises: receiving a cross-domain on-network request sent by a terminal; obtaining an identity credential corresponding to the terminal from a block chain according to the cross-domain on-network request; wherein the identity credential is generated by a second gateway and stored in the block chain after the terminal completes on-network registration in the second gateway; verifying the validity of the signature of the terminal based on the identity credential; if the verification is passed, returning an on-network request confirmation to the terminal; wherein the cross-domain on-network request comprises a terminal identity, on-network request information, a terminal signature and a timestamp, and the identity credential corresponding to the terminal is obtained from the block chain according to the cross-domain on-network request, specifically as follows: obtaining the identity credential corresponding to the terminal from the block chain according to the terminal identity in the cross-domain on-network request based on RFID technology.

2. The blockchain-based two-way authentication method of claim 1, wherein, The method further comprises: obtaining the signature information, identity information and historical on-network behavior of the terminal based on the identity credential; verifying the validity of the signature of the terminal, and judging whether the request behavior of the terminal is normal according to the historical on-network behavior; if the signature of the terminal is valid and the behavior of the terminal is normal, the verification is passed. 3.The blockchain-based two-way authentication method of claim 1, wherein, Before the terminal sends the cross-domain on-network request to the first gateway, the reputation of the first gateway is evaluated based on historical data stored on the block chain; if the reputation of the first gateway reaches a first preset threshold, the cross-domain on-network request is sent to the first gateway. 4.A two-way authentication method based on a blockchain, characterized in that, The method is executed by a second gateway, and the method comprises: receiving an on-network registration request sent by a terminal; verifying the validity of the signature in the on-network registration request, and generating a first public key and a first private key for the terminal, and transmitting the first public key and the first private key to the terminal in an encrypted manner; receiving a second public key, a second private key and a signature credential sent by the terminal; verifying the validity of the signature and the identity of the terminal based on the signature credential; if the verification is passed, generating an identity credential for the terminal, and sending the identity credential to the terminal and uploading it to a block chain for storage. 5.The blockchain-based two-way authentication method of claim 4, wherein, The on-network registration request comprises an internet reputation of the terminal, a terminal identity, a public key of the terminal, a terminal signature and a timestamp.

6. The blockchain-based two-way authentication method of claim 5, wherein, After receiving the on-network registration request sent by the terminal, the method further comprises: querying whether the terminal identity exists in the block chain based on RFID technology; if yes, generating an identity credential for the terminal, and sending the identity credential to the terminal and uploading it to the block chain for storage. 7.The blockchain-based two-way authentication method of claim 5, wherein, The method further comprises: judging whether the internet reputation of the terminal reaches a second preset threshold; if yes, responding to the on-network registration request of the terminal; if no, rejecting the on-network registration request of the terminal. 8.A blockchain-based two-way authentication device, characterized in that, The device is applied to a first gateway, and the device comprises: a request receiving module, configured to receive a cross-domain on-network request sent by a terminal; The credential obtaining module is configured to obtain the identity credential corresponding to the terminal from the blockchain according to the cross-domain on-network request; wherein the identity credential is generated by the second gateway and stored in the blockchain after the terminal completes on-network registration in the second gateway; The signature verification module is configured to verify the validity of the signature of the terminal based on the identity credential; if the verification is passed, the on-network request confirmation is returned to the terminal; The cross-domain on-network request includes terminal identity, on-network request information, terminal signature and timestamp, and the identity credential corresponding to the terminal is obtained from the blockchain according to the cross-domain on-network request, specifically as follows: The identity credential corresponding to the terminal is obtained from the blockchain according to the terminal identity in the cross-domain on-network request based on RFID technology. 9.A blockchain-based two-way authentication device, characterized in that, The device is applied to a second gateway, and the device includes: The request receiving module is configured to receive the on-network registration request sent by the terminal; The key generating module is configured to verify the validity of the signature in the on-network registration request, generate a first public key and a first private key for the terminal, and encrypt the first public key and the first private key and transmit them to the terminal; The key receiving module is configured to receive the second public key, the second private key and the signature credential sent by the terminal; The identity verification module is configured to verify the validity of the signature and the legality of the identity of the terminal based on the signature credential; The credential generating module is configured to generate an identity credential for the terminal if the verification is passed, and send the identity credential to the terminal and upload it to the blockchain for storage.

10. A terminal device, comprising: The computer readable storage medium stores a computer program, and the computer program is configured to be executed by the processor, and the processor implements the two-way authentication method based on the blockchain in any one of claims 1 to 7 when executing the computer program.

11. A computer readable storage medium characterized by The computer readable storage medium stores a computer program, and the computer program is configured to be executed by the processor, and the processor implements the two-way authentication method based on the blockchain in any one of claims 1 to 7 when executing the computer program.

12. A computer program product, characterised in that, The computer program product includes computer programs or computer instructions, and the computer programs or computer instructions are executed by the processor to implement the two-way authentication method based on the blockchain in any one of claims 1 to 7.

Images