Full-quantity identification analysis method and device based on block chain and secure multi-party computing

Abstract

The invention discloses a full-quantity identification analysis method and device based on a block chain and secure multi-party computing. The method comprises the following steps: step 1, setting an identifier structure; 2, trusted full-amount identification registration is carried out; step 3, multi-party key negotiation; step 4, threshold secret sharing; and 5, carrying out safety analysis on the full-amount identification. The device is used for realizing the method content. According to the method, the block chain and the threshold secret sharing algorithm are utilized, safety and credibility of industrial internet full-amount identification analysis are ensured, and malicious leakage of privacy data of the multi-party enterprise nodes is prevented by safely sharing the identification and the source data of the identification among the multi-party enterprise nodes.

Description

Technical Field

[0001] The present invention belongs to the field of network security and blockchain technology, and relates to a full-quantity identity resolution method and device based on blockchain and secure multi-party computing. Background Art

[0002] Against the backdrop of global technological innovation and industrial transformation, the Industrial Internet has emerged as an innovative industrial growth model. It represents a profound transformation of the entire industry towards high informatization, comprehensive digitalization and intelligence. It is also a practical paradigm for the deep integration of network technology, big data resources and intelligent algorithms with the real economy. One of the core components of the Industrial Internet is its identity resolution system, which enables accurate identification and information retrieval of these entities by assigning unique identifiers to industrial equipment, products and resources, thereby promoting data interconnection and interoperability between various links in the industrial chain and enhancing the resilience and security protection capabilities of the industrial chain. In recent years, blockchain technology has been widely used in many fields such as finance, healthcare, and supply chain management with its unique decentralized architecture, data immutability and high transparency. These characteristics of blockchain technology are expected to solve the centralization risks, security risks of inter-node communication, and privacy data protection issues of participating enterprise nodes in the Industrial Internet identity resolution system. Through the application of blockchain technology, a more secure, reliable and transparent Industrial Internet environment can be built.

[0003] In a complex industrial production environment, an industrial product often requires the cooperation of multiple enterprise nodes. The full identification source data should include the identification source data of sub-industrial products such as parts and components of the industrial product, involving the privacy data of multiple cooperating enterprise nodes. Existing solutions usually include all the identification source data of multiple enterprise nodes in the full identification source data, without considering the privacy protection issues of multiple enterprise nodes. The secret sharing algorithm has the characteristics of risk dispersion and tolerance of intrusion, so it can achieve secure resolution of the full identification. However, when each enterprise node shares secrets, a trusted superior node is required to reconstruct the shared information. In the process of transmitting data to the superior node, there may be a risk of secret leakage, which will greatly reduce the security of the full identification resolution. Summary of the invention

[0004] In view of the problems existing in the prior art, the present invention proposes a method and device for full identification resolution based on blockchain and secure multi-party computing. The method of the present invention firstly sends the full identification and key to the superior node by the multi-party enterprise node, and the superior node reconstructs the message and distributes the sub-share to each enterprise node to complete secret sharing; secondly, through the multi-party key negotiation method, the secure communication between the superior node and the multi-party enterprise node is realized; finally, a trusted multi-party industrial Internet identification resolution process based on threshold secret sharing is designed to realize the secure resolution of the full identification.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is:

[0006] A full-quantity identity resolution method based on blockchain and secure multi-party computing includes the following steps:

[0007] Step 1: Identifier structure setup

[0008] Setting an identifier structure based on a hierarchical identifier resolution structure, wherein the identifier includes an identity identifier and a product identifier;

[0009] Step 2: Register a trusted full identity

[0010] The data collector collects the source data and submits it to the identification registration node for identification registration. The identification registration node then generates an identification key, encrypts the source data, and uploads the encrypted data to the IPFS server to obtain the mapping value. It then generates a trusted identification by combining the public and private keys of the identification provided by the upper node. The trusted identification is then registered with the enterprise alliance, which performs ordered multi-group signatures on the trusted identification and packages the relevant information and uploads it to the identification registration chain.

[0011] Step 3: Multi-party key negotiation

[0012] The main enterprise node and multi-party enterprise nodes send key negotiation requests to the superior node. The superior node confirms the legitimacy of the node identity through the identity authentication chain, and encrypts the negotiated key based on the public key of each node, and transmits it back to each node to complete the multi-party key negotiation;

[0013] Step 4: Threshold Secret Sharing

[0014] The multiple enterprise nodes transmit their partial identifications and resolution results to the upper node, which reconstructs the message and returns it to the multiple enterprise nodes after obtaining the sub-shares. The identification resolution node obtains several sub-shares through recursive resolution and performs message recovery to complete threshold secret sharing.

[0015] Step 5: Full identification security analysis

[0016] The identity resolution node first confirms the legitimacy of the identity through the identity registration chain, and then initiates a recursive request to the recursive resolution node after confirming the legitimacy of the identity; the recursive resolution node confirms the identity of the identity resolution node through the identity authentication chain, and obtains the address of the identity registration node, performs recursive resolution, and performs key negotiation and secret sharing between multiple enterprise nodes and superior nodes. The recursive resolution node returns the sub-share to the identity resolution node, and the identity resolution node decrypts the resolution result through the identity private key in the trusted identity, downloads the encrypted identity source data in the IPFS server through the mapping value in the trusted identity, and finally obtains the identity source data through decryption of the resolution structure.

[0017] Furthermore, in step 1, the identity identification is obtained by the enterprise participating in the identification resolution system by registering its identity in the enterprise alliance, and the product identification includes a resolution mode code, a serial number code, an IPFS mapping code and a security code.

[0018] Furthermore, the enterprise identity is unique, including the first-level node code, the second-level node code and the enterprise node code; the resolution mode code in the product identification is used to determine the resolution mode adopted when resolving the identification; the serial number code is used to represent the unique identification of the identification object and contains some product information; the IPFS mapping code is the return mapping value obtained after encrypting and uploading the identification source data to the IPFS server, and the security code is the identification private key used when transmitting the identification resolution result.

[0019] Furthermore, the step 2 specifically includes the following sub-steps:

[0020] Sub-step 2-1: Collect source data. First, the data collector collects source data for the identification object and encapsulates it to obtain the identification source data Data r Then, Data r Upload to the identification registration node; identify the source data Data r as follows:

[0021] Data r ={A d ,S d ,C d ,F d ,Sig d} (1)

[0022] Among them, A d To identify the basic attributes of data, S d is the serial number, C d To identify the specific content of the object, F d To identify the object features, Sig d The signature of the data collector;

[0023] Sub-step 2-2: Generate a trusted identity. The identity registration node generates an identity key K based on a symmetric encryption algorithm for the identity. i , and the source data r Encrypted by symmetric key and uploaded to IPFS server; IPFS server stores the data and returns the mapping CID. The mapping value CID is as follows:

[0024]

[0025] in Indicates that the identification source data is symmetrically encrypted using the identification key K; the identification registration node is based on its own node identity and original data Datar Generate a relative prefix prefix containing the identity code and serial number; identify the registered node combined with the relative prefix prefix, CID and the identification private key SK i Generate a trusted identity I and register it with the enterprise alliance. The trusted identity I is as follows:

[0026] I=(prefix||CID||SK i ) (3)

[0027] Sub-step 2-3: Identity signature authentication, the enterprise alliance verifies the reliability of the identity and signs the registered identity through an ordered multi-group signature based on the elliptic curve. i , the message Msg to be signed is as follows:

[0028] Msg = {PK rg ,ts h ,CID} (4)

[0029] where ts h Indicates the current timestamp; the first group is signed by member a, who obtains the hash value h=H(Msg) through the information to be signed Msg, and then selects a random value r s ∈Z p , and generate a group signature as follows:

[0030]

[0031] parameter The calculation process is as follows:

[0032]

[0033]

[0034] Where p1 is the point constructed by the first group member to complete the signature. is the horizontal coordinate of point p1, is the ordinate of point p1, g1 is the group Z p The generator of

[0035] The second group is signed by member b. Similarly, the hash value h=H(Msg) is obtained through the message Msg. First, check whether member a is a user of the first group. If IsUser(L1,PK a )=True, then check whether member a belongs to the revocation list. If NotRevoke(L1,PK a )=True, then member a is a legitimate user, using member a’s public key PK a and signature The signature verification process is as follows:

[0036]

[0037] If the signature verification is successful, the ordered multi-group signature will continue, and member b will select a random value r s ∈Z p , and generate a group signature as follows:

[0038]

[0039] parameter The calculation process is as follows:

[0040]

[0041]

[0042] The third group is signed by member c, and the same operation as b is performed until the last group n is signed by member d, and the group signature is obtained.

[0043] Sub-step 2-4: The logo is stored on the chain, and finally the enterprise alliance registers the logo in the Tx block i Upload to the logo registration chain; logo registration block Tx i as follows:

[0044] Tx i = {PK rg ,ts h ,CID,sig i ,tid i} (12)

[0045] Among them, PK rg is the public key that identifies the registered node, CID is the mapping value, Sig i Ordered multi-group signature for the enterprise alliance to identify the registration block, tid i is the hash value of the first four items of the block;

[0046] PK rg and SK rg PK is the key pair that identifies the registered node. i and SK i Each identity has an identity key pair for secure transmission.

[0047] Furthermore, the step 3 specifically includes the following sub-steps:

[0048] Sub-step 3-1: Initiate a negotiation request. The primary enterprise node sends a key negotiation start request to multiple enterprise nodes. KAS as follows:

[0049]

[0050] Where H(I) is the hash value obtained by the identifier registration node for the trusted identifier I in the resolution request, PK ma is the public key of the main enterprise node, PK mu is the public key of the registered node, The signature of the request by the identity resolution node;

[0051] After accepting the key negotiation, the multi-party enterprise nodes return to the main enterprise node to accept the request, and together with the main enterprise node, send a key negotiation request to the superior node. The key negotiation request is as follows:

[0052]

[0053]

[0054] Sub-step 3-2: Negotiation key generation. After receiving the negotiation request, the upper node confirms the identity of each enterprise node through the identity authentication chain and generates a negotiation key K for each enterprise node. mu , the enterprise nodes negotiate the key K mu as follows:

[0055] K mu ={K1,K2,...,K n} (16)

[0056] Sub-step 3-3: Send the negotiated key, the upper node passes the enterprise node public key PK mun The negotiated key K mu Encryption key is obtained and distributed to each enterprise node. The encryption key K mue as follows:

[0057]

[0058] Sub-step 3-4: Multi-party key negotiation, after the enterprise node obtains the encryption key, it uses its own private key SK mun Decrypt and obtain the negotiated key K mu , realize multi-party key negotiation based on blockchain, decrypt and obtain the negotiated key K mu as follows:

[0059]

[0060] Furthermore, the step 4 specifically includes the following sub-steps:

[0061] Sub-step 4-1: System initialization. The system includes n enterprise nodes and an upper node that the enterprise node trusts. Let P = {P1, P2, ..., P n} as a set of n enterprise nodes, select a large prime number p, set t as the threshold value, M = {M1, M2, ..., M n} is the plain text information;

[0062] Sub-step 4-2: Message reconstruction: The upper node selects t-1 random numbers a, generates a secret S by mapping the plaintext message M through block coding, and constructs a polynomial function f(x) for secret reconstruction, where S = f(0); the upper node sets S i =f(i), (i=1,2,...,n), and distribute it to n enterprise nodes P; initialization of some parameters is as follows:

[0063] S=Encode(M) (19)

[0064] a={a1,a2,...,a t-1}∈[1,p] (20)

[0065] f(x)=s+a1x+a2x 2 +…+a t-1 x t-1 (twenty one)

[0066] Sub-step 4-3: Message recovery, the identity resolution node collects t sub-shares {f(1), f(2), ..., f(t)}, and calculates the complete secret S = f(0) through the Lagrange interpolation formula g(x). The recovery function g(x) is as follows:

[0067]

[0068] Finally, the plaintext information M is obtained by decoding and mapping. The plaintext message M is as follows:

[0069] M=Decode(S) (23).

[0070] Furthermore, the step 5 specifically includes the following sub-steps:

[0071] Sub-step 5-1: Blockchain confirmation. When the identity resolution node receives the identity, it first quickly queries the block Tx in the identity storage chain based on the CID part of the identity. i , and obtain the public key PK of the registered node rg ; After the identity resolution node confirms that the identity is legitimate, it uses the node private key SK rs Sign and send a resolution request to the recursive resolution node. The resolution request is as follows:

[0072]

[0073] Among them, PK rs The public key of the resolution node is used to identify the resolution node. The resolution node performs hash encryption for the trusted identity I in the resolution request to obtain H(I) to prevent the leakage of the identity data. The signature of the request by the identity resolution node;

[0074] Recursive parsing nodes will quickly query block Tx through the identity authentication chain a , confirm the identity resolution node identity PK rs And identify the registered node identity PK rg ;

[0075] Sub-step 5-2: Multi-party key negotiation, recursive resolution node quickly queries block Tx through the identity authentication chain a , confirm the identity resolution node identity PK rs And the main enterprise node identity PK rg ; Then, the location of the main enterprise node is obtained through recursive resolution, and a full resolution request is sent to it; after receiving the full resolution request, the enterprise node group consisting of the main enterprise node and multiple enterprise nodes negotiates the key with the upper-level node to obtain the key K mu ; The enterprise node group will identify and analyze the results through the negotiated key K mu Encrypt and transmit to the upper node; the upper node integrates the messages sent by the enterprise node group to obtain the message set Message p , message collection Message p as follows:

[0076]

[0077] Among them, I p K is the trusted identifier provided by the enterprise node in the full resolution. ip Identifier I p The corresponding parsing results are used to decrypt the identification source data downloaded from the IPFS server;

[0078] Sub-step 5-3: Threshold secret sharing: the upper node decrypts the message with the key and reconstructs the message based on the threshold secret sharing algorithm to generate n message sub-shares Share p , distribute it to n enterprise nodes for full resolution; message sub-share Share p as follows:

[0079]

[0080] Share p Represents the sub-share set obtained after sharding all messages. is the decryption function, MRC TSS Used to fragment messages; when the recursive parsing node performs recursive parsing, the enterprise node will identify the share through the public key PK i Encrypt to obtain encrypted sub-share Share e The recursive resolution node collects the encrypted sub-shares and transmits them to the identity resolution node; the identity resolution node uses the identity private key SK i Decrypt to obtain the message sub-share, and restore the message based on the threshold secret sharing algorithm to obtain the identifier and analysis result required for full analysis (I p ,K ip ); Encrypted sub-share Share e , the result of the full resolution of the required identifiers (I p ,K ip ) is calculated as follows:

[0081]

[0082]

[0083] MRT TSS It represents the message recovery in secret sharing. The message is recovered through p message sub-shares to complete the secret sharing.

[0084] Sub-step 5-4: Full identification security resolution. Finally, the identification resolution node downloads the encrypted full identification source data Data from the IPFS server through CID e , and identify the parsing result K ip Decrypt to obtain the full amount of identification source data Data r ; Encrypted full identification source data Data e , full identification source data Data r as follows:

[0085] Data e ={Data ep1 ,Data ep2 ,...,Data epn} (29)

[0086]

[0087] Data epn Represents the source data for the nth identifier.

[0088] The present invention also provides a full-quantity identity resolution device based on blockchain and secure multi-party computing, comprising: an identifier structure setting module, a trusted full-quantity identity registration module, a multi-party key negotiation module, a threshold secret sharing module, and a full-quantity identity security resolution module; the identifier structure setting module is used to set the identifier structure based on the hierarchical identity resolution structure, specifically implementing the content of step 1; the trusted full-quantity identity registration module is used to collect identity source data, generate an identity key to encrypt the identity source data, and register the trusted identity with the enterprise alliance after generating a trusted identity, specifically implementing the content of step 2; the multi-party key negotiation module is used for the main enterprise node and the multi-party enterprise node to send a key negotiation request to the superior node to complete the multi-party key negotiation, specifically implementing the content of step 3; the threshold secret sharing module is used to reconstruct, return, and recursively parse the partial identities and resolution results of each of the multi-party enterprise nodes to obtain a number of sub-shares, perform message recovery to complete threshold secret sharing, and specifically implement the content of step 4; the full-quantity identity security resolution module is used to obtain the identity source data through recursive resolution, key negotiation, secret sharing, and resolution structure decryption, specifically implementing the content of step 5.

[0089] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0090] 1. The present invention utilizes blockchain and threshold secret sharing algorithm to ensure the security and reliability of the full-scale identity resolution of the Industrial Internet, and prevents the private data of multiple enterprise nodes from being maliciously leaked by securely sharing the identity and its source data among multiple enterprise nodes.

[0091] 2. The threshold secret sharing algorithm suitable for industrial Internet scenarios proposed in the present invention reduces the risk of privacy data leakage of multiple enterprise nodes in the industrial Internet identity resolution system at a lower cost compared to traditional secret sharing algorithms.

[0092] 3. The present invention realizes the secure transmission of messages between multiple enterprise nodes in the industrial Internet identity resolution system through a multi-party key negotiation algorithm. Compared with plain text transmission, it can effectively alleviate the problem of privacy data leakage during the identity resolution process.

[0093] 4. The present invention improves the identifier structure setting, can select the corresponding parsing mode, enhances the scalability, and realizes the deep association between the identifier and its source data, which can effectively alleviate the problem of collusion between identifier registration nodes to forge identifiers. BRIEF DESCRIPTION OF THE DRAWINGS

[0094] Figure 1 A schematic diagram of the overall process of a full-quantity identity resolution method based on blockchain and secure multi-party computing provided by the present invention.

[0095] Figure 2Schematic diagram of the steps for setting the identifier structure in an embodiment of the present invention.

[0096] Figure 3 Schematic diagram of the process of registering a trusted full identity in an embodiment of the present invention.

[0097] Figure 4 The figure is a flowchart of the multi-party key negotiation steps in an embodiment of the present invention.

[0098] Figure 5 Schematic diagram of the process of full identification security parsing steps in an embodiment of the present invention. DETAILED DESCRIPTION

[0099] The technical solution provided by the present invention will be described in detail below in conjunction with specific embodiments. It should be understood that the following specific implementation methods are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0100] The present invention provides a full-quantity identification resolution method based on blockchain and secure multi-party computing, the process of which is as follows: Figure 1 As shown, there are five steps in total. The first step is to set the identifier structure, where the identifier structure is shown in Figure 2 The second step is to register the trusted full identity. For the process, see Figure 3 , the data collector first collects the identification source data, and then the identification registration node generates an identification key to encrypt the identification source data, and uploads the encrypted data to the IPFS server to obtain the mapping value CID, and then combines the identification public and private keys provided by the upper node to generate a trusted identification. After that, the trusted identification is registered with the enterprise alliance, and the enterprise alliance performs ordered multi-group signatures on the trusted identification and packages the relevant information and uploads it to the identification registration chain. The third step is multi-party key negotiation, and its process can be found in Figure 4 , the main enterprise node and the multi-party enterprise node send a key negotiation request to the superior node. The superior node confirms the legitimacy of the node identity through the identity authentication chain, and encrypts the negotiated key based on the public key of each node, and transmits it back to each node to complete the multi-party key negotiation. The fourth step is threshold secret sharing. The multi-party enterprise nodes transmit their partial identification and resolution results to the superior node. The superior node reconstructs the message and returns it to the multi-party enterprise node after obtaining the sub-shares. The identification resolution node obtains several sub-shares through recursive resolution, and restores the message to complete the threshold secret sharing. The fifth step is the full identification security resolution. The process can be found in Figure 5, the identity resolution node first confirms the legitimacy of the identity through the identity registration chain, and then initiates a recursive request to the recursive resolution node after confirming the legitimacy of the identity. The recursive resolution node confirms the identity of the identity resolution node through the identity authentication chain, and obtains the address of the identity registration node, performs recursive resolution, and performs key negotiation and secret sharing between multiple enterprise nodes and superior nodes. The recursive resolution node returns the sub-share to the identity resolution node. The identity resolution node decrypts the resolution result through the identity private key in the trusted identity, downloads the encrypted identity source data in the IPFS server through the CID in the trusted identity, and finally obtains the identity source data through the resolution structure decryption. The detailed implementation steps are as follows:

[0101] Step 1: Setting the identifier structure, as follows: Setting the identifier structure based on the hierarchical identifier resolution structure. Each identifier can be divided into two parts: identity identifier and product identifier, which are separated by " / ".

[0102] The first part is the identity identifier, which is obtained by enterprises participating in the identity resolution system by registering their identities in the enterprise alliance. Each enterprise's identity identifier is unique, specifically consisting of three parts: the primary node code, the secondary node code, and the enterprise node code, each of which is separated by a ".". Among them, the primary node code indicates the country or region to which the identifier owner belongs, represented by a three-digit fixed-length string; the secondary node code indicates the industry domain to which the identifier owner belongs, represented by a three-digit fixed-length string; the enterprise node code represents the unique identity ID of the identifier owner, and is represented by a variable-length string to ensure the scalability of the present invention.

[0103] The second part is the product identification, which can be divided into four parts, namely, the parsing mode code, the serial number code, the IPFS mapping code and the security code, and each part is separated by ".". Among them, the parsing mode code is used to determine the parsing mode adopted when the identification is parsed. In this method, "00" is used to represent lightweight parsing, and "01" is used to represent full parsing, which is represented by a two-digit fixed-length string. The serial number code is a unique identifier used to represent the identification object, and also contains some product information, such as the current number of products, the number of generated equipment, date, timestamp, etc. The IPFS mapping code is the returned mapping value obtained after encrypting the identification source data and uploading it to the IPFS server. With the help of this field, the identification can be bound to the source data. The code length is determined by the CID format of the mapping value returned by the IPFS server. The security code is the identification private key used when transmitting the identification parsing result. During parsing, the identification registration node will encrypt the identification parsing result through the identification public key and transmit it. The parsing result can be decrypted by the private key, and the code length depends on the length of the private key.

[0104] Step 2: Trusted full-quantity identity registration. In this step, the identity registration node that has passed identity authentication in the enterprise alliance registers the trusted identity in the system. Its implementation is divided into the following sub-steps:

[0105] Sub-step 2-1: Collect source data. All nodes in the enterprise alliance have a key pair PK n and SK n In order to distinguish and identify the registered node, its key pair is set to PK rg and SK rg Each identity has an identity key pair PK for secure transmission. i and SK i First, the data collector collects source data for the identification object and encapsulates it to obtain the identification source data Data r Then, the Data r Upload to the ID registration node. ID source data r as follows:

[0106] Data r ={A d ,S d ,C d ,F d ,Sig d} (1)

[0107] Among them, A d To identify the basic attributes of data, it can be used in industrial processes, including object classification, object name, model specifications, etc. d It is a serial number used to ensure the uniqueness of the identification object. Enterprises can add semantics such as timestamp and production location as needed. d To identify the specific content of the object. d To identify object features, different products will extract key features as needed to ensure a strong connection between the identifier and the object. d The signature of the data collector can be used to detect whether the data has been tampered with. Once there is a problem with the data, the relevant personnel can be quickly held accountable.

[0108] Sub-step 2-2: Generate a trusted identity. The identity registration node generates an identity key K based on a symmetric encryption algorithm for the identity. i , and the source data r Encrypted with a symmetric key and uploaded to the IPFS server. The IPFS server stores the data and returns the mapped CID. The mapped value CID is as follows:

[0109]

[0110] in It means that the source data is symmetrically encrypted using the identification key K to ensure that the data stored on the IPFS server is not leaked.

[0111] Identify the registered node based on its own node identity and original data r Generate a relative prefix prefix containing the identity code and serial number. Identify the registration node combined with the relative prefix prefix, CID and the identification private key SK i Generate a trusted identity I and register it with the enterprise alliance. The trusted identity I is as follows:

[0112] I=(prefix||CID||SK i ) (3)

[0113] Sub-step 2-3: Identity signature authentication, the enterprise alliance verifies the reliability of the identity and signs the registered identity through an ordered multi-group signature based on the elliptic curve. i The message Msg to be signed is as follows:

[0114] Msg = {PK rg ,ts h ,CID} (4)

[0115] where ts h Indicates the current timestamp. The first group is signed by member a, who obtains the hash value h=H(Msg) from the information to be signed Msg, and then selects a random value r s ∈Z p , and generate a group signature as follows:

[0116]

[0117] parameter The calculation process is as follows:

[0118]

[0119]

[0120] Where p1 is the point constructed by the first group member to complete the signature. is the horizontal coordinate of point p1, is the ordinate of point p1, g1 is the group Z p The generator of . Subsequent signatures require as a parameter.

[0121] The second group is signed by member b. Similarly, the hash value h = H(Msg) is obtained through the message Msg. First, check whether member a is a user of the first group. If IsUser(L1,PK a )=True, then check whether member a belongs to the revocation list. If NotRevoke(L1,PK a)=True, then member a is a legitimate user, using member a’s public key PK a and signature Verify the signature. The verification process is as follows:

[0122]

[0123] If the signature verification is successful, the ordered multi-group signature will continue, and member b will select a random value r s ∈Z p , and generate a group signature as follows:

[0124]

[0125] parameter The calculation process is as follows:

[0126]

[0127]

[0128] The third group is signed by member c, and the same operation as b is performed until the last group n is signed by member d, and the group signature is obtained.

[0129] Sub-step 2-4: The logo is stored on the chain, and finally the enterprise alliance registers the logo in the Tx block i Upload to the logo registration chain. Logo registration block Tx i as follows:

[0130] Tx i = {PK rg ,ts h ,CID,sig i ,tid i} (12)

[0131] Among them, PK rg To identify the public key of the registered node, CID is the mapping value. i Ordered multi-group signature for the enterprise alliance to identify the registration block, tid i It is the hash value of the first four items of the block.

[0132] Step 3: Multi-party key negotiation. In this step, the multi-party enterprise nodes participating in the full identity resolution request multi-party key negotiation from the superior node. Its implementation is divided into the following sub-steps:

[0133] Sub-step 3-1: Initiate a negotiation request. In order to perform a secure resolution of the full identity, the primary enterprise node and the multi-party enterprise node need to negotiate a key with the upper-level node. The primary enterprise node sends a key negotiation start request to the multi-party enterprise node. KAS as follows:

[0134]

[0135] The identity registration node performs hash encryption for the trusted identity I in the resolution request to obtain H(I) to prevent the identity data from being leaked. ma is the public key of the main enterprise node, PK mu The public key of the registered node. The signature of the request is used by the identity resolution node.

[0136] After accepting the key negotiation, the multi-party enterprise nodes return to the main enterprise node to accept the request, and together with the main enterprise node, send a key negotiation request to the superior node. The key negotiation request is as follows:

[0137]

[0138]

[0139] Sub-step 3-2: Negotiation key generation. After receiving the negotiation request, the upper node confirms the identity of each enterprise node through the identity authentication chain and generates a negotiation key K for each enterprise node. mu . Enterprise nodes negotiate the key K mu as follows:

[0140] K mu ={K1,K2,...,K n} (16)

[0141] Sub-step 3-3: Send the negotiated key, the upper node passes the enterprise node public key PK mun The negotiated key K mu Encryption key K is obtained and distributed to each enterprise node. mue as follows:

[0142]

[0143] Sub-step 3-4: Multi-party key negotiation, after the enterprise node obtains the encryption key, it uses its own private key SK mun Decrypt and obtain the negotiated key K mu , realizing multi-party key negotiation based on blockchain. Decryption obtains the negotiated key K mu as follows:

[0144]

[0145] Step 4: Threshold secret sharing. In this step, multiple enterprise nodes participating in the full identity resolution share secrets with their superior nodes. The implementation is divided into the following sub-steps:

[0146] Sub-step 4-1: System initialization. The system consists of n enterprise nodes and a superior node that the enterprise node trusts. Let P = {P1, P2, ..., P n} as a set of n enterprise nodes, select a large prime number p, set t as the threshold value, M = {M1, M2, ..., M n} is the plain text information.

[0147] Sub-step 4-2: Message reconstruction: The upper node selects t-1 random numbers a, maps the plaintext message M to generate a secret S through block coding, and constructs a polynomial function f(x) for secret reconstruction, where S = f(0). The upper node sets S i =f(i), (i=1,2,...,n), and distribute it to n enterprise nodes P. The initialization of some parameters is as follows:

[0148] S=Encode(M) (19)

[0149] a={a1,a2,...,a t-1}∈[1,p] (20)

[0150] f(x)=s+a1x+a2x 2 +…+a t-1 x t-1 (twenty one)

[0151] Sub-step 4-3: Message recovery, the identity resolution node collects t sub-shares {f(1), f(2), ..., f(t)}, and calculates the complete secret S = f(0) through the Lagrange interpolation formula g(x). The recovery function g(x) is as follows:

[0152]

[0153] Finally, the plaintext information M is obtained by decoding and mapping. The plaintext message M is as follows:

[0154] M=Decode(S) (23)

[0155] Step 5: Full identification security analysis. In this step, the identification holder confirms the identity of the registered node and the authenticity of the identification through the blockchain, and completes the full identification security analysis in combination with cryptographic technology. Its implementation is divided into the following sub-steps:

[0156] Sub-step 5-1: Blockchain confirmation. When the identity resolution node receives the identity, it first quickly queries the block Tx in the identity storage chain based on the CID part of the identity. i , and obtain the public key PK of the registered node rg After the identity resolution node confirms that the identity is legitimate, it uses the node private key SK rs Sign and send a resolution request to the recursive resolution node. The resolution request is as follows:

[0157]

[0158] Among them, PK rs The public key of the resolution node is used to identify the resolution node. The resolution node performs hash encryption for the trusted identity I in the resolution request to obtain H(I) to prevent the leakage of the identity data. The signature of the request is used by the identity resolution node.

[0159] Recursive parsing nodes will quickly query block Tx through the identity authentication chain a , confirm the identity resolution node identity PK rs And identify the registered node identity PK rg .

[0160] Sub-step 5-2: Multi-party key negotiation, recursive resolution node quickly queries block Tx through the identity authentication chain a , confirm the identity resolution node identity PK rs And the main enterprise node identity PK rg . Then, the location of the main enterprise node is obtained through recursive resolution, and a full resolution request is sent to it. After receiving the full resolution request, the main enterprise node and the enterprise node group composed of multiple enterprise nodes negotiate the key with the upper node to obtain the key K mu The enterprise node group will identify and analyze the results through the negotiated key K mu Encrypt and transmit to the upper node. The upper node integrates the messages sent by the enterprise node group to obtain the message collection Message p Message collection p as follows:

[0161]

[0162] Among them, I p K is the trusted identifier provided by the enterprise node in the full resolution. ip Identifier I p The corresponding analysis results are obtained through K ip Can decrypt the identified source data downloaded from the IPFS server.

[0163] Sub-step 5-3: Threshold secret sharing: the upper node decrypts the message with the key and reconstructs the message based on the threshold secret sharing algorithm to generate n message sub-shares Share p , distribute it to n enterprise nodes for full resolution. p as follows:

[0164]

[0165] Share p It represents the sub-share set obtained after all messages are sharded. Since each enterprise node encrypts the identifier and the identifier resolution result through the negotiated key to generate the message p , and sent to the upper node. Therefore, through the decryption function The upper node decrypts the messages sent by each enterprise node and then sends them to the TSS The message is fragmented and distributed to each enterprise node.

[0166] When the recursive resolution node performs recursive resolution, the enterprise node will identify the share through the public key PK i Encrypt to obtain encrypted sub-share Share e The recursive resolution node collects the encrypted sub-shares and transmits them to the identity resolution node. The identity resolution node uses the identity private key SK i Decrypt to obtain the message sub-share, and restore the message based on the threshold secret sharing algorithm to obtain the identifier and analysis result required for full analysis (I p ,K ip ). Encrypted sub-share Share e , the result of the full resolution of the required identifiers (I p ,K ip ) is calculated as follows:

[0167]

[0168]

[0169] MRT TSS It represents the message recovery in secret sharing. The message is restored through p message sub-shares to complete the secret sharing.

[0170] Sub-step 5-4: Full identification security resolution. Finally, the identification resolution node downloads the encrypted full identification source data Data from the IPFS server through CID e , and identify the parsing result K ip Decrypt to obtain the full amount of identification source data Data r . Encrypted full identification source data Data e, full identification source data Data r as follows:

[0171] Data e ={Data ep1 ,Data ep2 ,...,Data epn} (29)

[0172]

[0173] The full amount of identified source data contains source data of multiple identifiers. epn Represents the source data of the nth identifier. The source data downloaded from the IPFS server is encrypted source data, which needs to be decrypted by the identifier private key to obtain the source data of the full identifier.

[0174] Based on the same inventive concept, the present invention provides a full-quantity identification resolution device based on blockchain and secure multi-party computing, including an identifier structure setting module, a trusted full-quantity identification registration module, a multi-party key negotiation module, a threshold secret sharing module, and a full-quantity identification security resolution module. The identifier structure setting module is used to set the identifier structure based on the hierarchical identification resolution structure, specifically implementing the content of step 1; the trusted full-quantity identification registration module is used to collect identification source data, generate an identification key to encrypt the identification source data, and register the trusted identification with the enterprise alliance after generating a trusted identification, specifically implementing the content of step 2; the multi-party key negotiation module is used for the main enterprise node and the multi-party enterprise node to send a key negotiation request to the superior node to complete the multi-party key negotiation, specifically implementing the content of step 3; the threshold secret sharing module is used to reconstruct, return, and recursively resolve the partial identification and resolution results of each multi-party enterprise node to obtain several sub-shares, and perform message recovery to complete the threshold secret sharing, specifically implementing the content of step 4; the full-quantity identification security resolution module is used to obtain the identification source data through recursive resolution, key negotiation, secret sharing, and resolution structure decryption, specifically implementing the content of step 5.

[0175] It should be noted that the above content only illustrates the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications all fall within the protection scope of the claims of the present invention.

Claims

1. A full-quantity identity resolution method based on blockchain and secure multi-party computing, characterized in that: The following steps are involved: Step 1: Identifier structure setup Setting an identifier structure based on a hierarchical identifier resolution structure, wherein the identifier includes an identity identifier and a product identifier; Step 2: Register a trusted full identity The data collector collects the identification source data and submits it to the identification registration node for identification registration. The identification registration node then generates an identification key, encrypts the identification source data, and uploads the encrypted data to the IPFS server to obtain the mapping value. It then combines the identification public and private keys provided by the upper-level node to generate a trusted identification. After that, the trusted identity is registered with the enterprise alliance. The enterprise alliance performs ordered multi-group signatures on the trusted identity and packages the relevant information to upload to the identity registration chain; Step 3: Multi-party key negotiation The main enterprise node and multi-party enterprise nodes send key negotiation requests to the superior node. The superior node confirms the legitimacy of the node identity through the identity authentication chain, and encrypts the negotiated key based on the public key of each node, and transmits it back to each node to complete the multi-party key negotiation; Step 4: Threshold Secret Sharing The multiple enterprise nodes transmit their partial identifications and resolution results to the upper node, which reconstructs the message and returns it to the multiple enterprise nodes after obtaining the sub-shares. The identification resolution node obtains several sub-shares through recursive resolution and performs message recovery to complete threshold secret sharing. Step 5: Full identification security analysis The identity resolution node first confirms the legitimacy of the identity through the identity registration chain, and then initiates a recursive request to the recursive resolution node after confirming the legitimacy of the identity; the recursive resolution node confirms the identity of the identity resolution node through the identity authentication chain, and obtains the address of the identity registration node, performs recursive resolution, and performs key negotiation and secret sharing between multiple enterprise nodes and superior nodes. The recursive resolution node returns the sub-share to the identity resolution node, and the identity resolution node decrypts the resolution result through the identity private key in the trusted identity, downloads the encrypted identity source data in the IPFS server through the mapping value in the trusted identity, and finally obtains the identity source data through decryption of the resolution structure.

2. The method for full-quantity identification resolution based on blockchain and secure multi-party computing according to claim 1 is characterized in that: In step 1, the identity identifier is obtained by the enterprise participating in the identity resolution system by registering its identity in the enterprise alliance, and the product identifier includes a resolution mode code, a serial number code, an IPFS mapping code and a security code.

3. The full-quantity identification resolution method based on blockchain and secure multi-party computing according to claim 2 is characterized in that: The enterprise identity is unique, including the primary node code, secondary node code and enterprise node code; the resolution mode code in the product identification is used to determine the resolution mode adopted when resolving the identification; the serial number code is used to represent the unique identification of the identification object and contains some product information; The IPFS mapping code is the returned mapping value obtained after encrypting and uploading the identification source data to the IPFS server, and the security code is the identification private key used when transmitting the identification resolution result.

4. The method for full-quantity identification resolution based on blockchain and secure multi-party computing according to claim 1 is characterized in that: The step 2 specifically includes the following sub-steps: Sub-step 2-1: Collect source data. First, the data collector collects source data for the identification object and encapsulates it to obtain the identification source data Data r Then, Data r Upload to the identification registration node; identify the source data Data r as follows: Data r ={A d ,S d ,C d ,F d ,Sig d } (1) Among them, A d To identify the basic attributes of data, S d is the serial number, C d To identify the specific content of the object, F d To identify the object features, Sig d The signature of the data collector; Sub-step 2-2: Generate a trusted identity. The identity registration node generates an identity key K based on a symmetric encryption algorithm for the identity. i , and the source data r Encrypted by symmetric key and uploaded to IPFS server; IPFS server stores the data and returns the mapping CID. The mapping value CID is as follows: in Indicates that the identification source data is symmetrically encrypted using the identification key K; the identification registration node is based on its own node identity and original data Data r Generate a relative prefix prefix containing the identity code and serial number; identify the registered node combined with the relative prefix prefix, CID and the identification private key SK i Generate a trusted identity I and register it with the enterprise alliance. The trusted identity I is as follows: I=(prefix||CID||SK i ) (3) Sub-step 2-3: Identity signature authentication, the enterprise alliance verifies the reliability of the identity and signs the registered identity through an ordered multi-group signature based on the elliptic curve. i , the message Msg to be signed is as follows: Msg={PK rg ,ts h ,CID} (4) where ts h Indicates the current timestamp; the first group is signed by member a, who obtains the hash value h=H(Msg) through the information to be signed Msg, and then selects a random value r s ∈Z p , and generate a group signature as follows: parameter The calculation process of s1 is as follows: Where p1 is the point constructed by the first group member to complete the signature. is the horizontal coordinate of point p1, is the ordinate of point p1, g1 is the group Z p The generator of The second group is signed by member b, and the hash value h = H(Msg) is obtained through the message Msg. First, check whether member a is a user of the first group. If IsUser(L1,PK a )=True, then check whether member a belongs to the revocation list. If NotRevoke(L1,PK a )=True, then member a is a legitimate user, using member a’s public key PK a and signature The signature verification process is as follows: If the signature verification is successful, the ordered multi-group signature will continue, and member b will select a random value r s ∈Z p , and generate a group signature as follows: parameter The calculation process of s2 is as follows: The third group is signed by member c, and the same operation as b is performed until the last group n is signed by member d, and the group signature is obtained. Sub-step 2-4: The logo is stored on the chain, and finally the enterprise alliance registers the logo in the Tx block i Upload to the logo registration chain; logo registration block Tx i as follows: Tx i ={PK rg ,ts h ,CID,say i ,time i } (12) Among them, PK rg is the public key that identifies the registered node, CID is the mapping value, Sig i Ordered multi-group signature for the enterprise alliance to identify the registration block, tid i is the hash value of the first four items of the block; PK rg and SK rg PK is the key pair that identifies the registered node. i and SK i Each identity has an identity key pair for secure transmission.

5. The method for full-quantity identification resolution based on blockchain and secure multi-party computing according to claim 1 is characterized in that: The step 3 specifically includes the following sub-steps: Sub-step 3-1: Initiate a negotiation request. The primary enterprise node sends a key negotiation start request to multiple enterprise nodes. KAS as follows: Where H(I) is the hash value obtained by the identifier registration node for the trusted identifier I in the resolution request, PK ma is the public key of the main enterprise node, PK mu is the public key of the registered node, The signature of the request by the identity resolution node; After accepting the key negotiation, the multi-party enterprise nodes return to the main enterprise node to accept the request, and together with the main enterprise node, send a key negotiation request to the superior node. The key negotiation request is as follows: Sub-step 3-2: Negotiation key generation. After receiving the negotiation request, the upper node confirms the identity of each enterprise node through the identity authentication chain and generates a negotiation key K for each enterprise node. mu , the enterprise nodes negotiate the key K mu as follows: K mu ={K1,K2,…,K n } (16) Sub-step 3-3: Send the negotiated key, the upper node passes the enterprise node public key PK mun The negotiated key K mu Encryption key is obtained and distributed to each enterprise node. The encryption key K mue as follows: Sub-step 3-4: Multi-party key negotiation, after the enterprise node obtains the encryption key, it uses its own private key SK mun Decrypt and obtain the negotiated key K mu , realize multi-party key negotiation based on blockchain, decrypt and obtain the negotiated key K mu as follows:

6. The method for full-quantity identification resolution based on blockchain and secure multi-party computing according to claim 1 is characterized in that: The step 4 specifically includes the following sub-steps: Sub-step 4-1: System initialization. The system includes n enterprise nodes and an upper node that the enterprise node trusts. Let P = {P1, P2, ..., P n } as a set of n enterprise nodes, select a large prime number p, set t as the threshold value, M = {M1, M2, ..., M n } is the plain text information; Sub-step 4-2: Message reconstruction: The upper node selects t-1 random numbers a, generates a secret S by mapping the plaintext message M through block coding, and constructs a polynomial function f(x) for secret reconstruction, where S = f(0); the upper node sets S i =f(i), (i=1,2,...,n), and distribute it to n enterprise nodes P; initialization of some parameters is as follows: S=Encode(M) (19) a={a1,a2,...,a t-1 }∈[1,p] (20) f(x)=s+a1x+a2x 2 +…+a t-1 x t-1 (21) Sub-step 4-3: Message recovery, the identity resolution node collects t sub-shares {f(1), f(2), ..., f(t)}, and calculates the complete secret S = f(0) through the Lagrange interpolation formula g(x). The recovery function g(x) is as follows: Finally, the plaintext information M is obtained by decoding and mapping. The plaintext message M is as follows: M=Decode(S) (23).

7. The method for full-quantity identification resolution based on blockchain and secure multi-party computing according to claim 1 is characterized in that: The step 5 specifically includes the following sub-steps: Sub-step 5-1: Blockchain confirmation. When the identity resolution node receives the identity, it first quickly queries the block Tx in the identity storage chain based on the CID part of the identity. i , and obtain the public key PK of the registered node rg ; After the identity resolution node confirms that the identity is legitimate, it uses the node private key SK rs Sign and send a resolution request to the recursive resolution node. The resolution request is as follows: Among them, PK rs The public key of the resolution node is used to identify the resolution node. The resolution node performs hash encryption for the trusted identity I in the resolution request to obtain H(I) to prevent the leakage of the identity data. The signature of the request by the identity resolution node; Recursive parsing nodes will quickly query block Tx through the identity authentication chain a , confirm the identity resolution node identity PK rs And identify the registered node identity PK rg ; Sub-step 5-2: Multi-party key negotiation, recursive resolution node quickly queries block Tx through the identity authentication chain a , confirm the identity resolution node identity PK rs And the main enterprise node identity PK rg ; Then, the location of the main enterprise node is obtained through recursive resolution, and a full resolution request is sent to it; after receiving the full resolution request, the enterprise node group consisting of the main enterprise node and multiple enterprise nodes negotiates the key with the upper-level node to obtain the key K mu ; The enterprise node group will identify and analyze the results through the negotiated key K mu Encrypt and transmit to the upper node; the upper node integrates the messages sent by the enterprise node group to obtain the message set Message p , message collection Message p as follows: Among them, I p K is the trusted identifier provided by the enterprise node in the full resolution. ip Identifier I p The corresponding parsing results are used to decrypt the identification source data downloaded from the IPFS server; Sub-step 5-3: Threshold secret sharing: the upper node decrypts the message with the key and reconstructs the message based on the threshold secret sharing algorithm to generate n message sub-shares Share p , distribute it to n enterprise nodes for full resolution; message sub-share Share p as follows: Share p Represents the sub-share set obtained after sharding all messages. is the decryption function, MRC TSS Used to fragment messages; when the recursive parsing node performs recursive parsing, the enterprise node will identify the share through the public key PK i Encrypt to obtain encrypted sub-share Share e The recursive resolution node collects the encrypted sub-shares and transmits them to the identity resolution node; the identity resolution node uses the identity private key SK i Decrypt to obtain the message sub-share, and restore the message based on the threshold secret sharing algorithm to obtain the identifier and analysis result required for full analysis (I p ,K ip ); Encrypted sub-share Share e , the result of the full resolution of the required identifiers (I p ,K ip ) is calculated as follows: MRT TSS It represents the message recovery in secret sharing. The message is recovered through p message sub-shares to complete the secret sharing. Sub-step 5-4: Full identification security resolution. Finally, the identification resolution node downloads the encrypted full identification source data Data from the IPFS server through CID e , and identify the parsing result K ip Decrypt to obtain the full amount of identification source data Data r ; Encrypted full identification source data Data e , full identification source data Data r as follows: Date e ={Date ep1 ,Date ep2 ,...,Date epn } (29) Data epn Represents the source data for the nth identifier.

8. A full-quantity identification resolution device based on blockchain and secure multi-party computing, characterized in that: include: Identifier structure setting module, trusted full-quantity identification registration module, multi-party key negotiation module, threshold secret sharing module, full-quantity identification security parsing module; The identifier structure setting module is used to set the identifier structure based on the hierarchical identifier resolution structure, specifically implementing the content of step 1 in the full identifier resolution method based on blockchain and secure multi-party computing described in any one of claims 1 to 7; The trusted full-quantity identification registration module is used to collect identification source data, generate an identification key to encrypt the identification source data, and register the trusted identification with the enterprise alliance after generating the trusted identification, specifically implementing the content of step 2 in the full-quantity identification resolution method based on blockchain and secure multi-party computing described in any one of claims 1-7; The multi-party key negotiation module is used for the main enterprise node and the multi-party enterprise node to send a key negotiation request to the superior node to complete the multi-party key negotiation, specifically implementing the content of step 3 in the full identity resolution method based on blockchain and secure multi-party computing as described in any one of claims 1-7; the threshold secret sharing module is used to reconstruct, return, and recursively parse the partial identification and resolution results of each of the multi-party enterprise nodes to obtain a number of sub-shares, and perform message recovery to complete threshold secret sharing, specifically implementing the content of step 4 in the full identity resolution method based on blockchain and secure multi-party computing as described in any one of claims 1-7; the full identity security resolution module is used to obtain the identity source data through recursive resolution, key negotiation, secret sharing, and resolution structure decryption, specifically implementing the content of step 5 in the full identity resolution method based on blockchain and secure multi-party computing as described in any one of claims 1-7.

Images