User identity authentication method, readable storage medium and computer program product

Abstract

The invention discloses a user identity authentication method, a readable storage medium and a computer program product, and relates to the technical field of information security, a user side is located in a block chain, the block chain at least comprises the user side, a platform side and an authentication side, and the user identity authentication method comprises the steps of obtaining user identity information, password information and biological feature information; generating corresponding updated user encryption information according to the user identity information, the password information, the biological characteristic information, preset first encryption information and a first random number; when the updated user encryption information is equal to preset second user encryption information, generating a second random number and a head portrait identity, and determining corresponding verification information according to the second random number and the head portrait identity; and sending the head portrait identity, a preset false identity and verification information to the platform end for verification in the block chain by the platform end. According to the technical scheme, the problem of how to ensure the communication security between the user and the platform in the meta-universe environment is solved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a user identity authentication method, a computer-readable storage medium, and a computer program product. Background Art

[0002] In the current metaverse environment, users and platform servers communicate through public servers. This environment may be vulnerable to various security threats. For example, when users conduct virtual activities in the virtual space of the metaverse, the user's location, habits, lifestyle and other privacy may be violated during the life cycle of data services such as data perception, transmission, processing, governance, and storage. How to communicate securely and transparently manage user identity data, and how to ensure the security of interactions between virtual characters are crucial in the virtual environment of the metaverse.

[0003] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of this application is to provide a user identity authentication method, a computer-readable storage medium and a computer program product, aiming to solve the technical problem of how to ensure the security of communication between users and platforms in a metaverse environment.

[0005] To achieve the above purpose, the present application proposes a user identity authentication method, which is applied to a user terminal, wherein the user terminal is located in a blockchain, and the blockchain at least includes a user terminal, a platform terminal, and an authentication terminal. The user identity authentication method includes:

[0006] Obtain user identity information, password information, and biometric information;

[0007] Generate corresponding updated user encrypted information according to the user identity information, the password information, the biometric information, the preset first encrypted information, and the first random number;

[0008] When the updated user encrypted information is equal to the preset second user encrypted information, a second random number and an avatar identity are generated, and corresponding verification information is determined according to the second random number and the avatar identity;

[0009] The avatar identity, the preset pseudo identity and the verification information are sent to the platform end, so that the platform end can verify the pseudo identity in the blockchain, and after the verification, the public keys corresponding to the avatar identity and the pseudo identity are stored in the database, and the corresponding session key is calculated according to the public key and the verification information, wherein the session key is used for communication encryption between the user end and the platform end.

[0010] In one embodiment, the step of generating corresponding updated user encryption information according to the user identity information, the password information, the biometric information, the preset first encryption information, and the first random number includes:

[0011] Performing hash calculation on the user identity information, the password information and the biometric information to obtain a corresponding hash password;

[0012] Calculate a third random number based on the first user encrypted information in the blockchain and the hash password;

[0013] Performing a hash calculation on the password information, the biometric information and the third random number to obtain a corresponding random number password;

[0014] A hash calculation is performed on the user identity information, the hash password, the random number password and the third random number to obtain updated user encryption information.

[0015] In one embodiment, before the step of obtaining user identity information, password information, and biometric information, the method further includes:

[0016] Obtaining user identity information, naming information, and biometric information, and generating a corresponding fourth random number and private key;

[0017] Calculate a pseudo identity according to the user identity information and the fourth random number;

[0018] Calculate a public key based on the private key and a preset elliptic curve base point;

[0019] The pseudo identity and the public key are sent to the authentication end so that the authentication end can verify the uniqueness of the pseudo identity and the public key in the blockchain. If the verification is successful, a fifth random number is generated at the authentication end, and a corresponding signature value is generated. The authentication end sends a verification message consisting of the signature value and the fifth random number to the user end, and finally the pseudo identity and the public key are stored in the blockchain.

[0020] In one embodiment, before the step of sending the pseudo identity and the public key to the authentication end, the authentication end has published a preset elliptic curve, an elliptic curve base point, a public key, a one-way hash function, and a biometric hash function into the blockchain.

[0021] In one embodiment, after the step of sending the pseudo identity and the public key to the authentication end, the method further includes:

[0022] After receiving the verification message sent by the authentication end, based on the one-way hash function, the biometric hash function value corresponding to the identity information, the password information and the biometric information is calculated to obtain a hash password;

[0023] Based on the one-way hash function, calculate the password information, the biometric hash function value corresponding to the biometric information, and the fourth random number to obtain a random number password;

[0024] Performing an XOR operation on the fourth random number and the hash password to determine the first user encryption information;

[0025] Based on the one-way hash function, calculate the identity information, the hash password, the random number password and the fourth random number to obtain second user encrypted information;

[0026] Performing an XOR operation on the verification message and the random number password to obtain third user encrypted information;

[0027] The first user encrypted information, the second user encrypted information, and the third user encrypted information are stored.

[0028] In one embodiment, the user identity authentication method further includes:

[0029] Obtain user identity information, password information, and biometric information;

[0030] Determine a hash password, a third random number, a random number password, and update user encryption information according to the user identity information, the password information, and the biometric information;

[0031] When the updated user encryption information is equal to the preset second user encryption information, generating a sixth random number and a first timestamp;

[0032] Performing an XOR operation on the preset third user encryption information and the random number password to obtain update verification information;

[0033] Calculate a first verification intermediate value according to the pseudo identity, the avatar identity, the fifth random number, the sixth random number, and the timestamp;

[0034] Calculating the product of the first verification intermediate value and a preset elliptic curve base point to obtain a first elliptic curve point;

[0035] Calculate the product of the first verification intermediate value and the platform public key corresponding to the platform end to obtain a second elliptic curve point;

[0036] Calculate a user-side verification value according to the first verification intermediate value, the pseudo identity, the avatar identity, the session key, and a preset private key;

[0037] Determine a first user encrypted message based on the second elliptic curve point and the first timestamp, as well as the pseudo identity, the avatar identity, and the user terminal verification value;

[0038] The first user encrypted message, the first elliptic curve point and the first timestamp are sent to the platform end, so that the platform end can generate a corresponding session key after verification.

[0039] In addition, the present application also proposes a user identity authentication method, which is applied to a platform end, the platform end is located in a blockchain, the blockchain includes at least a user end, a platform end and an authentication end, and the user identity authentication method includes:

[0040] After receiving the avatar identity, verification information, pseudo identity and verification information sent by the user, query whether the pseudo identity exists in the blockchain;

[0041] If so, the pseudo identity authentication is passed, and the public key corresponding to the avatar identity and the pseudo identity is stored in the database;

[0042] A corresponding first session key is calculated according to the public key and the verification information, wherein the first session key is used for communication between the user end and the platform end.

[0043] In one embodiment, after the step of calculating the corresponding session key according to the public key and the verification information, the method further includes:

[0044] When receiving the user encrypted message, the first elliptic curve point and the first timestamp sent by the user terminal;

[0045] verifying the first timestamp based on a current second timestamp;

[0046] After the first timestamp is verified, an updated elliptic curve point is calculated based on the first elliptic curve point and a preset platform private key;

[0047] Performing user identity authentication based on the pseudo identity, the avatar identity, the user encryption information, and a preset user terminal verification value, the updated elliptic curve point, and the timestamp;

[0048] After the verification is passed, a second verification intermediate value is obtained by calculating a hash value of the pseudo identity, the avatar identity, the platform private key, the newly generated seventh random number, and the second timestamp;

[0049] determining a third elliptic curve point and a fourth elliptic curve point based on the second verification intermediate value;

[0050] Calculate a second session key according to the updated elliptic curve point, the avatar identity and the fourth elliptic curve point;

[0051] The corresponding second user encrypted message is determined by the second session key, and the second user encrypted message, the third elliptic curve point and the second timestamp are sent to the user end so that the user end can determine the corresponding second session key.

[0052] In addition, to achieve the above-mentioned purpose, the present application also proposes an electronic device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the user authentication method described above.

[0053] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the user identity authentication method described above are implemented.

[0054] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the user identity authentication method described above are implemented.

[0055] The present application proposes a user identity authentication method, firstly obtaining user identity information, password information and biometric information, then generating corresponding updated user encryption information according to the user identity information, the password information, the biometric information and the preset first encryption information and the first random number, when the updated user encryption information is equal to the preset second user encryption information, it indicates that the currently acquired user identity information, password information and biometric information have passed the verification, and generating the second random number and the avatar identity, and determining the corresponding verification information according to the second random number and the avatar identity, sending the avatar identity, the preset pseudo identity and the verification information to the platform end, so that the platform end can verify the pseudo identity in the blockchain, and storing the public key corresponding to the avatar identity and the pseudo identity to the database after the verification, and calculating the corresponding session key according to the public key and the verification information, wherein the session key is used for communication encryption between the user end and the platform end. The technical solution of the present application prevents the dependence of user data on each platform server by using blockchain technology, thereby providing the security of user data, and manages user identification data in the blockchain to provide the integrity and transparency of user data. After obtaining the information input by the user on the user side, the verification steps on the user side are executed, and then the newly created avatar identity, the preset pseudo identity and the generated verification information are sent to the platform side for verification by the platform side. Finally, the session key used for encrypted communication is obtained, realizing multi-terminal identity authentication and ensuring secure communication between the user and the platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0057] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0058] Figure 1 This is a schematic diagram of the composition structure of the blockchain including the user end, the authentication end and the platform end in the embodiment of the present application;

[0059] Figure 2 A schematic diagram of a flow chart of a user identity authentication method applied to a user terminal in an embodiment of the present application;

[0060] Figure 3 A schematic diagram of a flow chart of a user identity authentication method applied to an authentication terminal in an embodiment of the present application;

[0061] Figure 4 This is a flow chart of a user identity authentication method applied to a platform end in an embodiment of the present application;

[0062] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the user identity authentication method in the embodiment of the present application.

[0063] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0064] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0065] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0066] In the embodiment of the present application, blockchain technology is used to prevent user data from relying on the platform servers, and to provide security for user data and the communication process. User identification data is managed in the blockchain to provide integrity and transparency for user data. Moreover, the embodiment of the present application also provides an authentication scheme using blockchain between users and platform servers and between virtual characters to ensure secure communication and virtual character interaction in a virtual environment.

[0067] In order to achieve the above purpose, the embodiment of the present application provides a user identity authentication method applied to a user terminal, wherein the user terminal is located in the blockchain, and refers to Figure 1 In the blockchain, the user end communicates with the authentication end and the platform end respectively. The authentication end and the platform end can also communicate through the blockchain to obtain various data published by each party in the blockchain (such as user identity information, pseudo identity, avatar identity, public key, etc.). The number of user ends, authentication ends and platform ends in the blockchain can be more than one. Figure 2 This is a flow chart of the first embodiment of the user identity authentication method of the present application, the user identity authentication method comprises:

[0068] Step S10, obtaining user identity information, password information and biometric information;

[0069] It should be noted that the embodiment of the present application provides a method for creating a corresponding avatar identity (i.e., virtual identity) in the virtual space corresponding to the platform end (i.e., the virtual space of the metaverse) through the user end and providing verification to the platform end after the user is authenticated in the blockchain through the authentication end and obtains the credentials required to participate in the metaverse environment.

[0070] Specifically, the user terminal can be a smart device, such as a mobile terminal (such as a mobile phone) and a computer device (such as a personal computer). When the user needs to create a corresponding avatar identity in the virtual space corresponding to the platform, he first logs in to the corresponding account on the user terminal and enters the user identity information (such as account number, mobile phone number, ID number, etc.), password information (password corresponding to the account) and biometric information (such as facial features, fingerprint features, etc.) into the user terminal.

[0071] Step S20, generating corresponding updated user encryption information according to the user identity information, password information, biometric information, preset first encryption information, and first random number;

[0072] Among them, updating user encrypted information refers to the information generated by combining the existing acquired user identity information, password information, and biometric information with the first encrypted information and the first random number pre-stored in the blockchain, which can be used to compare with the second user encrypted information stored in the blockchain, so as to verify the authenticity of the user identity information, password information, and biometric information, and verify whether the user's true identity is consistent with the identity of the corresponding user who has been authenticated in the blockchain, thereby ensuring the user's information security and preventing identity information from being stolen.

[0073] It can be understood that the first encrypted information and the first random number are both information generated when the user is performing authentication in the blockchain, and are used for subsequent creation of avatar identities, account logins, and identity authentication during communications.

[0074] Step S30, when the updated user encryption information is equal to the preset second user encryption information, a second random number and a head portrait identity are generated, and corresponding verification information is determined according to the second random number and the head portrait identity;

[0075] When the updated user encryption information is equal to the preset second user encryption information, it can be determined that the current user identity information, password information, and biometric information have passed the authentication, and the next step of creating an avatar identity and generating verification information can be performed. The verification information is used to be sent to the platform end for the platform end to verify the user's identity.

[0076] For example, user U ik The second random number n can be generated by the smart device i and avatar i , where avatar i It can be understood as the server S on the platform side t The unique ID used in the i The verification information V can be calculated by smart devices i =Z 3 ⊕RPWi ,N i =n i ·P,S i =k i ·PK st ,C i =n i +h(PID i ||avatar i ||X i ||Sig i-CA )·k i ,EM i =h(N i ||C i ||X i ||Sig i-CA )⊕h(PID i ||avatar i ||S i ), where N i is an elliptic curve point randomly generated by the user; S i Represents the session key between the user end and the platform end; C i Represents a generated verification value used to ensure that the user's authentication is valid and secure when communicating with the server; Z 3 Indicates the third user's encrypted information, RPW i Represents a random number password, N i represents the random number corresponding to the second random number, P represents the preset elliptic curve base point, k i Indicates the user's private key, PK st Indicates the public key provided by the platform, PID i represents a pre-set pseudo identity, X i Indicates the preset fifth random number, Sig i-CA Indicates the signature value of the authentication end, EM i Represents verification information, and h(.) represents a one-way hash function.

[0077] It should be noted that in addition to calculating the verification information, the platform also calculates the corresponding session key, which is used to encrypt the communication between the user end and the platform end in the subsequent process.

[0078] Step S40, the avatar identity, the preset pseudo identity and the verification information are sent to the platform end, so that the platform end can verify the pseudo identity in the blockchain, and store the public keys corresponding to the avatar identity and the pseudo identity in the database after the verification, and calculate the corresponding session key according to the public key and the verification information, wherein the session key is used for communication encryption between the user end and the platform end.

[0079] Finally, the user side can send the avatar identity, preset pseudo identity and verification information to the platform side through the secure communication channel between the user side and the platform side. One is for the platform side to authenticate the identity, and the other is to create a corresponding avatar identity on the platform side so that the avatar identity can be registered and stored in the virtual space of the platform side.

[0080] For example, user U i The corresponding user end can use the secure channel to i ,PID i ,EM i} (i.e., avatar identity, preset pseudo identity, and verification information) is sent to the platform server S t .

[0081] After the platform receives the above information, it first passes it to the platform server S t Checking for Pseudo-Identities (PIDs) in the Blockchain i And retrieve the corresponding user U i The public key PK i If the pseudo identity and public key are equal to the values ​​corresponding to the pseudo identity and public key stored in the blockchain, the platform server S t Store unique (avatar) i PK i ), and calculate the session key Then the platform server S t We can further verify that C i Is P equal to RN? i +h(PID i ||avatar i ||X i ||Sig i-CA )·PK i and Sig i-CA Is P equal to X? i +h(PID i ||X i ||PK i )·PK ca , where PK ca The public key provided by the authentication end. Adding the above verification steps can further enhance the security of the user identity. If they are equal, the platform server S t Store in the database (avatar i ,PK i ) and publish the user's corresponding (avatar) in the virtual space i ,PK i). This is equivalent to the user's avatar identity being registered and stored in the virtual space on the platform, and the user can use the avatar identity to move freely in the virtual space.

[0082] In the embodiment of the present application, a user identity authentication method is proposed, firstly obtaining user identity information, password information and biometric information, then generating corresponding updated user encryption information according to the user identity information, the password information, the biometric information and the preset first encryption information and the first random number, when the updated user encryption information is equal to the preset second user encryption information, it indicates that the currently acquired user identity information, password information and biometric information have passed the verification, and generating the second random number and the avatar identity, and determining the corresponding verification information according to the second random number and the avatar identity, sending the avatar identity, the preset pseudo identity and the verification information to the platform end, so that the platform end can verify the pseudo identity in the blockchain, and storing the public key corresponding to the avatar identity and the pseudo identity to the database after the verification, and calculating the corresponding session key according to the public key and the verification information, wherein the session key is used for communication encryption between the user end and the platform end. The technical solution of the embodiment of the present application prevents the dependence of user data on each platform server by using blockchain technology, thereby providing the security of user data, and managing user identification data in the blockchain to provide the integrity and transparency of user data. After obtaining the information input by the user on the user side, the verification steps on the user side are executed, and then the newly created avatar identity, the preset pseudo identity and the generated verification information are sent to the platform side for verification by the platform side. Finally, the session key used for encrypted communication is obtained, realizing multi-terminal identity authentication and ensuring secure communication between the user and the platform.

[0083] Further, in a feasible embodiment, the step of generating corresponding updated user encryption information according to the user identity information, the password information, the biometric information, the preset first encryption information, and the first random number includes:

[0084] Step S21, performing hash calculation on the user identity information, password information and biometric information to obtain a corresponding hash password;

[0085] Step S22, calculating a third random number according to the first user encrypted information in the blockchain and the hash password;

[0086] Step S23, performing hash calculation on the password information, the biometric information and the third random number to obtain a corresponding random number password;

[0087] Step S24, performing hash calculation on the user identity information, the hash password, the random number password and the third random number to obtain updated user encryption information.

[0088] It should be noted that in the process of generating the corresponding updated user encrypted information through user identity information, password information, biometric information, preset first encryption information and first random number, it is necessary to calculate some intermediate values ​​based on the one-way hash function, biometric hash function, etc. in the blockchain, such as hash password, third random number, random number password, etc., and finally determine the updated user encrypted information based on these intermediate values.

[0089] For example, user U i On smart device SD i Enter the user's ID i , password information PW i , Biometric information B i , then user U i Calculate hash password HPW based on smart devices i =h(ID i ||PW i ||h b (B i )), the third random number RN i =Z 1 ⊕HPW i ,Random number password RPW i =h(PW i ||h b (B i )||RN i ), and update user encryption information Z 2 * =h(ID i ||HPW i ||RPW i ||RN i ), and check Z 2 * Is it equal to the second user encrypted information Z 2 ,h b () refers to the biometric hash function.

[0090] It can be understood that the above calculation steps are consistent with the steps of calculating the second user encryption information during the process of the user end authenticating its own identity on the blockchain, thereby authenticating the user identity information, password information and biometric information obtained by the user end this time.

[0091] In a feasible embodiment, before the step of obtaining user identity information, password information and biometric information, the method further includes:

[0092] Step A10, obtaining user identity information, naming information, and biometric information, and generating a corresponding fourth random number and private key;

[0093] Step A20, calculating a pseudo identity according to the user identity information and the fourth random number;

[0094] Step A30, calculating a public key based on the private key and a preset elliptic curve base point;

[0095] Step A40, the pseudo identity and the public key are sent to the authentication end for the authentication end to verify the uniqueness of the pseudo identity and the public key in the blockchain. If the verification is successful, a fifth random number is generated at the authentication end, and a corresponding signature value is generated. The authentication end sends a verification message consisting of the signature value and the fifth random number to the user end, and finally the pseudo identity and the public key are stored in the blockchain.

[0096] The present application embodiment also provides a step for a user to authenticate his / her identity in the blockchain through a user terminal. It is understandable that in the user setting stage, the user U i The identity must be verified from a certification authority (CA) to obtain the credentials (e.g., verification information) required to participate in the Metaverse environment.

[0097] For example, the process of the user setting stage is described as follows: the user sets the i Enter user U i Identity information ID i 、Password PW i and biometric information B i , then generate a random number RN i (ie the fourth random number) and the private key k i . Then, user U i Based on smart device SD i Calculate the corresponding pseudo identity PID i =h(ID i ||RN i ) and public key PK i =k i P, then user U i Based on smart device SD i Send the message {PID i ,PK i ,info i} is sent to the certification authority CA (i.e. the certification end), where info i For U i personal information.

[0098] In a feasible embodiment, after receiving the above information, the authentication end CA checks (PID i,PK i ) in the blockchain to verify the information. If the verification is successful, the certification authority CA generates a random number x i , and calculate the fifth random number X i =x i P and Sig i-CA =x i +h(PID i ||PK i ||x i )·k ca , where the signature value Sig generated by the certification authority i-CA It is used to represent the user U i It is verified by the certification authority CA, and then the certification authority CA verifies the information V i =(X i ,Sig i-CA ) is sent to user Ui, and (PID i ,PK i ) is stored in the blockchain, so that the user has successfully completed the registration and storage of the pseudo-identity in the blockchain, which can ensure the uniqueness of the user's identity in the blockchain and ensure the security of the user's information.

[0099] In another feasible embodiment, before the step of sending the pseudo-identity and the public key to the authentication end, the authentication end has published a preset elliptic curve, an elliptic curve base point, a public key, a one-way hash function, and a biometric hash function into the blockchain.

[0100] It is understandable that in the embodiment of the present application, the authentication end may be a certification authority CA. Before the aforementioned user setting stage, refer to Figure 3 , the certification body first needs to perform the initialization phase:

[0101] Step B10, determining a non-singular elliptic curve;

[0102] Step B20, selecting a base point and a private key in the elliptic curve;

[0103] Step B30, calculate the corresponding public key based on the base point and the private key:

[0104] Step B40, publish the elliptic curve, base point, private key, public key, one-way hash function and biometric hash function in the blockchain.

[0105] For example, the certification authority CA first needs to select a non-singular elliptic curve E p (u,r) / F p Then, the certification authority CA in E p Select a base point P and a private key k on (u,r)ca Then the certification authority CA calculates the corresponding public key PK ca =k ca ·P, and publish the system parameters {Ep(u,r), P, PK ca ,h(·),h b (·)} for other nodes in the distinguishing chain (including user end and platform end) to obtain, where h(.) represents a one-way hash function, h b (·) represents a biometric hash function, wherein the one-way hash function and the biometric hash function are used for the user side and the platform side to perform hash operations to perform a two-way verification step.

[0106] In another feasible embodiment, after the step of sending the pseudo identity and the public key to the authentication end, the method further includes:

[0107] Step C10, after receiving the verification message sent by the authentication end, the biometric hash function value corresponding to the identity information, password information and biometric information is calculated based on a one-way hash function to obtain a hash password;

[0108] Step C20, based on a one-way hash function, calculating the biometric hash function value corresponding to the password information, the biometric information, and a fourth random number to obtain a random number password;

[0109] Step C30, performing an XOR operation on the fourth random number and the hash password to determine the first user encryption information;

[0110] Step C40, calculating the identity information, the hash password, the random number password and the fourth random number based on a one-way hash function to obtain the second user encrypted information;

[0111] Step C50, performing an XOR operation on the verification message and the random number password to obtain the third user encrypted information;

[0112] Step C60, storing the first user encrypted information, the second user encrypted information and the third user encrypted information.

[0113] The embodiment of the present application provides a step of further calculating the first user encryption information, the second user encryption information and the third user encryption information during the user setting stage, after the authentication end passes the identity information of the user end and the user receives the verification message sent by the verification end.

[0114] Specifically, the user first calculates the hash password HPW i =h(ID i ||PW i ||h b (B i )) and random number password RPWi =h(PW i ||h b (B i )||RN i ), and further calculate the first user encryption information Z 1 =RN i ⊕HPW i ,Second user encrypted information Z 2 =h(ID i ||HPW i ||RPW i ||RN i ), and the third user encrypted information Z 3 =V i ⊕RPW i , then {Z 1 ,Z 2 ,Z 3}Stored in smart device SD i , where the first user encrypted information Z 1 Used to confuse the original random number, so that even if the attacker gets Z 1 , it is also impossible to easily deduce RN i or HPW i ; Second user encrypted information Z 2 Used to further verify whether the user's identity information and password and other sensitive data match; the third user encrypted information Z 3 Used as part of generation validation in subsequent steps of the protocol.

[0115] At this point, the user end (smart device) obtains and stores {Z 1 ,Z 2 ,Z 3}, so that further identity authentication and two-way verification steps with the platform can be carried out to improve the security of user information and communication security.

[0116] In another feasible embodiment, the user identity authentication method further includes:

[0117] Step D10, obtaining user identity information, password information and biometric information;

[0118] Step D20, determining the hash password, the third random number, the random number password and updating the user encryption information according to the user identity information, password information and biometric information;

[0119] Step D30, when the updated user encryption information is equal to the preset second user encryption information, generating a sixth random number and a first timestamp;

[0120] Step D40, performing an XOR operation on the preset third user encryption information and the random number password to obtain update verification information;

[0121] Step D50, calculating a first verification intermediate value according to the pseudo identity, the avatar identity, the fifth random number, the sixth random number and the timestamp;

[0122] Step D60, calculating the product of the first verification intermediate value and the preset elliptic curve base point to obtain a first elliptic curve point;

[0123] Step D70, calculating the product of the first verification intermediate value and the platform public key corresponding to the platform end to obtain a second elliptic curve point;

[0124] Step D80, calculating a user-side verification value according to the first verification intermediate value, the pseudo identity, the avatar identity, the session key, and the preset private key;

[0125] Step D90, determining the first user encrypted message based on the second elliptic curve point and the first timestamp, as well as the pseudo identity, the avatar identity and the user terminal verification value;

[0126] Step D100, sending the first user encrypted message, the first elliptic curve point and the first timestamp to the platform end, so that the platform end can generate a corresponding session key after verification.

[0127] The embodiment of the present application provides a method for a user to log in to a virtual space of a platform end through an avatar identity, so that the platform end can perform identity authentication and generate a session key. It should be noted that the session key generated here is used for the user to enter the virtual space of the platform end using the avatar identity and perform encrypted communication with the platform end.

[0128] It should be noted that the preset second user encryption information, third user encryption information, elliptic curve base point, private key and other data are all pre-stored locally or can be directly obtained in the blockchain.

[0129] For example, user U i Can be based on the user's avatar identity i Login platform server S t Thus entering the virtual space. i and platform server S t You can obtain the session key and achieve secure communication by following the steps below.

[0130] First, user U i On smart device SD i Enter your ID i , password information PW i , Biometric information B i, then user U i Calculate hash password HPW based on smart devices i =h(ID i ||PW i ||h b (B i )), the third random number RN i =Z 1 ⊕HPW i ,Random number password RPW i =h(PW i ||h b (B i )||RN i ), update user encryption information Z 2 * =h(ID i ||HPW i ||RPW i ||RN i ), and check Z 2 * Is it equal to the second user encrypted information Z 2 If they are equal, user U i Then the sixth random number n is generated based on the smart device 1 and the first timestamp T 1 Then user U i Based on the calculation of smart device, update verification information V i =Z 3 ⊕RPW i , first verify the intermediate value v 1 =h(PID i ||avatar i ||X i ||n 1 ||T 1 ), the first elliptic curve point S generated by the user 1 =v 1 P, the second elliptic curve point S 2 =v 1 ·PK st , and the user-side verification value Ver i-st =v 1 +h(PID i ||avatar i ||S i )·k i and the user encrypted message (ie, the first user encrypted message) EM 1 =(PID i ||avatar i ||Ver i-st )⊕h(S 2||T 1 ). Afterwards, user U i Based on smart devices through a secure public channel 1 ,S 1 ,T 1}Sent to platform server S t .

[0131] Furthermore, when the platform receives the above information, it will first verify the first timestamp through the local second timestamp, and then calculate the corresponding second elliptic curve point, further verify the user-side verification value, and calculate the new second verification intermediate value and the third elliptic curve point and the fourth elliptic curve point, and then calculate the corresponding session key and the second user encrypted message, and finally send the second user encrypted message, the third elliptic curve point and the second timestamp to the user side, so that the user side can perform the next step of verification and calculate the same session key as the platform side.

[0132] For example, when the platform receives {EM 1 ,S 1 ,T 1}, the platform server S t Use condition|T 1 * -T 1 |≤△TVerify timestamp T 1 Then, the platform server S t Calculate the second elliptic curve point S 2 * =S 1 ·k st ,(PID i ||avatar i ||Ver i-st )=EM 1 ⊕h(S 2 * ||T 1 ). Afterwards, the platform server S t Verification i-st Is P equal to S? 1 +h(PID i ||avatar i ||T 1 )·PK i If they are equal, the user-side verification value is verified, and the platform server S t Calculate the second verification intermediate value v 2 =h(PID i ||avatar i ||k st ||n 2 ||T 2), the third elliptic curve point S 3 =v 2 P, the fourth elliptic curve point S 4 =v 2 ·S 1 ,Session key SK i-st =h(S 2 * ||avatar i ||S 4 ) and the user encrypted message (i.e. the second user encrypted message) EM 2 =h(PID i ||avatar i ||SK i-st ||T 2 ). Then, the platform server S t Through public channels 2 ,S 3 ,T 2}Send to user U i .

[0133] Furthermore, when the user terminal receives the data from the platform server S t Received 2 ,S 3 ,T 2}, user U i Use condition|T 2 * -T 2 |≤△TVerify timestamp T 2 , where T 2 * It is the latest timestamp read by the user. If the verification is successful, user U i Calculate elliptic curve point S 4 * =v 1 ·S 3 ,Session key SK * i-st =h(S 2 ||avatar i ||S 4 * ) and the updated user encrypted message EM * 2 =h(PID i ||avatar i ||SK * i-st ||T 2 ). Then, user U i Verify EM * 2 Is it equal to EM?2 (Second user encrypted message). If they are equal, user U i With platform server S t The login and authentication phase is successfully completed. After that, the user U i With platform server S t The session key SK will be used i-st Communicate securely.

[0134] In another feasible embodiment, the virtual character identity authentication stage is only available to users who log in and exchange session keys with the platform server, so as to conduct secure virtual character interaction in the virtual space corresponding to the platform server. In this stage, the platform server is only responsible for forwarding request and response messages. In the virtual space, the user's virtual character identity can be bidirectionally authenticated according to the following process.

[0135] First, user U i Generate a random number n based on the user end 3 and timestamp T 3 Then, user U i Calculate and verify the intermediate value v based on the user side 3 =h(PID i ||avatar i ||X i ||n 3 ||T 3 ), elliptic curve point S 5 =v 3 ·P,S 6 =v 3 ·PK j , and calculate And Req=SYE SKi-st (EM 3 ,S 5 ,T 3 ,avatar j ). Afterwards, user U i Based on the user end to the platform server S t Send a verification request message Req.

[0136] On the platform server S ti After receiving the verification request message Req, the platform server S t Calculation (EM 3 ,S 5 ,T 3 ,avatar j )=SYD SKi-st (Req), which is the symmetric decrypted session key. iYou need to use the avatar identity to communicate with another user in the virtual space j When interacting, the platform server S t Based on S t And another user U j The session key pair Req ij Encryption, such as Req ij =SYE SKj-st (EM 3 ,S 5 ,T 3 ) to ensure the security of communication between users. t To user U j Send Req ij , so that another user U j Received from user U i news.

[0137] In user U j After receiving the above message, the user end calculates (EM 3 ,S 5 ,T 3 ,avatar j )=SYD SKj-st (Req ij )S 6 * =k j ·S 5 ,(PID i ||Ver i )=EM 3 ⊕h(S 6 * ||T 3 ). Afterwards, user U j Verify PID in blockchain based on the user side i and retrieve the PK i After that, U j Based on user-side verification j Is P equal to S? 5 +h(avatar i ||T 3 ||avatar j ||S 6 * )·PK i If they are equal, the verification is confirmed to be successful, and then the user U j Generate a random number n based on the user end 4 and timestamp T 4 Then, user U j Based on the user-side calculation v 4 =h(PIDj ||avatar j ||X i ||n 4 ||T 4 ), elliptic curve point S 7 =v 4 ·P,S 8 =v 4 ·S 5 ,Ver j =v 4 +h(avatar i ||T 4 ||avatar j ||S 8 )·k j , the encrypted message EM 4 =(PID j ||Ver j )⊕h(S 8 ||T 4 ) and the response message Res = SYE SKj-st (EM 4 ,S 7 ,T 4 ,avatar i ), which is the symmetrically encrypted session key. Afterwards, user U j Based on the user end to the platform server S t Send a response message Res.

[0138] When the platform server S t From user U j After the user receives the response message Res, the platform server S t Calculation (EM 4 ,S 7 ,T 4 ,avatar i )=SYD SKj-st (Res). Afterwards, the platform server S t Use S t and U i The session key between them is used to encrypt Res ij , such as Res ij =SYE SKi-st (EM 4 ,S 7 ,T 4 ). Afterwards, the platform server S t To user U i The user sends Res ij .

[0139] UserU iThe session key (EM 4 ,S 7 ,T 4 )=SYD SKi-st (Res ij ), elliptic curve point S 8 * =v 3 ·S 7 ,(PID j ||Ver j )=EM 4 ⊕h(S 8 * ||T 4 ). After that, U i Verify the pseudo identity PID in the blockchain through the user end j And retrieve the corresponding public key PK j . Afterwards, user U i Verification j Is P equal to S? 7 +h(avatar i ||T 4 ||avatar j ||S 8 * )·PK j If all steps are completed successfully, the verification is successful, indicating that user U i and U j It can prove the corresponding avatar and avatar j It belongs to them, ensuring the identity security of users when they interact and communicate with each other, and avoiding the occurrence of user account theft.

[0140] The technical solution of the embodiment of the present application can ensure secure communication and virtual character interaction between user platforms in a virtual environment. Specifically, blockchain technology is used to transparently manage data such as each user's virtual identity and public key. In addition, the technical solution of the embodiment of the present application provides secure communication between users and platform servers by using a two-way authentication scheme of elliptic curve encryption (ECC) and biometric information. In addition, secure virtual identity to virtual identity interaction is also provided.

[0141] Field tests have shown that the technical solution of the embodiment of the present application can resist various security attacks, including impersonation, stolen smart devices, MITM (Man-in-the-Middle Attack) and internal attacks. The field test also used the Burrows-Abadi-130Needham (BAN) logic and the Real-or-Random (ROR) model to prove that the proposed scheme can ensure the mutual authentication and security of session keys. Moreover, in a similar environment, the cost of the solution of the embodiment of the present application was compared with the conventional solution, and the results showed that the cost of this solution is lower than other conventional solutions. It can be understood that the technical solution of the embodiment of the present application can be applied to any link in the entire life cycle of the metaverse that requires identity verification, combined with other security mechanisms such as access control, trust management, and privacy protection, and can also be used to ensure the security of other interactions such as transactions between users.

[0142] In addition, the embodiment of the present application also provides a user identity authentication method applied to a platform end, wherein the platform end is located in a blockchain, and the blockchain at least includes a user end, a platform end, and an authentication end, referring to Figure 4 , the user identity authentication method includes:

[0143] Step E10, after receiving the avatar identity, verification information, pseudo identity and verification information sent by the user, query whether there is a pseudo identity in the blockchain;

[0144] Step E20, if yes, the pseudo identity verification is passed, and the public keys corresponding to the avatar identity and the pseudo identity are stored in the database;

[0145] Step E30, calculating a corresponding first session key according to the public key and the verification information, wherein the first session key is used for communication between the user end and the platform end.

[0146] The embodiment of the present application provides a method for performing identity authentication on the platform side after the user generates a virtual identity (e.g., an avatar identity) and sends the avatar identity, pseudo identity, and verification information to the platform side. i Can use user-side smart device SD i Generate a virtual identity to enter the platform server S t Managed virtual space.

[0147] Platform side (i.e. platform server S t ) received the above information (including {avatar i ,PID i ,EM i}) After that, first pass the platform server S tChecking for Pseudo-Identities (PIDs) in the Blockchain i And retrieve the corresponding user U i The public key PK i If the pseudo identity and public key are equal to the corresponding values ​​of the pseudo identity and public key stored in the blockchain, the platform server S t Store unique (avatar) i PK i ), and calculate the session key S i * =k st ·PK i ,(N i ||C i ||X i ||Sig i-CA )=EM i ⊕h(PID i ||avatar i ||S i * ). Then the platform server S t We can further verify that C i Is P equal to RN? i +h(PID i ||avatar i ||X i ||Sig i-CA )·PK i and Sig i-CA Is P equal to X? i +h(PID i ||X i ||PK i )·PK ca , where PK ca The public key provided by the authentication end. Adding the above verification steps can further enhance the security of the user identity. If they are equal, the platform server S t Store in the database (avatar i , PK i ) and publish the user's corresponding (avatar) in the virtual space i , PK i ). After completing the above steps, it is equivalent to that the user's avatar identity has been registered and stored in the virtual space of the platform, and the user can use the avatar identity to move freely in the virtual space.

[0148] In another feasible embodiment, after the step of calculating the corresponding session key according to the public key and the verification information, the method further includes:

[0149] Step F10, when receiving the user encrypted message, the first elliptic curve point and the first timestamp sent by the user terminal;

[0150] Step F20, verifying the first timestamp based on the current second timestamp;

[0151] Step F30, after the first timestamp verification is passed, an updated elliptic curve point is calculated based on the first elliptic curve point and a preset platform private key;

[0152] Step F40, performing user identity verification based on the pseudo identity, the avatar identity, the user encryption information, and the preset user terminal verification value and the updated elliptic curve point and the timestamp;

[0153] Step F50, after the verification is passed, a second verification intermediate value is obtained by calculating the hash value of the pseudo identity, the avatar identity, the platform private key, the newly generated seventh random number, and the second timestamp;

[0154] Step F60, determining a third elliptic curve point and a fourth elliptic curve point based on the second verification intermediate value;

[0155] Step F70, calculating a second session key according to the updated elliptic curve point, the avatar identity and the fourth elliptic curve point;

[0156] Step F80, determining the corresponding second user encrypted message by using the second session key, and sending the second user encrypted message, the third elliptic curve point and the second timestamp to the user end, so that the user end can determine the corresponding second session key.

[0157] When the platform receives the above information (for example {EM 1 ,S 1 ,T 1}), the timestamp will be verified by the local second timestamp, and then the corresponding second elliptic curve point will be calculated to further verify the user-side verification value, and the new second verification intermediate value and the third elliptic curve point and the fourth elliptic curve point will be calculated, and then the corresponding session key and the second user encrypted message will be calculated. Finally, the second user encrypted message, the third elliptic curve point and the second timestamp will be sent to the user side for the next step of verification and calculation of the same session key as the platform side.

[0158] For example, when the platform receives {EM 1 ,S 1 ,T 1}, the platform server S t Use condition|T 1 * -T 1 |≤△TVerify timestamp T 1Then, the platform server S t Calculate the second elliptic curve point S 2 * =S 1 ·k st ,(PID i ||avatar i ||Ver i-st )=EM 1 ⊕h(S 2 * ||T 1 ). Afterwards, the platform server S t Verify again i-st Is P equal to S? 1 +h(PID i ||avatar i ||T 1 )·PK i If they are equal, the user-side verification value is verified, and the platform server S t Calculate the second verification intermediate value v 2 =h(PID i ||avatar i ||k st ||n 2 ||T 2 ), the third elliptic curve point S 3 =v 2 P, the fourth elliptic curve point S 4 =v 2 ·S 1 ,Session key SK i-st =h(S 2 * ||avatar i ||S 4 ) and the user encrypted message (i.e. the second user encrypted message) EM 2 =h(PID i ||avatar i ||SK i-st ||T 2 ). Then, the platform server S t Through public channels 2 ,S 3 ,T 2}Send to user U i .

[0159] The user identity authentication method applied to the platform side provided in the embodiment of the present application, combined with the user identity authentication method applied to the user side in the above embodiment, can solve the technical problem of how to ensure the communication security between the user and the platform in the metaverse environment. Compared with the prior art, the beneficial effects of the user identity authentication method applied to the platform side provided in the embodiment of the present application are the same as the beneficial effects of the user identity authentication method applied to the user side provided in the above embodiment, and the other technical features in the electronic device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0160] The user identity authentication method applied to the user side, the authentication side and the platform side mentioned in the above application embodiments. The specific implementation sequence may include: first, the user sends his predefined pseudo identity, public key and personal information to the certificate authority (CA, equivalent to the authentication side) to verify his identity and obtain the corresponding verification information in order to participate in the metaverse environment; then, the user can use their pseudo identity, public key and verification information to create an avatar identity on each platform. Then, the user transmits the verification information obtained from the certification authority CA to the corresponding platform server to enter the virtual space managed by the platform server; if the platform server successfully completes the authentication phase of the user, the platform server sends a session key to the user, and then the user and the platform server can communicate using the session key to ensure communication security; finally, users who have entered the virtual space using virtual images can interact with other virtual images, where for secure avatar-to-avatar interactions, users can perform identity authentication.

[0161] The embodiment of the present application is equivalent to proposing a secure two-way authentication scheme using blockchain technology. In addition, a virtual identity authentication stage is also considered to ensure the secure interaction between virtual identities in the virtual space. It can be understood that the scheme includes 5 main stages, namely initialization, user settings, virtual identity generation, login and authentication, and virtual identity authentication stage.

[0162] Combined with the content of the above embodiments, in the process of implementing the above methods, the time cost is mainly the execution time of bilinear pairing, EC (Elliptic Curve) point multiplication, EC point addition, symmetric encryption / decryption, hash function and Biohash (biological hash function). i The execution cost of sending a login request message requires 4 EC point multiplications, 1 EC point addition, 8 hashes, and 2 Biohash. t After receiving the login request message, execute the response U iThe operation requires 5 EC point multiplications, 1 EC point addition, and 5 hash function execution times. Therefore, the total time is lower than other existing schemes, and the processing efficiency is higher. In addition, in terms of communication cost, in this scheme, EC points, hash function outputs, virtual identities, random numbers, symmetric encryption and decryption, and timestamps require 320, 160, 160, 128, 128, and 32 bits, respectively. In the login and authentication phase of user identity authentication, when user U i and S t Transmit messages between 1 ,S 1 ,T 1} and {EM 2 ,S 3 ,T 2}, requiring (480+320+32) bits and (160+320+32) bits respectively. Therefore, the total communication overhead of the login authentication scheme is (832+512)=1344 bits, which is less than other schemes (other conventional schemes also require a minimum of 1440 bits). In summary, the user identity authentication method proposed in the embodiment of the present application has the advantages of lower time cost and communication overhead cost, higher efficiency and stronger usability.

[0163] On the other hand, the solution proposed in the embodiment of the present application can resist smart card / device theft, offline password guessing, impersonation, server deception, replay, MITM and privileged internal attacks. In addition, the technical solution of the embodiment of the present application also provides perfect forward secrecy, user anonymity and user-server two-way identity authentication strategy. The technical solution of the embodiment of the present application also provides user-to-user two-way authentication to ensure secure virtual identity interaction. Therefore, the technical solution of the embodiment of the present application has more diverse and stricter security features.

[0164] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the user identity authentication method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0165] The present application provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the user identity authentication method in the above-mentioned embodiment one.

[0166] Reference below Figure 5, which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present application. The electronic devices in the embodiments of the present application may include but are not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0167] like Figure 5 As shown, the electronic device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the electronic device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an electronic device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0168] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0169] The electronic device provided by this application adopts the user identity authentication method in the above embodiment, which can solve the technical problem of how to ensure the communication security between users and platforms in the metaverse environment. Compared with the prior art, the beneficial effects of the electronic device provided by this application are the same as the beneficial effects of the user identity authentication method provided by the above embodiment, and the other technical features in the electronic device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0170] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0171] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0172] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, wherein the computer-readable program instructions are used to execute the user identity authentication method in the above-mentioned embodiment.

[0173] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0174] The computer-readable storage medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0175] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by an electronic device, the electronic device: obtains user identity information, password information and biometric information; generates corresponding updated user encryption information according to the user identity information, the password information, the biometric information and the preset first encryption information and the first random number; when the updated user encryption information is equal to the preset second user encryption information, generates a second random number and an avatar identity, and determines the corresponding verification information according to the second random number and the avatar identity; sends the avatar identity, the preset pseudo identity and the verification information to the platform end, so that the platform end verifies the pseudo identity in the blockchain, and stores the public keys corresponding to the avatar identity and the pseudo identity in the database after the verification is passed, and calculates the corresponding session key according to the public key and the verification information.

[0176] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0177] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0178] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0179] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned user identity authentication method, and can solve the technical problem of how to ensure the communication security between users and platforms in the metaverse environment. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the user identity authentication method provided in the above-mentioned embodiment, and will not be repeated here.

[0180] The present application also provides a computer program product, including a computer program, which implements the steps of the user identity authentication method as described above when executed by a processor.

[0181] The computer program product provided by this application can solve the technical problem of how to ensure the communication security between users and platforms in the metaverse environment. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the user identity authentication method provided in the above embodiment, which will not be repeated here.

[0182] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A user identity authentication method, characterized in that: Applied to a user terminal, the user terminal is located in a blockchain, the blockchain includes at least a user terminal, a platform terminal and an authentication terminal, and the user identity authentication method includes: Obtain user identity information, password information, and biometric information; Generate corresponding updated user encrypted information according to the user identity information, the password information, the biometric information, the preset first encrypted information, and the first random number; When the updated user encrypted information is equal to the preset second user encrypted information, a second random number and a head portrait identity are generated, and corresponding verification information is determined according to the second random number and the head portrait identity; The avatar identity, the preset pseudo identity and the verification information are sent to the platform end, so that the platform end can verify the pseudo identity in the blockchain, and after the verification, the public keys corresponding to the avatar identity and the pseudo identity are stored in the database, and the corresponding session key is calculated according to the public key and the verification information. The session key is used for communication encryption between the user end and the platform end.

2. The user identity authentication method according to claim 1, characterized in that: The step of generating corresponding updated user encryption information according to the user identity information, the password information, the biometric information, the preset first encryption information, and the first random number comprises: Performing hash calculation on the user identity information, the password information and the biometric information to obtain a corresponding hash password; Calculate a third random number based on the first user encrypted information in the blockchain and the hash password; Performing a hash calculation on the password information, the biometric information and the third random number to obtain a corresponding random number password; A hash calculation is performed on the user identity information, the hash password, the random number password and the third random number to obtain updated user encryption information.

3. The user identity authentication method according to claim 1, characterized in that: Before the step of obtaining user identity information, password information and biometric information, the method further includes: Obtaining user identity information, naming information, and biometric information, and generating a corresponding fourth random number and private key; Calculate a pseudo identity according to the user identity information and the fourth random number; Calculate a public key based on the private key and a preset elliptic curve base point; The pseudo identity and the public key are sent to the authentication end so that the authentication end can verify the uniqueness of the pseudo identity and the public key in the blockchain. If the verification is successful, a fifth random number is generated at the authentication end, and a corresponding signature value is generated. The authentication end sends a verification message consisting of the signature value and the fifth random number to the user end, and finally the pseudo identity and the public key are stored in the blockchain.

4. The user identity authentication method according to claim 3, characterized in that: Before the step of sending the pseudo identity and the public key to the authentication end, the authentication end has published the preset elliptic curve, elliptic curve base point, public key, one-way hash function and biometric hash function to the blockchain.

5. The user identity authentication method according to claim 4, characterized in that: After the step of sending the pseudo identity and the public key to the authentication end, the method further includes: After receiving the verification message sent by the authentication end, based on the one-way hash function, the biometric hash function value corresponding to the identity information, the password information and the biometric information is calculated to obtain a hash password; Based on the one-way hash function, calculate the password information, the biometric hash function value corresponding to the biometric information, and the fourth random number to obtain a random number password; Performing an XOR operation on the fourth random number and the hash password to determine the first user encryption information; Based on the one-way hash function, calculate the identity information, the hash password, the random number password and the fourth random number to obtain second user encrypted information; Performing an XOR operation on the verification message and the random number password to obtain third user encrypted information; The first user encrypted information, the second user encrypted information, and the third user encrypted information are stored.

6. The user identity authentication method according to claim 1, characterized in that: The user identity authentication method further includes: Obtain user identity information, password information, and biometric information; Determine a hash password, a third random number, a random number password, and update user encryption information according to the user identity information, the password information, and the biometric information; When the updated user encryption information is equal to the preset second user encryption information, generating a sixth random number and a first timestamp; Performing an XOR operation on the preset third user encryption information and the random number password to obtain update verification information; Calculate a first verification intermediate value according to the pseudo identity, the avatar identity, the fifth random number, the sixth random number, and the timestamp; Calculating the product of the first verification intermediate value and a preset elliptic curve base point to obtain a first elliptic curve point; Calculate the product of the first verification intermediate value and the platform public key corresponding to the platform end to obtain a second elliptic curve point; Calculate a user-side verification value according to the first verification intermediate value, the pseudo identity, the avatar identity, the session key, and a preset private key; Determine a first user encrypted message based on the second elliptic curve point and the first timestamp, as well as the pseudo identity, the avatar identity, and the user terminal verification value; The first user encrypted message, the first elliptic curve point and the first timestamp are sent to the platform end, so that the platform end can generate a corresponding session key after verification.

7. A user identity authentication method, characterized in that: Applied to a platform end, the platform end is located in a blockchain, the blockchain includes at least a user end, a platform end and an authentication end, and the user identity authentication method includes: After receiving the avatar identity, verification information, pseudo identity and verification information sent by the user, query whether the pseudo identity exists in the blockchain; If so, the pseudo identity authentication is passed, and the public key corresponding to the avatar identity and the pseudo identity is stored in the database; A corresponding first session key is calculated according to the public key and the verification information, wherein the first session key is used for communication between the user end and the platform end.

8. The user identity authentication method according to claim 7, characterized in that: After the step of calculating the corresponding session key according to the public key and the verification information, the method further includes: When receiving the user encrypted message, the first elliptic curve point and the first timestamp sent by the user terminal; verifying the first timestamp based on a current second timestamp; After the first timestamp is verified, an updated elliptic curve point is calculated based on the first elliptic curve point and a preset platform private key; Performing user identity authentication based on the pseudo identity, the avatar identity, the user encryption information, and a preset user terminal verification value, the updated elliptic curve point, and the timestamp; After the verification is passed, a second verification intermediate value is obtained by calculating a hash value of the pseudo identity, the avatar identity, the platform private key, the newly generated seventh random number, and the second timestamp; determining a third elliptic curve point and a fourth elliptic curve point based on the second verification intermediate value; Calculate a second session key according to the updated elliptic curve point, the avatar identity and the fourth elliptic curve point; The corresponding second user encrypted message is determined by the second session key, and the second user encrypted message, the third elliptic curve point and the second timestamp are sent to the user end so that the user end can determine the corresponding second session key.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the user identity authentication method according to any one of claims 1 to 8 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the user identity authentication method according to any one of claims 1 to 8 are implemented.

Images