Hardware module identification method based on block chain technology

Abstract

The invention relates to the technical field of block chains, in particular to a hardware module identification method based on the block chain technology, and the method comprises the steps: generating a seed random number through a random number generator based on a module chip ID and a user-defined random number rule; performing Hash calculation on the seed random number to obtain a private key, and calculating the private key through an asymmetric encryption algorithm to obtain a public key; performing Hash calculation on the public key to obtain Hash1, intercepting the first 20 bytes of the Hash1 and recording the first 20 bytes as Hash2, and adding DID type bytes before the Hash2 to generate Hash3; and carrying out Hash calculation on the Hash3 to obtain Hash4, carrying out Base58 coding on the Hash4 to obtain a DID, and taking the DID as a unique DID identifier of the hardware module. The DID generated by the method can effectively solve the problem that the identity identification method of the existing hardware chip module cannot identify the identity and perform security authentication, and can provide basic guarantee for secure communication between devices.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a hardware module identification method based on blockchain technology. Background Art

[0002] With the rapid development of IoT devices, security and unique identification become key issues.

[0003] Blockchain technology is an innovative technology based on distributed ledger and encryption technology. It has the characteristics of decentralization, immutability, transparency and traceability, which makes blockchain technology have broad application prospects in the fields of finance, medical care, government affairs, etc. With the rapid development of blockchain technology, different types of public chains, alliance chains, and private chains have emerged, which carry blockchain scenarios for different important businesses.

[0004] Blockchain-based security authentication uses the decentralized and tamper-proof characteristics of blockchain to ensure the uniqueness and security of device identity. Each device has a unique identifier on the blockchain, and the legitimacy of the device is confirmed by verifying this identifier. Existing device identification methods have risks such as failure to identify identity and failure to authenticate securely, and thus cannot provide basic guarantees for secure communication between devices. Therefore, a new technical solution is urgently needed to solve the above technical problems. Summary of the invention

[0005] The purpose of the present invention is to overcome the above-mentioned problems of the prior art and provide a hardware module identification method based on blockchain technology to solve the technical problems of the existing hardware chip module identification method and its uniqueness, security and verifiability.

[0006] The above objectives are achieved through the following technical solutions: A hardware module identification method based on blockchain technology, comprising: Generate a seed random number through a random number generator based on the module chip ID and custom random number rules; Performing hash calculation on the seed random number to obtain a private key, and calculating the private key using an asymmetric encryption algorithm to obtain a public key; The public key is hashed to obtain Hash1, the first 20 bytes of Hash1 are intercepted and recorded as Hash2, and the DID type byte is added before Hash2 to generate Hash3; the Hash3 is hashed to obtain Hash4, and the Hash4 is Base58 encoded to obtain DID, and the DID is used as the unique DID identifier of the hardware module.

[0007] Furthermore, the unique DID identifier of the hardware module is stored in the flash of the device, and the unique DID identifier of the hardware module and the DID document containing detailed information of the DID are uploaded to the blockchain for consensus.

[0008] Furthermore, it also includes DID verification, including module management platform, hardware modules and devices; The module management platform, as the issuer of the VC credential, digitally signs the DID document of the hardware module to prove the authenticity of the DID attribute of the hardware module; The hardware module, as the holder of the VC credential, is used to sign the verification of the VC credential and send the signed VP to the device; The device acts as a verifier to verify the integrity and source of the received VP. After the verification is passed and the module identity is confirmed to be secure, data transmission is performed.

[0009] Furthermore, the module chip ID is a unique identifier on the module chip, which is used to distinguish different module chips and ensure that each module chip has a unique identity.

[0010] Furthermore, the hash calculation adopts the Sha-512 algorithm.

[0011] Furthermore, the asymmetric encryption algorithm adopts the Secp256k1 elliptic curve algorithm.

[0012] Furthermore, the format of the DID is as follows: did: <example> : <identifier> Among them, did is fixed, indicating that this is a DID identifier; <example>Specifies the resolution method for DID; <identifier>Represents a unique identifier that is used to distinguish different DIDIs and remains unique in the context of the corresponding method.

[0013] The hardware module identification method based on blockchain technology provided by the present invention can effectively solve the problems of inability to identify identity and security authentication existing in the identity identification method of the existing hardware chip module, and can provide basic guarantee for secure communication between devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a flowchart of a hardware module identification method based on blockchain technology according to the present invention; Figure 2 This is a schematic diagram of DID verification in a hardware module identification method based on blockchain technology described in the present invention. DETAILED DESCRIPTION

[0015] The present invention is further described in detail below based on the accompanying drawings and embodiments. The described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0016] like Figure 1 As shown, a hardware module identification method based on blockchain technology includes: Step (1) seed generation is based on the module chip ID and the custom random number rule, and a seed random number is generated through a random number generator; Specifically, in computer science and programming, a seed is often used in random number generators to ensure repeatability and predictability of random number sequences (given the same seed); a seed is an initial value that a random number generator uses to produce a series of random numbers.

[0017] It should be noted that the module chip ID described in this embodiment is a unique identifier on the module chip, which is used to distinguish different module chips and ensure that each module chip has a unique identity; it is usually designed by the manufacturer and contains some basic information about the chip, such as the manufacturer, chip type, production date, etc. It is an identifier physically implanted into the chip during the chip manufacturing process (for example: chip model or serial number), which is unique and cannot be modified under any circumstances. As for the internal ID of the chip in the embedded system, it is usually stored in the chip's specified memory address. Different chips have different storage addresses. The chip ID can be obtained by reading a specific memory address according to the chip manual.

[0018] Step (2) Public and private key generation: Hash calculation is performed on the seed random number to obtain a private key, and the private key is calculated using an asymmetric encryption algorithm to obtain a public key; Specifically, because the private key cannot be disclosed to the public, the custom rules for generating the Seed need to ensure randomness and difficulty in cracking. The public key is disclosed to the public and is calculated from the private key according to the asymmetric encryption algorithm. A third party can use the public key to verify the signature and other operations.

[0019] Step (3) DID generation: Hash the public key to obtain Hash1, intercept the first 20 bytes of Hash1 and record them as Hash2, add the DID type byte before Hash2 to generate Hash3; hash the Hash3 to obtain Hash4, and Base58 encode the Hash4 to obtain DID, and use the DID as the unique DID identifier of the hardware module.

[0020] Specifically, this embodiment uses a public key to generate a unique DID for the hardware module, which enables the module to be verified independently of any centralized entity, authority, or third party. This step can further enhance its security by performing multiple hash calculations on the public key. By applying the SHA-512 algorithm multiple times, it is more difficult for an attacker to recover the original data through brute force or collision attacks, thereby improving data security.

[0021] In this solution, the unique DID identifier of the hardware module is generated based on an asymmetric encryption algorithm and a hash algorithm. Specifically: The hash algorithm used is an algorithm that converts input data of arbitrary length into fixed-length output. Even a slight change in the input data of the hash algorithm will result in a significant change in the output data. Therefore, the data output by the hash algorithm is unique. In addition, the length of the output of the hash algorithm is fixed. Most importantly, the hash algorithm is irreversible, that is, the original data cannot be reversed from the hash value, which ensures the security and irreversibility of the unique DID.

[0022] In this embodiment, the hash calculation uses the Sha-512 algorithm, which can generate a 512-bit hash value, usually represented as a 128-character hexadecimal digit string. The purpose of performing SHA-512 processing on the public key is usually to obtain the fingerprint of the public key, which can be used to identify and verify the uniqueness of the public key.

[0023] The asymmetric encryption algorithm used is an important cryptographic tool. Compared with the symmetric encryption algorithm, it uses a pair of related keys: a public key and a private key. There is a special mathematical relationship between the two keys. The public key can be used to encrypt data, while the private key is used to decrypt data.

[0024] In this embodiment, the asymmetric encryption algorithm uses the Secp256k1 elliptic curve algorithm for generating the public key.

[0025] In this embodiment, the unique DID identifier of the hardware module is stored in the flash of the device, and the unique DID identifier of the hardware module and the DID document containing the detailed information of the DID are uploaded to the blockchain for consensus.

[0026] The format of the DID is as follows: did: <example> : <identifier> Among them, did is fixed, indicating that this is a DID identifier; <example>Specifies the resolution method for DID; <identifier>Represents a unique identifier that is used to distinguish different DIDIs and remains unique in the context of the corresponding method.

[0027] The DID document is a detailed description of the DID. After the DID document is generated, the DID and DID document will be uploaded to the blockchain for evidence storage. After the upload is successful, everyone can query the DID and DID document.

[0028] As a specific embodiment of the DID document in this solution, the DID document example is as follows: { / / DID document format and field description address "@context": "https: / / w3id.org / did / v1", / / DID, globally unique "id": "DID:module:7f8ca8982f6cc6e8ea087bd9457ab8024bd2", / / Version number, the first creation is 1, subsequent updates or deletions are incremented by 1 based on the previous operation "version": 1, / / Operation type: create, update, delete "operation": "create", / / Creation time "created": "2023-02-02 16:02:20", / / Update time "updated": "2023-02-03 16:02:20", / / Primary and backup public key information "publicKey": [ { / / Public key ID "id": "DID:module:7f8ca8982f6cc6e8ea087bd9457ab8024bd2#keys-1", / / Generate the public key type "type": "Secp256k1", / / Public key "publicKeyHex": "02b97c30de767f084ce3080168ee293053ba33b235d7116a3263d29f1450936b71" }, { "id": "DID:module:7f8ca8982f6cc6e8ea087bd9457ab8024bd2#keys-2", "type": "Secp256k1", "publicKeyHex": "e3080168ee293053ba33b235d7116a3263d29f1450936b71" } ], / / Public key ID used by the holder "authentication": "DID:module:7f8ca8982f6cc6e8ea087bd9457ab8024bd2#key-1", / / Public key ID that can be used for reset "recovery": [ "DID:module:7f8ca8982f6cc6e8ead9457ab8024bd2#key-2" ], / / Use the private key corresponding to the public key ID of the authentication field to sign the document (except the signatureValue field) "signatureValue": "02b97c30de767f084ce3080168ee293053ba33b235d7116a3263d29f1450936b71qwe" } As a specific embodiment of this solution, assume that there is a hardware module whose CPU chip ID is 0x0F8BFBFF00050657. If it has a hardware random number generator, read the 64-bit value generated by it as a random number (if not, use the current period time as the high 32 bits and the time elapsed since the system startup as the low 32 bits). Assume that the read value is 0x0768BB4EAD2C139F. Then, connect the two numbers as a 16-byte sequence, that is, a 128-bit number, which is the Seed. Input it into the SHA512 hash function to calculate the private key sk: Then sk = SHA512(0x0F8BFBFF00050657| 0x0768BB4EAD2C139F | 0x00000000) = 5daea052dcc51832f4cd2b23a85b7348c4b3e175c1d0647dcbd417b8e4f81ad61ff454eb0faef275f7f29e34d4a1b61f60f6c6734b4abf3d8b058174ccd74cef Note: (1) The | symbol indicates that two numbers are concatenated in byte order from the most significant bit to the least significant bit to form a new For the example here, even if we form an input byte sequence: 0F 8B FB FF 00 05 06 57 07 68 BB 4E AD 2C 13 9F 00 00 00 00 (2) The last 4 bytes in the input are used to calculate the iteration factor, which is used to avoid the calculated result being used as part of the private key. If the non-zero sum of the encryption algorithm does not meet the requirement of being within the bounds of the limited domain, add 1 to it and recalculate it. Until the requirements are met.

[0029] The result of the calculation given above is 128 hexadecimal numbers, or 512 bits, arranged from low byte to high byte.

[0030] Take the lower 256 bits as the private key sk, which is the 64 hexadecimal numbers starting from the left hand side of the number, that is, sk = 5daea052dcc51832f4cd2b23a85b7348c4b3e175c1d0647dcbd417b8e4f81ad6 According to the private key sk, the public key pk is calculated based on the SECP256k1 algorithm: Then pk = DerivePublicKey(sk) = 038D66ADC909AE996F9B4EB39C6A5DB02C62F9B79F27D222EBA08294A5DF1373FB According to the public key pk, DID is calculated. The steps and results are as follows: (1) Hash1 = SHA512(pk) = 0fd7c6cf703ff4b54e384df4e75d9270afb10524783d1e1d7d1750bbdfd85548b0195d470f18f859af78f3a47006a57ccb9e67acbbea0ef490e8a38d292e1aaf (2) Hash2 = Hash1[0 .. 19] = 0fd7c6cf703ff4b54e384df4e75d9270afb10524 Note: [..] means taking a range of values ​​from its byte sequence, numbered from left to right, starting from 0 (3) Hash3 = DID type byte (02) | Hash2 = 020fd7c6cf703ff4b54e384df4e75d9270afb10524 Note: The DID type byte is used to describe the value of the DID type. It can be any value. Here we assume it is 02 (4) Hash4 = SHA512(Hash3) = 49892d7883cbd56618a1ff84dad51cd4718e038eb2a0db1d7739f41f587bbcf8 a2a8e6e0b6637f8bc2e7c069af3557aa55e39abb28ac86893965faf71eb09508 (5) DID = Base58(Hash4) = wczewgmX3G8oMWjLFQ8MzbNspeD9KML49j2XrazVNRn9Ze9iHKPnRZi8EBcoQqN65xqsEaCkNogGBVq58Jored98zosba.

[0031] like Figure 2 As shown, this solution also provides DID verification, including module management platform, hardware modules and devices; The module management platform, as the issuer of the VC (Verifiable Credential) certificate, digitally signs the DID document of the hardware module to prove the authenticity of the DID attribute of the hardware module; The hardware module, as the holder of the VC (Verifiable Credential) credential, is used to sign the verification of the VC (Verifiable Credential) credential and send the signed VP (Verifiable Presentation) to the device; The device acts as a verifier to verify the integrity and source of the received VP (Verifiable Presentation), and after the verification is passed and the module identity is confirmed to be secure, data transmission is performed. The device is an embedded device.

[0032] The above description is only for illustrating the implementation mode of the present invention and is not intended to limit the present invention. For those skilled in the art, any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.< / identifier> < / example> < / identifier> < / example> < / identifier> < / example> < / identifier> < / example>

Claims

1. A hardware module identification method based on blockchain technology, characterized in that: include: Generate a seed random number through a random number generator based on the module chip ID and custom random number rules; Performing hash calculation on the seed random number to obtain a private key, and calculating the private key using an asymmetric encryption algorithm to obtain a public key; The public key is hashed to obtain Hash1, the first 20 bytes of Hash1 are intercepted and recorded as Hash2, and the DID type byte is added before Hash2 to generate Hash3; the Hash3 is hashed to obtain Hash4, and the Hash4 is Base58 encoded to obtain DID, and the DID is used as the unique DID identifier of the hardware module.

2. According to a hardware module identification method based on blockchain technology according to claim 1, it is characterized in that: The unique DID identifier of the hardware module is stored in the flash of the device, and the unique DID identifier of the hardware module and the DID document containing detailed information of the DID are uploaded to the blockchain for consensus.

3. According to a hardware module identification method based on blockchain technology according to claim 2, it is characterized in that: It also includes DID verification, including module management platform, hardware modules and devices; The module management platform, as the issuer of the VC credential, digitally signs the DID document of the hardware module to prove the authenticity of the DID attribute of the hardware module; The hardware module, as the holder of the VC credential, is used to sign the verification of the VC credential and send the signed VP to the device; The device acts as a verifier to verify the integrity and source of the received VP. After the verification is passed and the module identity is confirmed to be secure, data transmission is performed.

4. According to a hardware module identification method based on blockchain technology according to claim 1, it is characterized in that: The module chip ID is a unique identifier on the module chip, which is used to distinguish different module chips and ensure that each module chip has a unique identity.

5. According to a hardware module identification method based on blockchain technology according to claim 1, it is characterized in that: The hash calculation adopts the Sha-512 algorithm, which can generate a 512-bit hash value, usually represented as a 128-character hexadecimal digit string.

6. According to a hardware module identification method based on blockchain technology according to claim 1, it is characterized in that: The asymmetric encryption algorithm adopts the Secp256k1 elliptic curve algorithm.

7. According to claim 1, a hardware module identification method based on blockchain technology is characterized in that: The format of the DID is as follows: did: <example> : <identifier>< / identifier> < / example> Among them, did is fixed, indicating that this is a DID identifier; <example>Specifies the resolution method for DID; <identifier> Represents a unique identifier that is used to distinguish different DIDIs and remains unique in the context of the corresponding method.< / identifier> < / example>

Images