Identity authentication method, system and related equipment

Abstract

The invention discloses an identity authentication method, an identity authentication system and related equipment, and relates to the technical field of communication. The identity authentication method comprises the following steps: a relay node receives an access request sent by a terminal of a user; the relay node obtains the zero-knowledge proof of the user from the block chain, and the zero-knowledge proof is determined according to the identity information of the user; the relay node verifies the zero knowledge proof by using the verification key; and the relay node determines an identity verification result of the user according to the verification result of the zero knowledge proof. According to the embodiment of the invention, the automation degree of identity authentication of the P-RAN network can be improved through the block chain technology, and the intelligent development of the wireless near field network is promoted. Furthermore, the identity of the user is ensured to be anonymous to the relay node through a zero-knowledge proof method when the user accesses the network, so that the privacy information of the user is protected, the privacy information of the user is prevented from being utilized by the malicious relay node, and the access security of the P-RAN network is improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an identity authentication method, system and related equipment. Background Art

[0002] With the continuous development of mobile communication networks, 6G will further improve the data transmission rate of communication by using higher frequency bands based on 5G. In order to solve the problem of poor coverage of 6G high frequency bands, 3GPP (3rd Generation Partnership Project) proposed a new 6G network deployment solution - Proximity Radio Access Network (P-RAN). This solution further extends the original structure of the base station to smartphones, providing a low-maintenance and high-coverage deployment solution for the development of 6G.

[0003] The expanded base station structure will allow more smartphones to access, resulting in a long time for a large number of devices to register or verify their identities; connected smartphones, as relay nodes, need to frequently obtain users' geographic location information, which may cause serious problems of user privacy leakage when combined with registered identity information. Therefore, inefficient identity authentication and privacy information protection have become a problem that cannot be ignored in the application of P-RAN. Summary of the invention

[0004] A technical problem to be solved by the embodiments of the present invention is: how to improve the efficiency and security of access authentication.

[0005] According to a first aspect of some embodiments of the present invention, there is provided a method for identity authentication, comprising: a relay node receiving an access request sent by a user's terminal; the relay node obtaining the user's zero-knowledge proof from a blockchain, wherein the zero-knowledge proof is determined based on the user's identity information; the relay node verifies the zero-knowledge proof using a verification key; the relay node determines an identity authentication result for the user based on the verification result of the zero-knowledge proof.

[0006] In some embodiments, the zero-knowledge proof is generated by a zero-knowledge proof generation algorithm, wherein the input of the zero-knowledge proof generation algorithm includes the user's proof key, public statement, and the user's identity information.

[0007] In some embodiments, the relay node verifies the zero-knowledge proof using the verification key, including: the relay node processes the verification key, the public statement, and the zero-knowledge proof using the zero-knowledge proof verification algorithm to obtain a verification result of the zero-knowledge proof.

[0008] In some embodiments, the output of the zero-knowledge proof verification algorithm is a Boolean type, used to indicate whether the zero-knowledge proof is valid.

[0009] In some embodiments, the verification result of the zero-knowledge proof indicates whether the zero-knowledge proof is valid, and the relay node determines the identity authentication result of the user based on the verification result of the zero-knowledge proof, including: when the zero-knowledge proof is valid, the relay node determines that the identity authentication result of the user is passed; when the zero-knowledge proof is invalid, the relay node determines that the identity authentication result of the user is failed.

[0010] In some embodiments, the access request includes at least one of an identity certificate and a certification key of the user.

[0011] In some embodiments, the relay node obtains the user's zero-knowledge proof from the blockchain, including: the relay node calls a smart contract to obtain the user's zero-knowledge proof from the blockchain, wherein the smart contract is used to obtain the zero-knowledge proof using at least one of the user's identity certificate and proof key.

[0012] In some embodiments, the relay node is configured with a first node of the blockchain, and the first node is a full node or a light node.

[0013] In some embodiments, the relay node obtains the user's zero-knowledge proof from the blockchain, including: the relay node searches for the user's zero-knowledge proof from the first node; if the zero-knowledge proof is not found from the first node, the relay node searches for the user's zero-knowledge proof from the second node of the blockchain configured by the base station to which the relay node accesses.

[0014] In some embodiments, the identity authentication method also includes: the relay node sends a first identity certificate of the relay node to the terminal, so that the terminal authenticates the relay node based on the first identity certificate and the second identity certificate of the relay node obtained from the blockchain.

[0015] In some embodiments, the identity authentication method further includes: after completing registration, the relay node receives an identity certificate of the relay node sent by the network side device.

[0016] In some embodiments, the type of relay node is a Near Field Radio Access Network (P-RAN) relay node.

[0017] According to a second aspect of some embodiments of the present invention, a method for identity authentication is provided, comprising: a user's terminal sends an access request to a relay node, so that the relay node uses a verification key to verify the user's zero-knowledge proof obtained from the blockchain, and determines the user's identity authentication result based on the verification result of the zero-knowledge proof, wherein the zero-knowledge proof is determined based on the user's identity information.

[0018] In some embodiments, the identity authentication method also includes: the terminal receives a first identity certificate of the relay node sent by the relay node; the terminal obtains a second identity certificate of the relay node from the blockchain; and the terminal authenticates the relay node based on the first identity certificate and the second identity certificate.

[0019] In some embodiments, the identity authentication method further includes: the terminal selecting a relay node from a plurality of relay nodes according to a direct excitation algorithm and an indirect excitation algorithm.

[0020] In some embodiments, the identity authentication method further includes: the terminal sends a user registration request to the network side device; and the terminal receives the user's identity certificate sent by the network side device.

[0021] According to a third aspect of some embodiments of the present invention, there is provided a registration method, comprising: a network side device receives a user registration request sent by a user's terminal, wherein the user registration request includes the user's identity information; the network side device generates a zero-knowledge proof of the user using the identity information, wherein the zero-knowledge proof is used for identity verification of the user; and the network side device stores the zero-knowledge proof in a blockchain.

[0022] In some embodiments, the network side device uses identity information to generate a zero-knowledge proof of the user, including: the network side device uses arithmetic circuits and default input parameters to perform calculations to generate a proof key and a verification key; the network side device uses a zero-knowledge proof generation algorithm to process the user's proof key, public statement, and the user's identity information to generate the user's zero-knowledge proof.

[0023] In some embodiments, the registration method further includes: the network side device sends at least one of the user's identity certificate and certification key to the terminal.

[0024] In some embodiments, the registration method also includes: the network side device sends at least one of a verification key and an identity certificate of the relay node to the relay node in response to obtaining the registration information of the relay node broadcast in the blockchain network.

[0025] In some embodiments, the network side device is configured with a consensus node of the blockchain.

[0026] According to a fourth aspect of some embodiments of the present invention, there is provided a relay node, comprising: a receiving module, configured to receive an access request sent by a user's terminal; an acquisition module, configured to obtain a zero-knowledge proof of the user from a blockchain, wherein the zero-knowledge proof is determined based on the user's identity information; a zero-knowledge proof verification module, configured to verify the zero-knowledge proof using a verification key; and a user identity verification module, configured to determine an identity verification result for the user based on the verification result of the zero-knowledge proof.

[0027] According to a fifth aspect of some embodiments of the present invention, a terminal is provided, comprising: a sending module, configured to send an access request to a relay node, so that the relay node uses a verification key to verify the user's zero-knowledge proof obtained from the blockchain, and determines the identity authentication result of the user based on the verification result of the zero-knowledge proof, wherein the zero-knowledge proof is determined based on the user's identity information.

[0028] According to a sixth aspect of some embodiments of the present invention, there is provided a network side device, comprising: a receiving module, configured to receive a user registration request sent by a user's terminal, wherein the user registration request includes the user's identity information; a generating module, configured to generate a zero-knowledge proof of the user using the identity information, wherein the zero-knowledge proof is used for identity authentication of the user; and a storage module, configured to store the zero-knowledge proof in a blockchain.

[0029] According to a seventh aspect of some embodiments of the present invention, there is provided a system for identity authentication, comprising: a relay node according to an embodiment of the present invention; and a terminal according to an embodiment of the present invention.

[0030] In some embodiments, the identity authentication system further includes: a network side device according to an embodiment of the present invention.

[0031] In some embodiments, the identity authentication system further includes a base station, wherein the base station is configured with a blockchain node.

[0032] In some embodiments, the base station is further configured to: receive a relay node registration request from a device, wherein the relay node registration request includes registration information of the device; after verifying and passing the identity information of the device, broadcast the registration information of the device in the blockchain network.

[0033] In some embodiments, the base station is further configured to store the registration information of the device in the blockchain using a smart contract.

[0034] According to an eighth aspect of some embodiments of the present invention, there is provided an electronic device, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to execute any one of the aforementioned authentication methods or registration methods based on instructions stored in the memory.

[0035] According to a ninth aspect of some embodiments of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements any one of the aforementioned identity authentication methods or registration methods.

[0036] Some embodiments of the above invention have the following advantages or beneficial effects. The embodiments of the present invention can improve the automation of identity authentication of the P-RAN network through blockchain technology, and promote the intelligent development of wireless near-field network. Furthermore, the identity of the user when accessing the network is guaranteed to be anonymous to the relay node through the zero-knowledge proof method, thereby protecting the user's privacy information and preventing the user's privacy information from being used by malicious relay nodes, thereby improving the access security of the P-RAN network.

[0037] Further features and advantages of the present invention will become apparent from the following detailed description of exemplary embodiments of the present invention with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0039] Figure 1 The system architecture diagram of some embodiments of the present invention is exemplarily shown.

[0040] Figure 2 Another system architecture diagram of some embodiments of the present invention is exemplarily shown.

[0041] Figure 3 A schematic flow chart of an identity authentication method according to some embodiments of the present invention is shown.

[0042] Figure 4 A schematic flow chart of a relay node authentication method according to some embodiments of the present invention is shown.

[0043] Figure 5 A schematic flow chart of a registration method for a relay device according to some embodiments of the present invention is shown.

[0044] Figure 6 A schematic flow chart of a relay node registration method according to some embodiments of the present invention is shown.

[0045] Figure 7 A schematic structural diagram of a relay node according to some embodiments of the present invention is shown.

[0046] Figure 8 A schematic structural diagram of a terminal according to some embodiments of the present invention is shown.

[0047] Fig. 9 A schematic structural diagram of a network side device according to some embodiments of the present invention is shown.

[0048] Fig.10 A schematic structural diagram of an identity authentication system according to some embodiments of the present invention is shown.

[0049] Fig.11 A schematic structural diagram of an electronic device according to some embodiments of the present invention is shown.

[0050] Fig.12 The schematic diagrams of structures of electronic devices according to other embodiments of the present invention are shown. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present invention and its application or use. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] The relative arrangement of components and steps, the numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present invention unless specifically stated otherwise.

[0053] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0054] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered as part of the specification.

[0055] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0056] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0057] When a large number of devices are connected, the P-RAN network lacks an automated mechanism to improve the authentication efficiency of the access devices, resulting in slow authentication and low efficiency of the P-RAN network access devices. After analysis, blockchain technology can synchronize the rules in all blockchain nodes through a consensus algorithm through smart contracts. Therefore, the inventors thought that blockchain and smart contracts can be used as identity management tools in the scenario of accessing the cellular network through communication relays to achieve efficient identity authentication of P-RAN.

[0058] Since the blockchain network can synchronize ledger data between all nodes, smartphones that join the P-RAN network as relay nodes can obtain all the data in the blockchain. When users use their devices to access the P-RAN network, relay nodes can see the user's identity, transactions and other private information, which poses a risk of privacy leakage.

[0059] At present, traditional identity authentication schemes are difficult to meet the needs of node privacy protection in near-field wireless access networks, and lack effective privacy information protection strategies to protect the identity information of user nodes. Zero-knowledge proof is a cutting-edge cryptographic scheme that can verify the identity information of both parties while hiding private data. By using the zero-knowledge proof method for authentication, the user's plaintext identity privacy information can be hidden while synchronizing identity-related information on the blockchain, thereby achieving efficient and secure identity authentication in near-field networks.

[0060] Based on the above analysis, the present invention proposes an identity authentication method, system and related equipment.

[0061] Reference below Figure 1 A system architecture diagram of the present invention is exemplarily described. The system architecture may be a P-RAN architecture.

[0062] like Figure 1 As shown, the system 1 of this embodiment includes a network side device 11 , a relay node 12 , a terminal 13 and a base station 14 .

[0063] The network side device 11 is, for example, a provincial operator company device.

[0064] The relay node 12 is, for example, a P-RAN relay, which can be implemented by an idle intelligent terminal of the user and is responsible for the transfer of user terminal signals. Of course, the relay node 12 can also be other types of relay devices as needed.

[0065] The user's terminal 13 is a device with communication needs such as a smart phone. In some embodiments, the relay node can also be a user terminal, such as a smart phone. Unless otherwise specified, the "terminal" in the embodiments of the present invention refers to a user terminal device that does not serve as a relay node.

[0066] The base station 14 is a public mobile communication base station, which is an interface device for user terminals to access the Internet.

[0067] The terminal 13 accesses the base station 14 through the relay node 12, or directly connects to the base station 14. The following will focus on the authentication process when the terminal accesses the base station 14 through the relay node 12 and then accesses the network. The network side device 11 is used to issue an identity certificate to the relay node 12 or the terminal 13. The issuance process can also be completed through the base station 14, or the base station 14 and the relay node 12. Figure 1 No further detailed description is given in the text.

[0068] Figure 2 Another system architecture diagram of some embodiments of the present invention is exemplarily shown. Figure 2 middle, Figure 1 The system 1 used is used as the P-RAN resource layer. In addition, there is a blockchain identity management layer 2, which includes multiple blockchain nodes, and these multiple blockchain nodes further include consensus nodes 21 (two nodes located in the center of the blockchain identity management layer 2) and ordinary nodes 22. The blockchain identity management layer can complete the construction of the blockchain network in the blockchain management layer based on mature blockchain technologies such as Ethereum. Consensus node 21 is a node that provides blockchain consensus function and stores all data of the blockchain network. Ordinary node 22 is a node other than consensus node 21, such as a lightweight blockchain node, which may only have a storage function, and the stored data is all or part of the data of the blockchain. Objects in the P-RAN resource layer call nodes in the blockchain identity management layer through smart contracts 20.

[0069] In the specific implementation process, the blockchain node can be configured in the device of the P-RAN resource layer. A consensus node can be configured in the network side device 11. The base station 14 can configure an edge server near it, and configure a full node on the edge server. The full node has the function of a consensus node and stores full data. The relay node 12 and the user's terminal 13 can be configured as a lightweight blockchain node or a blockchain client, or they can also be configured as a full node. In some embodiments, it is determined whether to configure a light node or a full node for the relay node or the terminal depending on the storage space of the relay node or the user's terminal. For example, if the storage space of the device can store all the data on the blockchain ledger, the device is synchronized with all the data in the ledger; if the storage space is not enough to store all the data, only part of the ledger data is stored, and simple blockchain functions such as blockchain network access and transaction initiation are implemented.

[0070] It should be clear to those skilled in the art that Figure 1 and Figure 2This is only an exemplary system architecture diagram. Those skilled in the art may adopt other network architectures as needed, which will not be described in detail here.

[0071] The embodiment of the present invention applies zero-knowledge proof to the identity authentication process of the terminal. Zero-knowledge proof needs to provide three properties of data integrity, robustness and zero-knowledge for the privacy protection of user identity.

[0072] 1. Completeness: Each statement has a valid zero-knowledge proof that convinces the verifier;

[0073] 2. Robustness: The statement of an illegal prover cannot generate evidence that can be verified by the verifier;

[0074] 3. Zero-knowledge: The proof only conveys information about the validity of the claim, without any information about the prover.

[0075] In the application scenario of the present invention, there are three roles: prover, verifier and trusted third party. The prover is played by the user's terminal, which needs to provide the verifier with the evidence required for identity authentication; the verifier is played by the relay node, which verifies the evidence provided by the prover under the condition of zero knowledge and confirms the identity of the prover; the trusted third party is played by the network-side device as a consensus node, which endorses whether the entire verification process is credible, generates and provides the relevant keys and public inputs required for verification.

[0076] Figure 3 FIG. 1 is a flow chart showing a method for identity authentication according to some embodiments of the present invention. Figure 3 As shown, the identity authentication method of this embodiment includes steps S302 to S308.

[0077] In step S302, the relay node receives an access request sent by a user terminal.

[0078] After selecting a relay node, the terminal may send an access request to the selected relay node. In some embodiments, the terminal selects a relay node from a plurality of relay nodes according to a direct excitation algorithm and an indirect excitation algorithm. The terminal obtains the location information and service information of the relay node, for example, through broadcasting.

[0079] The access request is a request for indicating that the terminal accesses the relay node, and may indicate non-privacy information capable of identifying the user.

[0080] In some embodiments, the access request includes at least one of an identity certificate and a certification key of the user. The identity certificate and the certification key may be generated by the network side during the registration phase of the terminal.

[0081] In step S304, the relay node obtains the user's zero-knowledge proof from the blockchain, where the zero-knowledge proof is determined based on the user's identity information.

[0082] Since the blockchain network can synchronize ledger data between nodes, relay nodes can also obtain data in the blockchain.

[0083] In some embodiments, the relay node calls a smart contract to obtain the user's zero-knowledge proof from the blockchain, wherein the smart contract is used to obtain the zero-knowledge proof using at least one of the user's identity certificate and proof key. By performing authentication based on smart contracts, automated identity authentication can be achieved, thereby achieving hierarchical automatic management of user identities, effectively improving the access efficiency of smartphones and the speed of network information updates.

[0084] In some embodiments, the relay node is configured with a first node of the blockchain, and the first node is a full node (storing all the data of the blockchain) or a light node (storing part of the data of the blockchain). The relay node searches for the user's zero-knowledge proof from the first node; if the zero-knowledge proof is not found from the first node, the relay node searches for the user's zero-knowledge proof from the second node of the blockchain configured by the base station to which the relay node is connected. Thus, the relay node can search for data from the blockchain through itself or the base station as needed, sharing the access pressure of the base station. Moreover, regardless of whether the relay node stores the full data of the blockchain, it can also directly or indirectly obtain the zero-knowledge proof.

[0085] The user's identity information includes information that can identify the user but involves the user's privacy. If this information is directly sent to the relay node, there will be a risk of privacy leakage. Therefore, the relay node obtains a zero-knowledge proof from the blockchain that is associated with the user's identity information but does not leak the user's privacy.

[0086] In some embodiments, the user's zero-knowledge proof is generated by a zero-knowledge proof generation algorithm, wherein the input of the zero-knowledge proof generation algorithm includes the user's proof key, public statement, and the user's identity information.

[0087] Public declarations are public information that can be obtained by any device in the system and does not involve the user's privacy. For example, they are parameters randomly generated by the network side.

[0088] The proof key is a pre-generated key that, in addition to being used to generate zero-knowledge proofs, can also be sent to the terminal.

[0089] In step S306, the relay node verifies the zero-knowledge proof using the verification key.

[0090] In some embodiments, the relay node processes the verification key, the public statement, and the zero-knowledge proof using a zero-knowledge proof verification algorithm to obtain a verification result of the zero-knowledge proof.

[0091] In some embodiments, the output of the zero-knowledge proof verification algorithm is a Boolean type, which is used to indicate whether the zero-knowledge proof is valid. For example, if the output is "True", it indicates that the zero-knowledge proof is valid; if the output is "False", it indicates that the zero-knowledge proof is invalid.

[0092] In step S308, the relay node determines the identity authentication result of the user according to the verification result of the zero-knowledge proof.

[0093] In some embodiments, when the zero-knowledge proof is valid, the relay node determines that the identity authentication result of the user is passed; when the zero-knowledge proof is invalid, the relay node determines that the identity authentication result of the user is failed.

[0094] The embodiments of the present invention can improve the automation of identity authentication of the P-RAN network through blockchain technology, and promote the intelligent development of wireless near-field network. Furthermore, the identity of the user when accessing the network is guaranteed to be anonymous to the relay node through the zero-knowledge proof method, thereby protecting the user's privacy information and preventing the user's privacy information from being used by malicious relay nodes, thereby improving the access security of the P-RAN network.

[0095] Moreover, the embodiments of the present invention promote the development of 5G+, industrial Internet of Things, etc. while optimizing the network resource sharing mechanism. The solution provided by the embodiments of the present invention is a universal solution for identity authentication, which has good practicality and feasibility, and can also have good technical effects in the scenario of large-scale P-RAN access.

[0096] In some embodiments, the relay node and the terminal can implement bidirectional authentication, that is, the terminal can also authenticate the relay node. Figure 4 An embodiment of a relay node authentication method is described.

[0097] Figure 4 FIG. 2 is a flow chart showing a relay node authentication method according to some embodiments of the present invention. Figure 4 As shown, the relay node authentication method of this embodiment includes steps S402 to S406.

[0098] In step S402, the relay node sends a first identity certificate of the relay node to the terminal.

[0099] In step S404, the terminal obtains the second identity certificate of the relay node from the blockchain.

[0100] In step S406, the terminal authenticates the relay node according to the first identity certificate and the second identity certificate.

[0101] For example, the terminal authenticates the relay node by comparing the first identity certificate and the second identity certificate to see whether they are consistent.

[0102] Steps S402 to S406 may be performed after steps S302 to S308, or may be performed in other orders, which will not be described in detail here.

[0103] When both the terminal and the relay node have passed the identity authentication of each other, the two can continue to execute the subsequent network interaction process.

[0104] In order to ensure the security of the interaction between P-RAN users and relays outside the blockchain, the above embodiment designs a P-RAN network two-way authentication model for privacy protection, completes the mutual authentication between P-RAN users and P-RAN relays, and ensures the computability of specific transaction information while hiding user privacy information.

[0105] The embodiment of the present invention also provides a method for registering a relay node and a user terminal. The registration process can be completed by a network side device or a base station.

[0106] Figure 5 FIG. 2 is a flow chart showing a method for registering a relay device according to some embodiments of the present invention. Figure 5 As shown, the relay device registration method of this embodiment includes steps S502 to S506.

[0107] In step S502, the network side device receives a user registration request sent by a user terminal, wherein the user registration request includes the user's identity information.

[0108] The registration information in the user registration request includes, for example, an ID number, a phone number, and a time stamp. The phone number is the user's identity information, that is, privacy information.

[0109] The user may first check whether he / she has been registered in the system through the base station. If no registration information is found, step S502 is executed.

[0110] After verifying the user registration request, the network side device can associate the information in the registration request with the blockchain account or blockchain wallet. For example, the identity information is used as the content of the blockchain account. The content of the blockchain account will not be made public, so the information will not be leaked in the subsequent interaction process.

[0111] In step S504, the network-side device generates a zero-knowledge proof of the user using the identity information, wherein the zero-knowledge proof is used to authenticate the identity of the user.

[0112] The following is an exemplary description of the process of generating a zero-knowledge proof by a network-side device.

[0113] First, given the security parameter λ, a set of public parameters pubpara = (P; e; G1; P1; G2; P2; G t ; F p ), where p is a prime number, G1 and G2 are two p-order cyclic groups corresponding to generators P1 and P2 respectively, and e is a bilinear mapping: e: G1×G2→G t Therefore, we can know that (G1; G2; G t ) are three cyclic groups of order P. p Defined as a finite field. All algorithms use pubpara as the default public input parameter. Use C for a given arithmetic circuit.

[0114] Then, the network side device uses the arithmetic circuit and the default input parameters to perform calculations to generate a proof key and a verification key. In the zero-knowledge encryption scheme proposed in the embodiment of the present invention, a network side device (such as the device of the operator's provincial company) is required to execute the algorithm to generate a proof key and a verification key. In order to make the entire process credible, the network side device cannot let the participants know the coordinates of the random points they choose. Through the given arithmetic circuit C and the generated parameters pubpara, a proof key pk and a verification key vk are generated, where pk is used to generate zero-knowledge proof and saved by the user, and vk is used to verify zero-knowledge proof and saved by the verifier, i.e., the relay node.

[0115] The network-side device uses a zero-knowledge proof generation algorithm to process the user's proof key, public statement, and user identity information to generate the user's zero-knowledge proof. For example, the proof generation algorithm of the zero-knowledge proof takes the proof key vk, the public statement ε (as the public input of circuit C), and the identity information m of the prover (the auxiliary input of circuit C) as input. The output of the algorithm is π, which is a zero-knowledge proof that proves the relationship between ε and m constructed by circuit C. ε and π are publicly released and can be used by anyone; while m is the private information provided by the prover, that is, the identity information provided by the user during registration.

[0116] When the relay node performs verification, vk, ε, and π can be input into the verification algorithm of the zero-knowledge proof to determine the result of the user's identity authentication based on the output result of the verification algorithm.

[0117] In step S506, the network-side device stores the zero-knowledge proof in the blockchain.

[0118] For example, the network-side device packages the zero-knowledge proof that does not contain privacy information on the chain and broadcasts the zero-knowledge proof to each node in the blockchain network.

[0119] In some embodiments, the method further includes step S508: the network side device sends at least one of the user's identity certificate and certification key to the terminal.

[0120] Through the above registration process, the relay node can obtain an identity for using the near-area network service.

[0121] Through the above embodiment, the terminal can submit its own identity information through the registration process, so that the network side generates a zero-knowledge proof for authentication that can protect user privacy based on the identity information, and stores the zero-knowledge proof in the blockchain. Thereby, the efficiency and security of the subsequent identity authentication process are improved.

[0122] Figure 6 FIG. 2 is a flow chart showing a method for registering a relay node according to some embodiments of the present invention. Figure 6 As shown, the registration method of this embodiment includes steps S602 to S604.

[0123] In step S602, the base station receives a relay node registration request from a device, wherein the relay node registration request includes registration information of the device.

[0124] The device is a device that intends to become a relay node.

[0125] The registration information of the device (ie, the registration information of the relay node) includes at least one of an ID number, a phone number, an equipment type, a resource, a time stamp, and an initial score.

[0126] After verifying the relay registration request, the base station associates the information in the registration request with the blockchain account or blockchain wallet. For example, the information in the registration request is used as the content of the relay node's account in the blockchain.

[0127] In step S604, after verifying and passing the identity information of the device, the base station broadcasts the registration information of the device in the blockchain network.

[0128] The base station is further configured to store the registration information of the device in the blockchain using a smart contract, for example, it can be broadcast in the blockchain network so that the nodes in the blockchain synchronously store the information.

[0129] In some embodiments, step S606 is also included: the network side device responds to obtaining the registration information of the relay node broadcasted in the blockchain, and sends at least one of a verification key and an identity certificate of the relay node to the relay node. Since the network side device may include multiple devices, the relay node may obtain the verification key or identity certificate from the nearest network side device.

[0130] Through the above registration process, the relay node can obtain an identity for providing near-area network services.

[0131] Thus, the relay node can obtain a verification key for verifying the zero-knowledge proof after completing the registration. Alternatively, the relay node can obtain an identity certificate for the terminal to authenticate the relay node.

[0132] Through the above embodiments, the relay node can store the registration information in the blockchain through the registration process, so that other devices in the network can obtain the information of the relay node, thereby improving the efficiency of the subsequent identity authentication process.

[0133] Figure 7 FIG. 2 shows a schematic diagram of the structure of a relay node according to some embodiments of the present invention. Figure 7 As shown, the relay node 700 of this embodiment includes: a receiving module 7100, configured to receive an access request sent by a user's terminal; an acquisition module 7200, configured to obtain the user's zero-knowledge proof from the blockchain, wherein the zero-knowledge proof is determined based on the user's identity information; a zero-knowledge proof verification module 7300, configured to verify the zero-knowledge proof using a verification key; and a user identity verification module 7400, configured to determine an identity verification result for the user based on the verification result of the zero-knowledge proof.

[0134] In some embodiments, the zero-knowledge proof is generated by a zero-knowledge proof generation algorithm, wherein the input of the zero-knowledge proof generation algorithm includes the user's proof key, public statement, and the user's identity information.

[0135] In some embodiments, the zero-knowledge proof verification module 7300 is further configured to process the verification key, the public statement, and the zero-knowledge proof using a zero-knowledge proof verification algorithm to obtain a verification result of the zero-knowledge proof.

[0136] In some embodiments, the output of the zero-knowledge proof verification algorithm is a Boolean type, used to indicate whether the zero-knowledge proof is valid.

[0137] In some embodiments, the verification result of the zero-knowledge proof indicates whether the zero-knowledge proof is valid, and the user identity authentication module 7400 is further configured to determine that the identity authentication result of the user is passed if the zero-knowledge proof is valid; and to determine that the identity authentication result of the user is failed if the zero-knowledge proof is invalid.

[0138] In some embodiments, the access request includes at least one of an identity certificate and a certification key of the user.

[0139] In some embodiments, the acquisition module 7200 is further configured to call a smart contract to obtain the user's zero-knowledge proof from the blockchain, wherein the smart contract is used to obtain the zero-knowledge proof using at least one of the user's identity certificate and proof key.

[0140] In some embodiments, the relay node is configured with a first node of the blockchain, and the first node is a full node or a light node.

[0141] In some embodiments, the acquisition module 7200 is further configured to search for the user's zero-knowledge proof from the first node; if the zero-knowledge proof is not found from the first node, search for the user's zero-knowledge proof from the second node of the blockchain configured by the base station to which the relay node accesses.

[0142] In some embodiments, the relay node 700 also includes: a sending module 7500, configured to send a first identity certificate of the relay node to the terminal, so that the terminal authenticates the relay node based on the first identity certificate and the second identity certificate of the relay node obtained from the blockchain.

[0143] In some embodiments, the receiving module 7100 is further configured to receive an identity certificate of the relay node sent by the network side device after completing the registration.

[0144] In some embodiments, the type of relay node is a Near Field Radio Access Network (P-RAN) relay node.

[0145] Figure 8 FIG. 2 shows a schematic diagram of the structure of a terminal according to some embodiments of the present invention. Figure 8 As shown, the terminal 800 of this embodiment includes: a sending module 8100, which is configured to send an access request to the relay node, so that the relay node uses the verification key to verify the user's zero-knowledge proof obtained from the blockchain, and determines the user's identity authentication result based on the verification result of the zero-knowledge proof, wherein the zero-knowledge proof is determined based on the user's identity information.

[0146] In some embodiments, the terminal 800 also includes: a receiving module 8200, configured to receive a first identity certificate of the relay node sent by the relay node; obtain a second identity certificate of the relay node from the blockchain; and the terminal authenticates the relay node based on the first identity certificate and the second identity certificate.

[0147] In some embodiments, the terminal 800 further includes: a selection module 8300 configured to select a relay node from a plurality of relay nodes according to a direct excitation algorithm and an indirect excitation algorithm.

[0148] In some embodiments, the sending module 8100 is further configured to send a user registration request to the network side device; and receive the user's identity certificate sent by the network side device.

[0149] Fig. 9 FIG. 2 shows a schematic diagram of the structure of a network side device according to some embodiments of the present invention. Fig. 9 As shown, the network side device 900 of this embodiment includes: a receiving module 9100, configured to receive a user registration request sent by a user's terminal, wherein the user registration request includes the user's identity information; a generating module 9200, configured to generate a zero-knowledge proof of the user using the identity information, wherein the zero-knowledge proof is used for identity authentication of the user; and a storage module 9300, configured to store the zero-knowledge proof in a blockchain.

[0150] In some embodiments, the generation module 9200 is further configured to perform calculations using arithmetic circuits and default input parameters to generate a proof key and a verification key; and to use a zero-knowledge proof generation algorithm to process the user's proof key, public statement, and user's identity information to generate the user's zero-knowledge proof.

[0151] In some embodiments, the network side device 900 further includes: a sending module 9400 configured to send at least one of a user's identity certificate and a certification key to the terminal.

[0152] In some embodiments, the sending module 9400 is further configured to send at least one of a verification key and an identity certificate of the relay node to the relay node in response to obtaining registration information of the relay node broadcast in the blockchain network.

[0153] In some embodiments, the network side device is configured with a consensus node of the blockchain.

[0154] Fig.10 FIG. 1 is a schematic diagram showing the structure of an identity authentication system according to some embodiments of the present invention. Fig.10 As shown, the system 10 of this embodiment includes a relay node 700 and a terminal 800 .

[0155] In some embodiments, the identity authentication system 10 also includes a network-side device 900 .

[0156] In some embodiments, the identity authentication system 10 further includes a base station 100, wherein the base station 100 is configured with a blockchain node.

[0157] In some embodiments, the base station 100 is further configured to: receive a relay node registration request from a device, wherein the relay node registration request includes registration information of the device; after verifying and passing the identity information of the device, broadcast the registration information of the device in the blockchain network.

[0158] In some embodiments, the base station 100 is further configured to store the registration information of the device in the blockchain using a smart contract.

[0159] Fig.11 FIG. 1 is a schematic diagram showing the structure of an electronic device according to some embodiments of the present invention. Fig.11 As shown, the electronic device 110 of this embodiment includes: a memory 1110 and a processor 1120 coupled to the memory 1110, and the processor 1120 is configured to execute the identity authentication method or registration method in any of the aforementioned embodiments based on instructions stored in the memory 1110.

[0160] The memory 1110 may include, for example, a system memory, a fixed non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application program, a boot loader, and other programs.

[0161] Fig.12 FIG. 2 shows a schematic diagram of the structure of an electronic device according to some other embodiments of the present invention. Fig.12 As shown, the electronic device 120 of this embodiment includes: a memory 1210 and a processor 1220, and may also include an input / output interface 1230, a network interface 1240, a storage interface 1250, etc. These interfaces 1230, 1240, 1250 and the memory 1210 and the processor 1220 may be connected, for example, via a bus 1260. Among them, the input / output interface 1230 provides a connection interface for input / output devices such as a display, a mouse, a keyboard, and a touch screen. The network interface 1240 provides a connection interface for various networked devices. The storage interface 1250 provides a connection interface for external storage devices such as SD cards and USB flash drives.

[0162] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements any one of the aforementioned identity authentication methods or registration methods.

[0163] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable non-transient storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0164] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0165] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0166] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0167] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for identity authentication, comprising: The relay node receives an access request sent by a user terminal; The relay node obtains the zero-knowledge proof of the user from the blockchain, wherein the zero-knowledge proof is determined based on the identity information of the user; The relay node verifies the zero-knowledge proof using a verification key; The relay node determines an identity authentication result for the user according to a verification result of the zero-knowledge proof.

2. The method according to claim 1, wherein: The zero-knowledge proof is generated by a zero-knowledge proof generation algorithm, wherein the input of the zero-knowledge proof generation algorithm includes the user's proof key, public statement and the user's identity information.

3. The method according to claim 1, wherein: The relay node verifies the zero-knowledge proof using the verification key, including: The relay node processes the verification key, the public statement and the zero-knowledge proof using a zero-knowledge proof verification algorithm to obtain a verification result of the zero-knowledge proof.

4. The method according to claim 3, wherein: The output of the zero-knowledge proof verification algorithm is a Boolean type, which is used to indicate whether the zero-knowledge proof is valid.

5. The method according to claim 1, wherein: The verification result of the zero-knowledge proof indicates whether the zero-knowledge proof is valid, and the relay node determines the identity authentication result of the user according to the verification result of the zero-knowledge proof, including: When the zero-knowledge proof is valid, the relay node determines that the identity authentication result of the user is passed; In the case where the zero-knowledge proof is invalid, the relay node determines that the identity authentication result of the user is failed.

6. The method according to claim 1, wherein: The access request includes at least one of an identity certificate and a certification key of the user.

7. The method according to claim 6, wherein: The relay node obtains the user's zero-knowledge proof from the blockchain including: The relay node calls a smart contract to obtain the user's zero-knowledge proof from the blockchain, wherein the smart contract is used to obtain the zero-knowledge proof using at least one of the user's identity certificate and a proof key.

8. The method according to claim 1, wherein: The relay node is configured with a first node of the blockchain, and the first node is a full node or a light node.

9. The method according to claim 8, wherein: The relay node obtains the user's zero-knowledge proof from the blockchain including: The relay node searches for the zero-knowledge proof of the user from the first node; If the zero-knowledge proof is not found from the first node, the relay node searches for the zero-knowledge proof of the user from the second node of the blockchain configured by the base station to which the relay node accesses.

10. The method according to claim 1, further comprising: The relay node sends the first identity certificate of the relay node to the terminal, so that the terminal authenticates the relay node according to the first identity certificate and the second identity certificate of the relay node obtained from the blockchain.

11. The method according to claim 1, further comprising: After completing registration, the relay node receives the identity certificate of the relay node sent by the network side device.

12. The method according to any one of claims 1 to 11, wherein: The type of the relay node is a Near Field Radio Access Network (P-RAN) relay node.

13. A method for identity authentication, comprising: The user's terminal sends an access request to the relay node so that the relay node uses the verification key to verify the user's zero-knowledge proof obtained from the blockchain, and determines the identity authentication result of the user based on the verification result of the zero-knowledge proof, wherein the zero-knowledge proof is determined based on the user's identity information.

14. The method according to claim 13, further comprising: The terminal receives a first identity certificate of the relay node sent by the relay node; The terminal obtains a second identity certificate of the relay node from the blockchain; The terminal authenticates the relay node according to the first identity certificate and the second identity certificate.

15. The method according to claim 13, further comprising: The terminal selects the relay node from a plurality of relay nodes according to a direct excitation algorithm and an indirect excitation algorithm.

16. The method according to claim 13, further comprising: The terminal sends a user registration request to the network side device; The terminal receives the identity certificate of the user sent by the network side device.

17. A registration method comprising: The network side device receives a user registration request sent by a user terminal, wherein the user registration request includes the identity information of the user; The network-side device generates a zero-knowledge proof of the user using the identity information, wherein the zero-knowledge proof is used for identity verification of the user; The network side device stores the zero-knowledge proof in the blockchain.

18. The registration method according to claim 17, wherein: The network-side device generates the zero-knowledge proof of the user by using the identity information, including: The network side device uses an arithmetic circuit and default input parameters to perform calculations to generate a certification key and a verification key; The network-side device processes the user's proof key, public statement, and identity information using a zero-knowledge proof generation algorithm to generate a zero-knowledge proof of the user.

19. The registration method according to claim 18, further comprising: The network side device sends at least one of the identity certificate of the user and the certification key to the terminal.

20. The registration method according to claim 17, further comprising: In response to obtaining the registration information of the relay node broadcasted in the blockchain network, the network-side device sends at least one of a verification key and an identity certificate of the relay node to the relay node.

21. The registration method according to claim 17, wherein: The network side device is configured with a consensus node of the blockchain.

22. A relay node, comprising: A receiving module, configured to receive an access request sent by a user's terminal; An acquisition module is configured to acquire a zero-knowledge proof of the user from a blockchain, wherein the zero-knowledge proof is determined based on the identity information of the user; A zero-knowledge proof verification module, configured to verify the zero-knowledge proof using a verification key; The user identity authentication module is configured to determine an identity authentication result of the user according to a verification result of the zero-knowledge proof.

23. A terminal, comprising: The sending module is configured to send an access request to the relay node so that the relay node verifies the zero-knowledge proof of the user obtained from the blockchain using the verification key, and determines the identity authentication result of the user according to the verification result of the zero-knowledge proof, wherein the zero-knowledge proof is determined according to the identity information of the user.

24. A network side device, comprising: A receiving module, configured to receive a user registration request sent by a user's terminal, wherein the user registration request includes the identity information of the user; A generating module is configured to generate a zero-knowledge proof of the user using the identity information, wherein the zero-knowledge proof is used for identity verification of the user; The storage module is configured to store the zero-knowledge proof in the blockchain.

25. A system for identity authentication, comprising: The relay node as claimed in claim 22; and The terminal as claimed in claim 23.

26. The system of claim 25, further comprising: The network side device as described in claim 24.

27. The system of claim 25, further comprising a base station, wherein: The base station is configured with a blockchain node.

28. The system of claim 27, wherein: The base station is further configured to: receiving a relay node registration request from a device, wherein the relay node registration request includes registration information of the device; After the identity information of the device is verified and passed, the registration information of the device is broadcast in the blockchain network.

29. The system of claim 28, wherein: The base station is further configured to store the registration information of the device in the blockchain using a smart contract.

30. An electronic device comprising: Memory; as well as A processor coupled to the memory, the processor being configured to execute the identity authentication method according to any one of claims 1 to 16 or the registration method according to any one of claims 17 to 21 based on instructions stored in the memory.

31. A computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the method for identity authentication according to any one of claims 1 to 16 or the registration method according to any one of claims 17 to 21 is implemented.

Images