Security enhancement system and method for e-government electronic authentication service

Abstract

The invention relates to the field of e-government services, and discloses a security enhancement system and method for e-government electronic authentication services, and the system constructs a distributed network based on a block chain, achieves the decentralized storage and non-tampering of data, and effectively improves the security and reliability of the data. Meanwhile, by introducing the intelligent contract layer, the business process and rule of the electronic authentication service are defined, the processes of automatic processing of the authentication request, issuing and revoking of the certificate and the like are realized, and the working efficiency is improved. Besides, the system also adopts a multi-factor authentication mechanism, and combines with a dynamic verification element to perform user identity authentication, so that the authentication strength and security are remarkably enhanced, and the problems of centralized data storage risk, single-point failure and vulnerability of a static or single-factor authentication mechanism existing in the existing electronic authentication system are solved. According to the invention, a comprehensive security enhancement scheme is provided for electronic authentication service of e-government affairs.

Description

Technical Field

[0001] The present invention relates to the field of e-government services, and in particular to a security enhancement system and method for e-government electronic authentication services. Background Art

[0002] E-government is an important channel for the government to provide public services and conduct social management. In e-government, electronic authentication services are increasingly important as a key link to ensure the security of transactions and information exchanges.

[0003] Existing electronic authentication systems often use centralized data storage methods, which have the risk of single point failure. Once the data center is attacked or fails, a large amount of authentication data may be lost or tampered with, seriously threatening the security of the e-government system. At the same time, centralized data management also increases the risk of illegal access and abuse of data.

[0004] Moreover, existing electronic authentication systems mostly use static or single-factor authentication mechanisms, which are relatively vulnerable to complex and ever-changing network attacks and cannot effectively resist security risks such as identity forgery and data tampering. To this end, we propose a security enhancement system and method for electronic authentication services in e-government. Summary of the invention

[0005] The purpose of the present invention is to provide a security enhancement system and method for electronic government electronic authentication services to solve the problems raised in the above-mentioned background technology.

[0006] To achieve the above-mentioned object, the present invention provides the following technical solutions: a security enhancement system for electronic government electronic authentication services, comprising a blockchain network layer, a smart contract layer, an authentication service layer, and a user interface layer;

[0007] The blockchain network layer includes a distributed network module and a data storage module;

[0008] The distributed network module is responsible for building and maintaining a distributed network based on blockchain. The distributed network module further includes a node management submodule and a network communication submodule; the node management submodule is responsible for node joining, exiting and authority management; the network communication submodule is used to realize data transmission and communication between nodes;

[0009] The data storage module is used to store key data in the electronic authentication process on the blockchain, and the data storage module further includes a block generation submodule and an on-chain storage submodule; the block generation submodule is used to generate a new block and package the authentication data and transaction records into the block; the on-chain storage submodule adds the generated block to the blockchain to achieve tamper-proof and traceable storage of data;

[0010] The smart contract layer includes a contract deployment module and a contract execution module;

[0011] The contract deployment module is responsible for deploying smart contracts on the blockchain network and defining the business processes and rules of electronic certification services; the contract execution module is used to automatically execute the business logic in the smart contract, including the processing of certification requests, certificate issuance conditions and certificate revocation processes;

[0012] The authentication service layer includes an identity authentication module, a certificate management module and an authentication algorithm module;

[0013] The identity authentication module is used to provide identity authentication services, and the identity authentication module further includes an identity authentication submodule and a digital signature submodule; the identity authentication submodule adopts a multi-factor authentication mechanism to verify the identity information submitted by the user; the digital signature submodule is used to generate and verify the digital signature for the electronic certificate file; the certificate management module is responsible for the issuance, update and revocation of certificates; the authentication algorithm module combines the multi-factor authentication mechanism of the identity authentication module and introduces additional dynamic verification elements to perform user identity authentication;

[0014] The user interface layer includes a user interaction module and an interface security module;

[0015] The user interaction module is used to provide a unified authentication service interface, which includes online submission of authentication requests, query of authentication status and downloading of certificates; the interface security module is responsible for the security protection of the user interface layer, including access account verification, access permission control and transmission data encryption.

[0016] Preferably, the network communication submodule uses the IPsec protocol to encrypt and authenticate IP data packets during data transmission.

[0017] Preferably, the identity authentication submodule first collects identity information submitted by the user, including a password, answers to preset security questions, and fingerprint and facial recognition data; then a multi-factor identity authentication mechanism is adopted to require the user to provide at least two different types of identity authentication factors. During the verification process, the system will compare the identity information submitted by the user with pre-stored or preset information to verify whether the identity information has passed the verification.

[0018] Preferably, the implementation steps of the authentication algorithm module include:

[0019] Collect multiple user-submitted authentication factors, including passwords, answers to preset security questions, and fingerprint and facial recognition data;

[0020] Combining the user's authentication factors and the current environment factors, the dynamic verification value is calculated using the following formula:

[0021] DVV=f(IVF1,IVF2,...,IVF n , EF1, EF2, ..., EF m )

[0022] Where DVV represents the dynamic verification value, IVF1, IVF2, ..., IVF n Indicates the user's authentication factors, EF1, EF2, ..., EF m represents the current environmental factors, and f represents a nonlinear function;

[0023] The calculated dynamic verification value is stored in the distributed database of the blockchain network, and the dynamic verification value is updated regularly to adapt to changes in user authentication factors and environmental factors;

[0024] When the user authenticates, the authentication factors and environmental factors are collected in real time, and the current dynamic verification value is calculated using the same algorithm and formula. The calculated dynamic verification value is compared with the dynamic verification value stored on the blockchain to verify the user's identity.

[0025] If the dynamic verification value comparison is successful, the user identity authentication is considered to be passed. If the dynamic verification value comparison fails, the user's identity authentication request is rejected and the corresponding security event is recorded.

[0026] Preferably, a neural network model is used as the nonlinear function f, wherein the neural network model includes multiple hidden layers, each hidden layer includes multiple neurons, the neurons are connected and calculated through weights and activation functions, the input of the neural network model is the user's identity authentication factors and environmental factors, and the output is a dynamic verification value; by training the neural network model, the mapping relationship between the user's identity authentication factors and environmental factors and the dynamic verification value is learned, thereby generating an accurate dynamic verification value.

[0027] Preferably, the input layer of the neural network model receives the user's identity authentication factors and environmental factors as input, and the environmental factors include the current timestamp, geographic coordinates and IP address; the input layer encodes the identity authentication factors and environmental factors into numerical vectors.

[0028] Preferably, the hidden layer of the neural network model includes two layers of hidden nodes, the first layer of hidden nodes adopts the ReLU activation function to perform nonlinear transformation and feature extraction on the input data, and the second layer of hidden nodes adopts the Sigmoid activation function to further process the output of the first layer of hidden nodes and generate a more complex feature representation; the two layers of hidden nodes are connected in a fully connected manner and interact through weight parameters.

[0029] Preferably, the output layer of the neural network model receives the output of the last hidden layer and generates a dynamic verification value. The output layer is designed as a single node and uses a linear activation function to generate the dynamic verification value.

[0030] Preferably, after the user authentication is successful, a corresponding electronic certificate file is generated, and a secure download link or QR code is provided in the user interaction module to enable the user to obtain the electronic certificate.

[0031] Preferably, a method for enhancing security of an e-government electronic authentication service comprises the following steps:

[0032] S1: Build and maintain a distributed network based on blockchain, which includes a distributed network module and a data storage module; wherein the distributed network module further includes a node management submodule and a network communication submodule, the node management submodule is responsible for the joining, exiting and permission management of nodes, and the network communication submodule uses the IPsec protocol to encrypt and authenticate IP data packets to achieve secure data transmission and communication between nodes; the data storage module further includes a block generation submodule and an on-chain storage submodule, the block generation submodule is used to generate new blocks and pack authentication data and transaction records into blocks, and the on-chain storage submodule adds the generated blocks to the blockchain to achieve tamper-proof and traceable storage of data;

[0033] S2: Deploy smart contracts on the blockchain network, define the business processes and rules for electronic certification services, and automatically execute the business logic in the smart contracts, including the processing of certification requests, certificate issuance conditions, and certificate revocation processes;

[0034] S3: Provide identity authentication services, which further include identity verification and digital signatures; identity verification adopts a multi-factor authentication mechanism, collects identity information submitted by users, including passwords, answers to preset security questions, and fingerprint and facial recognition data, requires users to provide at least two different types of identity verification factors, and compares the identity information submitted by users with pre-stored or preset information to verify whether the identity information has been verified; digital signatures are used to generate and verify digital signatures for electronic certificate files;

[0035] S4: Provides certificate management functions and is responsible for issuing, updating, and revoking certificates;

[0036] S5: Combined with the identity authentication mechanism, additional dynamic verification elements are introduced to perform user identity authentication; the specific implementation steps include: collecting multiple identity authentication factors and environmental factors submitted by users; using the neural network model as a nonlinear function to calculate the dynamic verification value by combining the identity authentication factors and environmental factors; storing the calculated dynamic verification value in the distributed database of the blockchain network and updating it regularly; when the user authenticates his identity, the identity authentication factors and environmental factors are collected in real time, the current dynamic verification value is calculated, and compared with the dynamic verification value stored on the blockchain to verify the user's identity;

[0037] S6: Provide a unified authentication service interface, including online submission of authentication requests, query of authentication status, and downloading of certificates; and implement security protection at the user interface layer, including access account verification, access permission control, and transmission data encryption;

[0038] S7: After the user authentication is successful, a corresponding electronic certificate file is generated, and a secure download link or QR code is provided to enable the user to obtain the electronic certificate.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] By adopting a distributed network based on blockchain, decentralized data storage is achieved, effectively avoiding the risk of single point failure. Even if some nodes are attacked or fail, the integrity and security of the overall data can be ensured. The tamper-proof nature of blockchain makes it impossible for authentication data and transaction records stored on the chain to be maliciously modified or deleted, greatly enhancing the credibility of the data.

[0041] The introduction of a multi-factor authentication mechanism, combined with a dynamic verification element based on a neural network, ensures that each identity authentication contains changing factors, further enhancing the dynamism and security of authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is the overall structure diagram of the present invention;

[0043] Figure 2 To enhance the workflow diagram of the authentication algorithm module;

[0044] Figure 3 A step-by-step diagram of the security enhancement method for e-government electronic authentication services. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] See also Figure 1-3 , the present invention provides a technical solution: a security enhancement system for electronic government electronic authentication services, including a blockchain network layer, a smart contract layer, an authentication service layer and a user interface layer.

[0047] The blockchain network layer includes:

[0048] Distributed network module: responsible for building and maintaining a distributed network based on blockchain. This module includes node management submodule and network communication submodule. The node management submodule manages the joining, exiting and authority allocation of nodes to ensure the security and stability of the network. The network communication submodule is responsible for data transmission and communication between nodes to ensure the efficient flow of information in the network.

[0049] Data storage module: used to securely store key data in the electronic authentication process on the blockchain. It includes a block generation submodule and an on-chain storage submodule. The block generation submodule is responsible for generating new blocks and packaging authentication data and transaction records into them. The on-chain storage submodule adds these blocks to the blockchain, using the blockchain's tamper-proof characteristics to ensure data integrity and traceability.

[0050] The smart contract layer includes:

[0051] Contract deployment module: deploy smart contracts on the blockchain network to define the business processes and rules of electronic certification services. These smart contracts can be executed automatically, reduce human intervention, and improve the efficiency and security of the system.

[0052] Contract execution module: responsible for executing the business logic in the smart contract, including processing certification requests, issuing certificates according to preset conditions, and executing the certificate revocation process. The fairness and consistency of the certification service are ensured through the automated execution of smart contracts.

[0053] The authentication service layer includes:

[0054] Identity authentication module: provides identity authentication services, including identity authentication submodule and digital signature submodule. The identity authentication submodule adopts a multi-factor authentication mechanism to strictly verify the identity information submitted by the user. The digital signature submodule is used to generate and verify the digital signature of the electronic certificate file to ensure the authenticity and integrity of the certificate.

[0055] Certificate management module: responsible for the issuance, renewal and revocation of certificates. Centralized management of certificates ensures the validity and timeliness of certificates.

[0056] Authentication algorithm module: Combines the multi-factor authentication mechanism of the identity authentication module and introduces additional dynamic verification elements for user identity authentication. This innovation significantly enhances the security and accuracy of the authentication process.

[0057] The user interface layer includes:

[0058] User interaction module: provides a unified authentication service interface, including online submission of authentication requests, query of authentication status, download of certificates, etc. It improves user experience through a friendly user interface.

[0059] Interface security module: responsible for the security protection of the user interface layer, including access account verification, access permission control and transmission data encryption, etc. It ensures that the user's sensitive information is fully protected when using the authentication service.

[0060] The present invention will be further described below in conjunction with Examples 1 to 3:

[0061] Embodiment 1:

[0062] The blockchain network layer includes a distributed network module and a data storage module, which together build and maintain a blockchain-based distributed network to provide a secure, efficient and reliable infrastructure for electronic certification services.

[0063] The distributed network module is the core of the blockchain network layer, which is responsible for building and maintaining the entire distributed network. To achieve this goal, the distributed network module is further subdivided into the node management submodule and the network communication submodule. The node management submodule is responsible for node joining, exiting and permission management. When a node joins the network, the node management submodule authenticates and authorizes the new node to ensure that only legitimate nodes can join the network. At the same time, the node management submodule is also responsible for monitoring the behavior of the node, and will promptly remove malicious nodes or nodes with abnormal behavior from the network. In addition, the node management submodule is also responsible for node permission management, assigning corresponding permissions to the node according to its role and responsibilities to ensure the security and stability of the network. The network communication submodule is responsible for data transmission and communication between nodes. In order to ensure the security of data transmission, the network communication submodule uses the IPsec protocol to encrypt and authenticate IP packets during data transmission. Specifically, when two nodes need to transmit data, they will first establish an IPsec tunnel and encrypt and authenticate the transmitted data. Encryption ensures that data will not be stolen or tampered with during transmission, while authentication ensures the source and integrity of the data. By adopting the IPsec protocol, the network communication submodule can effectively protect the security of data transmission between nodes.

[0064] Assume that there are two nodes A and B that need to transmit electronic certificates. Before the transmission, they will first pass the node management submodule to authenticate and authorize to ensure that both parties are legitimate nodes. Then, they will establish an IPsec tunnel and encrypt and authenticate the transmitted electronic certificates. During the transmission process, even if someone tries to steal or tamper with the data, it will not succeed because the data has been encrypted and authenticated. In the end, nodes A and B are able to safely complete the transmission of the electronic certificate.

[0065] The smart contract layer realizes the automated execution of business processes and rules of electronic certification services through the collaborative work of the contract deployment module and the contract execution module.

[0066] The contract deployment module is responsible for deploying smart contracts on the blockchain network. These smart contracts define the specific business processes and rules of electronic certification services, such as the processing flow of certification requests, the conditions for issuing certificates, and the process of revoking certificates. By deploying these business processes and rules on the blockchain in the form of smart contracts, their immutability and traceability can be ensured, thereby enhancing the security and credibility of electronic certification services.

[0067] The contract execution module is responsible for automatically executing the business logic in the smart contract. When a certification request is received, the contract execution module will automatically trigger the certification process defined in the smart contract to verify and process the request. If the request meets the conditions for certificate issuance, the contract execution module will automatically issue an electronic certificate to the requester. Similarly, if a certificate needs to be revoked, the contract execution module will also operate according to the revocation process defined in the smart contract.

[0068] For example, suppose there is an e-government platform that needs to provide electronic authentication services to users. The platform can deploy a smart contract on the blockchain through the contract deployment module to define business processes and rules such as users submitting authentication requests, the platform verifying user identities, issuing electronic certificates, and revoking certificates. When a user needs to apply for an electronic certificate, he can submit a authentication request through the platform. At this time, the contract execution module will automatically trigger the authentication process in the smart contract to verify the identity information submitted by the user. If the verification is successful, the contract execution module will automatically issue an electronic certificate to the user. If the user later needs to revoke the certificate for some reason, the platform can also do so by triggering the revocation process in the smart contract.

[0069] Through the collaborative work of the contract deployment module and the contract execution module of the smart contract layer, the security enhancement system of the electronic government electronic authentication service of the present invention realizes the automatic execution of the business processes and rules of the electronic authentication service. This not only improves the efficiency and accuracy of the electronic authentication service, but also enhances its security and credibility. Because all business processes and rules are deployed on the blockchain in the form of smart contracts, they are tamper-proof and traceable, which can effectively prevent malicious attacks and tampering.

[0070] Embodiment 2:

[0071] The identity authentication module collects identity information submitted by users, including but not limited to passwords set by users, preset security questions and their answers, and biometric data such as fingerprints and facial recognition data. This information is the basis for user identity authentication.

[0072] The identity authentication module uses a multi-factor authentication mechanism to enhance security, requiring users to provide at least two different types of authentication factors during the identity authentication process. For example, users may need to provide a password and fingerprint data, or a password and facial recognition data, etc. In this way, even if one of the authentication factors is leaked or cracked, the user's identity will not be easily misused, thereby improving the security of identity authentication.

[0073] During the verification process, the identity authentication module will compare the identity information submitted by the user with the pre-stored or preset information. This pre-stored or preset information is entered when the user registers or sets up identity authentication, and is used to match and verify the information submitted by the user. During the comparison process, the system will check whether the information submitted by the user is consistent with the pre-stored information to verify whether the identity information has passed the verification. If the identity information passes the verification, the identity authentication module will allow the user to perform subsequent electronic authentication operations, such as applying for an electronic certificate or performing other transactions that require identity authentication. If the identity information fails to pass the verification, the system will reject the user's request and may require the user to re-authenticate or take other security measures.

[0074] The following describes in detail the implementation steps of the enhanced authentication algorithm module in the present invention in combination with specific examples:

[0075] Step 1. Collect authentication factors:

[0076] In the e-government electronic authentication service, users need to submit multiple authentication factors to complete identity authentication. In specific implementation, passwords submitted by users, biometrics (such as fingerprint scan data or facial recognition images), answers to preset security questions, and user behavior pattern data (such as login time, location, and frequency) can be collected.

[0077] Step 2: Pre-process authentication factors:

[0078] The collected authentication factors may have inconsistent formats, missing data, or errors. Therefore, these data need to be preprocessed. In specific implementation, the data can be cleaned to remove invalid or erroneous data; the data can be formatted to ensure the consistency of the data format; and the data can be normalized so that data of different magnitudes can be used in the same algorithm.

[0079] Step 3: Generate dynamic verification elements:

[0080] Generate dynamic verification elements using algorithms. In specific implementation, the dynamic verification value can be calculated by combining the user's identity verification factors and current environmental factors (such as current time and user's geographic location) using the following formula:

[0081] Dvv=f(IvF1,IvF2,...,IvF n , EF1, EF2, ..., EF m )

[0082] Where DVV represents the dynamic verification value, IVF1, IVF2, ..., IVF n Represents the user's authentication factors (such as password, biometrics, etc.), eF1, eF2, ..., EF mrepresents the current environmental factors (such as time, geographic location, etc.), and f represents a complex nonlinear function. The function can be a model based on machine learning or deep learning, which learns the mapping relationship between identity authentication factors and environmental factors and dynamic verification values ​​through training data.

[0083] Step 4: Store and update dynamic validation elements:

[0084] The calculated dynamic verification value is stored in the distributed database of the blockchain network. In specific implementation, the dynamic verification value can be associated with the user's identity and stored in a block of the blockchain. In this way, the dynamic verification value is tamper-proof and traceable. In order to adapt to changes in user authentication factors and environmental factors, the dynamic verification value needs to be updated regularly. In specific implementation, an update cycle (such as daily, weekly or monthly) can be set, and when the update cycle arrives, the user's authentication factors and environmental factors are re-collected and the dynamic verification value is recalculated.

[0085] Step 5: Identity verification:

[0086] When the user authenticates, the authentication factors and environmental factors are collected in real time. In specific implementation, the user can be asked to enter a password, perform a fingerprint scan, and obtain the current time and the user's geographic location.

[0087] The same algorithm and formula are used to calculate the current dynamic verification value. In specific implementation, the collected identity authentication factors and environmental factors are input into the algorithm to obtain a new dynamic verification value.

[0088] The calculated dynamic verification value is compared with the dynamic verification value stored on the blockchain. In specific implementation, the dynamic verification value associated with the user identity can be retrieved from the blockchain and compared with the newly calculated dynamic verification value. If the two dynamic verification values ​​are the same or very similar (taking into account a certain error range), the user's identity verification is considered to have passed.

[0089] Step 6: Identity verification result processing:

[0090] If the dynamic verification value is successfully matched, the user identity verification is considered to be passed. In specific implementation, the user can be allowed to access relevant functions or services of the e-government system.

[0091] If the dynamic verification value comparison fails, the user's identity authentication request is rejected. In specific implementation, an error message can be displayed to the user and the corresponding security event can be recorded. The recorded security events can be used for subsequent security analysis and auditing.

[0092] A neural network model is used as the nonlinear function f, where the neural network model contains multiple hidden layers, each hidden layer contains multiple neurons, and the neurons are connected and calculated through weights and activation functions. The input of the neural network model is the user's identity authentication factors and environmental factors, and the output is a dynamic verification value; by training the neural network model, the mapping relationship between the user's identity authentication factors and environmental factors and the dynamic verification value is learned, thereby generating an accurate dynamic verification value. The environmental factors specifically include the current timestamp, geographic coordinates, and IP address. These factors are encoded as numerical vectors as the input of the neural network.

[0093] The neural network model contains two layers of hidden nodes. The first layer of hidden nodes uses the ReLU (Rectified Linear Unit) activation function, which performs nonlinear transformation and feature extraction on the input data. The ReLU function is in the form of: f(x) = max(0, x), which can set negative values ​​to 0 while keeping positive values ​​unchanged. This feature enables the model to learn the sparse features of the data.

[0094] The second layer of hidden nodes uses the Sigmoid activation function, which is in the form of: f(x) = 1 / (1+exp(-x)), which compresses the input value to between 0 and 1, and is used to further process the output of the first layer of hidden nodes and generate more complex feature representations. The two layers of hidden nodes are connected in a fully connected manner, that is, each node is connected to all nodes in the previous layer and interacts through weight parameters.

[0095] The output layer receives the output of the last hidden layer and is designed as a single node, using a linear activation function to generate a dynamic verification value. The linear activation function simply returns its input value without any nonlinear transformation. In this way, the output of the output layer is the dynamic verification value, which represents the comprehensive mapping result of user authentication factors and environmental factors.

[0096] In order to learn the mapping relationship between user authentication factors and environmental factors and dynamic verification values, the neural network model needs to be trained. The training process includes preparing a training data set, which contains a large number of user authentication factors, environmental factors and corresponding dynamic verification values. Then, the neural network is trained using the back propagation algorithm and the gradient descent optimizer. By continuously iteratively updating the weight parameters, the output of the model gradually approaches the real dynamic verification value.

[0097] Suppose there is an e-government electronic authentication service system that needs to generate a dynamic verification value for the user. First, collect the user's authentication factors (such as passwords, fingerprint scans) and environmental factors (such as current timestamps, geographic coordinates, IP addresses). Then, encode these factors into numerical vectors and input them into the neural network model. The neural network model performs forward propagation calculations according to the above structure and finally outputs a dynamic verification value. This dynamic verification value will be stored in the distributed database of the blockchain network for subsequent user authentication processes. When the user authenticates, their authentication factors and environmental factors are collected in real time and input into the neural network model to calculate the current dynamic verification value. Then, compare this value with the dynamic verification value stored on the blockchain to verify the user's identity. If the comparison is successful, the user is allowed to access the relevant functions or services of the e-government system; if the comparison fails, the user's authentication request is rejected and the corresponding security event is recorded.

[0098] Embodiment 3:

[0099] The user interface layer is the front-end interface for users to interact with e-government electronic authentication services, and mainly includes user interaction modules and interface security modules.

[0100] The user interaction module provides a unified authentication service interface, allowing users to easily interact with the e-government electronic authentication service. The authentication service interface specifically includes the following functions:

[0101] Submit authentication request online: Users can submit identity authentication requests online through the user interaction module, including entering authentication factors (such as passwords, biometric information) and uploading necessary supporting documents.

[0102] Query authentication status: Users can query the processing status of their identity authentication requests in real time to understand the authentication progress and results.

[0103] Download certificate: Once the user is authenticated successfully, the user interaction module will provide a secure download link or QR code for the user to obtain their electronic certificate file.

[0104] The interface security module is responsible for the security protection of the user interface layer, ensuring that the interaction between users and e-government electronic authentication services is safe and reliable. Specifically, it includes the following security measures:

[0105] Access account verification: When users access the user interaction module, they need to perform account verification to ensure that only legitimate users can use the authentication service interface.

[0106] Access permission control: Based on the user's identity and role, the interface security module performs fine-grained control over the user's access permissions to ensure that the user can only access the resources and services for which he is authorized.

[0107] Transmission data encryption: The transmission data between users and e-government electronic authentication services (such as authentication factors, authentication requests, and certificate files) are encrypted to prevent the data from being stolen or tampered with during transmission.

[0108] Suppose there is an e-government platform that needs to provide electronic authentication services to users. The user first submits an authentication request online through the user interaction module, enters his or her authentication factors (such as password and fingerprint information), and uploads an identity document. The interface security module verifies the user's account and controls access rights to ensure that only legitimate users can submit authentication requests.

[0109] Once the user submits the authentication request, the e-government electronic authentication service will start processing the request and perform identity authentication and certificate generation. After the user authentication is successful, the user interaction module will generate the corresponding electronic certificate file and provide a secure download link or QR code to the user. The user can obtain his electronic certificate file by clicking the download link or scanning the QR code.

[0110] Throughout the entire process, the interface security module ensures that the interaction between users and the e-government electronic authentication service is safe and reliable, including access account verification, access rights control, and transmission data encryption. In this way, users can easily obtain their electronic certificate files and enjoy the various services provided by the e-government platform.

[0111] The specific implementation steps of a security enhancement method for an e-government electronic authentication service include:

[0112] S1: Build and maintain a distributed network based on blockchain. The network mainly includes a distributed network module and a data storage module. The distributed network module is further divided into a node management submodule and a network communication submodule. The core responsibility of the node management submodule is to manage the joining, exiting and authority allocation of nodes. The network communication submodule uses the IPsec protocol to encrypt and authenticate IP data packets to ensure the security of data transmission and communication between nodes. The data storage module includes a block generation submodule and an on-chain storage submodule. The block generation submodule is used to create new blocks and integrate authentication data and transaction records into the blocks. The on-chain storage submodule is responsible for adding these blocks to the blockchain to achieve tamper-proof and traceable storage of data.

[0113] S2: Deploy smart contracts on the blockchain network. Smart contracts define the business processes and rules of electronic certification services and can automatically execute the business logic. This includes the processing of certification requests, the conditions for issuing certificates, and the certificate revocation process, all of which are automatically managed and executed through smart contracts.

[0114] S3: Provides identity authentication services. This service covers identity authentication and digital signature. Identity authentication uses a multi-factor authentication mechanism, requiring users to submit at least two different types of identity authentication factors, such as passwords, answers to preset security questions, fingerprints, and facial recognition data. The system compares the identity information submitted by the user with pre-stored or preset information to verify the authenticity of the identity information. Digital signatures are used to generate and verify digital signatures for electronic certificate files to ensure the integrity and authenticity of certificate files.

[0115] S4: Provides certificate management function. This function is responsible for issuing, updating and revoking certificates. The system will decide whether to issue a certificate based on the user's identity authentication results and the rules defined in the smart contract, and perform necessary updates during the certificate's validity period. If the certificate needs to be revoked, the system will also handle it according to the prescribed process.

[0116] S5: Combined with the identity authentication mechanism, additional dynamic verification elements are introduced to perform user identity authentication. The specific implementation steps include: first, collect multiple identity authentication factors and environmental factors submitted by the user; then use the neural network model as a nonlinear function to calculate the dynamic verification value in combination with these identity authentication factors and environmental factors; then store the calculated dynamic verification value in the distributed database of the blockchain network and update it regularly; finally, when the user authenticates his identity, collect his identity authentication factors and environmental factors in real time, calculate the current dynamic verification value, and compare it with the dynamic verification value stored on the blockchain to verify the user's identity.

[0117] S6: Provide a unified authentication service interface. This interface includes functions such as online submission of authentication requests, query of authentication status, and download of certificates. At the same time, implement security protection at the user interface layer, including access account verification, access permission control, and transmission data encryption, to ensure that the interaction process between users and e-government electronic authentication services is safe and reliable.

[0118] S7: After the user authentication is successful, the system will generate the corresponding electronic certificate file and provide a secure download link or QR code. The user can obtain his electronic certificate file by clicking the download link or scanning the QR code to perform identity authentication and authorization operations on the e-government platform.

[0119] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0120] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A security enhancement system for electronic government electronic authentication services, characterized by: Includes blockchain network layer, smart contract layer, authentication service layer and user interface layer; The blockchain network layer includes a distributed network module and a data storage module; The distributed network module is responsible for building and maintaining a distributed network based on blockchain. The distributed network module further includes a node management submodule and a network communication submodule; the node management submodule is responsible for node joining, exiting and authority management; the network communication submodule is used to realize data transmission and communication between nodes; The data storage module is used to store key data in the electronic authentication process on the blockchain, and the data storage module further includes a block generation submodule and an on-chain storage submodule; the block generation submodule is used to generate a new block and package the authentication data and transaction records into the block; the on-chain storage submodule adds the generated block to the blockchain to achieve tamper-proof and traceable storage of data; The smart contract layer includes a contract deployment module and a contract execution module; The contract deployment module is responsible for deploying smart contracts on the blockchain network and defining the business processes and rules of electronic certification services; the contract execution module is used to automatically execute the business logic in the smart contract, including the processing of certification requests, certificate issuance conditions and certificate revocation processes; The authentication service layer includes an identity authentication module, a certificate management module and an authentication algorithm module; The identity authentication module is used to provide identity authentication services, and the identity authentication module further includes an identity authentication submodule and a digital signature submodule; the identity authentication submodule adopts a multi-factor authentication mechanism to verify the identity information submitted by the user; the digital signature submodule is used to generate and verify the digital signature for the electronic certificate file; the certificate management module is responsible for the issuance, update and revocation of certificates; the authentication algorithm module combines the multi-factor authentication mechanism of the identity authentication module and introduces additional dynamic verification elements to perform user identity authentication; The user interface layer includes a user interaction module and an interface security module; The user interaction module is used to provide a unified authentication service interface, which includes online submission of authentication requests, query of authentication status and download of certificates; The interface security module is responsible for the security protection of the user interface layer, including access account verification, access permission control and transmission data encryption.

2. The security enhancement system for electronic government electronic authentication services according to claim 1 is characterized by: The network communication submodule uses the IPsec protocol to encrypt and authenticate IP data packets during data transmission.

3. The security enhancement system for electronic government electronic authentication services according to claim 2 is characterized in that: The identity authentication submodule first collects the identity information submitted by the user, including passwords, answers to preset security questions, and fingerprint and facial recognition data; then a multi-factor identity authentication mechanism is adopted, requiring the user to provide at least two different types of identity authentication factors. During the verification process, the system will compare the identity information submitted by the user with the pre-stored or preset information to verify whether the identity information has passed the verification.

4. The security enhancement system for electronic government electronic authentication services according to claim 3 is characterized in that: The implementation steps of the authentication algorithm module include: Collect multiple user-submitted authentication factors, including passwords, answers to preset security questions, and fingerprint and facial recognition data; Combining the user's authentication factors and the current environment factors, the dynamic verification value is calculated using the following formula: DVV=f(IVF1,IVF2,...,IVF n ,EF1,EF2,...,EF m ) Where DVV represents the dynamic verification value, IVE1, IVF2, ..., IVF n Indicates the user's authentication factors, EF1, EF2, ..., EF m represents the current environmental factors, and f represents a nonlinear function; The calculated dynamic verification value is stored in the distributed database of the blockchain network, and the dynamic verification value is updated regularly to adapt to changes in user authentication factors and environmental factors; When the user authenticates, the authentication factors and environmental factors are collected in real time, and the current dynamic verification value is calculated using the same algorithm and formula. The calculated dynamic verification value is compared with the dynamic verification value stored on the blockchain to verify the user's identity. If the dynamic verification value comparison is successful, the user identity authentication is considered to be passed. If the dynamic verification value comparison fails, the user's identity authentication request is rejected and the corresponding security event is recorded.

5. The security enhancement system for electronic government electronic authentication services according to claim 4 is characterized in that: A neural network model is used as the nonlinear function f, wherein the neural network model includes multiple hidden layers, each hidden layer includes multiple neurons, the neurons are connected and calculated through weights and activation functions, the input of the neural network model is the user's identity authentication factors and environmental factors, and the output is a dynamic verification value; by training the neural network model, the mapping relationship between the user's identity authentication factors and environmental factors and the dynamic verification value is learned, thereby generating an accurate dynamic verification value.

6. The security enhancement system for electronic government electronic authentication services according to claim 5 is characterized in that: The input layer of the neural network model receives the user's identity authentication factors and environmental factors as inputs, and the environmental factors include a current timestamp, geographic coordinates, and an IP address; the input layer encodes the identity authentication factors and environmental factors into numerical vectors.

7. The security enhancement system for electronic government electronic authentication services according to claim 6 is characterized by: The hidden layer of the neural network model includes two layers of hidden nodes, the first layer of hidden nodes uses the ReLU activation function to perform nonlinear transformation and feature extraction on the input data, and the second layer of hidden nodes uses the Sigmoid activation function to further process the output of the first layer of hidden nodes and generate more complex feature representations; The two layers of hidden nodes are connected in a fully connected manner and interact through weight parameters.

8. The security enhancement system for electronic government electronic authentication services according to claim 7 is characterized in that: The output layer of the neural network model receives the output of the last hidden layer and generates a dynamic verification value. The output layer is designed as a single node and uses a linear activation function to generate the dynamic verification value.

9. The security enhancement system for electronic government electronic authentication services according to claim 1, characterized in that: After the user authentication is successful, the corresponding electronic certificate file is generated, and a secure download link or QR code is provided in the user interaction module so that the user can obtain the electronic certificate.

10. A method for enhancing security of electronic government electronic authentication services, characterized in that: The steps of the method include: S1: Build and maintain a distributed network based on blockchain, which includes a distributed network module and a data storage module; wherein the distributed network module further includes a node management submodule and a network communication submodule, the node management submodule is responsible for the joining, exiting and permission management of nodes, and the network communication submodule uses the IPsec protocol to encrypt and authenticate IP data packets to achieve secure data transmission and communication between nodes; the data storage module further includes a block generation submodule and an on-chain storage submodule, the block generation submodule is used to generate new blocks and pack authentication data and transaction records into blocks, and the on-chain storage submodule adds the generated blocks to the blockchain to achieve tamper-proof and traceable storage of data; S2: Deploy smart contracts on the blockchain network, define the business processes and rules for electronic certification services, and automatically execute the business logic in the smart contracts, including the processing of certification requests, certificate issuance conditions, and certificate revocation processes; S3: Provide identity authentication services, which further include identity verification and digital signatures; identity verification adopts a multi-factor authentication mechanism, collects identity information submitted by users, including passwords, answers to preset security questions, and fingerprint and facial recognition data, requires users to provide at least two different types of identity verification factors, and compares the identity information submitted by users with pre-stored or preset information to verify whether the identity information has been verified; digital signatures are used to generate and verify digital signatures for electronic certificate files; S4: Provides certificate management functions and is responsible for issuing, updating, and revoking certificates; S5: Combined with the identity authentication mechanism, additional dynamic verification elements are introduced to perform user identity authentication; the specific implementation steps include: collecting multiple identity authentication factors and environmental factors submitted by users; using the neural network model as a nonlinear function to calculate the dynamic verification value by combining the identity authentication factors and environmental factors; storing the calculated dynamic verification value in the distributed database of the blockchain network and updating it regularly; when the user authenticates his identity, the identity authentication factors and environmental factors are collected in real time, the current dynamic verification value is calculated, and compared with the dynamic verification value stored on the blockchain to verify the user's identity; S6: Provide a unified authentication service interface, including online submission of authentication requests, query of authentication status, and downloading of certificates; and implement security protection at the user interface layer, including access account verification, access permission control, and transmission data encryption; S7: After the user authentication is successful, a corresponding electronic certificate file is generated, and a secure download link or QR code is provided to enable the user to obtain the electronic certificate.

Images