Identity authentication method and device, equipment and storage medium

Abstract

The invention discloses an identity authentication method, device and equipment and a storage medium, and relates to the technical field of computers, and the method comprises the steps: determining a user identity label and user signature data according to a received authentication request, and determining a user public key and encrypted secret information according to the user identity label; after determining that the user public key is consistent with a public key of an authentication initiator corresponding to the authentication request, decrypting the user signature data based on the user public key to obtain an encrypted authentication password and password hash; and performing hash verification on the encrypted authentication password according to the password hash, and determining an authentication result corresponding to the authentication request according to a first authentication password corresponding to the encrypted authentication password and a second authentication password corresponding to the encrypted secret information under the condition of determining that the verification is passed. According to the technical scheme, the operation steps of the user are reduced, the authentication efficiency is improved, and the use experience of the user is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and in particular to an identity authentication method, apparatus, device and storage medium. Background Art

[0002] Identity authentication is critical to the secure operation of a system, ensuring that only authorized personnel can access the system.

[0003] In the prior art, in order to improve the reliability of identity authentication, a multi-factor authentication method combining multiple authentication methods is usually adopted to ensure system security and user convenience, for example, combining username and password, two-factor authentication and biometric recognition.

[0004] However, multi-factor authentication requires multiple identity authentications, which is inefficient and provides a poor user experience. Summary of the invention

[0005] The present invention provides an identity authentication method, device, equipment and storage medium to improve identity authentication efficiency and user experience.

[0006] In a first aspect, an embodiment of the present invention provides an identity authentication method, comprising:

[0007] Determine the user identity and user signature data according to the received authentication request, and determine the user public key and encrypted secret information according to the user identity;

[0008] After determining that the user public key is consistent with the public key of the authentication initiator corresponding to the authentication request, decrypt the user signature data based on the user public key to obtain the encrypted authentication password and password hash;

[0009] The encrypted authentication password is hash-verified according to the password hash, and when it is determined that the verification passes, the authentication result corresponding to the authentication request is determined according to the first authentication password corresponding to the encrypted authentication password and the second authentication password corresponding to the encrypted secret information.

[0010] The technical solution of the embodiment of the present invention provides an identity authentication method, which reduces the user operation steps, improves the efficiency of authentication, and enhances the user experience compared to the multiple identity authentication methods used in the prior art. In addition, after any service deployed on the blockchain determines that the identity authentication has passed, other services also deployed on the blockchain and associated with the service simultaneously determine that the identity authentication has passed. The user only needs to register and authenticate once on one service to access multiple services associated with it, further enhancing the user experience.

[0011] Further, determining the user identity and user signature data according to the received authentication request includes:

[0012] When it is determined that the authentication request is a forwarding authentication request, determining a cross-chain authentication request and a request hash according to the forwarding authentication request;

[0013] The cross-chain authentication request is hash-verified according to the request hash, and when it is determined that the verification passes, the user identity and the user signature data are determined according to the cross-chain authentication request.

[0014] Further, determining a cross-chain authentication request and a request hash according to the forwarded authentication request includes:

[0015] The forwarded authentication request is decrypted based on the relay public key of the relay chain that sends the authentication request to obtain the cross-chain authentication request and the request hash.

[0016] Further, determining the user public key and the encrypted secret information according to the user identity includes:

[0017] Searching the registration information according to the user identity identifier to determine the user information corresponding to the user identity identifier, wherein the registration information includes the user identity identifier and user information of each user registered in the current blockchain;

[0018] The user public key and the encrypted secret information are determined in the user information.

[0019] Furthermore, the user signature data is obtained by the source blockchain that receives the authentication request encrypting the authentication password according to the source public key to obtain an encrypted authentication password, and then signing the encrypted authentication password and the password hash corresponding to the encrypted authentication password based on the user private key.

[0020] Furthermore, before determining the authentication result corresponding to the authentication request according to the first authentication password corresponding to the encrypted authentication password and the second authentication password corresponding to the encrypted secret information, the method further includes:

[0021] Decrypting the encrypted authentication password based on the source private key of the source blockchain to obtain the first authentication password;

[0022] The encrypted secret information is decrypted based on the current private key of the current blockchain to obtain the second authentication password.

[0023] Further, determining an authentication result corresponding to the authentication request according to a first authentication password corresponding to the encrypted authentication password and a second authentication password corresponding to the encrypted secret information includes:

[0024] When it is determined that the first authentication password is consistent with the second authentication password, determining that the authentication result corresponding to the authentication request is authentication success;

[0025] When it is determined that the first authentication password is inconsistent with the second authentication password, it is determined that the authentication result corresponding to the authentication request is authentication failure.

[0026] In a second aspect, an embodiment of the present invention further provides an identity authentication device, including:

[0027] A determination module, used to determine the user identity and user signature data according to the received authentication request, and determine the user public key and encrypted secret information according to the user identity;

[0028] A decryption module, used to decrypt the user signature data based on the user public key to obtain an encrypted authentication password and a password hash;

[0029] An execution module is used to perform hash verification on the encrypted authentication password according to the password hash, and when it is determined that the verification is passed, determine the authentication result corresponding to the authentication request according to the first authentication password corresponding to the encrypted authentication password and the second authentication password corresponding to the encrypted secret information.

[0030] In a third aspect, an embodiment of the present invention further provides a computer device, the computer device comprising:

[0031] at least one processor; and a memory communicatively coupled to the at least one processor;

[0032] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the identity authentication method as described in any one of the first aspects.

[0033] In a fourth aspect, an embodiment of the present invention further provides a storage medium comprising computer executable instructions, wherein the computer executable instructions, when executed by a computer processor, are used to execute an identity authentication method as described in any one of the first aspects.

[0034] In a fifth aspect, the present application provides a computer program product, which includes computer instructions. When the computer instructions are executed on a computer, the computer executes the identity authentication method provided in the first aspect.

[0035] It should be noted that the above computer instructions may be stored in whole or in part on a computer-readable storage medium, wherein the computer-readable storage medium may be packaged together with the processor of the identity authentication device, or may be packaged separately from the processor of the identity authentication device, which is not limited in this application.

[0036] The description of the second, third, fourth and fifth aspects in this application can refer to the detailed description of the first aspect; and the beneficial effects of the description of the second, third, fourth and fifth aspects can refer to the beneficial effect analysis of the first aspect, which will not be repeated here.

[0037] In this application, the name of the above-mentioned identity authentication device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of this application, they fall within the scope of the claims of this application and their equivalent technologies.

[0038] These and other aspects of the present application will become more apparent from the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 A flowchart of an identity authentication method provided by an embodiment of the present invention;

[0041] Figure 2 A schematic diagram of the structure of an identity authentication system provided by an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of the structure of an identity authentication device provided by an embodiment of the present invention;

[0043] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0045] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0046] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0047] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0048] It should be mentioned before discussing exemplary embodiments in more detail that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe various operations (or steps) as sequential processes, many operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of various operations can be rearranged. The process can be terminated when its operation is completed, but can also have additional steps not included in the accompanying drawings. The process can correspond to methods, functions, procedures, subroutines, subprograms, etc. In addition, the embodiments in the present invention and the features in the embodiments can be combined with each other without conflict.

[0049] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0050] In the description of the present application, unless otherwise specified, “plurality” means two or more.

[0051] Common authentication methods include username and password, two-factor authentication, multi-factor authentication, biometrics, smart card / electronic ID card, etc. Username and password is the most basic authentication method, which is verified by the username and password provided by the user. Although this method is simple, it is vulnerable to security issues such as password leakage and weak passwords. Two-factor authentication adds an additional authentication step on the basis of username and password, such as SMS verification code, email verification code or one-time password (TOTP) generated by authentication application. This method significantly improves security. Multi-factor authentication (MFA) requires users to provide multiple different types of authentication methods, such as password, biometrics (fingerprint, facial recognition, etc.), smart card / electronic ID card, which greatly reduces the risk of unauthorized access and further enhances security. Biometrics uses the user's unique biological characteristics for identity authentication, such as fingerprint, facial recognition, iris recognition and voice recognition. It has high security, but requires dedicated hardware support. Smart card / electronic ID card uses smart cards or electronic ID cards embedded with encryption chips for identity authentication. These cards are usually used in combination with PIN codes or biometrics to ensure the uniqueness and authenticity of the cardholder's identity.

[0052] The various authentication methods used in the prior art require users to perform multiple identity authentications, such as entering a password, receiving a text message verification code, using fingerprint recognition, etc. Each time the authentication is performed, the user needs to spend time to complete the authentication steps, resulting in low authentication efficiency and poor user experience.

[0053] Therefore, the present application proposes an identity authentication method to improve the efficiency of identity authentication.

[0054] The identity authentication method proposed in this application will be described in detail below with reference to diagrams and embodiments.

[0055] Figure 1 This is a flow chart of an identity authentication method provided by an embodiment of the present invention. This embodiment is applicable to situations where the efficiency of identity authentication needs to be improved. The method can be executed by an identity authentication device, such as Figure 1 As shown, the specific steps include:

[0056] Step 110: Receive an authentication request.

[0057] Step 120: Determine whether the authentication request is a forwarding authentication request.

[0058] The various services accessible to users can be deployed on the blockchain, and the blockchains where the services are deployed can transmit data through the relay chain. After any service authenticates the user, the user can access other services associated with the service.

[0059] Specifically, the forwarded authentication request is issued after being signed by the relay chain. The signature can be understood as the process of encrypting the request based on the relay private key of the relay chain. After the current blockchain receives the authentication request, it can use the relay public key of the relay chain to verify the signature of the authentication request and determine whether the authentication request comes from the relay chain. That is, if it is determined that the relay public key can decrypt the authentication request, it is determined that the authentication request is a forwarded authentication request.

[0060] In the embodiment of the present invention, the signature of the authentication request is verified by the relay chain public key to determine whether the authentication request is a forwarding authentication request.

[0061] When it is determined that the received authentication request is a forwarding authentication request, step 130 is executed; otherwise, step 150 is executed.

[0062] Step 130: Determine the cross-chain authentication request and request hash based on the forwarded authentication request.

[0063] In one implementation, step 130 may specifically include:

[0064] The forwarded authentication request is decrypted based on the relay public key of the relay chain that sent the authentication request to obtain the cross-chain authentication request and request hash.

[0065] After receiving the forwarding authentication request Request_Transfer_1 signed by the source private key sent by the source blockchain, the relay chain decrypts and hashes the forwarding authentication request based on the source public key of the source blockchain, and signs it based on the relay private key of the relay chain, and obtains the forwarding authentication request Request_Transfer_2 signed by the relay private key.

[0066] First, the relay chain can obtain the cross-chain authentication request and request hash by decrypting the forwarding authentication request signed by the source private key based on the source public key, that is, it can determine Hash_Result = SM2 (Public_Key_BlockA, Request_Transfer_1), where Query represents the cross-chain authentication request, Hash_Result represents the hash value corresponding to the cross-chain authentication request, that is, the request hash, SM2 represents the national secret algorithm SM2, and Public_Key_BlockA represents the source public key of the source blockchain A. Secondly, in order to ensure the integrity and correctness of the received cross-chain authentication request, the relay chain can perform hash verification on the cross-chain authentication request based on Hash_Result. Specifically, by determining whether the hash value obtained by hashing the Query is consistent with the Hash_Result, the hash verification of the Query is realized. When the Result in Result = Equal (Hash_Result, SM3 (Query)) is True, it is determined that the Query passes the hash verification. When the Result is False, it is determined that the Query fails the hash verification, and the relay chain will refuse to forward the request, where SM3 represents the national secret algorithm SM3. Furthermore, the relay chain signs the cross-chain authentication request and the hash value corresponding to the cross-chain authentication request based on the relay private key, and obtains the forwarding authentication request signed by the relay private key, thereby determining Request_Transfer_2 = SM2 (Private_Key_Middle, Query, Hash_Result).

[0067] Specifically, when the current blockchain determines that the received authentication request is a forwarding authentication request, the forwarding authentication request is a forwarding authentication request signed by the relay private key. Therefore, the forwarding authentication request can be decrypted based on the relay public key to obtain the cross-chain authentication request and request hash.

[0068] In an embodiment of the present invention, the forwarded authentication request is decrypted according to the relay public key of the relay chain that sends the authentication request to obtain a cross-chain authentication request and a request hash.

[0069] Step 140: Perform hash verification on the cross-chain authentication request according to the request hash, and if the verification is successful, determine the user identity and user signature data according to the cross-chain authentication request.

[0070] Among them, the user signature data is obtained by the source blockchain that receives the authentication request encrypting the authentication password according to the source public key to obtain the encrypted authentication password, and then signing the encrypted authentication password and the password hash corresponding to the encrypted authentication password based on the user's private key.

[0071] Specifically, in order to ensure the integrity and correctness of the cross-chain authentication request obtained by decryption, the cross-chain authentication request can be hash-verified according to the request hash obtained by decryption. Specifically, the Query can be hash-verified based on the Hash_Result. The hash verification of the Query is achieved by determining whether the hash value obtained by hashing the Query is consistent with the Hash_Result. When it is determined that the Result in Result = Equal(Hash_Result, SM3(Query)) is True, it is determined that the Query has passed the hash verification. When it is determined that the Result in Result = Equal(Hash_Result, SM3(Query)) is False, it is determined that the Query has not passed the hash verification, and the current blockchain will reject the request.

[0072] Query is determined by the source blockchain by packaging the initial authentication request, and the initial authentication request includes the user identity and user signature data. The user identity is determined by the current blockchain when the user registers based on the current blockchain. The user signature data is obtained by the source blockchain encrypting the authentication password based on the source public key, and then signing the encrypted authentication password and the password hash corresponding to the encrypted authentication password based on the user private key.

[0073] Therefore, after determining that the hash verification of the cross-chain authentication request has passed, the user identity and user signature data contained in the cross-chain authentication request can be determined.

[0074] In actual applications, after any blockchain receives an initial authentication request, it can search the registration information of the blockchain according to the user identity contained in the initial authentication request. If an identity consistent with the user identity is found, it indicates that the initial authentication request is used to request the blockchain. Otherwise, it indicates that the initial authentication request is used to request other blockchains. At this time, the initial authentication request can be packaged to generate a cross-chain authentication request, which includes the request type, source blockchain identifier, target blockchain identifier, user identity identifier, and user signature data. The request type is used to indicate that the authentication request is an identity authentication request, the source blockchain identifier is used to indicate the blockchain that initiates the identity authentication request, and the target blockchain identifier is used to indicate the direction for the relay chain to forward the request.

[0075] In addition, when the user device initiates identity authentication based on the source blockchain, the authentication password is first encrypted based on the source public key of the source blockchain to obtain the encrypted authentication password, that is, Encrypt_Password = SM2 (Public_Key_BlockA, Password), Encrypt_Password represents the encrypted authentication password, and Password represents the authentication password. Secondly, the encrypted authentication password is hashed to determine the hash value corresponding to the encrypted authentication password, that is, Hash_Result = SM3 (Encrypt_Password), and Hash_Result represents the hash value corresponding to the encrypted authentication password. Then, the encrypted authentication password and the hash value corresponding to the encrypted authentication password are signed based on the user's private key to obtain user signature data, that is, Sign_Request = SM2 (Private_Key_User, Encrypt_Password, Hash_Result), where Sign_Request represents the user signature data, and Private_Key_User represents the user private key, and then the initial authentication request is determined based on the user identity and the user signature data.

[0076] The user identity is determined by the blockchain when the user is registered based on the blockchain. The user identity corresponding to the forwarded authentication request forwarded to the current blockchain is determined by the current blockchain when the user is registered based on the current blockchain. Specifically, the user device can generate a user public key and a user private key, secretly store the user private key in the user device for subsequent identity authentication, and publish the user public key for subsequent communication. When registering a user based on the current blockchain, the current blockchain first encrypts the user's private identity information and authentication password based on the current public key to obtain the encrypted password information, so as to prevent the transmission process from being monitored by a third-party attacker and causing the user's private identity information and authentication password to be leaked, that is, to determine Encrypt_Secret = SM2 (Public_Key_BlockB, Secret_Info, Password), where Encrypt_Secret represents the encrypted secret information, Public_Key_BlockB represents the current public key of the current blockchain B, and Secret_Info represents the user's private identity information. The basic identity information and encrypted secret information of the user are hashed to obtain the hash value corresponding to the basic identity information and the encrypted secret information, which can determine Hash_Result = SM3 (Basic_Info, Encrypt_Secret), where Basic_Info represents the basic identity information of the user. The basic identity information, the encrypted secret information, and the hash value corresponding to the basic identity information and the encrypted secret information are signed based on the user's private key to obtain a registration request, which can determine Requst = SM2 (Private_Key_User, Basic_Info, Encrypt_Secret, Hash_Result), where Requst represents the registration request. Then, the user device can send the registration request to the current blockchain.

[0077] It should be noted that the user's basic identity information can be understood as user information that is publicly available and used for daily use, such as name, gender, etc., and the user's secret identity information can be understood as personal privacy information that is not publicly available, such as identity card, etc.

[0078] After the registration contract of the current blockchain receives the registration request, it first decrypts the registration request based on the user's public key to obtain the basic identity information, the encrypted secret information, and the hash value corresponding to the basic identity information and the encrypted secret information, so as to determine that the sender of the registration request is the user device, not a third-party attacker, that is, Basic_Info, Encrypt_Secret, Hash_Result = SM2 (Public_Key_User, Request). In order to ensure the integrity and correctness of the received basic identity information and encrypted secret information, the basic user information and the encrypted password information can be hash-verified based on Hash_Result. Specifically, by determining whether the hash value obtained by hashing the basic user information and the encrypted password information is consistent with Hash_Result, the hash verification of the basic user information and the encrypted password information is realized. When it is determined that the Result in Result = Equal (Hash_Result, SM3 (Basic_Info, Encrypt_Secret)) is True, it is determined that the hash verification is passed. When it is determined that the Result is False, it is determined that the hash verification is not passed, and the current blockchain will reject the request.

[0079] The current blockchain can also store the user's basic identity information, encrypted secret information, authentication password and user public key. Specifically, determine User_ID = SM3 ((Basic_Info, Encrypt_Secret, Password, Public_Key_User), where User_ID represents the user identity identifier, and the User_ID and the user's basic identity information, encrypted secret information, authentication password and user public key are stored as registration information in the form of key-value.

[0080] In an embodiment of the present invention, a cross-chain authentication request is hash-verified according to a request hash, and when it is determined that the verification is passed, the user identity and user signature data are determined according to the cross-chain authentication request, and the user identity and user signature data are determined under the premise of ensuring the integrity and correctness of the cross-chain authentication request.

[0081] After step 140 , step 160 is performed.

[0082] Step 150: Determine the user identity and user signature data according to the authentication request.

[0083] Specifically, when the received authentication request is a direct authentication request sent by a user device, the authentication request is determined by the user device based on the user identity and user signature data and sent to the current blockchain. Therefore, the user identity and user signature data can be directly determined based on the authentication request.

[0084] In the embodiment of the present invention, the user identity and user signature data are determined according to the authentication request.

[0085] Step 160: Determine the user public key and encrypted secret information according to the user identity.

[0086] In one implementation, step 160 may specifically include:

[0087] Search the registration information according to the user identity to determine the user information corresponding to the user identity; determine the user public key and encrypted secret information in the user information.

[0088] Among them, the registration information includes the user identity and user information of each user registered in the current blockchain.

[0089] Specifically, the registration information includes User_ID and user information stored in key-value format. Therefore, the registration information can be searched according to User_ID, and the value corresponding to the key consistent with User_ID in the registration information is determined as the user information. The user information includes the user's basic identity information, encrypted secret information, authentication password and user public key storage. Then, the user public key and encrypted secret information can be determined in the user information.

[0090] In an embodiment of the present invention, the user public key and encrypted secret information are determined according to the user identity in the registration information of the current blockchain.

[0091] Step 170: After determining that the user public key is consistent with the public key of the authentication initiator corresponding to the authentication request, the user signature data is decrypted based on the user public key to obtain the encrypted authentication password and password hash.

[0092] Specifically, it is first possible to determine whether the user public key determined in the registration information of the current blockchain is consistent with the public key of the authentication initiator, that is, it is possible to determine whether the user public key determined in the aforementioned step 150 is consistent with the user public key corresponding to the user device that initiates the authentication request, and when it is determined to be consistent, the user signature data is decrypted based on the user public key to obtain the encrypted authentication password and password hash, that is, to determine Encrypt_Password, Hash_Result = SM2 (Public_Key_User, Sign_Request). When it is determined to be inconsistent, the current blockchain can reject the request.

[0093] In an embodiment of the present invention, by determining whether the user public key is consistent with the public key of the authentication initiator corresponding to the authentication request, the authentication request that is not registered in the current blockchain is rejected, the security of identity authentication is improved, and the user signature data is decrypted based on the user public key. Successful decryption obtains the encrypted authentication password and password hash, indicating that the authentication request is initiated by the user device corresponding to the user public key.

[0094] Step 180: Perform hash verification on the encrypted authentication password according to the password hash, and if the verification is determined to be successful, determine the first authentication password based on the encrypted authentication password, and determine the second authentication password based on the encrypted secret information.

[0095] In one implementation, determining the first authentication password based on the encrypted authentication password and determining the second authentication password based on the encrypted secret information includes:

[0096] The encrypted authentication password is decrypted based on the source private key of the source blockchain to obtain the first authentication password; and the encrypted secret information is decrypted based on the current private key of the current blockchain to obtain the second authentication password.

[0097] Specifically, in order to ensure the integrity and correctness of the encrypted authentication password, the encrypted authentication password can be hash-verified based on the password hash. Specifically, the hash value obtained by hashing the encrypted authentication password is determined to be consistent with the password hash, and the hash verification of the encrypted authentication password is achieved. When the Result in Result = Equal(Hash_Result, SM3(Encrypt_Password)) is True, it is determined that the encrypted authentication password passes the hash verification. When the Result is False, it is determined that the encrypted authentication password does not pass the hash verification, and the current blockchain will refuse to forward the request.

[0098] When it is determined that the encrypted authentication password passes the hash verification, the first authentication password corresponding to the encrypted authentication password can be determined. Specifically, the encrypted authentication password is encrypted based on the source public key. Therefore, the encrypted authentication password can be decrypted based on the source private key to obtain the first authentication password. The second authentication password corresponding to the encrypted secret information can also be determined. The encrypted secret information is obtained by encrypting the user's private identity information and authentication password based on the current public key when the user registers in the current blockchain. Therefore, the encrypted secret information can be decrypted based on the current private key of the current blockchain to obtain the second authentication password.

[0099] In an embodiment of the present invention, the encrypted authentication password is hash-verified through password hashing to achieve rejection of incomplete or incorrectly formatted authentication requests, determine the first authentication password based on the encrypted authentication password, and determine the second authentication password based on the encrypted secret information, thereby providing a data basis for determining the authentication result.

[0100] Step 190: Determine an authentication result corresponding to the authentication request according to the first authentication password and the second authentication password.

[0101] In one implementation, step 190 may specifically include:

[0102] When it is determined that the first authentication password is consistent with the second authentication password, the authentication result corresponding to the authentication request is determined to be authentication success; when it is determined that the first authentication password is inconsistent with the second authentication password, the authentication result corresponding to the authentication request is determined to be authentication failure.

[0103] Specifically, when the first authentication password determined according to the user signature data determined by the authentication request is consistent with the second password information determined according to the user identity determined by the authentication request, it indicates that the user corresponding to the user device that initiates the authentication request is the user registered in the current blockchain, and the authentication result of the authentication request can be determined as successful authentication. When the first authentication password determined according to the user signature data determined by the authentication request is inconsistent with the second password information determined according to the user identity determined by the authentication request, it indicates that the user corresponding to the user device that initiates the authentication request is not a user registered in the current blockchain, and the authentication result of the authentication request can be determined as failed authentication.

[0104] In an embodiment of the present invention, an authentication result corresponding to an authentication request is determined based on a first authentication password and a second authentication password, and the determination of the first authentication password undergoes multiple encryption and decryption and multiple hash verifications, thereby ensuring the security and correctness of the first authentication password, and further ensuring the security of the identity authentication process and the correctness of the identity authentication result.

[0105] The identity authentication method provided by the embodiment of the present invention, after the current blockchain receives the authentication request, first determines whether the authentication request is a forwarding authentication request. When it is determined that the authentication request is a forwarding authentication request, it is determined that the current blockchain is not the source blockchain that directly receives the authentication request. The forwarding authentication request is a forwarding authentication request signed by the source private key sent by the relay chain, which is decrypted and hashed, and then signed and sent to the current blockchain. The forwarding authentication request signed by the source private key is the initial authentication request sent by the source blockchain. After determining that the initial authentication request sent by the user device does not belong to the source blockchain, the initial authentication request is packaged to obtain a cross-chain authentication request, and hash calculation is performed and After signing, it is sent to the relay chain. Therefore, the forwarded authentication request can be decrypted based on the relay public key of the relay chain that sent the authentication request to obtain the cross-chain authentication request and request hash. The decryption and hash authentication of the cross-chain authentication request by the source blockchain and the relay blockchain ensure the security, integrity and correctness of the cross-chain authentication request. The cross-chain authentication request is hash-verified according to the request hash, and when the verification is determined to be passed, the user identity and user signature data are determined according to the cross-chain authentication request. Under the premise of ensuring the integrity and correctness of the cross-chain authentication request, the user identity and user signature data are determined. Of course, after determining that the authentication request is not a forwarded authentication request In the case of , it is determined that the current blockchain is the source blockchain that receives the authentication request. The current blockchain can determine the user identity and user signature data based on the direct authentication request. Then, the user public key and the encrypted secret information are determined based on the user identity in the registration information of the current blockchain. After determining that the user public key is consistent with the public key of the authentication initiator corresponding to the authentication request, the user signature data is decrypted based on the user public key to obtain the encrypted authentication password and password hash. By determining whether the user public key is consistent with the public key of the authentication initiator corresponding to the authentication request, the authentication request that is not registered in the current blockchain is rejected, thereby improving the security of identity authentication. The user signature data is decrypted to obtain the encrypted authentication password and password hash, indicating that the authentication request is initiated by the user device corresponding to the user public key. The encrypted authentication password is hash-verified through the password hash to achieve rejection of incomplete or incorrect authentication requests. The first authentication password is determined based on the encrypted authentication password, and the second authentication password is determined based on the encrypted secret information. The authentication result corresponding to the authentication request is determined based on the first authentication password and the second authentication password. The determination of the first authentication password has undergone multiple encryption and decryption and multiple hash verifications, ensuring the security and correctness of the first authentication password, thereby ensuring the security of the identity authentication process and the correctness of the identity authentication result. Compared with the multiple identity authentication methods used in the prior art, this application reduces the user operation steps, improves the efficiency of authentication, and enhances the user experience.Moreover, once any service deployed on the blockchain confirms that the identity authentication has passed, other services also deployed on the blockchain and associated with the service will also confirm that the identity authentication has passed. Users only need to register and authenticate once on one service to access multiple services associated with it, further improving the user experience.

[0106] Figure 2 A structural diagram of an identity authentication system provided by an embodiment of the present invention is shown in FIG. Figure 2 As shown, the identity authentication system includes multiple blockchains and a relay chain connecting each blockchain. The blockchain includes a registration contract, a cross-chain contract, and an authentication contract, and the relay chain includes a forwarding contract.

[0107] Any blockchain can be the source blockchain for receiving the authentication request, and the blockchain for user registration is the target blockchain. The target blockchain can be understood as the current blockchain in the aforementioned embodiment.

[0108] The registration contract of the target blockchain is used to, after receiving the registration request sent by the user device, decrypt the registration request based on the user public key corresponding to the user device to obtain the user's basic identity information, encrypted secret information and encrypted hash, perform hash verification on the user's basic identity information and encrypted secret information based on the encrypted hash, determine the hash verification result, and when the hash verification result is determined to be consistent, determine the user identity by performing hash calculation on the user's basic identity information, encrypted secret information, authentication password and user public key, and store the user identity and the user's basic identity information, encrypted secret information, authentication password and user public key accordingly. It is also used to send the user identity to the user device. It is also used to reject the registration request when the hash verification result is determined to be inconsistent.

[0109] Among them, the registration request is that after the user device determines the user public key and the user private key, the user's secret identity information and authentication password are encrypting based on the target public key of the target blockchain to obtain the encrypted secret information, the encrypted password information is hashed to obtain the encrypted hash, and the user's basic identity information, encrypted secret information and encrypted hash are signed based on the user private key and determined according to the signature data obtained by the signature.

[0110] The authentication contract of the source blockchain is used to determine whether the authentication request belongs to the source blockchain after receiving the authentication request based on the user identity contained in the authentication request and the registration information stored in the blockchain.

[0111] Among them, the authentication request is that the user device encrypts the authentication password based on the source public key of the source blockchain to obtain an encrypted authentication password, performs hash calculation on the encrypted authentication password to obtain a password hash, signs the encrypted authentication password and the password hash based on the user private key, and is determined based on the user signature data and user identity obtained by the signature.

[0112] The authentication contract of the source blockchain is also used to determine the user identity and user signature data based on the authentication request when it is determined that the authentication request belongs to the source blockchain.

[0113] The authentication contract of the source blockchain is also used to send the authentication request to the cross-chain contract of the source blockchain when it is determined that the authentication request does not belong to the source blockchain.

[0114] The cross-chain contract of the source blockchain is used to package the authentication request to generate a cross-chain authentication request, perform hash calculation on the cross-chain authentication request, sign the cross-chain authentication request and the hash value corresponding to the cross-chain authentication request based on the source private key, obtain the forwarding authentication request encrypted by the source private key, and send the forwarding authentication request encrypted by the source private key to the relay chain.

[0115] The forwarding contract of the relay chain is used to decrypt the forwarding authentication request encrypted by the source private key based on the source public key to obtain the cross-chain authentication request and the hash value corresponding to the cross-chain authentication request, perform hash verification on the cross-chain authentication request based on the hash value corresponding to the cross-chain authentication request, determine the hash verification result, and when the hash verification result is determined to be a passed verification, sign the cross-chain authentication request and the hash value corresponding to the cross-chain authentication request based on the relay private key to obtain the forwarding authentication request encrypted by the relay private key, and send the forwarding authentication request encrypted by the relay private key to the target blockchain. It is also used to reject the forwarding authentication request encrypted by the source private key when the hash verification result is determined to be a failed verification.

[0116] The cross-chain contract of the target blockchain is used to decrypt the forwarding authentication request encrypted by the relay private key based on the relay public key to obtain the cross-chain authentication request and the hash value corresponding to the cross-chain authentication request, perform hash verification on the cross-chain authentication request based on the hash value corresponding to the cross-chain authentication request, determine the hash verification result, and send the cross-chain authentication request to the authentication contract when the hash verification result is determined to be a passed verification. It is also used to reject the cross-chain authentication request when the hash verification result is determined to be a failed verification.

[0117] The authentication contract of the target blockchain is used to determine the user public key and the encrypted secret information in the registration information according to the user identity included in the cross-chain authentication request. When it is determined that the user public key is consistent with the user public key corresponding to the user device, the user signature data included in the cross-chain authentication request is decrypted based on the user public key to obtain the encrypted authentication password and password hash, and the encrypted authentication password is hash-verified according to the password hash to obtain the verification result. When it is determined that the hash verification result is a verification pass, the first authentication password is determined based on the encrypted authentication password, and the second authentication password is determined based on the encrypted secret information. The authentication result corresponding to the authentication request is determined according to the first authentication password and the second authentication password. It is also used to reject the cross-chain authentication request when it is determined that the hash verification result is a verification failure.

[0118] The identity authentication system provided by the embodiment of the present invention has the corresponding beneficial effects of executing the identity authentication method.

[0119] Figure 3 This is a schematic diagram of the structure of an identity authentication device provided by an embodiment of the present invention, which can be applied to situations where the efficiency of identity authentication needs to be improved. The device can be implemented by software and / or hardware and is generally integrated in an electronic device, such as a computer device.

[0120] like Figure 3 As shown, the device comprises:

[0121] The determination module 310 is used to determine the user identity and the user signature data according to the received authentication request, and determine the user public key and the encrypted secret information according to the user identity;

[0122] A decryption module 320, configured to decrypt the user signature data based on the user public key to obtain an encrypted authentication password and a password hash;

[0123] The execution module 330 is used to perform hash verification on the encrypted authentication password according to the password hash, and when it is determined that the verification is passed, determine the authentication result corresponding to the authentication request according to the first authentication password corresponding to the encrypted authentication password and the second authentication password corresponding to the encrypted secret information.

[0124] Compared with the multiple identity authentication methods used in the prior art, the identity authentication device provided by this embodiment reduces the user operation steps, improves the efficiency of authentication, and enhances the user experience. In addition, after any service deployed on the blockchain determines that the identity authentication has passed, other services also deployed on the blockchain and associated with the service will simultaneously determine that the identity authentication has passed. Users only need to register and authenticate once on one service to access multiple services associated with it, further enhancing the user experience.

[0125] Based on the above embodiment, the determination module 310 is specifically used for:

[0126] When it is determined that the authentication request is a forwarding authentication request, a cross-chain authentication request and a request hash are determined according to the forwarding authentication request; the cross-chain authentication request is hash-verified according to the request hash, and when it is determined that the verification passes, the user identity and the user signature data are determined according to the cross-chain authentication request; according to the user identity, a search is performed in the registration information to determine the user information corresponding to the user identity, wherein the registration information includes the user identity and user information of each user registered in the current blockchain; the user public key and the encrypted secret information are determined in the user information.

[0127] In one implementation, determining a cross-chain authentication request and a request hash according to the forwarded authentication request includes:

[0128] The forwarded authentication request is decrypted based on the relay public key of the relay chain that sends the authentication request to obtain the cross-chain authentication request and the request hash.

[0129] In one embodiment, the user signature data is obtained by the source blockchain that receives the authentication request encrypting the authentication password according to the source public key to obtain an encrypted authentication password, and then signing the encrypted authentication password and the password hash corresponding to the encrypted authentication password based on the user private key.

[0130] Based on the above embodiment, the determination module 310 is specifically used for:

[0131] The encrypted authentication password is hash-verified according to the password hash, and when it is determined that the verification passes, the encrypted authentication password is decrypted based on the source private key of the source blockchain to obtain the first authentication password; the encrypted secret information is decrypted based on the current private key of the current blockchain to obtain the second authentication password; when it is determined that the first authentication password is consistent with the second authentication password, the authentication result corresponding to the authentication request is determined to be successful authentication; when it is determined that the first authentication password is inconsistent with the second authentication password, the authentication result corresponding to the authentication request is determined to be failed authentication.

[0132] The identity authentication device provided in the embodiment of the present invention can execute the identity authentication method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the identity authentication method.

[0133] It is worth noting that in the embodiment of the above-mentioned identity authentication device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0134] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 4 A block diagram of an exemplary electronic device 4 suitable for implementing embodiments of the present invention is shown. Figure 4 The electronic device 4 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0135] like Figure 4 As shown, the electronic device 4 is in the form of a general purpose computing electronic device. The components of the electronic device 4 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 connecting different system components (including the system memory 28 and the processing unit 16).

[0136] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0137] The electronic device 4 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 4, including volatile and non-volatile media, removable and non-removable media.

[0138] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The electronic device 4 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 4 not shown, usually called a "hard drive"). Although Figure 4Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0139] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0140] The electronic device 4 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), one or more devices that enable a user to interact with the electronic device 4, and / or any device that enables the electronic device 4 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via an input / output (I / O) interface 22. Furthermore, the electronic device 4 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 20. Figure 4 As shown, the network adapter 20 communicates with other modules of the electronic device 4 via the bus 18. It should be understood that although Figure 4 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 4, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0141] The processing unit 16 executes various functional applications and page displays by running the program stored in the system memory 28, for example, implementing the identity authentication method provided in the embodiment of the present invention, which includes:

[0142] Determine the user identity and user signature data according to the received authentication request, and determine the user public key and encrypted secret information according to the user identity;

[0143] After determining that the user public key is consistent with the public key of the authentication initiator corresponding to the authentication request, decrypt the user signature data based on the user public key to obtain the encrypted authentication password and password hash;

[0144] The encrypted authentication password is hash-verified according to the password hash, and when it is determined that the verification passes, the authentication result corresponding to the authentication request is determined according to the first authentication password corresponding to the encrypted authentication password and the second authentication password corresponding to the encrypted secret information.

[0145] Of course, those skilled in the art can understand that the processor can also implement the technical solution of the identity authentication method provided by any embodiment of the present invention.

[0146] An embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, for example, an identity authentication method provided by an embodiment of the present invention is implemented. The method includes:

[0147] Determine the user identity and user signature data according to the received authentication request, and determine the user public key and encrypted secret information according to the user identity;

[0148] After determining that the user public key is consistent with the public key of the authentication initiator corresponding to the authentication request, decrypt the user signature data based on the user public key to obtain the encrypted authentication password and password hash;

[0149] The encrypted authentication password is hash-verified according to the password hash, and when it is determined that the verification passes, the authentication result corresponding to the authentication request is determined according to the first authentication password corresponding to the encrypted authentication password and the second authentication password corresponding to the encrypted secret information.

[0150] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0151] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0152] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0153] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0154] It should be understood by those skilled in the art that the modules or steps of the present invention described above can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0155] In addition, the acquisition, storage, use, and processing of data in the technical solution of the present invention are in compliance with the relevant provisions of national laws and regulations.

[0156] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. An identity authentication method, characterized in that: include: Determine the user identity and user signature data according to the received authentication request, and determine the user public key and encrypted secret information according to the user identity; After determining that the user public key is consistent with the public key of the authentication initiator corresponding to the authentication request, decrypt the user signature data based on the user public key to obtain the encrypted authentication password and password hash; The encrypted authentication password is hash-verified according to the password hash, and when it is determined that the verification passes, the authentication result corresponding to the authentication request is determined according to the first authentication password corresponding to the encrypted authentication password and the second authentication password corresponding to the encrypted secret information.

2. The identity authentication method according to claim 1, characterized in that: Determine the user identity and user signature data based on the received authentication request, including: When it is determined that the authentication request is a forwarding authentication request, determining a cross-chain authentication request and a request hash according to the forwarding authentication request; The cross-chain authentication request is hash-verified according to the request hash, and when it is determined that the verification passes, the user identity and the user signature data are determined according to the cross-chain authentication request.

3. The identity authentication method according to claim 2, characterized in that: Determining a cross-chain authentication request and a request hash according to the forwarded authentication request includes: The forwarded authentication request is decrypted based on the relay public key of the relay chain that sends the authentication request to obtain the cross-chain authentication request and the request hash.

4. The identity authentication method according to claim 1, characterized in that: Determining the user public key and encrypted secret information according to the user identity identifier includes: Searching the registration information according to the user identity identifier to determine the user information corresponding to the user identity identifier, wherein the registration information includes the user identity identifier and user information of each user registered in the current blockchain; The user public key and the encrypted secret information are determined in the user information.

5. The identity authentication method according to claim 1, characterized in that: The user signature data is obtained by signing the encrypted authentication password and the password hash corresponding to the encrypted authentication password based on the user private key after the source blockchain that receives the authentication request encrypts the authentication password according to the source public key to obtain the encrypted authentication password.

6. The identity authentication method according to claim 1, characterized in that: Before determining the authentication result corresponding to the authentication request according to the first authentication password corresponding to the encrypted authentication password and the second authentication password corresponding to the encrypted secret information, the method further includes: Decrypting the encrypted authentication password based on the source private key of the source blockchain to obtain the first authentication password; The encrypted secret information is decrypted based on the current private key of the current blockchain to obtain the second authentication password.

7. The identity authentication method according to claim 1, characterized in that: Determining an authentication result corresponding to the authentication request according to a first authentication password corresponding to the encrypted authentication password and a second authentication password corresponding to the encrypted secret information includes: When it is determined that the first authentication password is consistent with the second authentication password, determining that the authentication result corresponding to the authentication request is authentication success; When it is determined that the first authentication password is inconsistent with the second authentication password, it is determined that the authentication result corresponding to the authentication request is authentication failure.

8. An identity authentication device, characterized in that: include: A determination module, used to determine the user identity and user signature data according to the received authentication request, and determine the user public key and encrypted secret information according to the user identity; A decryption module, used to decrypt the user signature data based on the user public key to obtain an encrypted authentication password and a password hash; An execution module is used to perform hash verification on the encrypted authentication password according to the password hash, and when it is determined that the verification is passed, determine the authentication result corresponding to the authentication request according to the first authentication password corresponding to the encrypted authentication password and the second authentication password corresponding to the encrypted secret information.

9. A computer device, characterized in that: The computer device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the identity authentication method as described in any one of claims 1-7.

10. A storage medium containing computer executable instructions, characterized in that: The computer executable instructions are used to perform the identity authentication method as described in any one of claims 1-7 when executed by a computer processor.

Images