Identity authority authentication method and device, equipment and storage medium

Abstract

The invention relates to an identity permission authentication method and device, equipment and a storage medium. The signature value can be generated according to the information of the user, whether the user has the access permission of the target block chain is verified based on the signature value, after it is determined that the user has the access permission of the target block chain, the comprehensive permission value of the user to the requested target data is determined based on the information of the user, and after the comprehensive permission value reaches the preset requirement, the user can access the target block chain. According to the method, the user is determined to have the target data acquisition authority, and finally the target data on the target block chain is sent to the user, so that whether the user has the target data acquisition authority on the block chain or not can be determined by verifying the user information twice, and the data acquisition authority of the user on the block chain can be accurately authenticated; the authentication precision of the data authority on the block chain is improved, and the security of the data on the block chain is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of blockchain technology, and in particular to an identity and authority authentication method, device, equipment, and storage medium. Background Art

[0002] Blockchain is a decentralized distributed ledger that is tamper-proof, secure and reliable. It combines distributed storage, peer-to-peer transmission, consensus mechanism, cryptography and other technologies to record transactions and information through an ever-growing data chain (Blocks) to ensure data security and transparency. Blockchain is used to securely record and verify transactions or data, and is now widely used in various fields.

[0003] However, existing technologies are unable to accurately authenticate users’ data access rights on the blockchain, which reduces the security of data on the blockchain. Summary of the invention

[0004] In order to solve the above technical problems, the present disclosure provides an identity authority authentication method, device, equipment and storage medium.

[0005] A first aspect of the present disclosure provides an identity authority authentication method, comprising:

[0006] In response to receiving a data request from a target user for a target blockchain, generating a signature value of the target user based on a private key of the target user, a timestamp of the data request, and a data feature value of the requested target data;

[0007] Based on the signature value, verify whether the target user has access rights to the target blockchain;

[0008] When the target user does not have access rights, it is prohibited to send the target data on the target blockchain to the target user;

[0009] When the target user has access rights, the target user's comprehensive authority value for the target data is calculated based on the target user's authority value for the data feature value, the weight and adjustment factor corresponding to each authority value, and the location and timestamp of the target user's data request;

[0010] When the comprehensive authority value is less than or equal to the preset threshold, it is determined that the target user does not have the authority to obtain the target data, and the target data on the target blockchain is prohibited from being sent to the target user;

[0011] When the comprehensive authority value is greater than the preset threshold, it is determined that the target user has the authority to obtain the target data, and the target data on the target blockchain is sent to the target user.

[0012] A second aspect of the present disclosure provides an identity and authority authentication device, comprising:

[0013] A generation module, configured to generate a signature value of the target user based on a private key of the target user, a timestamp of the data request, and a data feature value of the requested target data in response to receiving a data request of the target user for the target blockchain;

[0014] The verification module is used to verify whether the target user has access rights to the target blockchain based on the signature value;

[0015] A first prohibition module, used to prohibit the target data on the target blockchain from being sent to the target user when the target user does not have access rights;

[0016] A calculation module, used to calculate the comprehensive authority value of the target user to the target data based on the authority value of the target user to the data feature value, the weight and adjustment factor corresponding to each authority value, and the location and timestamp of the target user's data request when the target user has the access authority;

[0017] The second prohibition module is used to determine that the target user does not have the authority to obtain the target data when the comprehensive authority value is less than or equal to the preset threshold, and prohibit the target data on the target blockchain from being sent to the target user;

[0018] The sending module is used to determine that the target user has the authority to obtain the target data when the comprehensive authority value is greater than a preset threshold, and send the target data on the target blockchain to the target user.

[0019] A third aspect of the present disclosure provides a computer device, including a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the identity authority authentication method of the first aspect can be implemented.

[0020] A fourth aspect of the present disclosure provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the identity and authority authentication method of the first aspect can be implemented.

[0021] Compared with the prior art, the technical solution provided by the present invention has the following advantages:

[0022] The present disclosure generates a signature value of the target user in response to receiving a data request of the target user for the target blockchain, based on the private key of the target user, the timestamp of the data request and the data characteristic value of the requested target data; verifies whether the target user has the access right to the target blockchain based on the signature value; prohibits sending the target data on the target blockchain to the target user when the target user does not have the access right; calculates the comprehensive authority value of the target user to the target data based on the authority value of the target user to the data characteristic value, the weight and adjustment factor corresponding to each authority value, and the location and timestamp of the target user making the data request when the target user has the access right; determines that the target user does not have the authority to obtain the target data when the comprehensive authority value is less than or equal to a preset threshold, and prohibits sending the target data on the target blockchain to the target user; determines that the target user has the authority to obtain the target data when the comprehensive authority value is greater than the preset threshold, and sends the target data on the target blockchain to the target user. The present disclosure can generate a signature value based on the user's information, verify whether the user has the access right to the target blockchain based on the signature value, and after determining that the user has the access right to the target blockchain, determine the user's comprehensive authority value for the requested target data based on the user's information, and after the comprehensive authority value reaches the preset requirement, determine that the user has the right to obtain the target data, and finally send the target data on the target blockchain to the user. It can determine whether the user has the right to obtain the target data on the blockchain by verifying the user information twice, and can accurately authenticate the user's data acquisition authority on the blockchain, thereby improving the authentication accuracy of data authority on the blockchain and improving the security of data on the blockchain. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0024] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0025] Figure 1 is a flow chart of an identity authority authentication method provided by an embodiment of the present disclosure;

[0026] Figure 2 It is a structural diagram of an identity authority authentication device provided by an embodiment of the present disclosure;

[0027] Figure 3 It is a structural diagram of a computer device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0029] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0030] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0031] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0032] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0033] The identity authority authentication method provided in the embodiment of the present disclosure can be executed by a computer device, which can be understood as any device with processing and computing capabilities. The device can include but is not limited to mobile terminals such as smart phones, laptops, personal digital assistants (PDAs), tablet computers (PADs), etc., as well as fixed electronic devices such as digital TVs, desktop computers, etc.

[0034] In order to better understand the inventive concept of the embodiments of the present disclosure, the technical solutions of the embodiments of the present disclosure are described below in conjunction with exemplary embodiments.

[0035] Figure 1 1 is a flowchart of an identity authentication method provided by an embodiment of the present disclosure. The method can be executed by a computer device, which can be understood as any device with computing and processing capabilities. Figure 1 As shown, the identity authority authentication method provided in this embodiment includes the following steps:

[0036] Step 110: In response to receiving a data request from a target user for a target blockchain, a signature value of the target user is generated based on a private key of the target user, a timestamp of the data request, and a data feature value of the requested target data.

[0037] In the disclosed embodiment, the user can be understood as a user terminal. The target user sends a data request for the target blockchain to the computer device through the user terminal, and the computer device can, in response to receiving the data request for the target blockchain from the target user, obtain the target user's private key, the timestamp of the data request, and the data characteristic value of the requested target data from the data request, and generate the signature value of the target user based on the target user's private key, the timestamp of the data request, and the data characteristic value of the requested target data.

[0038] The timestamp of a data request can be understood as the time when the data request was generated.

[0039] In some embodiments, the computer device can generate a random seed, input the target user's private key, the timestamp of the data request, the data feature value of the requested target data and the random seed into a preset signature generation model, and generate a signature value of the target user based on the signature generation model.

[0040] A random seed can be understood as a random number.

[0041] Specifically, generating the signature value of the target user based on the signature generation model may include S11-S15:

[0042] S11. Perform a connection operation on the data characteristic value of the target user and the timestamp of the data request to obtain a connected message value.

[0043] S12. Based on the private key, message value and random seed of the target user, calculate the third function value corresponding to the third nested transformation function in the signature generation model.

[0044] S13. Based on the third function value, the private key of the target user, the message value and the random seed, calculate the second function value corresponding to the second nested transformation function in the signature generation model.

[0045] S14. Based on the second function value, the private key of the target user and the random seed, calculate the first function value corresponding to the first nested transformation function in the signature generation model.

[0046] S15. Determine the first function value as the signature value of the target user.

[0047] For example, the above signature generation model may include formula (1):

[0048] NestedTransform(S u , M, γ)

[0049] =Transform1(S u , Transform2(S u , Transform3(S u , M,γ),γ),γ)

[0050] M=R||T (1);

[0051] Among them, NestedTransform(S u , M, γ) represents the signature value of the target user;

[0052] || indicates a connection operation;

[0053] M represents the message value after the data characteristic value of the target data and the timestamp of the data request are connected;

[0054] γ represents the random seed;

[0055] R represents the data characteristic value of the requested target data;

[0056] T represents the timestamp of the data request;

[0057] Transform1 represents the first nested transformation function;

[0058] Transform2 represents the second nested transformation function;

[0059] Transform3 represents the third nested transform function.

[0060] The third nested transformation function may include formula (2):

[0061]

[0062] Where N represents a large prime number, which is used for modulus operation;

[0063] mod represents the modulo operation.

[0064] The second nested transformation function may include formula (3):

[0065]

[0066] The first nested transformation function may include formula (4):

[0067]

[0068] Therefore, the user's signature value is generated through multi-layer nested nonlinear transformation of the user's various information and random numbers, making the generated signature more unpredictable, increasing the difficulty for attackers to reverse engineer the user's signature, increasing the complexity of the user's signature value, and improving the security of the user's signature value. In turn, the user's data access rights on the blockchain can be accurately authenticated, thereby improving the authentication accuracy of data permissions on the blockchain and the security of data.

[0069] Step 120: Based on the signature value, verify whether the target user has access rights to the target blockchain.

[0070] In the disclosed embodiment, after generating the signature value of the target user, the computer device can verify whether the target user has access rights to the target blockchain based on the signature value of the target user.

[0071] Specifically, the computer device may verify whether the signature value of the target user is within the preset signature value range corresponding to the authorized user of the target blockchain, where the authorized user may be understood as a user with access rights to the target blockchain;

[0072] If the signature value of the target user is within the preset signature value range corresponding to the authorized user of the target blockchain, it can be determined that the target user has the access rights to the target blockchain;

[0073] If the signature value of the target user is not within the preset signature value range corresponding to the authorized user of the target blockchain, it can be determined that the target user does not have access rights to the target blockchain.

[0074] The preset signature value range can be set as needed and is not limited here.

[0075] Step 130: When the target user does not have access rights, it is prohibited to send the target data on the target blockchain to the target user.

[0076] In the disclosed embodiment, when the target user does not have access rights to the target blockchain, the computer device may prohibit sending the target data on the target blockchain to the target user.

[0077] Step 140: When the target user has the access right, the comprehensive authority value of the target user to the target data is calculated based on the authority value of the target user to the data feature value, the weight and adjustment factor corresponding to each authority value, and the location and timestamp of the target user's data request.

[0078] In the disclosed embodiment, when the target user has access rights, the computer device can obtain from the data request the target user's permission value for the data characteristic value, the weight and adjustment factor corresponding to each permission value, and the location where the target user makes the data request, and calculate the target user's comprehensive permission value for the target data based on the target user's permission value for the data characteristic value, the weight and adjustment factor corresponding to each permission value, and the location and timestamp of the target user's data request.

[0079] The location where the target user makes a data request can be understood as the geographical location where the target user is located when making the data request.

[0080] In some embodiments, the above calculation of the comprehensive authority value of the target user for the target data based on the authority value of the target user for the data feature value, the weight and adjustment factor corresponding to each authority value, and the location and timestamp of the target user's data request may include steps 1401-1402:

[0081] Step 1401, calculate the number of target user's authority values ​​for data feature values, the first mean and first variance of the authority values, the second mean and second variance of the timestamp of the data request, and the third mean and third variance of the location where the target user makes the data request.

[0082] Among them, the first mean is the average value of the target user's authority value for the data feature value;

[0083] The first variance is the variance of the target user's authority value for the data feature value;

[0084] The second mean is the average of the timestamps of the data requests;

[0085] The second variance is the variance of the timestamp of the data request;

[0086] The third mean is the average value of the locations where the target users make data requests;

[0087] The third party variance is the variance of the location where the target user makes the data request.

[0088] Step 1402: input the target user's authority value for the data feature value, the weight and adjustment factor of each authority value, the location where the target user makes a data request and the timestamp of the data request, the number of authority values, the first mean and the first variance, the second mean and the second variance, and the third mean and the third variance into a preset comprehensive authority value calculation model, and generate a comprehensive authority value for the target user based on the comprehensive authority value calculation model.

[0089] For example, the above comprehensive authority value calculation model may include formula (5):

[0090]

[0091] Among them, X represents the comprehensive authority value of the target user;

[0092] α i Represents the weight corresponding to the i-th permission value;

[0093] n represents the number of target users’ permission values ​​for data feature values;

[0094] P i (u, d) represents the i-th permission value of target user u to data feature value d;

[0095] σp represents the first variance of the authority value;

[0096] μp represents the first mean of the authority value;

[0097] T represents the timestamp of the data request;

[0098] μT represents the second mean of the timestamp;

[0099] σ T Represents the second variance of the timestamp;

[0100] L represents the location where the target user makes the data request;

[0101] μL represents the third mean of the position;

[0102] σ L The third difference representing the position;

[0103] β′ j Represents the weight corresponding to the i-th permission value;

[0104] α j represents the first adjustment factor corresponding to the j-th authority value;

[0105] P j (u, d) represents the jth permission value of target user u to data feature value d;

[0106] β j represents the second adjustment factor corresponding to the j-th authority value;

[0107] γ′ j Indicates the third adjustment factor corresponding to the j-th authority value.

[0108] Therefore, by calculating the user's comprehensive authority value for the requested target data through various information of the user, the comprehensiveness of the authority value calculation is improved, and then the user's data acquisition authority on the blockchain can be accurately authenticated, thereby improving the authentication accuracy of data permissions on the blockchain and the security of data.

[0109] Step 150: When the comprehensive authority value is less than or equal to the preset threshold, it is determined that the target user does not have the authority to obtain the target data, and the target data on the target blockchain is prohibited from being sent to the target user.

[0110] In the embodiment of the present disclosure, when the comprehensive authority value of the target user to the target data is less than or equal to a preset threshold, the computer device can determine that the target user does not have the authority to obtain the target data, and prohibit the target data on the target blockchain from being sent to the target user.

[0111] The preset threshold can be set as needed and is not limited here.

[0112] Step 160: When the comprehensive authority value is greater than a preset threshold, it is determined that the target user has the authority to obtain the target data, and the target data on the target blockchain is sent to the target user.

[0113] In the disclosed embodiment, when the comprehensive authority value of the target user to the target data is greater than a preset threshold, the computer device can determine that the target user has the authority to obtain the target data, and then send the target data on the target blockchain to the target user.

[0114] In the disclosed embodiment, a signature value is generated according to the user's information, and whether the user has the access right to the target blockchain is verified based on the signature value. After determining that the user has the access right to the target blockchain, the comprehensive authority value of the user to the requested target data is determined based on the user's information. After the comprehensive authority value reaches the preset requirement, it is determined that the user has the right to obtain the target data. Finally, the target data on the target blockchain is sent to the user. Whether the user has the right to obtain the target data on the blockchain can be determined by verifying the user information twice, and the user's data acquisition authority on the blockchain can be accurately authenticated, thereby improving the authentication accuracy of data permissions on the blockchain and improving the security of data on the blockchain.

[0115] Figure 2 Schematic diagram of the structure of an identity authentication device provided by an embodiment of the present disclosure, which can be understood as the above-mentioned computer device or some functional modules in the above-mentioned computer device. Figure 2 As shown, the identity authority authentication device 200 includes:

[0116] A generation module 210, configured to generate a signature value of the target user in response to receiving a data request of the target user for the target blockchain, based on the private key of the target user, the timestamp of the data request, and the data feature value of the requested target data;

[0117] A verification module 220 is used to verify whether the target user has access rights to the target blockchain based on the signature value;

[0118] A first prohibition module 230, used to prohibit the target data on the target blockchain from being sent to the target user when the target user does not have access rights;

[0119] A calculation module 240, for calculating the comprehensive authority value of the target user to the target data based on the authority value of the target user to the data feature value, the weight and adjustment factor corresponding to each authority value, and the location and timestamp of the target user's data request when the target user has the access authority;

[0120] The second prohibition module 250 is used to determine that the target user does not have the authority to obtain the target data when the comprehensive authority value is less than or equal to the preset threshold, and prohibit the target data on the target blockchain from being sent to the target user;

[0121] The sending module 260 is used to determine that the target user has the authority to obtain the target data when the comprehensive authority value is greater than a preset threshold, and send the target data on the target blockchain to the target user.

[0122] Optionally, the above generation module includes:

[0123] The first generation submodule is used to generate a random seed;

[0124] The second generation submodule is used to input the private key, timestamp, data feature value and random seed into a preset signature generation model, and generate a signature value of the target user based on the signature generation model.

[0125] Optionally, the second generation submodule includes:

[0126] A connection unit, used for performing a connection operation on the data characteristic value and the timestamp to obtain a connected message value;

[0127] A first calculation unit, configured to calculate a third function value corresponding to a third nested transformation function in a signature generation model based on a private key, a message value, and a random seed;

[0128] A second calculation unit, configured to calculate a second function value corresponding to a second nested transformation function in the signature generation model based on the third function value, the private key, the message value, and the random seed;

[0129] A third calculation unit, configured to calculate a first function value corresponding to a first nested transformation function in a signature generation model based on the second function value, a private key, and a random seed;

[0130] A determining unit is used to determine the first function value as the signature value of the target user.

[0131] Optionally, the signature generation model includes:

[0132] NestedTransform(S u, M, γ)

[0133] =Transform1(S u , Transform2(S u , Transform3(S u , M,γ),γ),γ)

[0134] M = R || T;

[0135] Among them, NestedTransform(S u , M, γ) represents the signature value of the target user; || represents the connection operation; M represents the message value after the data feature value and the timestamp are connected; γ represents the random seed; R represents the data feature value; T represents the timestamp; Transform1 represents the first nested transformation function; Transform2 represents the second nested transformation function; Transform3 represents the third nested transformation function;

[0136] The third nested transformation function includes:

[0137]

[0138] Wherein, N represents a large prime number, which is used for modulo operation; mod represents modulo operation;

[0139] The second nested transformation function includes:

[0140]

[0141] The first nested transformation function includes:

[0142]

[0143] Optionally, the verification module includes:

[0144] The verification submodule is used to verify whether the signature value is within the preset signature value range corresponding to the authorized user of the target blockchain. The authorized user is a user with access rights to the target blockchain.

[0145] A first determination submodule, for determining that if yes, the target user has access rights to the target blockchain;

[0146] The second determination submodule is used to determine that the target user does not have access rights to the target blockchain.

[0147] Optionally, the above-mentioned calculation module includes:

[0148] A calculation submodule, used to calculate the number of authority values, a first mean and a first variance of the authority values, a second mean and a second variance of the timestamps, and a third mean and a third variance of the positions;

[0149] The third generation submodule is used to input the authority value, the weight and adjustment factor of each authority value, the location and timestamp, the quantity, the first mean and the first variance, the second mean and the second variance, the third mean and the third variance into a preset comprehensive authority value calculation model, and generate the comprehensive authority value of the target user based on the comprehensive authority value calculation model.

[0150] Optionally, the above comprehensive authority value calculation model includes:

[0151]

[0152] Among them, X represents the comprehensive authority value of the target user; α i represents the weight corresponding to the i-th permission value; n represents the number of permission values ​​of the target user for the data feature value; P i (u, d) represents the i-th permission value of target user u to data feature value d; σ p represents the first variance of the authority value; μp represents the first mean of the authority value; T represents the timestamp of the data request; μT represents the second mean of the timestamp; σ T represents the second variance of the timestamp; L represents the location where the target user makes a data request; μ L represents the third mean of the position; σ L represents the third difference of the position; β′ j Represents the weight corresponding to the jth permission value; α j represents the first adjustment factor corresponding to the jth authority value; P j (u, d) represents the jth permission value of target user u to data feature value d; β j represents the second adjustment factor corresponding to the jth authority value; γ j Indicates the third adjustment factor corresponding to the j-th authority value.

[0153] The identity and authority authentication device provided in the embodiments of the present disclosure can implement the method of any of the above embodiments, and its execution method and beneficial effects are similar, which will not be repeated here.

[0154] The embodiments of the present disclosure also provide a computer device, which includes a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the method of any of the above embodiments can be implemented, and its execution method and beneficial effects are similar and will not be repeated here.

[0155] Figure 3 is a schematic diagram of the structure of a computer device provided by an embodiment of the present disclosure, such as Figure 3As shown, the computer device 300 may include a processor 310 and a memory 320, wherein the memory 320 stores a computer program 321, and when the computer program 321 is executed by the processor 310, the method provided by any of the above embodiments can be implemented, and its execution method and beneficial effects are similar, which will not be repeated here.

[0156] Of course, to simplify, Figure 3 Only some of the components related to the present invention in the computer device 300 are shown, and components such as a bus, an input / output interface, an input device, and an output device are omitted. In addition, according to specific application conditions, the computer device 300 may also include any other appropriate components.

[0157] An embodiment of the present disclosure provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the method of any of the above embodiments can be implemented. The execution method and beneficial effects are similar and will not be repeated here.

[0158] The above-mentioned computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0159] The computer program may be written in any combination of one or more programming languages ​​to write program codes for performing the operations of the disclosed embodiments, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the target user computer device, partially on the target user device, as a separate software package, partially on the target user computer device and partially on a remote computer device, or entirely on a remote computer device or server.

[0160] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0161] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0162] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for identity authentication, characterized in that: include: In response to receiving a data request from a target user for a target blockchain, generating a signature value of the target user based on a private key of the target user, a timestamp of the data request, and a data feature value of the requested target data; Based on the signature value, verify whether the target user has access rights to the target blockchain; When the target user does not have the access right, it is prohibited to send the target data on the target blockchain to the target user; When the target user has the access authority, based on the target user's authority value for the data feature value, the weight and adjustment factor corresponding to each of the authority values, the location where the target user makes a data request, and the timestamp, calculate the target user's comprehensive authority value for the target data; When the comprehensive authority value is less than or equal to the preset threshold, it is determined that the target user does not have the authority to obtain the target data, and the target data on the target blockchain is prohibited from being sent to the target user; When the comprehensive authority value is greater than the preset threshold, it is determined that the target user has the authority to obtain the target data, and the target data on the target blockchain is sent to the target user.

2. The method according to claim 1, characterized in that: The generating the signature value of the target user based on the private key of the target user, the timestamp of the data request, and the data characteristic value of the requested target data includes: Generate a random seed; The private key, the timestamp, the data characteristic value and the random seed are input into a preset signature generation model, and a signature value of the target user is generated based on the signature generation model.

3. The method according to claim 2, characterized in that The step of inputting the private key, the timestamp, the data feature value, and the random seed into a preset signature generation model, and generating the signature value of the target user based on the signature generation model includes: Performing a concatenation operation on the data characteristic value and the timestamp to obtain a concatenated message value; Calculate, based on the private key, the message value and the random seed, a third function value corresponding to a third nested transformation function in the signature generation model; Calculate a second function value corresponding to a second nested transformation function in the signature generation model based on the third function value, the private key, the message value, and the random seed; Calculate a first function value corresponding to a first nested transformation function in the signature generation model based on the second function value, the private key and the random seed; The first function value is determined as the signature value of the target user.

4. The method according to claim 3, characterized in that The signature generation model includes: NestedTransform(S u ,M,γ) =Transform1(S u ,Transform2(S u ,Transform3(S u ,M,c),c),c) M = R||T; Among them, NestedTransform(S u , M, γ) represents the signature value of the target user; || represents a connection operation; M represents the message value after the data feature value and the timestamp are connected; γ represents a random seed; R represents the data feature value; T represents the timestamp; Transform1 represents the first nested transformation function; Transform2 represents the second nested transformation function; Transform3 represents the third nested transformation function; The third nested transformation function comprises: Wherein, N represents a large prime number, which is used for modulo operation; mod represents modulo operation; The second nested transformation function comprises: The first nested transformation function comprises:

5. The method according to claim 1, characterized in that The verifying, based on the signature value, whether the target user has access rights to the target blockchain includes: Verify whether the signature value is within a preset signature value range corresponding to an authorized user of the target blockchain, where the authorized user is a user with access rights to the target blockchain; If yes, it is determined that the target user has access rights to the target blockchain; Otherwise, it is determined that the target user does not have access rights to the target blockchain.

6. The method according to claim 1, characterized in that The calculating the comprehensive authority value of the target user for the target data based on the authority value of the target user for the data feature value, the weight and adjustment factor corresponding to each of the authority values, the location where the target user makes a data request, and the timestamp includes: Calculate the number of the authority values, a first mean and a first variance of the authority values, a second mean and a second variance of the timestamps, and a third mean and a third variance of the positions; The authority value, the weight and adjustment factor of each authority value, the location and the timestamp, the quantity, the first mean and the first variance, the second mean and the second variance, the third mean and the third variance are input into a preset comprehensive authority value calculation model, and the comprehensive authority value of the target user is generated based on the comprehensive authority value calculation model.

7. The method according to claim 6, characterized in that The comprehensive authority value calculation model includes: Wherein, X represents the comprehensive authority value of the target user; α i represents the weight corresponding to the i-th permission value; n represents the number of the target user's permission values ​​for the data feature value; P i (u, d) represents the i-th permission value of the target user u to the data feature value d; σ p Represents the first variance of the authority value; μ p represents the first mean value of the permission value; T represents the timestamp of the data request; μ T represents the second mean of the timestamp; σ T represents the second variance of the timestamp; L represents the location where the target user makes a data request; μ L represents the third mean of the position; σ L represents the third difference of the position; β′ j Represents the weight corresponding to the jth permission value; α j represents the first adjustment factor corresponding to the jth authority value; P j (u, d) represents the jth permission value of target user u to data feature value d; β j Represents the second adjustment factor corresponding to the jth authority value; γ′ j Indicates the third adjustment factor corresponding to the j-th authority value.

8. An identity and authority authentication device, characterized in that: include: A generation module, configured to generate, in response to receiving a data request from a target user for a target blockchain, a signature value of the target user based on a private key of the target user, a timestamp of the data request, and a data feature value of the requested target data; A verification module, used to verify whether the target user has access rights to the target blockchain based on the signature value; A first prohibition module, configured to prohibit the target data on the target blockchain from being sent to the target user when the target user does not have the access permission; a calculation module, configured to calculate, when the target user has the access permission, a comprehensive permission value of the target user to the target data based on the permission value of the target user to the data feature value, the weight and adjustment factor corresponding to each of the permission values, the location where the target user makes a data request, and the timestamp; A second prohibition module is used to determine that the target user does not have the permission to obtain the target data when the comprehensive authority value is less than or equal to the preset threshold, and prohibit the target data on the target blockchain from being sent to the target user; A sending module is used to determine that the target user has the authority to obtain the target data when the comprehensive authority value is greater than a preset threshold, and send the target data on the target blockchain to the target user.

9. A computer device, characterized in that: include: A memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the identity authority authentication method as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the identity authority authentication method according to any one of claims 1 to 7 is implemented.

Images