Identity authority authentication method, device, equipment and storage medium

Abstract

The present disclosure relates to an identity authority authentication method, apparatus, device, and storage medium. The present disclosure can generate a signature value based on user information, verify whether the user has access rights to a target blockchain based on the signature value, and after determining that the user has access rights to the target blockchain, determine the user's comprehensive authority value for the requested target data based on the user information. After the comprehensive authority value meets a preset requirement, determine that the user has access rights to the target data, and finally send the target data on the target blockchain to the user. Whether the user has access rights to the target data on the blockchain can be determined by verifying the user information twice, and the user's data access rights on the blockchain can be accurately authenticated, thereby improving the authentication accuracy of data rights on the blockchain and improving the security of data on the blockchain.

Description

Technical Field

[0001] The present disclosure relates to the field of blockchain technology, and in particular to an identity and authority authentication method, apparatus, device, and storage medium. Background Art

[0002] Blockchain is a decentralized, tamper-proof, and secure ledger. It combines distributed storage, peer-to-peer transmission, consensus mechanisms, and cryptography to record transactions and information through a growing chain of blocks, ensuring data security and transparency. Blockchain is used to securely record and verify transactions and data and is now widely used in various fields.

[0003] However, existing technologies are unable to accurately authenticate users' data access permissions on the blockchain, reducing the security of data on the blockchain. Summary of the Invention

[0004] In order to solve the above technical problems, the present disclosure provides an identity authority authentication method, device, equipment and storage medium.

[0005] A first aspect of the present disclosure provides an identity and authority authentication method, comprising:

[0006] In response to receiving a data request from a target user for a target blockchain, generating a signature value of the target user based on the target user's private key, the timestamp of the data request, and the data feature value of the requested target data;

[0007] Based on the signature value, verify whether the target user has access rights to the target blockchain;

[0008] When the target user does not have access rights, it is prohibited to send the target data on the target blockchain to the target user;

[0009] When the target user has access rights, the target user's comprehensive permission value for the target data is calculated based on the target user's permission value for the data feature value, the weight and adjustment factor corresponding to each permission value, and the location and timestamp of the target user's data request;

[0010] When the comprehensive authority value is less than or equal to the preset threshold, it is determined that the target user does not have the authority to obtain the target data, and the target data on the target blockchain is prohibited from being sent to the target user;

[0011] When the comprehensive authority value is greater than the preset threshold, it is determined that the target user has the authority to obtain the target data, and the target data on the target blockchain is sent to the target user.

[0012] A second aspect of the present disclosure provides an identity and authority authentication device, comprising:

[0013] a generation module for, in response to receiving a data request from a target user for a target blockchain, generating a signature value of the target user based on a private key of the target user, a timestamp of the data request, and a data feature value of the requested target data;

[0014] The verification module is used to verify whether the target user has access rights to the target blockchain based on the signature value;

[0015] A first prohibition module is used to prohibit the target data on the target blockchain from being sent to the target user when the target user does not have access rights;

[0016] a calculation module, configured to calculate, when the target user has access rights, a comprehensive authority value of the target user to the target data based on the authority value of the target user to the data feature value, the weight and adjustment factor corresponding to each authority value, and the location and timestamp of the target user's data request;

[0017] The second prohibition module is used to determine that the target user does not have the permission to obtain the target data when the comprehensive permission value is less than or equal to the preset threshold, and prohibit the target data on the target blockchain from being sent to the target user;

[0018] The sending module is used to determine that the target user has the authority to obtain the target data when the comprehensive authority value is greater than a preset threshold, and send the target data on the target blockchain to the target user.

[0019] A third aspect of the present disclosure provides a computer device, including a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the identity and authority authentication method of the first aspect can be implemented.

[0020] A fourth aspect of the present disclosure provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the identity and authority authentication method of the first aspect can be implemented.

[0021] The technical solution provided by the present disclosure has the following advantages compared with the existing technology:

[0022] The present disclosure generates a signature value of the target user in response to receiving a data request from the target user for the target blockchain based on the target user's private key, the timestamp of the data request, and the data characteristic value of the requested target data; verifies whether the target user has access rights to the target blockchain based on the signature value; when the target user does not have access rights, prohibits sending the target data on the target blockchain to the target user; when the target user has access rights, calculates the comprehensive authority value of the target user to the target data based on the target user's authority value for the data characteristic value, the weight and adjustment factor corresponding to each authority value, and the location and timestamp of the target user's data request; when the comprehensive authority value is less than or equal to a preset threshold, determines that the target user does not have the authority to obtain the target data, and prohibits sending the target data on the target blockchain to the target user; when the comprehensive authority value is greater than the preset threshold, determines that the target user has the authority to obtain the target data, and sends the target data on the target blockchain to the target user. The present disclosure can generate a signature value based on the user's information, verify whether the user has the access right to the target blockchain based on the signature value, and after determining that the user has the access right to the target blockchain, determine the user's comprehensive authority value for the requested target data based on the user's information. After the comprehensive authority value reaches the preset requirement, determine that the user has the access right to the target data, and finally send the target data on the target blockchain to the user. Whether the user has the access right to the target data on the blockchain can be determined by verifying the user information twice, and the user's data access right on the blockchain can be accurately authenticated, thereby improving the authentication accuracy of data rights on the blockchain and improving the security of data on the blockchain. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0024] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0025] Figure 1 This is a flow chart of an identity authority authentication method provided by an embodiment of the present disclosure;

[0026] Figure 2 This is a structural diagram of an identity and authority authentication device provided by an embodiment of the present disclosure;

[0027] Figure 3 It is a structural diagram of a computer device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features therein can be combined with each other in the absence of conflict.

[0029] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0030] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0031] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0032] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0033] The identity authority authentication method provided in the embodiments of the present disclosure can be executed by a computer device, which can be understood as any device with processing and computing capabilities. The device can include but is not limited to mobile terminals such as smart phones, laptops, personal digital assistants (PDAs), tablet computers (PADs), etc., as well as fixed electronic devices such as digital TVs and desktop computers.

[0034] In order to better understand the inventive concept of the embodiments of the present disclosure, the technical solutions of the embodiments of the present disclosure are described below in conjunction with exemplary embodiments.

[0035] Figure 1 This is a flow chart of an identity authentication method provided by an embodiment of the present disclosure. This method can be executed by a computer device, which can be understood as any device with computing and processing capabilities. Figure 1 As shown, the identity authority authentication method provided in this embodiment includes the following steps:

[0036] Step 110: In response to receiving a data request from a target user for a target blockchain, a signature value of the target user is generated based on the target user's private key, the timestamp of the data request, and the data feature value of the requested target data.

[0037] In the embodiments of the present disclosure, the term "user" may be understood as a user terminal. A target user may send a data request for a target blockchain to a computer device via the user terminal. In response to receiving the data request for the target blockchain from the target user, the computer device may obtain the target user's private key, the timestamp of the data request, and the data characteristic value of the requested target data from the data request, and generate a signature value of the target user based on the target user's private key, the timestamp of the data request, and the data characteristic value of the requested target data.

[0038] The timestamp of a data request can be understood as the time when the data request was generated.

[0039] In some embodiments, the computer device can generate a random seed, input the target user's private key, the timestamp of the data request, the data feature value of the requested target data and the random seed into a preset signature generation model, and generate the signature value of the target user based on the signature generation model.

[0040] A random seed can be understood as a random number.

[0041] Specifically, generating the signature value of the target user based on the signature generation model may include S11-S15:

[0042] S11. Perform a concatenation operation on the target user's data feature value and the timestamp of the data request to obtain a concatenated message value.

[0043] S12. Calculate the third function value corresponding to the third nested transformation function in the signature generation model based on the target user's private key, message value, and random seed.

[0044] S13. Calculate a second function value corresponding to the second nested transformation function in the signature generation model based on the third function value, the target user's private key, the message value, and the random seed.

[0045] S14. Calculate a first function value corresponding to the first nested transformation function in the signature generation model based on the second function value, the target user's private key, and the random seed.

[0046] S15. Determine the first function value as the signature value of the target user.

[0047] For example, the signature generation model may include formula (1):

[0048] NestedTransform(S u , M, γ)

[0049] =Transform1(S u , Transform2(S u , Transform3(S u , M, γ), γ), γ)

[0050] M=R||T (1);

[0051] Among them, NestedTransform(S u , M,γ) represents the signature value of the target user;

[0052] || indicates a connection operation;

[0053] M represents the message value after the data characteristic value of the target data and the timestamp of the data request are connected;

[0054] γ represents the random seed;

[0055] R represents the data characteristic value of the requested target data;

[0056] T represents the timestamp of the data request;

[0057] Transform1 represents the first nested transformation function;

[0058] Transform2 represents the second nested transformation function;

[0059] Transform3 represents the third nested transformation function.

[0060] The third nested transformation function may include formula (2):

[0061]

[0062] Where N represents a large prime number, which is used for modulo operation;

[0063] mod represents the modulo operation.

[0064] The second nested transformation function may include formula (3):

[0065]

[0066] The first nested transformation function may include formula (4):

[0067]

[0068] Therefore, the user's signature value is generated by multi-layer nested nonlinear transformation of the user's various information and random numbers, making the generated signature more unpredictable, increasing the difficulty for attackers to reverse engineer the user's signature, increasing the complexity of the user's signature value, and improving the security of the user's signature value. In turn, the user's data access rights on the blockchain can be accurately authenticated, thereby improving the authentication accuracy of data permissions on the blockchain and the security of data.

[0069] Step 120: Based on the signature value, verify whether the target user has access rights to the target blockchain.

[0070] In the embodiment of the present disclosure, after generating the signature value of the target user, the computer device can verify whether the target user has access rights to the target blockchain based on the signature value of the target user.

[0071] Specifically, the computer device can verify whether the signature value of the target user is within the preset signature value range corresponding to the authorized user of the target blockchain. The authorized user can be understood as a user with access rights to the target blockchain;

[0072] If the target user's signature value is within the preset signature value range corresponding to the authorized user of the target blockchain, it can be determined that the target user has access rights to the target blockchain;

[0073] If the signature value of the target user is not within the preset signature value range corresponding to the authorized user of the target blockchain, it can be determined that the target user does not have access rights to the target blockchain.

[0074] The preset signature value range can be set as needed and is not limited here.

[0075] Step 130: When the target user does not have access rights, it is prohibited to send the target data on the target blockchain to the target user.

[0076] In an embodiment of the present disclosure, when a target user does not have access rights to a target blockchain, the computer device may prohibit sending target data on the target blockchain to the target user.

[0077] Step 140: When the target user has the access right, the comprehensive authority value of the target user to the target data is calculated based on the authority value of the target user to the data feature value, the weight and adjustment factor corresponding to each authority value, and the location and timestamp of the target user's data request.

[0078] In an embodiment of the present disclosure, when the target user has access rights, the computer device can obtain the target user's permission value for the data feature value, the weight and adjustment factor corresponding to each permission value, and the location where the target user makes the data request from the data request, and calculate the target user's comprehensive permission value for the target data based on the target user's permission value for the data feature value, the weight and adjustment factor corresponding to each permission value, and the location and timestamp of the target user's data request.

[0079] The location where the target user makes a data request can be understood as the geographical location where the target user is located when making the data request.

[0080] In some embodiments, the calculation of the target user's comprehensive authority value for the target data based on the target user's authority value for the data feature value, the weight and adjustment factor corresponding to each authority value, and the location and timestamp of the target user's data request may include steps 1401-1402:

[0081] Step 1401: Calculate the number of target user's authority values ​​for data feature values, the first mean and first variance of the authority values, the second mean and second variance of the timestamp of the data request, and the third mean and third variance of the location where the target user makes the data request.

[0082] Among them, the first mean is the average value of the target user's authority value for the data feature value;

[0083] The first variance is the variance of the target user's authority value on the data feature value;

[0084] The second mean is the average of the timestamps of the data requests;

[0085] The second variance is the variance of the timestamp of the data request;

[0086] The third mean is the average of the locations where the target user makes data requests;

[0087] The third-party variance is the variance of the location where the target user makes the data request.

[0088] Step 1402: Input the target user's authority value for the data feature value, the weight and adjustment factor of each authority value, the location where the target user makes a data request and the timestamp of the data request, the number of authority values, the first mean and the first variance, the second mean and the second variance, and the third mean and the third variance into a preset comprehensive authority value calculation model, and generate a comprehensive authority value for the target user based on the comprehensive authority value calculation model.

[0089] For example, the above comprehensive authority value calculation model may include formula (5):

[0090]

[0091] Where X represents the comprehensive authority value of the target user;

[0092] α i Indicates the weight corresponding to the i-th permission value;

[0093] n represents the number of target users’ permission values ​​for data feature values;

[0094] P i (u, d) represents the i-th permission value of target user u to data feature value d;

[0095] σp represents the first variance of the authority value;

[0096] μp represents the first mean of the authority value;

[0097] T represents the timestamp of the data request;

[0098] μT represents the second mean of the timestamp;

[0099] σ T Represents the second variance of the timestamp;

[0100] L represents the location where the target user makes the data request;

[0101] μL represents the third mean of the position;

[0102] σ L The third difference of the position;

[0103] β′ j Indicates the weight corresponding to the i-th permission value;

[0104] α j Indicates the first adjustment factor corresponding to the j-th authority value;

[0105] P j (u, d) represents the jth permission value of target user u to data feature value d;

[0106] β j Indicates the second adjustment factor corresponding to the j-th authority value;

[0107] γ′ j Indicates the third adjustment factor corresponding to the j-th authority value.

[0108] Therefore, by calculating the user's comprehensive authority value for the requested target data based on various information of the user, the comprehensiveness of the authority value calculation is improved, and the user's data acquisition authority on the blockchain can be accurately authenticated, thereby improving the authentication accuracy of data permissions on the blockchain and the security of data.

[0109] Step 150: When the comprehensive authority value is less than or equal to the preset threshold, it is determined that the target user does not have the authority to obtain the target data, and the target data on the target blockchain is prohibited from being sent to the target user.

[0110] In an embodiment of the present disclosure, when the target user's comprehensive authority value for the target data is less than or equal to a preset threshold, the computer device may determine that the target user does not have the authority to obtain the target data and prohibit the target data on the target blockchain from being sent to the target user.

[0111] The preset threshold can be set as needed and is not limited here.

[0112] Step 160: When the comprehensive authority value is greater than the preset threshold, it is determined that the target user has the authority to obtain the target data, and the target data on the target blockchain is sent to the target user.

[0113] In an embodiment of the present disclosure, when the target user's comprehensive authority value for the target data is greater than a preset threshold, the computer device can determine that the target user has the authority to obtain the target data, and then send the target data on the target blockchain to the target user.

[0114] In the disclosed embodiment, a signature value is generated according to the user's information, and whether the user has the access right to the target blockchain is verified based on the signature value. After determining that the user has the access right to the target blockchain, the comprehensive permission value of the user to the requested target data is determined based on the user's information. After the comprehensive permission value reaches the preset requirement, it is determined that the user has the permission to obtain the target data. Finally, the target data on the target blockchain is sent to the user. Whether the user has the permission to obtain the target data on the blockchain can be determined by verifying the user information twice, and the user's permission to obtain data on the blockchain can be accurately authenticated, thereby improving the authentication accuracy of data permissions on the blockchain and improving the security of data on the blockchain.

[0115] Figure 2 This is a schematic diagram of the structure of an identity authentication device provided by an embodiment of the present disclosure. The device can be understood as the above-mentioned computer device or some functional modules in the above-mentioned computer device. Figure 2 As shown, the identity and authority authentication device 200 includes:

[0116] A generation module 210 is configured to generate a signature value of the target user based on the target user's private key, the timestamp of the data request, and the data feature value of the requested target data in response to receiving a data request from the target user for the target blockchain;

[0117] Verification module 220, used to verify whether the target user has access rights to the target blockchain based on the signature value;

[0118] A first prohibition module 230 is configured to prohibit the target data on the target blockchain from being sent to the target user when the target user does not have access rights;

[0119] Calculation module 240, configured to calculate the target user's comprehensive authority value for the target data based on the target user's authority value for the data feature value, the weight and adjustment factor corresponding to each authority value, and the location and timestamp of the target user's data request, when the target user has access rights;

[0120] The second prohibition module 250 is configured to, when the comprehensive authority value is less than or equal to a preset threshold, determine that the target user does not have the authority to obtain the target data, and prohibit the target data on the target blockchain from being sent to the target user;

[0121] The sending module 260 is used to determine that the target user has the authority to obtain the target data when the comprehensive authority value is greater than a preset threshold, and send the target data on the target blockchain to the target user.

[0122] Optionally, the generation module includes:

[0123] The first generation submodule is used to generate a random seed;

[0124] The second generation submodule is used to input the private key, timestamp, data characteristic value and random seed into a preset signature generation model, and generate a signature value of the target user based on the signature generation model.

[0125] Optionally, the second generation submodule includes:

[0126] A connection unit, used to perform a connection operation on the data characteristic value and the timestamp to obtain a connected message value;

[0127] A first calculation unit is configured to calculate a third function value corresponding to a third nested transformation function in the signature generation model based on the private key, the message value, and the random seed;

[0128] A second calculation unit is configured to calculate a second function value corresponding to a second nested transformation function in the signature generation model based on the third function value, the private key, the message value, and the random seed;

[0129] a third calculation unit, configured to calculate a first function value corresponding to the first nested transformation function in the signature generation model based on the second function value, the private key, and the random seed;

[0130] A determining unit is configured to determine the first function value as the signature value of the target user.

[0131] Optionally, the signature generation model includes:

[0132] NestedTransform(S u, M, γ)

[0133] =Transform1(S u , Transform2(S u , Transform3(S u , M, γ), γ), γ)

[0134] M=R||T;

[0135] Among them, NestedTransform(S u , M, γ) represents the signature value of the target user; || represents the concatenation operation; M represents the message value after the data feature value and the timestamp are concatenated; γ represents the random seed; R represents the data feature value; T represents the timestamp; Transform1 represents the first nested transformation function; Transform2 represents the second nested transformation function; Transform3 represents the third nested transformation function;

[0136] The third nested transformation function includes:

[0137]

[0138] Where N represents a large prime number, used for modulo operation; mod represents modulo operation;

[0139] The second nested transformation function includes:

[0140]

[0141] The first nested transformation function includes:

[0142]

[0143] Optionally, the verification module includes:

[0144] The verification submodule is used to verify whether the signature value is within the preset signature value range corresponding to the authorized user of the target blockchain. The authorized user is a user with access rights to the target blockchain;

[0145] A first determination submodule, configured to determine, if yes, whether the target user has access rights to the target blockchain;

[0146] The second determining submodule is used to determine that the target user does not have access rights to the target blockchain.

[0147] Optionally, the calculation module includes:

[0148] a calculation submodule, configured to calculate the number of authority values, a first mean and a first variance of the authority values, a second mean and a second variance of the timestamps, and a third mean and a third variance of the positions;

[0149] The third generation submodule is used to input the authority value, the weight and adjustment factor of each authority value, the location and timestamp, the quantity, the first mean and the first variance, the second mean and the second variance, and the third mean and the third variance into a preset comprehensive authority value calculation model, and generate the comprehensive authority value of the target user based on the comprehensive authority value calculation model.

[0150] Optionally, the above comprehensive authority value calculation model includes:

[0151]

[0152] Among them, X represents the comprehensive authority value of the target user; α i represents the weight corresponding to the i-th permission value; n represents the number of permission values ​​of the target user for the data feature value; P i (u, d) represents the i-th permission value of target user u to data feature value d; σ p represents the first variance of the authority value; μp represents the first mean of the authority value; T represents the timestamp of the data request; μT represents the second mean of the timestamp; σ T represents the second variance of the timestamp; L represents the location where the target user makes the data request; μ L represents the third mean of the position; σ L represents the third difference of the position; β′ j Indicates the weight corresponding to the jth permission value; α j P represents the first adjustment factor corresponding to the jth authority value; j (u, d) represents the jth permission value of target user u to data feature value d; β j represents the second adjustment factor corresponding to the j-th authority value; γ j Indicates the third adjustment factor corresponding to the j-th authority value.

[0153] The identity and authority authentication device provided in the embodiments of the present disclosure can implement the method of any of the above embodiments, and its execution method and beneficial effects are similar, which will not be repeated here.

[0154] An embodiment of the present disclosure also provides a computer device, which includes a processor and a memory, wherein a computer program is stored in the memory. When the computer program is executed by the processor, the method of any of the above embodiments can be implemented. The execution method and beneficial effects are similar and will not be repeated here.

[0155] Figure 3 is a structural diagram of a computer device provided by an embodiment of the present disclosure, such as Figure 3As shown, the computer device 300 may include a processor 310 and a memory 320, wherein the memory 320 stores a computer program 321. When the computer program 321 is executed by the processor 310, it can implement the method provided by any of the above embodiments. The execution method and beneficial effects are similar and will not be repeated here.

[0156] Of course, to simplify, Figure 3 Only some of the components related to the present invention in the computer device 300 are shown, and components such as a bus, input / output interface, input device, and output device are omitted. In addition, the computer device 300 may also include any other appropriate components according to specific application scenarios.

[0157] An embodiment of the present disclosure provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the method of any of the above embodiments can be implemented. The execution method and beneficial effects are similar and will not be repeated here.

[0158] The computer-readable storage medium can be any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, but is not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0159] The computer program can be written in any combination of one or more programming languages ​​to implement the program code for performing the operations of the embodiments of the present disclosure, including object-oriented programming languages ​​such as Java, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the target user's computer device, partially on the target user's computer device, as a stand-alone software package, partially on the target user's computer device and partially on a remote computer device, or entirely on a remote computer device or server.

[0160] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also includes other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

[0161] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details have been included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0162] The foregoing description is intended only to provide specific embodiments of the present disclosure, intended to enable those skilled in the art to understand and implement the present disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the embodiments described herein, but rather to be construed in the broadest manner consistent with the principles and novel features disclosed herein.

Claims

1. A method for identity authentication, characterized in that: include: In response to receiving a data request from a target user for a target blockchain, generating a signature value of the target user based on the target user's private key, the timestamp of the data request, and the data feature value of the requested target data; Based on the signature value, verify whether the target user has access rights to the target blockchain; When the target user does not have the access permission, prohibiting the target data on the target blockchain from being sent to the target user; When the target user has the access permission, calculating the comprehensive permission value of the target user to the target data based on the permission value of the target user to the data feature value, the weight and adjustment factor corresponding to each permission value, the location where the target user makes the data request, and the timestamp; When the comprehensive authority value is less than or equal to a preset threshold, it is determined that the target user does not have the authority to obtain the target data, and the target data on the target blockchain is prohibited from being sent to the target user; When the comprehensive authority value is greater than the preset threshold, it is determined that the target user has the authority to obtain the target data, and the target data on the target blockchain is sent to the target user.

2. The method according to claim 1, characterized in that The generating the signature value of the target user based on the private key of the target user, the timestamp of the data request, and the data characteristic value of the requested target data includes: Generate a random seed; The private key, the timestamp, the data characteristic value and the random seed are input into a preset signature generation model, and a signature value of the target user is generated based on the signature generation model.

3. The method according to claim 2, characterized in that Inputting the private key, the timestamp, the data characteristic value, and the random seed into a preset signature generation model, and generating the signature value of the target user based on the signature generation model, includes: Performing a concatenation operation on the data characteristic value and the timestamp to obtain a concatenated message value; Calculating a third function value corresponding to a third nested transformation function in the signature generation model based on the private key, the message value, and the random seed; Calculating a second function value corresponding to a second nested transformation function in the signature generation model based on the third function value, the private key, the message value, and the random seed; Calculating a first function value corresponding to a first nested transformation function in the signature generation model based on the second function value, the private key, and the random seed; The first function value is determined as the signature value of the target user.

4. The method according to claim 3, characterized in that The signature generation model includes: NestedTransform(S u ,M,γ) =Transform1(S u ,Transform2(S u ,Transform3(S u ,M,c),c),c) M=R||T; Among them, NestedTransform(S u , M, γ) represents the signature value of the target user; || represents a concatenation operation; M represents the message value after the data feature value and the timestamp are concatenated; γ represents a random seed; R represents the data feature value; T represents the timestamp; Transform1 represents the first nested transformation function; Transform2 represents the second nested transformation function; Transform3 represents the third nested transformation function; The third nested transformation function comprises: Where N represents a large prime number, used for modulo operation; mod represents modulo operation; The second nested transformation function includes: The first nested transformation function includes:

5. The method according to claim 1, wherein The verifying, based on the signature value, whether the target user has access rights to the target blockchain includes: Verify whether the signature value is within a preset signature value range corresponding to an authorized user of the target blockchain, where the authorized user is a user with access rights to the target blockchain; If so, it is determined that the target user has access rights to the target blockchain; Otherwise, it is determined that the target user does not have the access authority to the target blockchain.

6. The method according to claim 1, characterized in that The calculating, based on the target user's permission value for the data feature value, the weight and adjustment factor corresponding to each permission value, the location where the target user makes a data request, and the timestamp, of the target user's comprehensive permission value for the target data includes: Calculating the number of the authority values, a first mean and a first variance of the authority values, a second mean and a second variance of the timestamps, and a third mean and a third variance of the positions; The authority value, the weight and adjustment factor of each authority value, the location and the timestamp, the quantity, the first mean and the first variance, the second mean and the second variance, the third mean and the third variance are input into a preset comprehensive authority value calculation model, and the comprehensive authority value of the target user is generated based on the comprehensive authority value calculation model.

7. The method according to claim 6, characterized in that The comprehensive authority value calculation model includes: Where X represents the comprehensive authority value of the target user; α i represents the weight corresponding to the i-th permission value; n represents the number of permission values ​​of the target user to the data feature value; P i (u, d) represents the i-th permission value of the target user u to the data feature value d; σ p Represents the first variance of the authority value; μ p represents the first mean value of the authority value; T represents the timestamp of the data request; μ T represents the second mean of the timestamp; σ T represents the second variance of the timestamp; L represents the location where the target user makes the data request; μ L represents the third mean of the position; σ L represents the third difference of the position; β′ j Indicates the weight corresponding to the jth permission value; α j P represents the first adjustment factor corresponding to the jth authority value; j (u, d) represents the jth permission value of target user u to data feature value d; β j Represents the second adjustment factor corresponding to the jth authority value; γ′ j Indicates the third adjustment factor corresponding to the j-th authority value.

8. An identity and authority authentication device, characterized in that: include: a generation module, configured to, in response to receiving a data request from a target user for a target blockchain, generate a signature value of the target user based on the target user's private key, the timestamp of the data request, and the data feature value of the requested target data; A verification module, configured to verify, based on the signature value, whether the target user has access rights to the target blockchain; A first prohibition module is configured to prohibit the target data on the target blockchain from being sent to the target user when the target user does not have the access permission; a calculation module, configured to calculate, when the target user has the access permission, a comprehensive permission value of the target user to the target data based on the permission value of the target user to the data feature value, the weight and adjustment factor corresponding to each permission value, the location where the target user makes the data request, and the timestamp; A second prohibition module is configured to, when the comprehensive authority value is less than or equal to a preset threshold, determine that the target user does not have the authority to obtain the target data, and prohibit the target data on the target blockchain from being sent to the target user; The sending module is used to determine that the target user has the authority to obtain the target data when the comprehensive authority value is greater than the preset threshold, and send the target data on the target blockchain to the target user.

9. A computer device, characterized in that: include: A memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the identity and authority authentication method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that The storage medium stores a computer program, and when the computer program is executed by the processor, the identity authority authentication method according to any one of claims 1 to 7 is implemented.

Images