Login method and device of service system, storage medium and electronic equipment

Abstract

The invention discloses a login method and device of a service system, a storage medium and electronic equipment, the method is applied to the field of block chains, and the method comprises the following steps: generating a key pair under the condition that a data access request triggered by a data visitor is detected; the public key is sent to a data visitor, and the data visitor sends the public key to a smart contract of the block chain; and generating a login account through the smart contract, and sending the login account to the data visitor, so that the data visitor accesses the plurality of service systems based on the login account. Through application of the method and the device, the problem that the performance of the block chain is reduced due to the fact that a large amount of calculation needs to be carried out when a user accesses data because nodes in the block chain are increased in the related technology is solved.

Description

Technical Field

[0001] The present application relates to the field of blockchain, and specifically, to a login method, device, storage medium and electronic device for a business system. Background Art

[0002] The civil aviation system is a complex system that spans organizations and departments, involving multiple organizations such as airports, airlines, air traffic control, and freight forwarders, and requires multi-system interaction between multiple organizations. The current system access control mechanism mostly uses identity-based access control, which verifies the user's identity through an authentication mechanism to determine whether the user can access specific resources. However, the access control of the civil aviation system has the following problems:

[0003] (1) There is no unified standard among different systems. Users need to authenticate their identities across multiple systems and verify their permissions in each system, which makes user login operations cumbersome and affects user experience.

[0004] (2) The access control rights of civil aviation systems are usually managed by system administrators or department administrators. The rights are usually managed manually, which may lead to problems such as delayed rights management, inaccurate rights management, and rights tampering.

[0005] (3) The civil aviation system involves a large amount of sensitive information, such as flight information and passenger information, which needs to be strictly managed to ensure the security of the information. However, in the current civil aviation system, sensitive information is usually stored in plain text, which poses the risk of illegal tampering and leakage.

[0006] (4) Civil aviation systems are usually protected by security measures such as firewalls and intrusion detection systems. However, due to the complexity of the civil aviation system, there are large security loopholes, making it difficult to effectively protect it.

[0007] Currently, no effective solution has been proposed to the problem that due to the increase in nodes in the blockchain, users need to perform a lot of calculations when accessing data, which leads to the decline of blockchain performance. Summary of the invention

[0008] The main purpose of this application is to provide a business system login method, device, storage medium and electronic device to solve the problem in the related art that due to the increase in nodes in the blockchain, users need to perform a lot of calculations when accessing data, resulting in a decrease in blockchain performance.

[0009] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a business system login method is provided, the method comprising: when a data access request triggered by a data accessor is detected, generating a key pair, the key pair comprising at least: a public key; sending the public key to the data accessor, wherein the data accessor sends the public key to the smart contract of the blockchain; generating a login account through the smart contract, and sending the login account to the data accessor, so that the data accessor can access the multiple business systems based on the login account.

[0010] Furthermore, generating a key pair includes: generating a private key through a random number generator; constructing a numerical set based on a bilinear mapping function, wherein the numerical set at least includes: a first numerical value; multiplying the first numerical value with the private key to obtain the public key; and determining the key pair based on the private key and the public key.

[0011] Furthermore, generating a login account through the smart contract includes: calculating the public key and the private key by the data accessor to generate a string set; sending the string set to the smart contract, and verifying the string set based on the first numerical value and the public key by the smart contract to obtain a verification result, wherein the verification result is a verification result obtained through non-interactive zero-knowledge proof; when the verification result indicates that the verification is successful, generating the login account based on the public key; when the verification result indicates that the verification fails, rejecting the data access request of the data accessor.

[0012] Furthermore, the data accessor calculates the public key and the private key to generate a string set, including: multiplying the first numerical value and the second numerical value to obtain a first string, wherein the second numerical value represents an arbitrary random integer selected by the data accessor; performing a hash calculation on the first string and the public key to obtain an intermediate variable; calculating the intermediate variable, the private key and the second numerical value to obtain a second string; and determining the string set based on the first string and the second string.

[0013] Furthermore, the target system at least includes: a management subsystem, so that the data accessor can access the multiple business systems based on the login account, including: storing the login account in the target database through the management subsystem; receiving a login request, and comparing the target account in the login request and the login account in the target database through the management subsystem, wherein the login request is a request generated by the data accessor based on the login account; when the target account and the login account are consistent, executing the data access request of the data accessor to access the multiple business systems; when the target account and the login account are inconsistent, generating a prompt message, and sending the prompt message to the data accessor.

[0014] Furthermore, after generating a login account through the smart contract, the method also includes: generating a valid timestamp for the login account through the smart contract; counting down the valid timestamp through the smart contract; executing the data access request of the data accessor during the countdown of the valid timestamp; when the countdown of the valid timestamp ends, generating a logout instruction, and rejecting the data access operation of the data access request based on the logout instruction.

[0015] Furthermore, after generating a valid timestamp through the smart contract, the method also includes: sending the valid timestamp to the data accessor and the management subsystem; when the management subsystem receives the login account and the valid timestamp, executing the data access request of the data accessor according to the valid timestamp; rejecting the data access operation of the data access request according to the logout instruction, including: when the management subsystem detects the logout instruction, deleting the login account in the target database and forcibly ending the data access operation of the data access request.

[0016] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a login device for a business system is provided, which includes: a first generating unit, used to generate a key pair when a data access request triggered by a data accessor is detected, and the key pair includes at least: a public key; a first sending unit, used to send the public key to the data accessor, wherein the data accessor sends the public key to the smart contract of the blockchain; a second generating unit, used to generate a login account through the smart contract, and send the login account to the data accessor, so that the data accessor can access the multiple business systems based on the login account.

[0017] Furthermore, the first generation unit includes: a first generation subunit, used to generate a private key through a random number generator; a construction subunit, used to construct a numerical set based on a bilinear mapping function, wherein the numerical set at least includes: a first numerical value; a first calculation subunit, used to multiply the first numerical value with the private key to obtain the public key; and a determination subunit, used to determine the key pair based on the private key and the public key.

[0018] Furthermore, the second generation unit includes: a second calculation subunit, used to calculate the public key and the private key by the data accessor to generate a string set; a verification subunit, used to send the string set to the smart contract, and verify the string set based on the first numerical value and the public key by the smart contract to obtain a verification result, wherein the verification result is a verification result obtained through non-interactive zero-knowledge proof; the second generation subunit, used to generate the login account according to the public key when the verification result indicates that the verification is successful; the first processing subunit, used to reject the data access request of the data accessor when the verification result indicates that the verification fails.

[0019] Furthermore, the second calculation subunit includes: a first calculation module, used to multiply the first numerical value and the second numerical value to obtain a first string, wherein the second numerical value represents an arbitrary random integer selected by the data accessor; a second calculation module, used to perform hash calculation on the first string and the public key to obtain an intermediate variable; a third calculation module, used to calculate the intermediate variable, the private key and the second numerical value to obtain a second string; a determination module, used to determine the string set based on the first string and the second string.

[0020] Furthermore, the target system at least includes: a management subsystem, and the second generating unit includes: a storage subunit, used to store the login account in the target database through the management subsystem; a comparison subunit, used to receive a login request, and compare the target account in the login request with the login account in the target database through the management subsystem, wherein the login request is a request generated by the data accessor based on the login account; an execution subunit, used to execute the data access request of the data accessor to access the multiple business systems when the target account and the login account are consistent; a sending subunit, used to generate a prompt message when the target account and the login account are inconsistent, and send the prompt message to the data accessor.

[0021] Furthermore, the device also includes: a third generating unit, used to generate a valid timestamp for the login account through the smart contract after the login account is generated through the smart contract; a timing unit, used to count down the valid timestamp through the smart contract; a first execution unit, used to execute the data access request of the data accessor during the countdown of the valid timestamp; a processing unit, used to generate a logout instruction when the countdown of the valid timestamp ends, and reject the data access operation of the data access request based on the logout instruction.

[0022] Furthermore, the device also includes: a second sending unit, which is used to send the valid timestamp to the data accessor and the management subsystem after the valid timestamp is generated by the smart contract; a second execution unit, which is used to execute the data access request of the data accessor according to the valid timestamp when the management subsystem receives the login account and the valid timestamp; the processing unit includes: a second processing subunit, which is used to delete the login account in the target database and forcibly end the data access operation of the data access request when the management subsystem detects the logout instruction.

[0023] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer program product is provided, including a computer program, which, when executed by a processor, implements the login method of the business system described in any one of the above-mentioned items, and which, when executed by a processor, implements the steps of the login method of the business system described in each embodiment of the present application.

[0024] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes stored computer instructions, wherein when the computer instructions are executed by a processor, any one of the above-mentioned business system login methods is implemented.

[0025] In order to achieve the above-mentioned purpose, according to one aspect of the present application, an electronic device is provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement the login method of the business system described in any one of the above-mentioned items.

[0026] Through the present application, the following steps are adopted: when a data access request triggered by a data accessor is detected, a key pair is generated, the key pair comprising at least: a public key; the public key is sent to the data accessor, wherein the data accessor sends the public key to the smart contract of the blockchain; a login account is generated through the smart contract, and the login account is sent to the data accessor, so that the data accessor can access the multiple business systems based on the login account, thereby solving the problem in the related art that due to the increase in nodes in the blockchain, a large amount of calculations need to be performed when users access data, resulting in a decrease in blockchain performance. By generating and using a key pair and sending the public key in the key pair to the smart contract, the smart contract can automatically generate a single sign-on account based on the verification result. The visitor can use this account to access all software within the scope of the right, avoiding the tedious steps of repeatedly registering accounts in multiple business systems, simplifying the login process of data visitors, and improving the access efficiency between different software within the civil aviation system. At the same time, by utilizing the decentralized, tamper-proof and traceable characteristics of blockchain, the data access request and related key information of the data visitor are processed on the blockchain. Even if the data is intercepted during transmission, due to the encryption characteristics of blockchain and the use of zero-knowledge proof, the visitor's detailed information and data content are still protected and will not be obtained by unauthorized parties, improving the data access security within the civil aviation system. The entire single sign-on method of the civil aviation system based on blockchain, from key pair generation and verification to account allocation and cancellation, is automatically completed through smart contracts, reducing the need for manual operation and improving the automation level and overall operation efficiency of the civil aviation system. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0028] Figure 1 is a flowchart of a method for logging into a business system provided in Embodiment 1 of the present application;

[0029] Figure 2 is a schematic diagram of a system structure of an optional target system provided according to Embodiment 1 of the present application;

[0030] Figure 3 is a schematic diagram of a login device for a business system provided in Embodiment 2 of the present application;

[0031] Figure 4 This is a schematic diagram of a login electronic device for a business system provided in Example 5 of the present application. DETAILED DESCRIPTION

[0032] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0033] It should be noted that the user information (including but not limited to user device information, user personal information, collected data, used data, generated data, processed data, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, collected information, used information, generated information, processed information, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of relevant countries and regions, necessary confidentiality measures are taken, and public order and good morals are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0034] It should be noted that this application provides users with corresponding operation entrances for them to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0035] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0037] Embodiment 1

[0038] The present invention is described below in conjunction with preferred implementation steps. Figure 1 1 is a flowchart of a login method for a business system provided in Embodiment 1 of the present application. The above method is applied to a target system, the target system is connected to multiple business systems in communication, and the target system at least includes: a blockchain. Figure 1 As shown, the method comprises the following steps:

[0039] In this embodiment 1, the execution subject of the login method of the business system in this application can be the target system. The target system is a system that integrates a single sign-on function based on blockchain technology. Its main task is to manage the login and access rights between data accessors and various business systems within the civil aviation industry to ensure data security and access effectiveness.

[0040] The target system communicates and exchanges data with various business systems within the civil aviation industry (e.g., reservation system, departure system, distribution system, etc., which are not specifically limited in this embodiment 1) through the network. This connection ensures that after verifying their identity, data accessors can access all these connected business systems through a single sign-on account without having to authenticate and log in to each system separately.

[0041] In this scenario, blockchain is used as a distributed, decentralized data storage and processing platform, which has the characteristics of data immutability, transparent verifiability, and decentralized trust. Smart contracts run on the blockchain, execute non-interactive zero-knowledge proof schemes, generate single sign-on accounts with timestamps, and automatically destroy them after the account expires, ensuring the security of the entire login process and effective account management.

[0042] Step S101, when a data access request triggered by a data accessor is detected, a key pair is generated, and the key pair at least includes: a public key.

[0043] In the first embodiment, when a user (ie the above-mentioned data accessor) intends to access one or more software of the civil aviation system, the target system will first detect the data access request.

[0044] In order to ensure the security of the subsequent single sign-on process, the key distribution center (KPG) in the target system will generate a key pair for this data accessor. The key pair consists of a pair of mathematically related private keys and public keys, where the private key is used for decryption or signing, and the public key can be widely distributed for encryption or signature verification. Smart contracts can use the public key to verify the commitment submitted by the data accessor through a non-interactive zero-knowledge proof scheme without directly obtaining the data accessor's private information, thereby ensuring the privacy security of the data accessor.

[0045] Step S102, sending the public key to the data accessor, wherein the data accessor sends the public key to the smart contract of the blockchain.

[0046] In the first embodiment, after obtaining the public key, the data accessor needs to send it to the smart contract deployed on the blockchain. The smart contract is used to perform the non-interactive zero-knowledge proof process to verify whether the data accessor has the authority to access multiple business software in the civil aviation system.

[0047] After the smart contract receives the public key sent by the data accessor, it will use the public key and the preset system public parameters to verify the non-interactive zero-knowledge proof. The verification process is based on whether the data accessor can prove that he has the corresponding access rights without revealing specific information. If the verification is successful, the smart contract will generate a single sign-on account and send it to the data accessor and the system department administrator so that the data accessor can log in and access multiple business systems within the specified time.

[0048] Through the above steps, it is ensured that data accessors can protect their privacy information from being leaked while proving their identity and authority. At the same time, the blockchain's smart contracts are used to automate the verification process and improve login efficiency and security.

[0049] Step S103, generating a login account through a smart contract, and sending the login account to the data accessor, so that the data accessor can access multiple business systems based on the login account.

[0050] In the first embodiment, the smart contract sends the generated login account to the data accessor. After receiving this account, the data accessor can use it to access multiple business systems in the civil aviation system within the valid time range without having to log in separately on each system.

[0051] Based on the received single sign-on account, the data visitor can log in to any business system in the civil aviation system, such as the reservation system, departure system, etc. When the data visitor tries to log in with the account, the system department administrator will verify the validity of the account, including checking whether the account exists in the temporary database and whether the account has expired. If the account is valid, the data visitor will be able to successfully access multiple business systems.

[0052] The automatic execution capability of smart contracts ensures the secure generation, accurate delivery and effective use of single sign-on accounts, thereby improving the security and efficiency of data access within the civil aviation system, while also reducing the storage resource consumption caused by multiple system logins. The introduction of smart contracts can also ensure that accounts are automatically deregistered after the expiration of their use period, further enhancing the security and resource management capabilities of the system.

[0053] To summarize, the business system login method provided in Example 1 of the present application generates a key pair upon detecting a data access request triggered by a data accessor, the key pair comprising at least: a public key; sending the public key to the data accessor, wherein the data accessor sends the public key to the smart contract of the blockchain; generating a login account through the smart contract, and sending the login account to the data accessor, so that the data accessor can access multiple business systems based on the login account, thereby solving the problem in the related technology that due to the increase in nodes in the blockchain, a large amount of calculations need to be performed when users access data, resulting in a decrease in blockchain performance. By generating and using a key pair and sending the public key in the key pair to the smart contract, the smart contract can automatically generate a single sign-on account based on the verification result. The visitor can use this account to access all software within the scope of the right, avoiding the tedious steps of repeatedly registering accounts in multiple business systems, simplifying the login process of data visitors, and improving the access efficiency between different software within the civil aviation system. At the same time, by utilizing the decentralized, tamper-proof and traceable characteristics of blockchain, the data access request and related key information of the data visitor are processed on the blockchain. Even if the data is intercepted during transmission, due to the encryption characteristics of blockchain and the use of zero-knowledge proof, the visitor's detailed information and data content are still protected and will not be obtained by unauthorized parties, improving the data access security within the civil aviation system. The entire single sign-on method of the civil aviation system based on blockchain, from key pair generation and verification to account allocation and cancellation, is automatically completed through smart contracts, reducing the need for manual operation and improving the automation level and overall operation efficiency of the civil aviation system.

[0054] Optionally, in the login method of the business system provided in Example 1 of the present application, generating a key pair includes: generating a private key through a random number generator; constructing a numerical set based on a bilinear mapping function, wherein the numerical set at least includes: a first numerical value; multiplying the first numerical value by the private key to obtain a public key; and determining the key pair based on the private key and the public key.

[0055] In this first embodiment, the key distribution center (KPG) uses a random number generator to randomly generate a private key. This private key is the basis for data accessor identity authentication and subsequent security operations, and is also a key component of the subsequent calculation of the public key and the execution of non-interactive zero-knowledge proof process.

[0056] According to the bilinear mapping theory, the key distribution center constructs a numerical set that contains at least one first value. Bilinear mapping is a special mapping relationship established between two multiplication groups. It has the characteristics of bilinearity, non-degeneracy and computability. It is an important mathematical tool for building public key cryptography. Select the first value in the numerical set and multiply it with the private key.

[0057] Specifically, let G and G1 be multiplicative cyclic groups of prime order p, G represents the above-mentioned set of values, G contains at least one value (i.e., the first value mentioned above), g is the generator of G, and if the mapping e:G×G→G1 can satisfy the following conditions: Bilinear: and All satisfy e(u a ,v b )=e(u,v) ab ; Non-degenerate: Let e(u,v)≠1, where 1 is the identity element of G; computability: If there is an effective algorithm to calculate e(u,v)∈G1, then e is called a bilinear mapping. Using the private key as the factor of multiplication, the first value is calculated. The calculation formula can be expressed as pk=sk*G, where sk represents the private key and pk represents the public key. The key pair can be expressed as mk=(sk,pk), where sk represents the private key and pk represents the public key. The calculation process of the key pair utilizes the properties of bilinear mapping to ensure that even if the public key and the first value are known, it is difficult to reversely solve the private key, thereby ensuring the security of the private key.

[0058] Through bilinear mapping and asymmetric encryption, the secure generation of key pairs is ensured, providing the basis for identity authentication for data accessors, and is also an important security guarantee in the subsequent acquisition and use of single sign-on accounts. The generation and management of key pairs is the core of any security authentication solution based on public key infrastructure (PKI). In this way, data accessors can efficiently access multiple business systems within the civil aviation system while ensuring personal privacy and data security.

[0059] Optionally, in the login method of the business system provided in Example 1 of the present application, a login account is generated through a smart contract, including: calculating a public key and a private key by a data accessor to generate a string set; sending the string set to the smart contract, and verifying the string set based on a first numerical value and a public key by the smart contract to obtain a verification result, wherein the verification result is a verification result obtained through a non-interactive zero-knowledge proof; when the verification result indicates that the verification is successful, generating a login account based on the public key; when the verification result indicates that the verification fails, rejecting the data access request of the data accessor.

[0060] In the first embodiment, after the data accessor has his own private key and public key, he will perform a series of calculations to generate a string set. This calculation process is based on the design of a non-interactive zero-knowledge proof scheme. Through calculation, the data accessor can generate a series of commitments related to his identity and authority, that is, a string set, without revealing the private key itself.

[0061] The generated string set is then sent to the smart contract on the blockchain. Smart contracts are programs that perform automatic and trusted operations. They can process and verify data according to preset rules and logic without human intervention. After receiving the string set from the data accessor, the smart contract will use the above first value and the data accessor's public key to verify the commitment (i.e. the above string set). The verification process is based on the principle of non-interactive zero-knowledge proof, checking whether the commitment provided by the data accessor correctly reflects his or her identity and permissions, while ensuring that no sensitive information is leaked during the verification process.

[0062] If the verification result of the smart contract indicates that the verification is successful, that is, the commitment of the string set is consistent with the identity and authority of the data accessor, the smart contract will generate a single sign-on account based on the public key of the data accessor for subsequent access to business systems within the civil aviation system. On the contrary, if the verification fails, the smart contract will reject the access request of the data accessor to protect the system from unauthorized access. Specifically, the process of generating a single sign-on account can be expressed as: AccountNumber = AccountNumber_pk_one_point, where "AccountNumber" is the above-mentioned login account, that is, the single sign-on account, pk is the public key in the above-mentioned key pair, and "_one_point" is a preset string.

[0063] By utilizing the characteristics of non-interactive zero-knowledge proof, it ensures that data accessors can verify their identities and permissions through smart contracts without revealing their private keys, and automatically obtain a single sign-on account after successful verification, which not only enhances the security of the system, but also simplifies the user access process and improves the access efficiency of the internal business system of the civil aviation system. At the same time, through the automated execution of smart contracts, the fairness and non-tamperability of the verification results are ensured, further improving the credibility of the entire login authentication process.

[0064] Optionally, in the login method of the business system provided in Example 1 of the present application, a data accessor calculates a public key and a private key to generate a string set, including: multiplying a first numerical value and a second numerical value to obtain a first string, wherein the second numerical value represents an arbitrary random integer selected by the data accessor; performing a hash calculation on the first string and the public key to obtain an intermediate variable; calculating the intermediate variable, the private key and the second numerical value to obtain a second string; and determining the string set based on the first string and the second string.

[0065] In the first embodiment, the data accessor first randomly selects an integer r, called the second value, which can be expressed as , this value is temporary and is used to generate the commitments required for zero - knowledge proofs. Then, the data visitor multiplies the first value (which is an element in the set of values constructed by the key distribution center based on bilinear mapping, i.e., the above - mentioned first value) by the second value to obtain the above - mentioned first string. This calculation is based on the mathematical principles of zero - knowledge proofs and is used to generate the commitments required for subsequent verification.

[0066] Next, the data visitor performs a hash calculation on the first string and their own public key to generate an intermediate variable c. Hash calculation is a common data digest method that can ensure that any minor change in the input data will result in a significant difference in the output hash value, thus providing data integrity verification. The intermediate variable obtained here is the key for subsequent calculation of the second string. The data visitor uses the intermediate variable, the private key, and the previous second value for further calculation to obtain the second string.

[0067] Finally, based on the calculated first string and second string, the data visitor constructs a set of strings. The set of strings contains all the commitments required to prove the identity and permissions of the data visitor and will be sent to the smart contract for the verification process. After successful verification, the smart contract can confirm that the data visitor has the correct key pair and generate a single - sign - on account accordingly.

[0068] Specifically, the calculation process for generating the set of strings can be shown as in Formulas One to Three,

[0069] R = r * G (One)

[0070] c = Hash(pk, R) (Two)

[0071] z = r + c * sk (Three)

[0072] Among them, (R, z) represents two elements in the above - mentioned set of strings, which can also be called commitments. r represents an integer randomly selected from the set of integers and can be expressed as c represents the intermediate variable, sk represents the private key of the data visitor, pk represents the public key of the data visitor, and G represents the above - mentioned set of values, which includes the first value.

[0073] Through a series of calculation steps, a set of strings for verification is generated, ensuring that the data visitor can prove that they have the correct key pair while avoiding the direct exposure of sensitive information. This verification method not only protects the privacy of the data visitor but also ensures the security of the internal business systems of the civil aviation system and the accuracy of access control.

[0074] Optionally, in the first embodiment, the system structure of the target system of this solution can be as Figure 2As shown in the figure. The system model mainly includes smart contracts, blockchain systems, databases, system administrators, data accessors (such as Figure 2 visitors), and key distribution center.

[0075] Smart contracts use blockchain technology to ensure data immutability and transparency, and enhance the trust of the system. The key distribution center is responsible for generating key pairs for data accessors, and the generated public keys are transmitted to smart contracts via electronic signals. Smart contracts then make these public keys public for verification.

[0076] The non-interactive zero-knowledge proof verification is initiated by the data accessor, and the identity and permissions of the accessor are verified by interacting with the smart contract. The verification process between the data accessor and the smart contract uses a pairing-friendly elliptic curve to implement bilinear mapping, which optimizes the computational efficiency of the non-interactive zero-knowledge proof, ensures the rapid verification process, and protects the privacy of the accessor. After successful verification, the smart contract generates a single sign-on account and sets a timestamp to control the validity period of the account.

[0077] The smart contract sends the single sign-on account and timestamp to the data accessor and the system department administrator. After the data accessor receives the single sign-on account, he can use it to log in to various departments in the civil aviation system, such as Figure 2 Department 1, Department 2, Department 3, and Department 4. After receiving the account number, the system department administrator stores the account number and timestamp in a temporary database so that they can be compared when the data visitor logs in to confirm the legitimacy of the visitor.

[0078] Smart contracts automatically manage the validity period of accounts. After an account expires, the smart contract automatically destroys the account and clears all access records, and notifies the system department administrator to update the account information in the temporary database. The dynamic permission management of smart contracts ensures the validity of the account by checking the timestamp through regular communication, reducing the burden of manual management and realizing automated and intelligent permission management.

[0079] Optionally, in the login method for the business system provided in Example 1 of the present application, the above-mentioned target system includes at least: a management subsystem, so that the data accessor can access multiple business systems based on the login account, including: storing the login account in the target database through the management subsystem; receiving a login request, and comparing the target account in the login request with the login account in the target database through the management subsystem, wherein the login request is a request generated by the data accessor based on the login account; when the target account and the login account are consistent, executing the data access request of the data accessor to access multiple business systems; when the target account and the login account are inconsistent, generating a prompt message, and sending the prompt message to the data accessor.

[0080] In the first embodiment, the management subsystem is a key component of the target system, which is responsible for the management and verification of login accounts. When the smart contract generates a single sign-on account and sends it to the data accessor and the system department administrator, the system department administrator stores the account information in the target database through the management subsystem. The target database is a database used to save the single sign-on account within the validity period.

[0081] When a data accessor attempts to use a single sign-on account to access a business system within the civil aviation system, a login request is first sent. This request contains the account information that the data accessor is trying to use, namely the "target account". The system department will receive and process these login requests through the management subsystem. One of the core functions of the management subsystem is to compare the target account in the login request with the valid login account stored in the target database.

[0082] The management subsystem will check whether the target account exists in the target database and whether it is consistent with the record in the database. This process is to verify the validity and legitimacy of the login account provided by the data accessor. If the target account matches the record in the database, the management subsystem will consider the verification successful.

[0083] If the verification is successful, that is, the target account and the login account in the database are consistent, the management subsystem will allow the data accessor to access multiple business systems within the civil aviation system to which his account has permissions. That is, the data accessor can use the same login account and does not need to log in repeatedly on each business system, which greatly improves access efficiency and user experience.

[0084] If the target account does not match the login account in the database, or the target account has expired, the management subsystem will generate a prompt message and send it to the data accessor. This prompt message is to inform the data accessor of the reason for the failed login attempt, which may be due to an incorrect account input, an invalid account, or other problems.

[0085] Through the above process, the management subsystem realizes the effective management and verification of single sign-on accounts, ensuring that data accessors can safely and efficiently access multiple business systems in the civil aviation system under correct identity authentication. At the same time, it also enhances the user interactivity and fault handling capabilities of the target system by sending prompt information. This mechanism fully utilizes the ability of blockchain and smart contracts to ensure data security, while optimizing the login and access process of the civil aviation system.

[0086] Optionally, in the login method of the business system provided in Example 1 of the present application, after a login account is generated through a smart contract, the method further includes: generating a valid timestamp for the login account through a smart contract; counting down the valid timestamp through a smart contract; during the countdown of the valid timestamp, executing a data access request of a data accessor; when the countdown of the valid timestamp ends, generating a logout instruction, and rejecting the data access operation of the data access request based on the logout instruction.

[0087] In the first embodiment, when the smart contract verifies the identity and permission information submitted by the data accessor through non-interactive zero-knowledge proof, and the verification is successful, a valid timestamp will be added to the generated single sign-on account. This timestamp defines a specific time range from account creation to expiration, ensuring that the account can only be used within a limited time.

[0088] There is a countdown mechanism inside the smart contract, which starts counting according to the valid timestamp and monitors the validity period of each generated single sign-on account in real time. During the countdown of the valid timestamp, if the data accessor sends a data access request to the business system in the civil aviation system, the smart contract will check whether the timestamp is valid. As long as the timestamp has not expired, the smart contract will allow the data accessor's request to be executed, that is, the accessor can use the single sign-on account to freely access all business systems to which he has permission in the civil aviation system.

[0089] Once the smart contract monitors the countdown of the valid timestamp, that is, the validity period of the single sign-on account has expired, a logout instruction is automatically generated to deny data access requests and all data access operations of the single sign-on account in the logout instruction.

[0090] The smart contract automatically executes the countdown of the timestamp and the cancellation of the single sign-on account, avoiding the potential security risks caused by the long-term validity of the account, and also reducing the demand for storage resources in the civil aviation system, because the single sign-on account will be automatically destroyed after use and does not need to be stored for a long time. This blockchain-based management mechanism utilizes the automation and immutability of smart contracts, greatly improving the efficiency and security of the civil aviation system in data access control.

[0091] Optionally, in the login method of the business system provided in Example 1 of the present application, after generating a valid timestamp through a smart contract, the above method also includes: sending the valid timestamp to the data accessor and the management subsystem; when the management subsystem receives the login account and the valid timestamp, executing the data access request of the data accessor according to the valid timestamp; rejecting the data access operation of the data access request according to the logout instruction, including: when the management subsystem detects the logout instruction, deleting the login account in the target database and forcibly ending the data access operation of the data access request.

[0092] In the first embodiment, when the smart contract generates a single sign-on account, it will also generate a valid timestamp, which indicates the start and end time of the single sign-on account. The smart contract will send this timestamp together with the login account to the data accessor and the management subsystem. After receiving the timestamp, the data accessor can understand the validity period of the account, and the management subsystem will store the timestamp and account in the target database as an important basis for account management.

[0093] After receiving the login account and valid timestamp sent by the smart contract, the management subsystem will store this information in the target database. When a data accessor attempts to use a single sign-on account to access a business system in the civil aviation system, the management subsystem will check whether the timestamp of the corresponding account in the target database is within the validity period. If the timestamp shows that the login account is still valid, the management subsystem will allow the data access request of the data accessor to be executed, that is, the data accessor can use all business systems within the scope of the login account's access rights.

[0094] Once the smart contract monitors the countdown of the valid timestamp to end, that is, the account validity period expires, it will automatically generate a logout instruction. The logout instruction will be sent to the management subsystem to notify it that the account has expired and any access operations based on this account should be stopped immediately. After detecting the logout instruction, the management subsystem will delete the expired login account information in the target database to ensure that the login account cannot be successfully verified; at the same time, the management subsystem will forcibly end all data access operations using the account.

[0095] Through this mechanism, the synergy of smart contracts and management subsystems realizes the dynamic management and automatic security control of single sign-on accounts, ensuring the security, compliance and efficiency of data access within the civil aviation system. Especially in account validity management, this method can effectively avoid the potential security risks caused by long-term valid accounts, while reducing the storage burden of the database, thereby improving the performance of the civil aviation system.

[0096] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0097] Embodiment 2

[0098] The second embodiment of the present application also provides a login device for a business system. It should be noted that the login device for the business system in the second embodiment of the present application can be used to execute the login method for the business system provided in the first embodiment of the present application. The login device for the business system provided in the second embodiment of the present application is introduced below.

[0099] Figure 3 Schematic diagram of a login device for a business system according to Embodiment 2 of the present application. The device is deployed in a target system, the target system is connected to multiple business systems in communication, and the target system at least includes: a blockchain. Figure 3 As shown, the device includes: a first generating unit 301, a first sending unit 302 and a second generating unit 303.

[0100] Specifically, the first generating unit 301 is used to generate a key pair when a data access request triggered by a data accessor is detected. The key pair at least includes: a public key.

[0101] The first sending unit 302 is used to send the public key to the data accessor, wherein the data accessor sends the public key to the smart contract of the blockchain.

[0102] The second generating unit 303 is used to generate a login account through a smart contract, and send the login account to the data accessor, so that the data accessor can access multiple business systems based on the login account.

[0103] The login device of the business system provided in the second embodiment of the present application generates a key pair through the first generation unit 301 when a data access request triggered by a data accessor is detected. The key pair includes at least: a public key; the first sending unit 302 sends the public key to the data accessor, wherein the data accessor sends the public key to the smart contract of the blockchain; the second generation unit 303 generates a login account through the smart contract, and sends the login account to the data accessor, so that the data accessor can access multiple business systems based on the login account, which solves the problem in the related art that due to the increase of nodes in the blockchain, a large amount of calculations need to be performed when users access data, resulting in a decrease in blockchain performance. By generating and using a key pair and sending the public key in the key pair to the smart contract, the smart contract can automatically generate a single sign-on account based on the verification result. The visitor can use this account to access all software within the scope of the right, avoiding the tedious steps of repeatedly registering accounts in multiple business systems, simplifying the login process of data visitors, and improving the access efficiency between different software within the civil aviation system. At the same time, by utilizing the decentralized, tamper-proof and traceable characteristics of blockchain, the data access request and related key information of the data visitor are processed on the blockchain. Even if the data is intercepted during transmission, due to the encryption characteristics of blockchain and the use of zero-knowledge proof, the visitor's detailed information and data content are still protected and will not be obtained by unauthorized parties, improving the data access security within the civil aviation system. The entire single sign-on method of the civil aviation system based on blockchain, from key pair generation and verification to account allocation and cancellation, is automatically completed through smart contracts, reducing the need for manual operation and improving the automation level and overall operation efficiency of the civil aviation system.

[0104] Optionally, in the login device of the business system provided in Example 2 of the present application, the above-mentioned first generation unit 301 includes: a first generation subunit, used to generate a private key through a random number generator; a construction subunit, used to construct a numerical set based on a bilinear mapping function, wherein the numerical set at least includes: a first numerical value; a first calculation subunit, used to multiply the first numerical value with the private key to obtain a public key; and a determination subunit, used to determine a key pair based on the private key and the public key.

[0105] Optionally, in the login device of the business system provided in Example 2 of the present application, the above-mentioned second generation unit 303 includes: a second calculation subunit, used to calculate the public key and the private key by the data accessor to generate a string set; a verification subunit, used to send the string set to the smart contract, and verify the string set based on the first numerical value and the public key through the smart contract to obtain a verification result, wherein the verification result is a verification result obtained through non-interactive zero-knowledge proof; the second generation subunit, used to generate a login account based on the public key when the verification result indicates that the verification is successful; the first processing subunit, used to reject the data access request of the data accessor when the verification result indicates that the verification fails.

[0106] Optionally, in the login device of the business system provided in Example 2 of the present application, the above-mentioned second calculation sub-unit includes: a first calculation module, used to multiply the first numerical value and the second numerical value to obtain a first string, wherein the second numerical value represents an arbitrary random integer selected by the data accessor; a second calculation module, used to perform hash calculation on the first string and the public key to obtain an intermediate variable; a third calculation module, used to calculate the intermediate variable, the private key and the second numerical value to obtain a second string; a determination module, used to determine a string set based on the first string and the second string.

[0107] Optionally, in the login device of the business system provided in Example 2 of the present application, the above-mentioned target system includes at least: a management subsystem, and the second generation unit 303 includes: a storage subunit, which is used to store the login account in the target database through the management subsystem; a comparison subunit, which is used to receive a login request, and compare the target account in the login request with the login account in the target database through the management subsystem, wherein the login request is a request generated by the data accessor based on the login account; an execution subunit, which is used to execute the data access request of the data accessor to access multiple business systems when the target account and the login account are consistent; a sending subunit, which is used to generate a prompt message when the target account and the login account are inconsistent, and send the prompt message to the data accessor.

[0108] Optionally, in the login device of the business system provided in Example 2 of the present application, the above-mentioned device also includes: a third generation unit, which is used to generate a valid timestamp for the login account through the smart contract after the login account is generated through the smart contract; a timing unit, which is used to count down the valid timestamp through the smart contract; a first execution unit, which is used to execute the data access request of the data accessor during the countdown of the valid timestamp; and a processing unit, which is used to generate a logout instruction when the countdown of the valid timestamp ends, and reject the data access operation of the data access request based on the logout instruction.

[0109] Optionally, in the login device of the business system provided in Example 2 of the present application, the above-mentioned device also includes: a second sending unit, which is used to send the valid timestamp to the data accessor and the management subsystem after the valid timestamp is generated through the smart contract; a second execution unit, which is used to execute the data access request of the data accessor according to the valid timestamp when the management subsystem receives the login account and the valid timestamp; the processing unit includes: a second processing subunit, which is used to delete the login account in the target database and forcibly end the data access operation of the data access request when the management subsystem detects a logout instruction.

[0110] The login device of the business system includes a processor and a memory. The above-mentioned first generating unit 301, first sending unit 302, second generating unit 303, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0111] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the performance of the blockchain can be improved by adjusting the kernel parameters.

[0112] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0113] Embodiment 3 of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, a method for logging into a business system is implemented.

[0114] A fourth embodiment of the present invention provides a processor, which is used to run a program, wherein the program executes a login method of a business system when the program is running.

[0115] like Figure 4 As shown, embodiment 5 of the present invention provides an electronic device, the device includes a processor, a memory, and a program stored in the memory and executable on the processor, and the processor implements the following steps when executing the program: when a data access request triggered by a data accessor is detected, a key pair is generated, and the key pair includes at least: a public key; the public key is sent to the data accessor, wherein the data accessor sends the public key to the smart contract of the blockchain; a login account is generated through the smart contract, and the login account is sent to the data accessor, so that the data accessor can access multiple business systems based on the login account.

[0116] When the processor executes the program, the following steps are also implemented: generating a key pair, including: generating a private key through a random number generator; constructing a numerical set based on a bilinear mapping function, wherein the numerical set at least includes: a first numerical value; multiplying the first numerical value with the private key to obtain a public key; and determining the key pair based on the private key and the public key.

[0117] When the processor executes the program, the following steps are also implemented: generating a login account through a smart contract, including: calculating a public key and a private key by a data accessor to generate a string set; sending the string set to the smart contract, and verifying the string set based on a first numerical value and a public key by the smart contract to obtain a verification result, wherein the verification result is a verification result obtained through a non-interactive zero-knowledge proof; when the verification result indicates that the verification is successful, generating a login account based on the public key; when the verification result indicates that the verification fails, rejecting the data access request of the data accessor.

[0118] When the processor executes the program, the following steps are also implemented: the public key and the private key are calculated by the data accessor to generate a string set, including: multiplying the first numerical value and the second numerical value to obtain a first string, wherein the second numerical value represents an arbitrary random integer selected by the data accessor; performing a hash calculation on the first string and the public key to obtain an intermediate variable; calculating the intermediate variable, the private key and the second numerical value to obtain a second string; and determining the string set based on the first string and the second string.

[0119] When the processor executes the program, the following steps are also implemented: the above-mentioned target system includes at least: a management subsystem, so that the data accessor can access multiple business systems based on the login account, including: storing the login account in the target database through the management subsystem; receiving a login request, and comparing the target account in the login request with the login account in the target database through the management subsystem, wherein the login request is a request generated by the data accessor based on the login account; when the target account and the login account are consistent, executing the data access request of the data accessor to access multiple business systems; when the target account and the login account are inconsistent, generating a prompt message, and sending the prompt message to the data accessor.

[0120] The processor also implements the following steps when executing the program: after generating a login account through a smart contract, the above method also includes: generating a valid timestamp for the login account through a smart contract; counting down the valid timestamp through a smart contract; during the countdown of the valid timestamp, executing the data access request of the data accessor; when the countdown of the valid timestamp ends, generating a logout instruction, and rejecting the data access operation of the data access request based on the logout instruction.

[0121] When the processor executes the program, the following steps are also implemented: after a valid timestamp is generated through a smart contract, the above method also includes: sending the valid timestamp to the data accessor and the management subsystem; when the management subsystem receives the login account and the valid timestamp, executing the data access request of the data accessor according to the valid timestamp; rejecting the data access operation of the data access request according to the logout instruction, including: when the management subsystem detects the logout instruction, deleting the login account in the target database and forcibly ending the data access operation of the data access request.

[0122] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0123] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that initializes the following method steps: upon detecting a data access request triggered by a data accessor, generating a key pair, the key pair comprising at least: a public key; sending the public key to the data accessor, wherein the data accessor sends the public key to a smart contract on the blockchain; generating a login account through the smart contract, and sending the login account to the data accessor, so that the data accessor can access multiple business systems based on the login account.

[0124] When executed on a data processing device, it is also suitable for executing an initialized program having the following method steps: generating a key pair, including: generating a private key through a random number generator; constructing a numerical set based on a bilinear mapping function, wherein the numerical set at least includes: a first numerical value; multiplying the first numerical value with the private key to obtain a public key; and determining the key pair based on the private key and the public key.

[0125] When executed on a data processing device, it is also suitable for executing a program that is initialized with the following method steps: generating a login account through a smart contract, including: calculating a public key and a private key by a data accessor to generate a string set; sending the string set to the smart contract, and verifying the string set based on a first numerical value and a public key by the smart contract to obtain a verification result, wherein the verification result is a verification result obtained through a non-interactive zero-knowledge proof; when the verification result indicates that the verification is successful, generating a login account based on the public key; when the verification result indicates that the verification fails, rejecting the data access request of the data accessor.

[0126] When executed on a data processing device, it is also suitable for executing an initialized program having the following method steps: calculating a public key and a private key by a data accessor to generate a string set, including: multiplying a first numerical value and a second numerical value to obtain a first string, wherein the second numerical value represents an arbitrary random integer selected by the data accessor; performing a hash calculation on the first string and the public key to obtain an intermediate variable; calculating the intermediate variable, the private key and the second numerical value to obtain a second string; and determining a string set based on the first string and the second string.

[0127] When executed on a data processing device, it is also suitable for executing a program that initializes the following method steps: the above-mentioned target system at least includes: a management subsystem, so that data accessors can access multiple business systems based on a login account, including: storing the login account in the target database through the management subsystem; receiving a login request, and comparing the target account in the login request with the login account in the target database through the management subsystem, wherein the login request is a request generated by the data accessor based on the login account; when the target account and the login account are consistent, executing the data access request of the data accessor to access multiple business systems; when the target account and the login account are inconsistent, generating a prompt message, and sending the prompt message to the data accessor.

[0128] When executed on a data processing device, it is also suitable for executing a program initialized with the following method steps: after generating a login account through a smart contract, the above method also includes: generating a valid timestamp for the login account through a smart contract; counting down the valid timestamp through the smart contract; during the countdown of the valid timestamp, executing the data access request of the data accessor; when the countdown of the valid timestamp ends, generating a logout instruction, and rejecting the data access operation of the data access request based on the logout instruction.

[0129] When executed on a data processing device, it is also suitable for executing a program initialized with the following method steps: after generating a valid timestamp through a smart contract, the above method also includes: sending the valid timestamp to the data accessor and the management subsystem; when the management subsystem receives the login account and the valid timestamp, executing the data access request of the data accessor according to the valid timestamp; rejecting the data access operation of the data access request according to the logout instruction, including: when the management subsystem detects the logout instruction, deleting the login account in the target database and forcibly ending the data access operation of the data access request.

[0130] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0131] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0132] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0133] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0134] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0135] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0136] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0137] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0138] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0139] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for logging into a business system, characterized in that: The method is applied to a target system, the target system is connected to multiple business systems in communication, and the target system at least includes: a blockchain, including: In case of detecting a data access request triggered by a data accessor, generating a key pair, the key pair comprising at least: a public key; Sending the public key to the data accessor, wherein the data accessor sends the public key to the smart contract of the blockchain; A login account is generated through the smart contract, and the login account is sent to the data accessor, so that the data accessor can access the multiple business systems based on the login account.

2. The method according to claim 1, characterized in that Generate a key pair, including: Generate a private key through a random number generator; Constructing a value set according to a bilinear mapping function, wherein the value set at least includes: a first value; Multiplying the first value by the private key to obtain the public key; The key pair is determined according to the private key and the public key.

3. The method according to claim 2, characterized in that Generate a login account through the smart contract, including: The data accessor calculates the public key and the private key to generate a character string set; Sending the string set to the smart contract, and verifying the string set through the smart contract based on the first value and the public key to obtain a verification result, wherein the verification result is a verification result obtained through non-interactive zero-knowledge proof; If the verification result indicates that the verification is successful, generating the login account according to the public key; If the verification result indicates that the verification fails, the data access request of the data accessor is rejected.

4. The method according to claim 3, characterized in that: The data accessor calculates the public key and the private key to generate a string set, including: Multiplying the first value and the second value to obtain a first character string, wherein the second value represents an arbitrary random integer selected by the data accessor; Performing hash calculation on the first character string and the public key to obtain an intermediate variable; Calculating the intermediate variable, the private key, and the second value to obtain a second character string; The character string set is determined according to the first character string and the second character string.

5. The method according to claim 1, characterized in that The target system at least includes: a management subsystem, so that the data accessor can access the multiple business systems based on the login account, including: The management subsystem stores the login account in a target database; Receiving a login request, and comparing a target account in the login request with a login account in the target database through the management subsystem, wherein the login request is a request generated by the data accessor based on the login account; When the target account and the login account are consistent, executing the data access request of the data accessor to access the multiple business systems; When the target account and the login account are inconsistent, a prompt message is generated and sent to the data accessor.

6. The method according to claim 5, characterized in that After generating a login account through the smart contract, the method further includes: For the login account, a valid timestamp is generated through the smart contract; Counting down the valid timestamp through the smart contract; During the countdown of the valid timestamp, executing the data access request of the data accessor; When the countdown of the valid timestamp ends, a logout instruction is generated, and the data access operation of the data access request is rejected according to the logout instruction.

7. The method according to claim 6, characterized in that After the valid timestamp is generated by the smart contract, the method further includes: sending the valid timestamp to the data accessor and the management subsystem; when the management subsystem receives the login account and the valid timestamp, executing the data access request of the data accessor according to the valid timestamp; Rejecting the data access operation of the data access request according to the logout instruction includes: deleting the login account in the target database and forcibly ending the data access operation of the data access request when the management subsystem detects the logout instruction.

8. A login device for a business system, characterized in that: The device is deployed in a target system, the target system is connected to multiple business systems, the target system at least includes: a blockchain, and the device includes: A first generating unit is configured to generate a key pair upon detecting a data access request triggered by a data accessor, wherein the key pair includes at least: a public key; A first sending unit, configured to send the public key to the data accessor, wherein the data accessor sends the public key to the smart contract of the blockchain; The second generating unit is used to generate a login account through the smart contract, and send the login account to the data accessor, so that the data accessor can access the multiple business systems based on the login account.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes stored computer instructions, wherein when the computer instructions are executed by a processor, the business system login method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the business system login method described in any one of claims 1 to 7.

Images