Identity authentication method and device based on intra-domain block chain and cross-domain block chain

Abstract

The invention provides an identity authentication method and device based on an intra-domain block chain and a cross-domain block chain. The identity authentication method based on the intra-domain block chain and the cross-domain block chain comprises the following steps: when an intra-domain device is authenticated, querying identity information of a to-be-authenticated Internet of Things device based on a dynamic identity management data structure, and verifying the identity information of the to-be-authenticated Internet of Things device; the dynamic identity management data structure is used for storing identity information of the Internet of Things equipment in the same trust domain; during cross-domain device authentication, cross-domain authentication is carried out according to the cross-domain permission voucher; cross-domain license credentials are accumulated in the smart contract using a dynamic accumulator. According to the identity authentication method and device based on the intra-domain block chain and the cross-domain block chain provided by the invention, rapid identity authentication of the intra-domain device and the cross-domain device can be realized, rapid identity confirmation between devices of different domains can be realized under the condition of protecting device privacy, and the efficiency and security of device identity authentication are improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security technology, and in particular to an identity authentication method and device based on intra-domain blockchain and cross-domain blockchain. Background Art

[0002] The Internet of Things refers to a network of devices connected and communicating via the Internet. These devices generate data in real time, exchange data with other devices around them, and establish connections. The Internet of Things has profoundly changed our production and lifestyle. The industry and market are gradually maturing, and application scenarios represented by industrial manufacturing, agricultural production, health care, smart cities, etc. are playing a positive role.

[0003] IoT devices can be managed by the same organization or different organizations. In order to protect device privacy, blockchain technology can be used to authenticate IoT devices and establish connections, thereby enabling data sharing between devices. However, the current IoT device authentication process is complex and still poses security risks such as privacy leakage and data tampering. Summary of the invention

[0004] The present invention provides an identity authentication method and device based on intra-domain blockchain and cross-domain blockchain, so as to solve the technical problem of low security of identity authentication of Internet of Things devices in the prior art.

[0005] In a first aspect, the present invention provides an identity authentication method based on intra-domain blockchain and cross-domain blockchain, comprising the following steps.

[0006] In the case that the device to be authenticated IoT device requests to connect is the first device, querying the identity information of the IoT device to be authenticated based on the dynamic identity management data structure, and verifying the identity information of the IoT device to be authenticated; the dynamic identity management data structure is used to store the identity information of IoT devices in the same trust domain; the first device is an IoT device that belongs to the same trust domain as the IoT device to be authenticated; In the case that the device requested to be connected by the IoT device to be authenticated is a second device, cross-domain authentication is performed based on the cross-domain permission credential; the cross-domain permission credential is stored on the blockchain using a dynamic accumulator; the second device is an IoT device belonging to a different trust domain from the IoT device to be authenticated.

[0007] In some embodiments, the identity information includes public key information and device pseudonym PID of the IoT device; The dynamic identity management data structure is generated based on a sparse Merkle tree, and the leaf nodes of the dynamic identity management data structure are used to store public key information of an IoT device, and there is a key-value pair relationship between the index of the leaf node and the PID of the IoT device.

[0008] In some embodiments, the identity information of the IoT device in the dynamic identity management data structure is added, deleted and / or updated by a key generation center KGC.

[0009] In some embodiments, when the KGC modifies the public key information stored in the target leaf node, the hash values ​​of all nodes on the path from the target leaf node to the root node corresponding to the target leaf node are synchronously modified.

[0010] In some embodiments, querying the identity information of the IoT device to be authenticated in the dynamic identity management data structure includes: Querying the target leaf node index associated with the device pseudonym PID of the IoT device to be authenticated in the dynamic identity management data structure; The hash value of the public key of the IoT device to be authenticated is obtained through the target leaf node index.

[0011] In some embodiments, the method further comprises: querying the dynamic identity management data structure for a Merkle proof of a hash value of the public key; The legitimacy of the IoT device to be authenticated is verified through the Merkle proof.

[0012] In some embodiments, the cross-domain permission credential is generated by an edge server corresponding to the IoT device to be authenticated according to a received request message from the IoT device to be authenticated.

[0013] In a second aspect, the present invention provides an identity authentication device based on intra-domain blockchain and cross-domain blockchain, comprising the following modules.

[0014] The intra-domain authentication module is used to query the identity information of the IoT device to be authenticated based on the dynamic identity management data structure and verify the identity information of the IoT device to be authenticated when the device to be authenticated IoT device requests to connect is the first device; the dynamic identity management data structure is used to store the identity information of IoT devices in the same trust domain; the first device is an IoT device belonging to the same trust domain as the IoT device to be authenticated; A cross-domain authentication module is used to perform cross-domain authentication according to a cross-domain permission credential when the device to be authenticated IoT device requests to connect to is a second device; the cross-domain permission credential is stored on the blockchain using a dynamic accumulator; the second device is an IoT device belonging to a different trust domain from the IoT device to be authenticated.

[0015] In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the identity authentication method based on intra-domain blockchain and cross-domain blockchain as described in the first aspect above is implemented.

[0016] In a fourth aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the identity authentication method based on intra-domain blockchain and cross-domain blockchain as described in the first aspect above.

[0017] In a fifth aspect, the present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the identity authentication method based on intra-domain blockchain and cross-domain blockchain as described in the first aspect above.

[0018] The identity authentication method and device based on intra-domain blockchain and cross-domain blockchain provided by the present invention, when the device to be authenticated IoT device requests to be connected is the first device, the identity information of the IoT device to be authenticated is queried in the dynamic identity management data structure, and the identity information of the IoT device to be authenticated is verified, wherein the dynamic identity management data structure is used to store the identity information of IoT devices in the same trust domain, and the first device is an IoT device belonging to the same trust domain as the IoT device to be authenticated; when the device to be authenticated IoT device requests to be connected is the second device, cross-domain authentication is performed according to the cross-domain permission credential, wherein the cross-domain permission credential is stored on the blockchain using a dynamic accumulator, and the second device is an IoT device belonging to a different trust domain from the IoT device to be authenticated. Rapid identity authentication of intra-domain devices and cross-domain devices can be achieved, and cross-domain device identity confirmation can be achieved while protecting device privacy, thereby improving the efficiency and security of device identity authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 It is a flow chart of the identity authentication method based on intra-domain blockchain and cross-domain blockchain provided by the present invention.

[0021] Figure 2 It is a schematic diagram of the solution architecture of the identity authentication method based on intra-domain blockchain and cross-domain blockchain provided by the present invention.

[0022] Figure 3 It is a schematic diagram of the dynamic identity management data structure provided by the present invention.

[0023] Figure 4 It is a schematic diagram of the edge-level intra-domain identity authentication process provided by the present invention.

[0024] Figure 5 This is a schematic diagram of the cross-domain identity authentication process provided by the present invention.

[0025] Figure 6 It is a structural schematic diagram of the identity authentication device based on intra-domain blockchain and cross-domain blockchain provided by the present invention.

[0026] Figure 7 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0027] In a massive, heterogeneous IoT environment, IoT devices are usually divided into different organizations for independent management. In order to protect the security of device data, each organization will establish an identity authentication system independent of other organizations to form mutually isolated trust domains. With the increasing diversity of IoT application scenarios and the explosive growth of access devices, resource exchanges between different management domains are becoming more frequent. The accessed domain needs to authenticate the requester to prevent data within the domain from being leaked to unauthorized third parties.

[0028] However, the limitations of the existing IoT environment include potential identity forgery, data silos, and information leakage. Limited by the storage and computing power of smart devices, any device exposed to the outside world in the IoT may become a target of attack, facing the risk of malicious tampering and privacy leakage. In addition, devices in different domains usually have different identity authentication mechanisms. These limitations make it more difficult for IoT devices to simultaneously ensure data privacy and identity security during cross-domain authentication.

[0029] Based on the above technical problems, the present invention proposes an identity authentication method based on intra-domain blockchain and cross-domain blockchain. When authenticating an intra-domain device, the identity information of the IoT device to be authenticated is queried in the dynamic identity management data structure, and the identity information of the IoT device to be authenticated is verified; the dynamic identity management data structure is used to store the identity information of IoT devices in the same trust domain; when authenticating a cross-domain device, cross-domain authentication is performed based on the cross-domain permission credential; the cross-domain permission credential is stored on the blockchain using a dynamic accumulator.

[0030] Through a lightweight blockchain-based identity authentication protocol, and by ensuring the credibility and reliability of the authentication process through blockchain's distributed consensus, non-tamperability, and automatic execution, authenticated IoT devices can be securely connected and share data. Secure communication between different IoT devices in the same domain and between devices in different domains can be achieved, thereby increasing the security and scalability of heterogeneous IoT systems.

[0031] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] Figure 1 This is one of the flow charts of the identity authentication method based on intra-domain blockchain and cross-domain blockchain provided by the present invention, such as Figure 1 As shown, the present invention provides an identity authentication method based on intra-domain blockchain and cross-domain blockchain, involving intra-domain blockchain (IDBC) and cross-domain blockchain (CDBC). Among them, the intra-domain blockchain is a private blockchain, which is composed of edge servers (ES), IoT devices and key generation centers (KGC) distributed in the Internet of Things. Among them, ES and KGC are used to manage IoT devices in the domain. The cross-domain blockchain is a consortium blockchain, which is composed of ES in different domains and performs cross-domain information sharing for IoT devices.

[0033] Edge servers (ES) are honest and curious, acting as managers of the blockchain within the domain to which the IoT device belongs and maintainers of cross-domain blockchains. ES has strong computing and storage capabilities, and as a full node, it saves a complete blockchain ledger. ES can honestly verify the identity of IoT devices according to the protocol, and analyze and process the data. However, ES is curious about IoT devices. They may try to analyze the received information and reveal the true identity of the device.

[0034] In the embodiment of the present application, each IoT device communicates with only one edge server, and any unregistered IoT device cannot share information with other devices.

[0035] The Key Generation Center (KGC) is a semi-honest entity responsible for identity registration and key management of IoT devices and edge servers. KGC is the manager of the IDBC to which the IoT devices belong, acts as a full node of the blockchain network, and records blockchain transactions in the blockchain ledger through a consensus mechanism. In addition, KGC follows the rules to perform device registration and revocation. However, KGC attempts to infer sensitive information of IoT devices and edge servers.

[0036] IoT devices are ubiquitous smart devices. With limited computing and storage capabilities, IoT devices continuously sense and generate data, and send the data to edge servers for data preprocessing and analysis, which greatly reduces network pressure.

[0037] The identity authentication method based on intra-domain blockchain and cross-domain blockchain includes the following steps 101 and 102.

[0038] Step 101: When the device that the IoT device to be authenticated requests to connect to is a first device, query the identity information of the IoT device to be authenticated based on a dynamic identity management data structure, and verify the identity information of the IoT device to be authenticated; the dynamic identity management data structure is used to store the identity information of IoT devices in the same trust domain; the first device is an IoT device that belongs to the same trust domain as the IoT device to be authenticated.

[0039] Specifically, the intra-domain blockchain adopts a dynamic identity management data structure (MTS) to manage the identity information of IoT devices belonging to the same trust domain so that they can be queried and quickly verified by other devices.

[0040] When the IoT device to be authenticated requests to connect to the first device in the same trust domain, the identity information of the IoT device to be authenticated is first queried based on the dynamic identity management data structure, and then the identity information of the IoT device to be authenticated is verified. If the verification is successful, a secure connection is established between the IoT device to be authenticated and the first device.

[0041] Step 102: When the device to be authenticated IoT device requests to connect is a second device, cross-domain authentication is performed according to the cross-domain permission credential; the cross-domain permission credential is stored on the blockchain using a dynamic accumulator; the second device is an IoT device that belongs to a different trust domain from the IoT device to be authenticated.

[0042] Specifically, for cross-domain blockchains, dynamic accumulators are used in smart contracts to accumulate cross-domain permission credentials. There is no need to directly record a large amount of device information. After obtaining the cross-domain permission credentials, cross-domain authentication is implemented based on the cross-domain permission credentials. If the authentication is successful, a secure connection between cross-domain devices is achieved.

[0043] In the embodiment of the present application, a variety of smart contracts with different characteristics are designed to upload information such as device identity and cross-domain permission to the blockchain ledger, which is convenient for retrieval in subsequent authentication, identity verification, and abnormal situation tracing processes.

[0044] For example, Figure 2: is a schematic diagram of the scheme architecture of the identity authentication method based on intra-domain blockchain and cross-domain blockchain provided by the present invention, such as Figure 2 As shown in the figure, taking domain A as an example, IoT devices and edge servers register in the key generation center (KGC) to obtain their public and private key pairs. It has limited computing and storage capabilities and is connected to the edge server via wireless communications such as Bluetooth, Wifi, and Zigbee. The intra-domain blockchain (IDBC) uses a dynamic identity management data structure (MTS) to store the identity information of the device, forming the basis of a transparent and reliable identity management solution. For IoT devices In response to the request, a cross-domain permission credential is generated and stored on the cross-domain blockchain (CDBC).

[0045] The identity authentication method based on intra-domain blockchain and cross-domain blockchain provided by the embodiment of the present application, when authenticating intra-domain devices, the identity information of the IoT device to be authenticated is queried in the dynamic identity management data structure, and the identity information of the IoT device to be authenticated is verified; the dynamic identity management data structure is used to store the identity information of IoT devices in the same trust domain; when authenticating cross-domain devices, cross-domain authentication is performed based on cross-domain license credentials; cross-domain license credentials are stored on the blockchain using dynamic accumulators. Rapid identity authentication of intra-domain devices and cross-domain devices is achieved, and rapid identity confirmation between devices in different domains can be achieved while protecting device privacy, which improves the security and scalability of heterogeneous IoT systems.

[0046] In some embodiments, the identity information includes public key information and device pseudonym PID of the IoT device; The dynamic identity management data structure is generated based on a sparse Merkle tree, and the leaf nodes of the dynamic identity management data structure are used to store public key information of an IoT device, and there is a key-value pair relationship between the index of the leaf node and the PID of the IoT device.

[0047] Specifically, the dynamic identity management data structure (MTS) is an improved sparse Merkle tree. Figure 3 is a schematic diagram of the dynamic identity management data structure provided by the present invention, such as Figure 3 As shown in the figure, each leaf node stores the hash value of the public key of the IoT device (i.e. the Public key in the figure), and the device pseudonym (PID, i.e. the Search Keyword in the figure) and the public key information are stored in MTS together. Among them, the leaf node index (i.e. the Leaf Node Index in the figure) and the PID exist in the form of a key-value pair set.

[0048] The identity authentication method based on intra-domain blockchain and cross-domain blockchain provided by the embodiment of the present application uses a dynamic identity management data structure to implement intra-domain device authentication, which can improve the efficiency of verifying the legitimacy of IoT devices without retrieving the entire data set, which helps to protect data privacy. Moreover, MTS is sparse because in the initialization stage, the leaf nodes are preset to the default hash value, such as , ensuring that each node can be assigned a certain hash value. All empty nodes can share the same hash value, so there is no need to store a hash value for each empty node, greatly reducing storage space.

[0049] In some embodiments, the identity information of the IoT device in the dynamic identity management data structure is added, deleted and / or updated by a key generation center KGC.

[0050] Specifically, the MTS structure is dynamic, and its length is determined by the number of device pseudonyms of IoT devices recognized by the Key Generation Center (KGC) in the latest block. KGC can modify the identity information of IoT devices stored in the dynamic identity management data structure, including addition, deletion and change.

[0051] In some embodiments, when the KGC modifies the public key information stored in the target leaf node, the hash values ​​of all nodes on the path from the target leaf node to the root node corresponding to the target leaf node are synchronously modified.

[0052] Specifically, MTS provides a global data integrity view, which can prove the integrity of the entire data set through the root hash. Any modification to the data (such as adding, deleting or changing public key information) will cause a change in the root hash, which can be quickly discovered.

[0053] When IoT devices When a device is identified as legitimate, KGC will use its device pseudonym The public key information of the device is stored in MTS. Specifically, KGC calculates the hash value of the device pseudonym , replace it to the specified leaf node, and store the public key information of the IoT device at the leaf node Then, KGC recalculates the hash values ​​of all nodes on the path from the leaf node to the root node and updates the Merkle root hash. Finally, KGC adds the new block to the blockchain.

[0054] when When a device is identified as a malicious device, KGC will replace the hash value of the device pseudonym in MTS with Change to , and leaves the public key information blank. After that, KGC updates the Merkle root and links the new block to the blockchain. When The value is updated to the device pseudonym hash value of the new IoT device , saving storage space. If there is no deleted member information in MTS, The public key information is stored in the first empty node in the current MTS.

[0055] The identity authentication method based on intra-domain blockchain and cross-domain blockchain provided in the embodiments of the present application uses a dynamic identity management data structure to manage the identity information of intra-domain devices. Any modification to the device public key will cause the root hash to change, thereby ensuring the security of the device information.

[0056] In some embodiments, querying the identity information of the IoT device to be authenticated in the dynamic identity management data structure includes: Querying the target leaf node index associated with the device pseudonym PID of the IoT device to be authenticated in the dynamic identity management data structure; The hash value of the public key of the IoT device to be authenticated is obtained through the target leaf node index.

[0057] Specifically, IoT devices within the domain can quickly locate specific leaf nodes directly through the device pseudonyms of the IoT devices and access the public key information of the target devices.

[0058] For example, the device pseudonym of the IoT device to be authenticated is , and found in MTS The associated target leaf node index is 001, and the public key information of the IoT device to be authenticated stored in the leaf node on the path corresponding to the target leaf node index is obtained, including the hash value of the public key.

[0059] In some embodiments, the method further comprises: querying the dynamic identity management data structure for a Merkle proof of a hash value of the public key; The legitimacy of the IoT device to be authenticated is verified through the Merkle proof.

[0060] Specifically, other member nodes of the blockchain in the domain can also quickly verify whether the IoT device is a legitimate device through the blockchain network, that is, check the legitimacy of the IoT device to be authenticated. Query the hash value of the public key of the IoT device to be authenticated from the blockchain Merkle proof (i.e. Merkle proof) and verify it locally. If the reconstructed root hash is the same as the known root hash of MTS, then it proves In MTS, that is It is a legitimate IoT device.

[0061] The identity authentication method based on intra-domain blockchain and cross-domain blockchain provided by the embodiment of the present application can quickly verify whether the target device is a malicious device by the member nodes in the blockchain, which saves the query time and storage space of the malicious device list. At the same time, the linkability under specific conditions of the pseudonym and the real identity can be used to trace and punish the malicious device afterwards.

[0062] In some embodiments, the cross-domain permission credential is generated by an edge server corresponding to the IoT device to be authenticated according to a received request message from the IoT device to be authenticated.

[0063] Specifically, the IoT device to be authenticated Corresponding edge server Upon receipt After receiving the request message, it responds to the request, generates a cross-domain permission credential, and stores the cross-domain permission credential on the cross-domain blockchain using a dynamic accumulator.

[0064] The identity authentication method based on intra-domain blockchain and cross-domain blockchain provided in the embodiment of the present application adopts intra-domain blockchain and cross-domain blockchain to support the identity authentication and security audit of IoT devices, reducing the bottleneck of single-chain blockchain in terms of storage capacity. The dynamic accumulator is integrated into the cross-domain device authentication to effectively verify the identity of devices from different domains and ensure the anonymity and non-traceability of their identities. In addition, a dynamic identity management data structure is designed based on the sparse Merkle tree to achieve secure management and efficient verification of intra-domain devices.

[0065] The identity authentication methods provided in the above embodiments are further described below through specific examples: Example 1: The specific steps for system initialization are as follows: During the system initialization phase, the key generation center generates system parameters and initializes the intra-domain blockchain and cross-domain blockchain. KGCs of multiple domains are jointly based on the elliptic curve Select a cyclic additive group , the generator is , prime order Finally, KGC selects 6 hash functions , , , , , ; Represents the group of integers.

[0066] Take domain A as an example. Random Selection As the system private key. Calculate and set the system public key to , and then obtain System public and private key pair. Then, Publish system parameters , and save the system private key. Finally, will be Embedded in the genesis block of the domain's blockchain.

[0067] Example 2: The specific steps for device registration are as follows: During the device registration phase, KGC distributes the public and private keys to IoT devices in the domain. In the key generation center We assume that at this stage, there is a secure channel between KGC and the device, and KGC will register offline.

[0068] Step 1 Random Selection , and calculate Then use your physical identity and Submit together to register.

[0069] Step 2 First check if the device has been registered. If it has been registered, the registration process will be terminated. Otherwise, Random Selection ,for Create a pseudonym , and calculate and .Then, generate And return to the .

[0070] Step 3 verify Is it true? If the formula is true, Set the device public key to , the device private key is , and store locally . Otherwise send the registration request again.

[0071] Step 4 Local storage , broadcast an issuance transaction and send the public key information Write it to MTS as a new leaf node. The validity period of the pseudonym. for Registration time.

[0072] During the device registration phase, KGC distributes the public and private keys to the edge servers in the domain. exist We assume that at this stage, there is a secure channel between KGC and ES, and KGC will register offline.

[0073] Step 1 Random Selection , and calculate Then use your physical identity and Submit together to register.

[0074] Step 2 First check if the device has been registered. If it has been registered, the registration process will be terminated. Otherwise, Random Selection ,calculate and .Then, generate And return to the .

[0075] Step 3 verify Is it true? If the formula is true, The public key is , save the private key locally , otherwise send the registration request again.

[0076] Example 3: Intra-domain authentication

[0077] We built an intra-domain blockchain with KGC and ES as management nodes to manage and control a group of IoT devices. When an IoT device needs to communicate or share information with other devices in the same domain, the device can verify the identities of both parties by querying or verifying the public key information stored in the intra-domain blockchain, thereby establishing a secure connection. Figure 4 FIG. 1 is a schematic diagram of the edge-level intra-domain identity authentication process provided by the present invention. Figure 4 As shown, assuming Want to Communicate and know The public key information of the server, the specific authentication steps are as follows: Step 1 ,Right now Towards Sending a request message : Pick a random number ,calculate and , and Send to Request authentication.

[0078] Step 2 ,Right now Towards Sending a response message : when exist Received It first checks Is it established? is a predefined threshold. After verification, if have The public key information can be quickly verified by MTS Is it a legitimate device? Otherwise, Query in MTS via IDBC If The identity is valid, Will get , and execute Confirm whether the transaction belongs to .

[0079] Then, Sure After the validity period, calculate the equation Is it true? If the equation is true, Random Selection ,calculate , , and .Then, Will Send to .

[0080] Step 3 side: when exist receive It first checks After verification, calculate and , and verify the equation If the equation holds, then and Complete two-way authentication, the session key is .

[0081] Example 4: Cross-domain authentication

[0082] In our proposed solution, IoT devices are registered by the KGC of the domain in which they are located. If the communicating devices belong to the same domain, the identity information of the devices can be queried and verified in the blockchain within the domain. If the devices belong to different domains, the devices need to be authenticated in a decentralized manner through the blockchain network composed of edge servers, thereby realizing information sharing between nodes in multiple domains across the network. Figure 5 is a schematic diagram of the cross-domain identity authentication process provided by the present invention, such as Figure 5 As shown, the specific authentication steps are as follows: Step 1: Obtaining cross-domain licensing: When the device in Domain A Want to access devices in Domain B It first needs to obtain cross-domain permission. We assume Know At this stage, Generate relevant authentication information and send it to the edge server . Combining smart contracts and dynamic accumulator technology, information is uploaded to the blockchain for subsequent rapid authentication.

[0083] (1) ,Right now Towards Send a cross-domain permission request message : Pick a random number ,calculate and , and Send to About Cross-domain permission.

[0084] (2) ,Right now Generate cross-domain license Stored in a cross-domain blockchain: when exist Received It first checks Is it established? is a predefined threshold. After verification, if have The public key information can be quickly verified by MTS Is it a legitimate device? Otherwise, Query via MTS in IDBC If The identity is valid, Will get .Then, Calculation equation Is it true? If the equation is true, calculate and add it to the dynamic accumulator of CDBC as a cross-domain permission credential for subsequent authentication.

[0085] Step 2: Cross-domain Authentication

[0086] We assume Know The public key, after passing the cross-domain permission, Towards Send an authentication request.

[0087] (1) ,Right now Towards Send authentication request message : calculate and , and Send to .

[0088] (2) ,Right now Towards Sending an authentication message : when exist receive It first checks After verification, Calculation equation Is it true? If the equation is true, calculate , and Send to Authentication is performed, where Indicates the use Sign the message.

[0089] (3) ,Right now Towards Feedback authentication response message : when exist receive When it first passes Verify that the message comes from .Then, examine Since the credentials generated for each authentication are different, You can check it in CDBC Whether it is in the dynamic accumulator, determine Whether to obtain cross-domain permission credentials. If yes, Return verification success information to Otherwise, the authentication process is terminated. Deletes a specific element value of a dynamic accumulator.

[0090] (4) ,Right now Towards Feedback verification response message : When received After the verification information is passed, Random Selection ,calculate , , and .Then, Will Send to .

[0091] (5) side: when exist receive When it first passes verify The validity of the information sent. examine After verification, calculate and , and verify the equation Is it true? If the equation is true, and Will The data used as the session key to encrypt information sharing completes the cross-domain authentication.

[0092] Figure 6: is a schematic diagram of the structure of the identity authentication device based on the intra-domain blockchain and the cross-domain blockchain provided by the present invention, such as Figure 6 As shown, the present invention provides an identity authentication device based on intra-domain blockchain and cross-domain blockchain, including an intra-domain authentication module 601 and a cross-domain authentication module 602.

[0093] The intra-domain authentication module 601 is used to query the identity information of the IoT device to be authenticated based on the dynamic identity management data structure and verify the identity information of the IoT device to be authenticated when the device to be authenticated IoT device requests to connect to is the first device; the dynamic identity management data structure is used to store the identity information of IoT devices in the same trust domain; the first device is an IoT device that belongs to the same trust domain as the IoT device to be authenticated.

[0094] The cross-domain authentication module 602 is used to perform cross-domain authentication according to the cross-domain permission credential when the device requested to be connected by the IoT device to be authenticated is a second device; the cross-domain permission credential is stored on the blockchain using a dynamic accumulator; the second device is an IoT device belonging to a different trust domain from the IoT device to be authenticated.

[0095] In some embodiments, the identity information includes public key information and device pseudonym PID of the IoT device; The dynamic identity management data structure is generated based on a sparse Merkle tree, and the leaf nodes of the dynamic identity management data structure are used to store public key information of an IoT device, and there is a key-value pair relationship between the index of the leaf node and the PID of the IoT device.

[0096] In some embodiments, the identity information of the IoT device in the dynamic identity management data structure is added, deleted and / or updated by a key generation center KGC.

[0097] In some embodiments, when the KGC modifies the public key information stored in the target leaf node, the hash values ​​of all nodes on the path from the target leaf node to the root node corresponding to the target leaf node are synchronously modified.

[0098] In some embodiments, the intra-domain authentication module includes: A first query unit, configured to query the dynamic identity management data structure for a target leaf node index associated with a device pseudonym PID of the IoT device to be authenticated; An acquisition unit is used to acquire the hash value of the public key of the Internet of Things device to be authenticated through the target leaf node index.

[0099] In some embodiments, the intra-domain authentication module further includes: A second query unit, configured to query the Merkle proof of the hash value of the public key in the dynamic identity management data structure; The verification unit is used to verify the legitimacy of the IoT device to be authenticated through the Merkle proof.

[0100] In some embodiments, the cross-domain permission credential is generated by an edge server corresponding to the IoT device to be authenticated according to a received request message from the IoT device to be authenticated.

[0101] Specifically, the identity authentication device based on intra-domain blockchain and cross-domain blockchain provided by the present invention can implement all the method steps implemented by the above-mentioned identity authentication method embodiment based on intra-domain blockchain and cross-domain blockchain, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0102] It should be noted that the division of units / modules in the above-mentioned embodiments of the present invention is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the functional units in the various embodiments of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware or in the form of software functional units.

[0103] Figure 7 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 7 As shown, the electronic device may include: a processor 701, a communications interface 702, a memory 703 and a communication bus 704, wherein the processor 701, the communications interface 702 and the memory 703 communicate with each other through the communication bus 704. The processor 701 may call the logic instructions in the memory 703 to execute an identity authentication method based on an intra-domain blockchain and a cross-domain blockchain, the method comprising: In the case that the device to be authenticated IoT device requests to connect is the first device, querying the identity information of the IoT device to be authenticated based on the dynamic identity management data structure, and verifying the identity information of the IoT device to be authenticated; the dynamic identity management data structure is used to store the identity information of IoT devices in the same trust domain; the first device is an IoT device that belongs to the same trust domain as the IoT device to be authenticated; In the case that the device requested to be connected by the IoT device to be authenticated is a second device, cross-domain authentication is performed based on the cross-domain permission credential; the cross-domain permission credential is stored on the blockchain using a dynamic accumulator; the second device is an IoT device belonging to a different trust domain from the IoT device to be authenticated.

[0104] Specifically, the processor 701 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD), and the processor may also adopt a multi-core architecture.

[0105] The logic instructions in the memory 703 can be implemented in the form of software functional units and can be stored in a processor-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0106] In some embodiments, a computer program product is further provided, the computer program product comprising a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can execute the identity authentication method based on the intra-domain blockchain and the cross-domain blockchain provided by the above-mentioned method embodiments, the method comprising: In the case that the device to be authenticated IoT device requests to connect is the first device, querying the identity information of the IoT device to be authenticated based on the dynamic identity management data structure, and verifying the identity information of the IoT device to be authenticated; the dynamic identity management data structure is used to store the identity information of IoT devices in the same trust domain; the first device is an IoT device that belongs to the same trust domain as the IoT device to be authenticated; In the case that the device requested to be connected by the IoT device to be authenticated is a second device, cross-domain authentication is performed based on the cross-domain permission credential; the cross-domain permission credential is stored on the blockchain using a dynamic accumulator; the second device is an IoT device belonging to a different trust domain from the IoT device to be authenticated.

[0107] Specifically, the above-mentioned computer program product provided in the embodiment of the present application can implement all the method steps implemented by the above-mentioned method embodiments, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0108] In some embodiments, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program, wherein the computer program is used to enable a computer to execute the identity authentication method based on the intra-domain blockchain and the cross-domain blockchain provided in the above-mentioned method embodiments, and the method includes: In the case that the device to be authenticated IoT device requests to connect is the first device, querying the identity information of the IoT device to be authenticated based on the dynamic identity management data structure, and verifying the identity information of the IoT device to be authenticated; the dynamic identity management data structure is used to store the identity information of IoT devices in the same trust domain; the first device is an IoT device that belongs to the same trust domain as the IoT device to be authenticated; In the case that the device requested to be connected by the IoT device to be authenticated is a second device, cross-domain authentication is performed based on the cross-domain permission credential; the cross-domain permission credential is stored on the blockchain using a dynamic accumulator; the second device is an IoT device belonging to a different trust domain from the IoT device to be authenticated.

[0109] Specifically, the above-mentioned computer-readable storage medium provided by the present invention can implement all the method steps implemented by the above-mentioned method embodiments, and can achieve the same technical effects. The parts and beneficial effects that are the same as the method embodiments in this embodiment will not be described in detail here.

[0110] It should be noted that the computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)), etc.

[0111] It should also be noted that the terms "first", "second", etc. in the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first" and "second" are usually of the same type, and the number of objects is not limited. For example, the first object can be one or more.

[0112] In the present invention, the term "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0113] In the present invention, the term "plurality" refers to two or more than two, and other quantifiers are similar to them.

[0114] In the present invention, "determine B based on A" means that the factor A should be considered when determining B. It is not limited to "B can be determined based on A alone", but should also include: "determine B based on A and C", "determine B based on A, C and E", "determine C based on A, and further determine B based on C", etc. In addition, it can also include taking A as a condition for determining B, for example, "when A meets the first condition, use the first method to determine B"; for another example, "when A meets the second condition, determine B", etc.; for another example, "when A meets the third condition, determine B based on the first parameter", etc. Of course, it can also be a condition that takes A as a factor for determining B, for example, "when A meets the first condition, use the first method to determine C, and further determine B based on C", etc.

[0115] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program codes.

[0116] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer executable instructions. These computer executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0117] These processor executable instructions may also be stored in a processor readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0118] These processor-executable instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0119] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. An identity authentication method based on intra-domain blockchain and cross-domain blockchain, characterized in that: include: In a case where the device to be authenticated IoT device requests to be connected is the first device, querying the identity information of the IoT device to be authenticated based on the dynamic identity management data structure, and verifying the identity information of the IoT device to be authenticated; The dynamic identity management data structure is used to store the identity information of the Internet of Things devices in the same trust domain; The first device is an IoT device that belongs to the same trust domain as the IoT device to be authenticated; In the case that the device requested to be connected by the IoT device to be authenticated is a second device, cross-domain authentication is performed based on the cross-domain permission credential; the cross-domain permission credential is stored on the blockchain using a dynamic accumulator; the second device is an IoT device belonging to a different trust domain from the IoT device to be authenticated.

2. The identity authentication method based on intra-domain blockchain and cross-domain blockchain according to claim 1 is characterized in that: The identity information includes the public key information and device pseudonym PID of the IoT device; The dynamic identity management data structure is generated based on a sparse Merkle tree, and the leaf nodes of the dynamic identity management data structure are used to store public key information of an IoT device, and there is a key-value pair relationship between the index of the leaf node and the PID of the IoT device.

3. The identity authentication method based on intra-domain blockchain and cross-domain blockchain according to claim 2 is characterized in that: The identity information of the Internet of Things devices in the dynamic identity management data structure is added, deleted and / or updated by the key generation center KGC.

4. The identity authentication method based on intra-domain blockchain and cross-domain blockchain according to claim 3 is characterized in that: When the KGC modifies the public key information stored in the target leaf node, the hash values ​​of all nodes on the path from the target leaf node to the root node corresponding to the target leaf node are synchronously modified.

5. The identity authentication method based on intra-domain blockchain and cross-domain blockchain according to claim 2 is characterized in that: The querying of the identity information of the IoT device to be authenticated based on the dynamic identity management data structure includes: Querying the target leaf node index associated with the device pseudonym PID of the IoT device to be authenticated in the dynamic identity management data structure; The hash value of the public key of the IoT device to be authenticated is obtained through the target leaf node index.

6. The identity authentication method based on intra-domain blockchain and cross-domain blockchain according to claim 5 is characterized in that: The method further comprises: querying the dynamic identity management data structure for a Merkle proof of a hash value of the public key; The legitimacy of the IoT device to be authenticated is verified through the Merkle proof.

7. The identity authentication method based on intra-domain blockchain and cross-domain blockchain according to claim 1 is characterized in that: The cross-domain permission credential is generated by the edge server corresponding to the IoT device to be authenticated according to a received request message from the IoT device to be authenticated.

8. An identity authentication device based on intra-domain blockchain and cross-domain blockchain, characterized in that: include: The intra-domain authentication module is used to query the identity information of the IoT device to be authenticated based on the dynamic identity management data structure and verify the identity information of the IoT device to be authenticated when the device to be authenticated requests to be connected is the first device; The dynamic identity management data structure is used to store the identity information of the Internet of Things devices in the same trust domain; The first device is an IoT device that belongs to the same trust domain as the IoT device to be authenticated; A cross-domain authentication module is used to perform cross-domain authentication according to a cross-domain permission credential when the device to be authenticated IoT device requests to connect to is a second device; the cross-domain permission credential is stored on the blockchain using a dynamic accumulator; the second device is an IoT device belonging to a different trust domain from the IoT device to be authenticated.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, it implements the identity authentication method based on intra-domain blockchain and cross-domain blockchain as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the identity authentication method based on intra-domain blockchain and cross-domain blockchain as described in any one of claims 1 to 7.

Images