Identity authentication method and device based on intra-domain blockchain and cross-domain blockchain

Abstract

The application provides an identity authentication method and device based on an intra-domain blockchain and a cross-domain blockchain. The identity authentication method based on the intra-domain blockchain and the cross-domain blockchain comprises the following steps: when authenticating an intra-domain device, identity information of an Internet of Things device to be authenticated is inquired based on a dynamic identity management data structure, and the identity information of the Internet of Things device to be authenticated is verified; the dynamic identity management data structure is used for storing identity information of Internet of Things devices in the same trust domain; when authenticating a cross-domain device, cross-domain authentication is performed according to a cross-domain permission certificate; and the cross-domain permission certificate is accumulated in a smart contract by using a dynamic accumulator. The identity authentication method and device based on the intra-domain blockchain and the cross-domain blockchain can realize fast identity authentication of intra-domain devices and cross-domain devices, and can realize fast identity confirmation between devices in different domains while protecting the privacy of the devices, thereby improving the efficiency and security of device identity authentication.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things security, and in particular to an identity authentication method and device based on intra-domain blockchain and cross-domain blockchain. BACKGROUND

[0002] The Internet of Things refers to a network of devices connected and communicated through the Internet. These devices generate data in real time and exchange data with other surrounding devices and establish contact. The Internet of Things has profoundly changed our production and life style, and the industry and market are gradually maturing. The application scenarios represented by industrial manufacturing, agricultural production, health care, smart city, etc. are playing an active role.

[0003] Internet of Things devices can be divided into the same organization or different organizations for management. At present, in order to protect device privacy, the identity authentication of Internet of Things devices can be carried out through blockchain technology to establish connection, so as to realize data sharing between devices. However, the current Internet of Things device identity authentication process is complex, and there are still security risks such as privacy leakage and data tampering. SUMMARY

[0004] The present application provides an identity authentication method and device based on intra-domain blockchain and cross-domain blockchain, to solve the technical problem of low security of Internet of Things device identity authentication in the prior art.

[0005] In a first aspect, the present application provides an identity authentication method based on intra-domain blockchain and cross-domain blockchain, comprising the following steps.

[0006] In the case that the device requesting connection of the to-be-authenticated Internet of Things device is a first device, the identity information of the to-be-authenticated Internet of Things device is queried based on a dynamic identity management data structure, and the identity information of the to-be-authenticated Internet of Things device is verified; the dynamic identity management data structure is used to store the identity information of Internet of Things devices in the same trust domain; the first device is an Internet of Things device belonging to the same trust domain as the to-be-authenticated Internet of Things device;

[0007] In the case that the device requesting connection of the to-be-authenticated Internet of Things device is a second device, cross-domain authentication is carried out according to a cross-domain permission credential; the cross-domain permission credential is stored on the blockchain by using a dynamic accumulator; the second device is an Internet of Things device belonging to a different trust domain from the to-be-authenticated Internet of Things device.

[0008] In some embodiments, the identity information includes public key information and device pseudonym PID of the Internet of Things device;

[0009] The dynamic identity management data structure is generated based on a sparse Merkle tree, leaf nodes of the dynamic identity management data structure are used to store public key information of the Internet of Things device, and there is a key-value pair relationship between indexes of the leaf nodes and PIDs of the Internet of Things device.

[0010] In some embodiments, identity information of the Internet of Things device in the dynamic identity management data structure is added, deleted and / or updated by a key generation center KGC.

[0011] In some embodiments, in the case where the KGC modifies the public key information stored in a target leaf node, the hash values of all nodes on the path from the target leaf node to the root node corresponding to the target leaf node are synchronously modified.

[0012] In some embodiments, the querying of the identity information of the Internet of Things device to be authenticated in the dynamic identity management data structure comprises:

[0013] Querying a target leaf node index associated with a device pseudonym PID of the Internet of Things device to be authenticated in the dynamic identity management data structure;

[0014] Obtaining a hash value of the public key of the Internet of Things device to be authenticated through the target leaf node index.

[0015] In some embodiments, the method further comprises:

[0016] Querying a Merkle proof of the hash value of the public key in the dynamic identity management data structure;

[0017] Verifying the legitimacy of the Internet of Things device to be authenticated through the Merkle proof.

[0018] In some embodiments, the cross-domain permission credential is generated by an edge server corresponding to the Internet of Things device to be authenticated according to a request message received from the Internet of Things device to be authenticated.

[0019] In a second aspect, the present application provides an identity authentication device based on an intra-domain blockchain and a cross-domain blockchain, comprising the following modules.

[0020] An intra-domain authentication module is configured to, in the case where a device requested to be connected by an Internet of Things device to be authenticated is a first device, query identity information of the Internet of Things device to be authenticated based on a dynamic identity management data structure, and verify the identity information of the Internet of Things device to be authenticated; the dynamic identity management data structure is used to store identity information of Internet of Things devices in the same trust domain; and the first device is an Internet of Things device belonging to the same trust domain as the Internet of Things device to be authenticated.

[0021] The cross-domain authentication module is configured to perform cross-domain authentication according to a cross-domain permission credential in a case where the device requested to be connected by the to-be-authenticated Internet of Things device is a second device; the cross-domain permission credential is stored on a block chain by using a dynamic accumulator; and the second device is an Internet of Things device belonging to a different trust domain from the to-be-authenticated Internet of Things device.

[0022] In a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the identity authentication method based on the intra-domain block chain and the cross-domain block chain according to the first aspect.

[0023] In a fourth aspect, the present application further provides a non-transitory computer readable storage medium, which stores a computer program, wherein the computer program is executed by a processor to implement the identity authentication method based on the intra-domain block chain and the cross-domain block chain according to the first aspect.

[0024] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, wherein the computer program is executed by a processor to implement the identity authentication method based on the intra-domain block chain and the cross-domain block chain according to the first aspect.

[0025] The identity authentication method and device based on the intra-domain block chain and the cross-domain block chain provided by the present application can realize the rapid identity authentication of intra-domain devices and cross-domain devices, and can realize the cross-domain device identity confirmation while protecting the privacy of the devices, thereby improving the efficiency and security of the device identity authentication. BRIEF DESCRIPTION OF DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the present application or the prior art, the following will briefly introduce the drawings needed in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0027] Figure 1is a flowchart of the identity authentication method based on intra-domain blockchain and cross-domain blockchain provided by the present application.

[0028] Figure 2 is a scheme architecture diagram of the identity authentication method based on intra-domain blockchain and cross-domain blockchain provided by the present application.

[0029] Figure 3 is a schematic diagram of the dynamic identity management data structure provided by the present application.

[0030] Figure 4 is an edge-level intra-domain identity authentication flowchart provided by the present application.

[0031] Figure 5 is a cross-domain identity authentication flowchart provided by the present application.

[0032] Figure 6 is a structural diagram of the identity authentication device based on intra-domain blockchain and cross-domain blockchain provided by the present application.

[0033] Figure 7 is a structural diagram of the electronic device provided by the present application. DETAILED DESCRIPTION

[0034] In a massive and heterogeneous Internet of Things environment, Internet of Things devices are usually divided into different organizations for independent management. In order to protect the security of device data, each organization will establish an identity authentication system independent of other organizations, forming a mutually isolated trust domain. With the increasing diversity of Internet of Things application scenarios and the explosive growth of access devices, resource exchange between different management fields is more frequent. The accessed domain needs to authenticate the identity of the requestor to prevent data leakage in the domain to unauthorized third parties.

[0035] However, the limitations of the existing Internet of Things environment include potential identity forgery, data silos, and information leakage. Limited by the storage and computing capabilities of intelligent devices, any device exposed to the outside in the Internet of Things may become an object of attack, facing the risk of malicious tampering and privacy leakage. In addition, devices in different domains usually have different identity authentication mechanisms. These limitations make it more difficult for Internet of Things devices to ensure data privacy and identity security at the same time in the process of cross-domain authentication.

[0036] Based on the above technical problems, the present application provides an identity authentication method based on intra-domain blockchain and cross-domain blockchain. In the intra-domain device authentication, the identity information of the to-be-authenticated Internet of Things device is queried in the dynamic identity management data structure, and the identity information of the to-be-authenticated Internet of Things device is verified. The dynamic identity management data structure is used to store the identity information of the Internet of Things devices in the same trust domain. In the cross-domain device authentication, cross-domain authentication is performed according to the cross-domain permission certificate. The cross-domain permission certificate is stored on the blockchain by using a dynamic accumulator.

[0037] Through the lightweight blockchain-based identity authentication protocol, and through the characteristics of blockchain distributed consensus, tamper-proof, automatic execution, etc., the authenticity and reliability of the authentication process are ensured, so that the authenticated Internet of Things devices can be safely connected and data sharing can be performed. The security communication between different Internet of Things devices in the same domain and between devices in different domains can be realized, thereby increasing the security and scalability of the heterogeneous Internet of Things system.

[0038] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the present application will be described clearly and completely below in combination with the drawings in the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0039] Figure 1 is one of the flowcharts of the identity authentication method based on intra-domain blockchain and cross-domain blockchain provided by the present application, as shown in Figure 1 The present application provides an identity authentication method based on intra-domain blockchain and cross-domain blockchain, which relates to intra-domain blockchain (IDBC) and cross-domain blockchain (CDBC). The intra-domain blockchain is a private blockchain, which is composed of edge servers (ES), Internet of Things devices and key generation centers (KGC) distributed in the Internet of Things. The ES and KGC are used to manage the Internet of Things devices in the domain. The cross-domain blockchain is a consortium blockchain, which is composed of ESs in different domains and is used for cross-domain information sharing of Internet of Things devices.

[0040] The edge server (ES) is honest and curious, and acts as the manager of the intra-domain blockchain to which the Internet of Things device belongs and the maintainer of the cross-domain blockchain. The ES has strong computing and storage capability, and saves the complete blockchain ledger as a full node. The ES can honestly verify the identity of the Internet of Things device according to the protocol, and analyze and process the data. However, the ES is curious about the Internet of Things device. They may try to analyze the received information and reveal the real identity of the device.

[0041] In the embodiments of the present application, each Internet of Things device only communicates with one edge server, and any unregistered Internet of Things device cannot share information with other devices.

[0042] The key generation center (KGC) is a semi-honest entity responsible for the identity registration and key management of Internet of Things devices and edge servers. The KGC is the manager of the IDBC to which the Internet of Things device belongs, acts as a full node of the blockchain network, and records the blockchain transaction in the blockchain ledger through the consensus mechanism. In addition, the KGC performs device registration and revocation in accordance with the rules. However, the KGC attempts to infer sensitive information of the Internet of Things devices and edge servers.

[0043] The Internet of Things device (Device) is a ubiquitous smart device. The Internet of Things device has limited computing and storage capabilities, and it constantly senses and generates data and sends it to the edge server for data preprocessing and analysis, greatly reducing network pressure.

[0044] The identity authentication method based on intra-domain blockchain and cross-domain blockchain includes the following steps 101 and 102.

[0045] Step 101, in the case that the device requesting connection of the to-be-authenticated Internet of Things device is a first device, querying the identity information of the to-be-authenticated Internet of Things device based on a dynamic identity management data structure, and verifying the identity information of the to-be-authenticated Internet of Things device; the dynamic identity management data structure is used to store the identity information of the Internet of Things devices in the same trust domain; the first device is an Internet of Things device belonging to the same trust domain as the to-be-authenticated Internet of Things device.

[0046] Specifically, the intra-domain blockchain uses a dynamic identity management data structure (MTS) to manage the identity information of the Internet of Things devices belonging to the same trust domain, so as to be queried and quickly verified by other devices.

[0047] When the to-be-authenticated Internet of Things device requests to connect to the first device in the same trust domain, the identity information of the to-be-authenticated Internet of Things device is first queried based on the dynamic identity management data structure, and then the queried identity information of the to-be-authenticated Internet of Things device is verified. If the verification is passed, the to-be-authenticated Internet of Things device establishes a secure connection with the first device.

[0048] Step 102, in the case that the device requesting connection of the to-be-authenticated Internet of Things device is a second device, cross-domain authentication is performed according to a cross-domain permission credential; the cross-domain permission credential is stored on the blockchain using a dynamic accumulator; the second device is an Internet of Things device belonging to a different trust domain from the to-be-authenticated Internet of Things device.

[0049] Specifically, for cross-domain blockchain, a dynamic accumulator is used in a smart contract to accumulate cross-domain permission credentials, without directly recording a large amount of device information, and after obtaining the cross-domain permission credentials, cross-domain authentication is implemented according to the cross-domain permission credentials, and if the authentication is passed, a secure connection between cross-domain devices is achieved.

[0050] In the embodiments of the present application, a plurality of smart contracts with different characteristics are designed, and device identity, cross-domain permission and the like are uploaded to a blockchain ledger, facilitating retrieval in subsequent authentication, identity verification and abnormal condition tracing processes.

[0051] For example, Figure 2 is a scheme architecture diagram of the identity authentication method based on the intra-domain blockchain and the cross-domain blockchain provided by the present application, as Figure 2 shown, taking domain A as an example, the Internet of Things device and the edge server are registered in a key generation center (KGC) to obtain a public-private key pair. The Internet of Things device has limited computing and storage capabilities, and is connected to the edge server through wireless communication such as Bluetooth, Wifi, Zigbee, etc. The intra-domain blockchain (IDBC) stores the identity information of the device using a dynamic identity management data structure (MTS), forming the basis of a transparent and reliable identity management scheme. In cross-domain identity authentication, the edge server responds to the request of the Internet of Things device , generates and stores the cross-domain permission credentials on the cross-domain blockchain (CDBC).

[0052] The identity authentication method based on the intra-domain blockchain and the cross-domain blockchain provided by the present application, when authenticating intra-domain devices, queries the identity information of the Internet of Things device to be authenticated in the dynamic identity management data structure, and verifies the identity information of the Internet of Things device to be authenticated; the dynamic identity management data structure is used to store the identity information of the Internet of Things device in the same trust domain; when authenticating cross-domain devices, cross-domain authentication is performed according to the cross-domain permission credentials; the cross-domain permission credentials are stored on the blockchain using a dynamic accumulator. The identity authentication of intra-domain devices and cross-domain devices is realized, and the identity confirmation between devices in different domains can be realized while protecting the privacy of the devices, thereby improving the security and scalability of the heterogeneous Internet of Things system.

[0053] In some embodiments, the identity information includes public key information and a device pseudonym PID of the Internet of Things device;

[0054] The dynamic identity management data structure is generated based on a sparse Merkle tree, and the leaf nodes of the dynamic identity management data structure are used to store the public key information of the Internet of Things device, and the index of the leaf node has a key-value pair relationship with the PID of the Internet of Things device.

[0055] In particular, the dynamic identity management data structure (MTS) is a kind of improved sparse Merkle tree. Figure 3 is a schematic diagram of the dynamic identity management data structure provided by the application, as Figure 3 shown, each leaf node stores the hash value of the public key of the Internet of Things device (i.e. Public key in the figure), and the device pseudonym (PID, i.e. Search Keyword in the figure) and the public key information are stored in the MTS. Among them, the leaf node index (i.e. Leaf Node Index in the figure) and the PID exist in the form of key-value pair set.

[0056] The identity authentication method based on intra-domain blockchain and cross-domain blockchain provided by the embodiments of the application uses the dynamic identity management data structure to realize intra-domain device authentication, which can improve the efficiency of verifying the legitimacy of Internet of Things devices, without the need to search the entire data set, which helps to protect data privacy. Moreover, the MTS has sparsity, because in the initialization phase, the preset leaf nodes are default hash values, such as , ensuring that each node can be assigned a certain hash value. All empty nodes can share the same hash value, so there is no need to store a hash value for each empty node, greatly reducing the storage space.

[0057] In some embodiments, the identity information of the Internet of Things device in the dynamic identity management data structure is added, deleted and / or updated by the key generation center KGC.

[0058] In particular, the MTS structure is dynamic, and its length is determined by the number of device pseudonyms of the Internet of Things device identified by the key generation center (KGC) in the latest block. The KGC can modify the identity information of the Internet of Things device stored in the dynamic identity management data structure, including adding, deleting and changing.

[0059] In some embodiments, in the case where the KGC modifies the public key information stored in the target leaf node, the hash values of all nodes on the path from the target leaf node to the root node corresponding to the target leaf node are synchronously modified.

[0060] In particular, the MTS provides a global data integrity view, and the integrity of the entire data set can be proved by the root hash. Any modification to the data (such as adding, deleting or changing the public key information) will cause the root hash to change, so it can be quickly discovered.

[0061] When the Internet of Things device is identified as a legal device, the KGC stores the public key information of its device pseudonym in the MTS. In particular, the KGC calculates the hash value of the device pseudonym replaces it to the designated leaf node and stores the public key information of the thing internet device at the leaf node correspondingly. Then, the KGC recalculates the hash values of all nodes on the path from the leaf node to the root node and updates the Merkle root hash. Finally, the KGC adds the new block to the blockchain.

[0062] When a thing internet device is identified as a malicious device, the KGC changes the hash value of the device pseudonym of the device in the MTS from to and empties the public key information. After that, the KGC updates the Merkle root and links the new block to the blockchain. When a new thing internet device joins in, the MTS can update the value of to the device pseudonym hash value of the new thing internet device, saving storage space. If there is no deleted member information in the MTS, the public key information of is stored to the first empty node in the current MTS.

[0063] The identity authentication method based on the intra-domain blockchain and the cross-domain blockchain provided in the embodiments of the present application uses a dynamic identity management data structure to implement the management of the identity information of intra-domain devices, and any modification of the public key of a device will cause the root hash to change, thereby ensuring the security of the device information.

[0064] In some embodiments, the querying, in the dynamic identity management data structure, of the identity information of the thing internet device to be authenticated comprises:

[0065] querying, in the dynamic identity management data structure, a target leaf node index associated with a device pseudonym PID of the thing internet device to be authenticated;

[0066] obtaining, through the target leaf node index, a hash value of the public key of the thing internet device to be authenticated.

[0067] Specifically, the thing internet devices within a domain can directly locate a specific leaf node through the device pseudonym of the thing internet device and access the public key information of the target device.

[0068] For example, the device pseudonym of the thing internet device to be authenticated is , and the target leaf node index associated with is 001 in the MTS. The public key information of the thing internet device to be authenticated stored in the leaf node on the path corresponding to the target leaf node index includes the hash value of the public key.

[0069] In some embodiments, the method further comprises:

[0070] querying, in the dynamic identity management data structure, a Merkle proof of the hash value of the public key;

[0071] verifying, by the Merkle proof, the legitimacy of the Internet of Things device to be authenticated.

[0072] Specifically, other member nodes of the intra-domain blockchain can also quickly verify, through the blockchain network, whether the Internet of Things device is a legitimate device, that is, check the legitimacy of the Internet of Things device to be authenticated, the first device querying, in the dynamic identity management data structure, a Merkle proof of the hash value of the public key; of the Internet of Things device to be authenticated from the blockchain, and verifying locally. If the reconstructed root hash is the same as the numerical value of the root hash known by the MTS, it is proved in the MTS, that is the Internet of Things device is a legitimate device.

[0073] The identity authentication method based on intra-domain blockchain and cross-domain blockchain provided by the embodiments of the present application can quickly verify, by the member nodes in the blockchain, whether the target device is a malicious device, which saves the query time and storage space of the malicious device list. At the same time, the linkability of pseudonyms and real identities under certain conditions can be used to trace back and punish malicious devices afterwards.

[0074] In some embodiments, the cross-domain permission credential is generated by the edge server corresponding to the Internet of Things device to be authenticated according to the request message received from the Internet of Things device to be authenticated.

[0075] Specifically, the Internet of Things device to be authenticated corresponding edge server after receiving the request message, responds to the request, generates a cross-domain permission credential, and stores the cross-domain permission credential on the cross-domain blockchain by using a dynamic accumulator.

[0076] The identity authentication method based on intra-domain blockchain and cross-domain blockchain provided by the embodiments of the present application adopts intra-domain blockchain and cross-domain blockchain to support identity authentication and security audit of Internet of Things devices, and reduces the bottleneck of single-chain blockchain in terms of storage capacity. The dynamic accumulator is integrated into cross-domain device authentication to effectively verify the identity of devices from different domains and ensure the anonymity and non-traceability of the identity. In addition, a dynamic identity management data structure is designed based on a sparse Merkle tree, which realizes the security management and efficient verification of intra-domain devices.

[0077] The identity authentication method provided by each of the above embodiments will be further described below through specific examples:

[0078] Example 1: The system initialization specific steps are as follows:

[0079] In the system initialization phase, the key generation center generates system parameters, and initializes the intra-domain blockchain and cross-domain blockchain. The KGCs of multiple domains jointly select a cyclic additive group on an elliptic curve with generator and prime order . Finally, the KGC selects 6 hash functions , , , , ; represent the integer group.

[0080] Taking domain A as an example, randomly select as the system private key. Calculate and set the system public key as , then get the system public-private key pair. Then, publish the system parameters , and save the system private key. Finally, will be embedded in the genesis block of the intra-domain blockchain.

[0081] Example 2: The device registration specific steps are as follows:

[0082] In the device registration phase, the KGC distributes the public key and private key to the Internet of Things devices in the domain. Taking the Internet of Things device in domain A (Domain A) as an example. Register in the key generation center . We assume that there is a secure channel between the KGC and the device at this stage, and the KGC will register offline.

[0083] Step 1, randomly select , and calculate . Then submit its physical real identity and together to for registration.

[0084] Step 2, first check if the device has been registered. If it has been registered, terminate the registration program. Otherwise, randomly select , create a pseudonym for , and calculate and . Then, ​generate And returned to via a secure channel .

[0085] Step 3 verify Is the formula true? If the formula is true, Set the device public key to The device private key is and local storage Otherwise, send the registration request again.

[0086] Step 4 Local save Broadcast an issuance transaction and send the public key information. It is written to the MTS as a new leaf node. The validity period of the pseudonym. for The registration time.

[0087] During the device registration phase, KGC distributes public and private keys to edge servers within the domain. Taking edge servers in domain A as an example... exist Let's take online registration as an example. We assume that at this stage, there is a secure channel between KGC and ES, and KGC will register offline.

[0088] Step 1 Random selection and calculate Then reveal your true physical identity. and Submit together Register.

[0089] Step 2 First, check if the device is already registered. If it is, the registration process will be terminated. Otherwise, Random selection ,calculate and .Then, generate And returned to via a secure channel .

[0090] Step 3 verify Is the formula true? If the formula is true, The public key is Store the private key locally Otherwise, send the registration request again.

[0091] Example 3: Intra-domain authentication

[0092] We construct an in-domain blockchain with KGC and ES as management nodes to manage and control a group of IoT devices. When an IoT device needs to communicate or share information with other devices in the same domain, the device can verify the identity of both parties by querying or verifying the stored public key information of the in-domain blockchain, thereby establishing a secure connection. Figure 4 is the edge-level in-domain identity authentication process provided by the application, as shown in Figure 4 , assuming that wants to communicate with , and the public key information of is known, the specific authentication steps are as follows:

[0093] Step 1, i.e. send a request message to :

[0094] Select a random number , calculate and , and send to request identity authentication.

[0095] Step 2, i.e. send a response message to :

[0096] When receives , it first checks whether is valid, where is a predefined threshold. After verification, if has the public key information of , it can quickly verify whether is a legal device through MTS. Otherwise, queries the identity information of in MTS through IDBC. If the identity of is valid, will get and execute to confirm whether the transaction belongs to .

[0097] Then, determine after the validity period, calculate whether the equation is valid. If the equation is valid, randomly select ​,calculate , , and .Then, Will Send to .

[0098] Step 3 side:

[0099] when exist receive At that time, it first checks Is it valid? After successful verification... calculate and And verify the equation. Does it hold true? If the equation holds true, then... and Two-way authentication completed, session key is .

[0100] Example 4: Cross-domain authentication

[0101] In our proposed solution, IoT devices are registered by the KGC (Knowledge, Generic, and Domain) of their respective domains. If communicating devices belong to the same domain, their identity information can be queried and verified within the domain's blockchain. If devices belong to different domains, a blockchain network composed of edge servers is needed to authenticate the devices in a decentralized manner, thereby enabling information sharing between nodes across multiple domains in the network. Figure 5 This is a schematic diagram of the cross-domain identity authentication process provided by the present invention, such as... Figure 5 As shown, the specific authentication steps are as follows:

[0102] Step 1: Obtaining Cross-Domain Licensing:

[0103] Devices in Domain A Want to access devices in Domain B At that time, it first needs to obtain cross-domain permission. Let's assume... Know The public key information. At this stage, Generate relevant authentication information and send the information to the edge server. . By combining smart contracts and dynamic accumulator technology, information is uploaded to the blockchain for subsequent rapid authentication.

[0104] (1) ,Right now Towards Sending a cross-domain permission request message :

[0105] Selecting a random number , compute and and send to for cross-domain permission regarding .

[0106] (2) i.e. generate cross-domain permission and store in cross-domain blockchain:

[0107] When receives , it first checks whether holds, where is a predefined threshold. After verification, if owns the public key information of , it can quickly verify whether is a legal device through MTS. Otherwise, queries the identity information of in IDBC through MTS. If the identity of is valid, will get . Then, computes whether the equation holds. If the equation holds, computes and adds it as a cross-domain permission credential to the dynamic accumulator of CDBC for subsequent authentication.

[0108] Step 2, Cross-domain identity authentication (i.e. Cross-domain Authentication)

[0109] We assume that knows the public key of , and after passing the cross-domain permission, sends an authentication request to .

[0110] (1) i.e. sends an authentication request message to :

[0111] computes and and sends Send to .

[0112] (2) ,Right now Towards Send authentication message :

[0113] when exist receive At that time, it first checks Is it valid? After successful verification... Calculate the equation Does the equation hold true? If it does, calculate... and will Send to Authentication is performed, where Indicates use Sign the message.

[0114] (3) ,Right now Towards Feedback authentication response message :

[0115] when exist receive At that time, it first passed through Verify if the message source is from .Then, examine Is it valid? Since the credentials generated for each authentication are different, therefore... You can query it in CDBC Whether it is in the dynamic accumulator, determine Has a cross-domain permission certificate been obtained? If so, Return verification success message to Otherwise, terminate the authentication process. Furthermore, when You can delete specific element values ​​from a dynamic accumulator.

[0116] (4) ,Right now Towards Feedback verification response message :

[0117] When received After the verification information is approved, Random selection ,calculate , , and .Then, Will Send to .

[0118] (5) side:

[0119] when exist receive At that time, it first passed through verify The validity of the sent information. Secondly, examine Is it valid? After successful verification... calculate and And verify the equation. Does the equation hold true? If the equation holds true, and Will The data shared as a session key is then encrypted, and cross-domain authentication is complete.

[0120] Figure 6 This is a schematic diagram of the identity authentication device based on intra-domain blockchain and cross-domain blockchain provided by the present invention, as shown below. Figure 6 As shown, the present invention provides an identity authentication device based on intra-domain blockchain and cross-domain blockchain, including an intra-domain authentication module 601 and a cross-domain authentication module 602.

[0121] The domain authentication module 601 is used to query the identity information of the IoT device to be authenticated based on the dynamic identity management data structure and verify the identity information of the IoT device to be authenticated when the device to be authenticated requests to connect is the first device; the dynamic identity management data structure is used to store the identity information of IoT devices in the same trust domain; the first device is an IoT device that belongs to the same trust domain as the IoT device to be authenticated.

[0122] The cross-domain authentication module 602 is used to perform cross-domain authentication based on a cross-domain license credential when the device requested to connect by the IoT device to be authenticated is a second device; the cross-domain license credential is stored on the blockchain using a dynamic accumulator; the second device is an IoT device belonging to a different trust domain than the IoT device to be authenticated.

[0123] In some embodiments, the identity information includes the public key information of the IoT device and the device pseudonym (PID);

[0124] The dynamic identity management data structure is generated based on a sparse Merkle tree, leaf nodes of the dynamic identity management data structure are used to store public key information of the Internet of Things device, and an index of the leaf node has a key-value pair relationship with a PID of the Internet of Things device.

[0125] In some embodiments, identity information of the Internet of Things device in the dynamic identity management data structure is added, deleted and / or updated by a key generation center KGC.

[0126] In some embodiments, in the case where the KGC modifies the public key information stored in a target leaf node, the hash values of all nodes on a path from the target leaf node to a root node corresponding to the target leaf node are synchronously modified.

[0127] In some embodiments, the intra-domain authentication module comprises:

[0128] A first query unit is configured to query a target leaf node index associated with a device pseudonym PID of the Internet of Things device to be authenticated in the dynamic identity management data structure;

[0129] A obtaining unit is configured to obtain a hash value of a public key of the Internet of Things device to be authenticated through the target leaf node index.

[0130] In some embodiments, the intra-domain authentication module further comprises:

[0131] A second query unit is configured to query a Merkle proof of the hash value of the public key in the dynamic identity management data structure;

[0132] A verification unit is configured to verify the legitimacy of the Internet of Things device to be authenticated through the Merkle proof.

[0133] In some embodiments, the cross-domain permission credential is generated by an edge server corresponding to the Internet of Things device to be authenticated according to a request message received from the Internet of Things device to be authenticated.

[0134] Specifically, the above-mentioned identity authentication device based on the intra-domain blockchain and the cross-domain blockchain provided by the present application can realize all method steps realized by the above-mentioned identity authentication method based on the intra-domain blockchain and the cross-domain blockchain, and can achieve the same technical effects. Therefore, the same parts and beneficial effects in the method embodiment will not be described in detail.

[0135] It should be noted that the division of units / modules in the above embodiments of the present application is illustrative, and is only a logical functional division. In actual implementation, another division manner can be used. In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0136] Figure 7 is a structural schematic diagram of an electronic device provided by the present application, as shown in Figure 7 The electronic device can include a processor 701, a communications interface 702, a memory 703 and a communications bus 704, wherein the processor 701, the communications interface 702 and the memory 703 complete mutual communication through the communications bus 704. The processor 701 can invoke a logical instruction in the memory 703 to execute an identity authentication method based on an intra-domain blockchain and a cross-domain blockchain, which includes:

[0137] In a case where the device requesting connection of the to-be-authenticated Internet of Things device is a first device, identity information of the to-be-authenticated Internet of Things device is queried based on a dynamic identity management data structure, and the identity information of the to-be-authenticated Internet of Things device is verified; the dynamic identity management data structure is used to store identity information of Internet of Things devices in a same trust domain; the first device is an Internet of Things device belonging to the same trust domain as the to-be-authenticated Internet of Things device.

[0138] In a case where the device requesting connection of the to-be-authenticated Internet of Things device is a second device, cross-domain authentication is performed according to a cross-domain permission credential; the cross-domain permission credential is stored on a blockchain by using a dynamic accumulator; the second device is an Internet of Things device belonging to a different trust domain from the to-be-authenticated Internet of Things device.

[0139] Specifically, the processor 701 can be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD), and the processor can also adopt a multi-core architecture.

[0140] The logic instructions in the memory 703 can be implemented in the form of software functional units and sold or used as independent products, and can be stored in a processor-readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that make contributions to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0141] In some embodiments, a computer program product is also provided, which includes a computer program that can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can execute the identity authentication method based on the intra-domain blockchain and the cross-domain blockchain provided by the above-mentioned method embodiments, which includes the following steps:

[0142] In the case that the device requesting connection of the to-be-authenticated Internet of Things device is a first device, the identity information of the to-be-authenticated Internet of Things device is queried based on a dynamic identity management data structure, and the identity information of the to-be-authenticated Internet of Things device is verified; the dynamic identity management data structure is used to store the identity information of the Internet of Things devices in the same trust domain; the first device is an Internet of Things device belonging to the same trust domain as the to-be-authenticated Internet of Things device;

[0143] In the case that the device requesting connection of the to-be-authenticated Internet of Things device is a second device, cross-domain authentication is performed according to a cross-domain permission credential; the cross-domain permission credential is stored on a blockchain by using a dynamic accumulator; the second device is an Internet of Things device belonging to a different trust domain from the to-be-authenticated Internet of Things device.

[0144] Specifically, the above-mentioned computer program product provided by the embodiments of the present application can implement all the method steps realized by the above-mentioned method embodiments, and can achieve the same technical effects. Here, the same parts and beneficial effects in the method embodiments will not be described in detail.

[0145] In some embodiments, a computer readable storage medium is also provided, which stores a computer program for causing a computer to execute the identity authentication method based on the intra-domain blockchain and cross-domain blockchain provided by each method embodiment, the method comprising:

[0146] In a case where the device requesting connection of the to-be-authenticated Internet of Things device is a first device, identity information of the to-be-authenticated Internet of Things device is queried based on a dynamic identity management data structure, and the identity information of the to-be-authenticated Internet of Things device is verified; the dynamic identity management data structure is used to store identity information of Internet of Things devices in a same trust domain; the first device is an Internet of Things device belonging to the same trust domain as the to-be-authenticated Internet of Things device.

[0147] In a case where the device requesting connection of the to-be-authenticated Internet of Things device is a second device, cross-domain authentication is performed according to a cross-domain permission credential; the cross-domain permission credential is stored on a blockchain by using a dynamic accumulator; the second device is an Internet of Things device belonging to a different trust domain from the to-be-authenticated Internet of Things device.

[0148] Specifically, the above computer readable storage medium provided by the present application can implement all the method steps realized by each method embodiment and achieve the same technical effects, and thus the same parts and beneficial effects of the method embodiments in the present embodiment will not be described in detail here.

[0149] It should be noted that the computer readable storage medium can be any available medium or data storage device accessible by the processor, including but not limited to a magnetic memory (such as a floppy disk, a hard disk, a magnetic tape, a magneto-optical disk (MO), etc.), an optical memory (such as a CD, a DVD, a BD, a HVD, etc.), and a semiconductor memory (such as a ROM, an EPROM, an EEPROM, a non-volatile memory (NAND FLASH), a solid state disk (SSD)), etc.

[0150] In addition, it should be noted that the terms "first", "second", etc. in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second" are usually a category and do not limit the number of objects, for example, the first object can be one or more.

[0151] The term "and / or" used in the present application describes an associated relationship between associated objects, and means that three relationships can exist, for example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone. The character " / " generally means that the associated objects before and after the " / " are in an "or" relationship.

[0152] The term "multiple" in the present application means two or more, and other quantifiers are similar.

[0153] In the present application, "determining B based on A" means that A is considered as a factor when determining B. It is not limited to "determining B based on A only", but also includes "determining B based on A and C", "determining B based on A, C and E", "determining C based on A, and determining B based on C further", and the like. In addition, it can also include A as a condition for determining B, for example, "when A meets the first condition, B is determined by using the first method"; for example, "when A meets the second condition, B is determined"; for example, "when A meets the third condition, B is determined based on the first parameter"; and the like. Of course, A can also be a condition for determining B as a factor, for example, "when A meets the first condition, C is determined by using the first method, and B is further determined based on C", and the like.

[0154] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage, etc.) containing computer-usable program code.

[0155] The present application is described with reference to flowcharts and / or block diagrams according to the method, device (system), and computer program product of the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer executable instructions. These computer executable instructions can be provided to a general purpose computer, a special purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the computer or other programmable data processing apparatus produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The term "and / or" used in the present application describes an associated relationship between associated objects, and means that three relationships can exist, for example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone. The character " / " generally means that the associated objects before and after the " / " are in an "or" relationship. Figure 1 The term "and / or" used in the present application describes an associated relationship between associated objects, and means that three relationships can exist, for example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone. The character " / " generally means that the associated objects before and after the " / " are in an "or" relationship.

[0156] These processor-executable instructions can also be stored in a processor-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the processor-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart Figure 1 of flowchart or flowcharts and / or a block Figure 1 of blocks or multiple blocks.

[0157] These processor-executable instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the function specified in the flowchart Figure 1 of flowchart or flowcharts and / or a block Figure 1 of blocks or multiple blocks.

[0158] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. An identity authentication method based on intra-domain blockchain and cross-domain blockchain, characterized in that, The method comprises the steps of: In the case that the device requesting connection of the to-be-authenticated Internet of Things device is a first device, querying identity information of the to-be-authenticated Internet of Things device based on a dynamic identity management data structure, and verifying the identity information of the to-be-authenticated Internet of Things device; The dynamic identity management data structure is used for storing identity information of Internet of Things devices in the same trust domain; The first device is an Internet of Things device belonging to the same trust domain as the to-be-authenticated Internet of Things device; In the case that the device requesting connection of the to-be-authenticated Internet of Things device is a second device, cross-domain authentication is performed according to a cross-domain permission credential; the cross-domain permission credential is stored on a cross-domain blockchain by using a dynamic accumulator; and the second device is an Internet of Things device belonging to a different trust domain from the to-be-authenticated Internet of Things device; The identity information comprises public key information and a device pseudonym PID of the Internet of Things device; The dynamic identity management data structure is generated based on a sparse Merkle tree; leaf nodes of the dynamic identity management data structure are used for storing public key information of the Internet of Things device; and there is a key-value pair relationship between an index of the leaf node and a PID of the Internet of Things device. 2.The identity authentication method based on intra-domain blockchain and cross-domain blockchain according to claim 1, characterized in that, Identity information of the Internet of Things device in the dynamic identity management data structure is added, deleted and / or updated by a key generation center KGC. 3.The identity authentication method based on intra-domain blockchain and cross-domain blockchain according to claim 2, characterized in that, In the case that the KGC modifies the public key information stored in a target leaf node, the hash values of all nodes on a path from the target leaf node to a root node corresponding to the target leaf node are synchronously modified. 4.The identity authentication method based on intra-domain blockchain and cross-domain blockchain according to claim 1, characterized in that, The querying of the identity information of the to-be-authenticated Internet of Things device based on the dynamic identity management data structure comprises the steps of: Querying a target leaf node index associated with a device pseudonym PID of the to-be-authenticated Internet of Things device in the dynamic identity management data structure; Obtaining a hash value of a public key of the to-be-authenticated Internet of Things device through the target leaf node index. 5.The identity authentication method based on intra-domain blockchain and cross-domain blockchain according to claim 4, characterized in that, The method further comprises the steps of: Querying a Merkle proof of the hash value of the public key in the dynamic identity management data structure; Verifying the legitimacy of the to-be-authenticated Internet of Things device through the Merkle proof. 6.The identity authentication method based on intra-domain blockchain and cross-domain blockchain according to claim 1, wherein, The cross-domain permission credential is generated by an edge server corresponding to the to-be-authenticated Internet of Things device according to a request message received by the to-be-authenticated Internet of Things device.

7. An identity authentication apparatus based on an intra-domain blockchain and a cross-domain blockchain, characterized by, The method comprises the steps of: An intra-domain authentication module is configured to, in the case that the device requesting connection of the to-be-authenticated Internet of Things device is a first device, query identity information of the to-be-authenticated Internet of Things device based on a dynamic identity management data structure, and verify the identity information of the to-be-authenticated Internet of Things device; The dynamic identity management data structure is used for storing identity information of Internet of Things devices in the same trust domain; The first device is an Internet of Things device belonging to the same trust domain as the to-be-authenticated Internet of Things device; A cross-domain authentication module is configured to, in the case that the device requesting connection of the to-be-authenticated Internet of Things device is a second device, perform cross-domain authentication according to a cross-domain permission credential; the cross-domain permission credential is stored on a cross-domain blockchain by using a dynamic accumulator; and the second device is an Internet of Things device belonging to a different trust domain from the to-be-authenticated Internet of Things device; The identity information comprises public key information and a device pseudonym PID of the Internet of Things device. The dynamic identity management data structure is generated based on a sparse Merkle tree, leaf nodes of the dynamic identity management data structure are used to store public key information of the Internet of Things device, and there is a key-value pair relationship between indexes of the leaf nodes and PIDs of the Internet of Things device.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the identity authentication method based on the intra-domain blockchain and the cross-domain blockchain according to any one of claims 1 to 6 when executing the program. 9.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program implements the identity authentication method based on the intra-domain blockchain and the cross-domain blockchain according to any one of claims 1 to 6 when executed by the processor.

Images