Scalable blockchain identity authentication method and system for distributed resource aggregation scenarios

Abstract

The present invention provides a scalable blockchain identity authentication method and system for distributed resource aggregation scenarios, relating to the field of blockchain identity authentication technology. The method comprises receiving a user identity authentication request, generating an identity string using a distributed hash algorithm, selecting a verification node cluster to deploy a smart contract, each verification node executing the smart contract to verify the identity string, establishing an access control policy, and generating an authentication block. When the number of blocks reaches a preset threshold, a new verification node is selected based on terminal device information, a smart contract is deployed, and distributed storage is achieved by broadcasting the authentication block through the verification node cluster. The present invention improves the scalability of identity authentication, enables dynamic expansion of verification nodes, and ensures the reliable storage and efficient dissemination of authentication information.

Description

Technical Field

[0001] The present invention relates to the field of blockchain identity authentication technology, and particularly to an extensible blockchain identity authentication method and system based on a distributed resource aggregation scenario. Background Art

[0002] With the rapid development of distributed resource aggregation applications, users are increasingly demanding identity authentication for resource access. Traditional centralized identity authentication methods struggle to meet the authentication requirements of distributed scenarios. Blockchain technology, with its decentralized, tamper-proof, and traceable characteristics, provides a new technical path for identity authentication in distributed environments.

[0003] At present, blockchain-based identity authentication technology has been widely used in many fields such as finance, medical care, and the Internet of Things. It realizes identity authentication and access control through smart contracts, and uses distributed storage to ensure the security and availability of authentication information.

[0004] However, existing blockchain identity authentication technology still has the following problems: First, the existing authentication block broadcast mechanism lacks targeted optimization, and is prone to propagation delays and network congestion in large-scale node networks, affecting authentication efficiency; second, the storage load distribution of verification nodes is uneven, with some nodes experiencing excessive storage pressure while other nodes have idle resources, reducing the overall performance of the system; third, there is a lack of an effective node dynamic expansion mechanism, making it impossible to adjust the scale of verification nodes in real time according to business load, limiting the scalability of the system.

[0005] Therefore, there is an urgent need for a blockchain identity authentication method and system that can solve the problems of low authentication block propagation efficiency, unbalanced storage load, and limited node expansion capabilities. Summary of the Invention

[0006] In order to solve the above-mentioned problems existing in the prior art, the present invention provides a scalable blockchain identity authentication method and system for distributed resource aggregation scenarios. By designing a hierarchical broadcast strategy, the efficiency of authentication block propagation is optimized, multi-copy shard storage is adopted to achieve balanced distribution of authentication information, and a dynamic node expansion mechanism is introduced to ensure system scalability.

[0007] The technical solutions of the present invention are as follows:

[0008] The present invention provides a scalable blockchain identity authentication method for distributed resource aggregation scenarios, including:

[0009] Receive an identity authentication request submitted by a user, the identity authentication request including user identity information, resource access requirement information, user terminal device information, and a corresponding timestamp; encrypt the user identity information based on a preset distributed hash algorithm to obtain an identity identification string; and construct the identity identification string and the resource access requirement information into a data carrier of a blockchain node;

[0010] A plurality of verification nodes are selected from a preset blockchain network to form a verification node cluster, wherein each verification node in the verification node cluster is deployed with a smart contract; a corresponding smart contract is executed by each verification node in the verification node cluster, and the smart contract verifies the identity string based on a preset consensus rule; when the verification is successful, a dynamic access permission control policy is constructed based on the resource access requirement information, wherein the dynamic access permission control policy includes a resource access time limit, a resource access depth, and a resource operation permission; the identity string, the access permission control policy, and the verification time information obtained when the verification is successful are packaged to generate an authentication block;

[0011] The number of blocks in the blockchain network is monitored. When the number of blocks reaches a preset threshold, a terminal device with remaining computing resources is selected as a new verification node based on the user terminal device information; the new verification node is added to the verification node cluster, and the same smart contract as the original verification node is deployed in the new verification node; the newly generated authentication block is broadcasted to all nodes in the blockchain network through the verification node cluster to realize distributed storage of authentication information.

[0012] As a preferred embodiment of the present invention, the user identity information is encrypted based on a preset distributed hash algorithm to obtain an identity string, and the identity string and the resource access requirement information are constructed as a data carrier of a blockchain node, specifically:

[0013] Receive user identity information, split the user identity information into multiple data blocks, each of which is 1024 bits in size; obtain the processor identifier, memory capacity, and disk serial number of the user terminal device as hardware feature information; concatenate the hardware feature information with the current timestamp and perform a SHA-256 operation to obtain a random salt value; perform an XOR operation on the random salt value and each of the data blocks to obtain multiple obfuscated data blocks;

[0014] Sequentially perform encryption transformation on each of the obfuscated data blocks, the encryption transformation comprising:

[0015] Performing a linear mixing operation to generate intermediate state data, performing a bit cyclic left shift of 8 bits on the intermediate state data to obtain rotated data, rearranging the rotated data according to a preset permutation table to obtain permuted data, performing a nonlinear transformation on the permuted data using an S-box substitution table to obtain transformed data, and performing a modular addition operation on the transformed data and a round constant to obtain a data block hash value;

[0016] Constructing a Merkle hash tree based on the hash values ​​of the multiple data blocks, using each hash value of the data block as a leaf node; pairing the leaf nodes with each other to calculate the combined hash value to construct a parent node, repeating the node pairing and hash calculation process until a root node is generated; using the hash value of the root node as an identity string;

[0017] Constructing a three-layer coding structure, storing the identity string and intermediate data generated during its generation at the bottom layer, storing resource access requirement information at the middle layer, and storing a digital signature generated using an elliptic curve algorithm at the top layer; serializing the three-layer coding structure into a unified data carrier;

[0018] Initialize a Bloom filter with a bit array length of m and select k different hash functions; input the identity string into the k hash functions in sequence, take the output value of each hash function modulo m to obtain a bit array subscript; set the position of the corresponding subscript in the bit array to 1; generate a feature vector of the Bloom filter; and combine the feature vector with the unified data carrier to construct a complete data structure of a blockchain node.

[0019] As a preferred embodiment of the present invention, a plurality of verification nodes are selected from a preset blockchain network to form a verification node cluster, and each verification node in the verification node cluster is deployed with a smart contract; each verification node in the verification node cluster executes a corresponding smart contract, and the smart contract verifies the identity string based on a preset consensus rule; when the verification passes, a dynamic access permission control policy is constructed based on the resource access requirement information, specifically:

[0020] Based on the node computing power score, historical reliability score, network connection quality score, and storage capacity score, multiple verification nodes are selected from the preset blockchain network to form a verification node cluster;

[0021] Receive an access request, the access request including an identity string, access resource type information, access operation type information, and access time information; package the identity string, access resource type information, access operation type information, and access time information into a verification request data packet;

[0022] The verification request data packet is sent to each verification node in the verification node cluster. Each verification node in the verification node cluster deploys the same identity authentication smart contract. The identity authentication smart contract is called by each verification node in the verification node cluster. The identity authentication smart contract is preset with consensus rules. The identity identification string in the verification request data packet is verified based on the consensus rules to obtain a verification result, wherein the consensus rules include:

[0023] Verify the integrity of the identity string by reconstructing the Merkle tree path; verify the timeliness of the identity string based on the time window mechanism; verify the legitimacy of the signature of the identity string based on the asymmetric encryption algorithm;

[0024] The verification results of each verification node are processed through consensus, including:

[0025] Selecting the verification node with the highest reputation value from the verification node cluster as the master verification node; the master verification node collects verification results of each verification node in the verification node cluster, and when the number of consistency verification results exceeds a preset ratio of the total number of verification nodes, determines that the verification is passed and generates a verification pass flag;

[0026] When the verification pass identifier is generated, the access resource type information, access operation type information, and access time information in the verification request data packet are extracted; a three-dimensional access control matrix is ​​constructed based on the access resource type information, access operation type information, and access time information, wherein the coordinate axes of the three-dimensional access control matrix correspond to the resource type, operation type, and time dimensions, respectively;

[0027] Collect user access behavior feature information in real time, the user access behavior feature information includes historical access frequency data, historical access time data, and historical access resource type data; adjust the access permission level in the three-dimensional access control matrix according to the pre-acquired user behavior credibility, and generate a dynamic access permission control policy, wherein the resource dimension information, operation dimension information and time dimension information in the three-dimensional access control matrix are

[0028] As a preferred embodiment of the present invention, the integrity of the identity string is verified by reconstructing the Merkle tree path; the timeliness of the identity string is verified based on the time window mechanism; and the legitimacy of the signature of the identity string is verified based on the asymmetric encryption algorithm. Specifically,

[0029] The verification node obtains the Merkle tree child node information and node path information corresponding to the target identity string from the local storage of the verification node. The node path information includes the sibling node hash values ​​of each node on the path from the leaf node to the root node. Based on the leaf node information and the sibling node hash values, a combined hash is calculated layer by layer along the node path to obtain a reconstructed root hash value. The reconstructed root hash value is compared with the Merkle root hash value stored in the block header to generate an integrity verification result.

[0030] Extracting the creation timestamp from the identity string to obtain the current time of the verification node; setting the sliding time window size based on the service security level; calculating the time difference between the current time and the creation timestamp; comparing the time difference with the sliding time window size; recording the most recently processed timestamp sequence, performing continuity analysis on the creation timestamp and the timestamp sequence, and generating a timeliness verification result;

[0031] Extracting a signature value and public key information from the digital signature of the identity string; querying a trusted public key pool maintained by a verification node to confirm the authenticity of the public key information; decrypting the signature value using the public key information to obtain an original message digest; performing a hash calculation on the original content of the identity string to obtain a recalculated message digest; comparing the original message digest with the recalculated message digest to generate a signature legitimacy verification result;

[0032] Execute the processing of the integrity verification result, the timeliness verification result, and the signature legitimacy verification result in parallel; build a verification result cache pool, and manage the verification result cache pool using a least recently used policy; when the identity string appears repeatedly, query the verification result cache pool and return the cached verification result;

[0033] When the integrity verification result, the timeliness verification result, and the signature legitimacy verification result are all passed, a verification pass certificate including a verification timestamp, a verification node identifier, and a verification result summary is generated; the verification pass certificate is signed using the private key of the verification node; the signed verification pass certificate is submitted to the blockchain network record; when any verification result is failed, a verification failure report is generated including a failed verification link identifier, a description of the failure reason, and a verification node identifier.

[0034] As a preferred embodiment of the present invention, packaging the identity string, the dynamic access permission control policy, and the verification time information to generate an authentication block includes:

[0035] The identity string is analyzed hierarchically to obtain a basic information layer, an attribute information layer, and a signature information layer; the basic information layer includes a user identification code and a version identification code, the attribute information layer includes an identity type code and an expiration date code, and the signature information layer includes a digital signature code and a certification authority code;

[0036] Performing structured processing on the three-dimensional access control matrix in the dynamic access permission control policy, extracting resource dimension information, operation dimension information, and time dimension information from the three-dimensional access control matrix; selecting a compression encoding method based on the sparsity of the three-dimensional access control matrix to encode the resource dimension information, the operation dimension information, and the time dimension information to generate permission matrix encoding data;

[0037] Standardize the verification time information to extract the verification start timestamp, verification end timestamp, and verification duration; generate a time window identifier based on the verification start timestamp and the verification end timestamp; combine the time window identifier with the verification duration to form time series feature data;

[0038] Constructing a block header structure of the authentication block, the block header structure including a version number field, a previous block hash field, a timestamp field, a difficulty target field, and a random number field; combining the hierarchical parsing result of the identity string, the authority matrix encoded data, and the time series feature data to form block body data;

[0039] Constructing a first Merkle tree, dividing the block body data into data segments according to a preset byte length; calculating hash values ​​for each of the data segments to obtain leaf nodes; calculating hash values ​​for each of the leaf nodes layer by layer until a root hash value is obtained; and writing the root hash value into the block header structure;

[0040] Construct a second Merkle tree, using the field values ​​of the block header structure and the verification node signature information as leaf nodes; calculate hash values ​​for the leaf nodes layer by layer until a block identifier hash value is obtained; combine the block identifier hash value with the block header structure written with the root hash value to generate a final block header; and combine the final block header with the block body data to generate an authentication block.

[0041] As a preferred embodiment of the present invention, monitoring the number of blocks in the blockchain network, and when the number of blocks reaches a preset threshold, selecting a terminal device with remaining computing resources as a new verification node based on the user terminal device information; adding the new verification node to the verification node cluster, and deploying the same smart contract as the original verification node in the new verification node includes:

[0042] Counting the number of blocks in the blockchain network; obtaining the block generation rate within a historical period of the blockchain network; calculating the trend of block number changes based on the block generation rate; comparing the block number with a preset block threshold, and triggering a verification node expansion process when the block number exceeds the preset block threshold;

[0043] Broadcasting a resource query request to a user terminal device in the blockchain network; receiving device resource information returned by the user terminal device, the device resource information including processor usage, memory usage, storage space remaining, and network bandwidth remaining; and calculating the remaining computing resource score of the user terminal device;

[0044] Obtaining device type information of the user terminal device, the device type information including processor specifications, memory capacity, storage capacity, and network bandwidth specifications; calculating a basic computing power score of the user terminal device based on the device type information; performing a weighted calculation on the remaining computing resource score and the basic computing power score to obtain a comprehensive device score;

[0045] Obtaining geographic distribution information of existing verification nodes from the verification node cluster; constructing a geographic distribution optimization objective function based on the geographic distribution information; selecting a user terminal device as a new verification node based on the device comprehensive score and the geographic distribution information, wherein the device comprehensive score includes a remaining computing resource score and a basic computing power score, and the user terminal device information also includes device resource information;

[0046] Selecting a verification node with the lowest comprehensive device score from the verification node cluster as a data synchronization source node; synchronizing block data, transaction data, and status data in the data synchronization source node to the newly added verification node; verifying the data synchronization result in the newly added verification node; and when the data synchronization result passes verification, adding the newly added verification node to the verification node cluster;

[0047] Obtain smart contract information deployed in the verification node cluster, the smart contract information including the contract code, contract version number, and contract configuration parameters; verify the integrity of the smart contract information; and deploy the smart contract information to the newly added verification node.

[0048] The present invention also provides a scalable blockchain identity authentication system for distributed resource aggregation scenarios, the system comprising an identity authentication request processing unit, a verification and authority control unit, and a node expansion and block broadcasting unit, wherein:

[0049] The identity authentication request processing unit receives an identity authentication request submitted by a user, wherein the identity authentication request includes user identity information, resource access requirement information, user terminal device information, and a corresponding timestamp; encrypts the user identity information based on a preset distributed hash algorithm to obtain an identity identification string; and constructs the identity identification string and the resource access requirement information into a data carrier of a blockchain node;

[0050] The verification and permission control unit is used to select multiple verification nodes in a preset blockchain network to form a verification node cluster, each verification node in the verification node cluster is deployed with a smart contract; each verification node in the verification node cluster executes a corresponding smart contract, and the smart contract verifies the identity string based on a preset consensus rule; when the verification is successful, a dynamic access permission control policy is constructed based on the resource access requirement information, and the dynamic access permission control policy includes a resource access time limit, a resource access depth, and a resource operation permission; the identity string, the access permission control policy, and the verification time information obtained when the verification is successful are packaged to generate an authentication block;

[0051] The node expansion and block broadcasting unit is used to monitor the number of blocks in the blockchain network. When the number of blocks reaches a preset threshold, a terminal device with remaining computing resources is selected as a new verification node based on the user terminal device information; the new verification node is added to the verification node cluster, and the same smart contract as the original verification node is deployed in the new verification node; the newly generated authentication block is broadcast to all nodes in the blockchain network through the verification node cluster to realize distributed storage of authentication information.

[0052] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the program, it implements a scalable blockchain identity authentication method for a distributed resource aggregation scenario as described in any one of the embodiments.

[0053] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a scalable blockchain identity authentication method for a distributed resource aggregation scenario as described in any one of the embodiments.

[0054] The beneficial effects of this application are as follows:

[0055] 1. User identity information is encrypted using a distributed hashing algorithm and verified through a cluster of multiple verification nodes and smart contracts, effectively preventing identity information leakage and tampering, and enhancing the security of identity authentication. The use of a consensus mechanism further improves the reliability of authentication results, avoiding single points of failure and malicious attacks.

[0056] 2. Dynamically build access permission control strategies based on resource access demand information, including resource access time limit, resource access depth, and resource operation permissions, to achieve fine-grained resource access control and ensure the security and rational use of resources.

[0057] 3. By monitoring the number of blocks in the blockchain network and dynamically adding terminal devices with remaining computing resources as new verification nodes, the dynamic expansion of the verification node cluster is achieved, the scalability of the system is improved, and the computing resources of the terminal devices are fully utilized, thereby improving resource utilization. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 This is a flow chart of a scalable blockchain identity authentication method for a distributed resource aggregation scenario according to an embodiment of the present invention;

[0059] Figure 2 This is a schematic diagram of the structure of a scalable blockchain identity authentication system for a distributed resource aggregation scenario according to an embodiment of the present invention. DETAILED DESCRIPTION

[0060] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0061] The following specific embodiments are used to describe the technical solution of the present invention in detail. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0062] Example 1:

[0063] Figure 1 This is a flow chart of an extensible blockchain identity authentication method for a distributed resource aggregation scenario in Example 1 of the present invention, as shown in FIG. Figure 1 As shown, the method includes:

[0064] S1. Receive an identity authentication request submitted by a user, the identity authentication request including user identity information, resource access requirement information, user terminal device information, and a corresponding timestamp; encrypt the user identity information based on a preset distributed hash algorithm to obtain an identity identification string; and construct the identity identification string and the resource access requirement information into a data carrier of a blockchain node;

[0065] S11. The user submits an identity authentication request, which includes user identity information (e.g., user name, ID number, etc.), resource access request information (e.g., file name to be accessed, operation type, etc.), and user terminal device information (e.g., device model, operating system version, IP address, and hardware feature information, etc.);

[0066] S12. Encrypt the user identity information based on a preset distributed hash algorithm to obtain an identity string, and construct the identity string and the resource access requirement information into a data carrier of a blockchain node; select multiple verification nodes in the preset blockchain network to form a verification node cluster, specifically:

[0067] Receive user identity information, and divide the user identity information into multiple data blocks, each of which has a size of 1024 bits. For example, if the user identity information is a 2048-bit string, it is divided into two 1024-bit data blocks;

[0068] Obtaining the processor identification, memory capacity, and disk serial number of the user terminal device as hardware feature information; concatenating the hardware feature information with the current timestamp and performing a SHA-256 operation to obtain a random salt value; performing an XOR operation on the random salt value and each of the data blocks to obtain multiple obfuscated data blocks;

[0069] Sequentially perform encryption transformation on each of the obfuscated data blocks, the encryption transformation comprising:

[0070] Performing a linear mixing operation to generate intermediate state data, performing a bit cyclic left shift of 8 bits on the intermediate state data to obtain rotated data, rearranging the rotated data according to a preset permutation table to obtain permuted data, performing a nonlinear transformation on the permuted data using an S-box substitution table to obtain transformed data, and performing a modular addition operation on the transformed data and a round constant to obtain a data block hash value;

[0071] Constructing a Merkle hash tree based on the hash values ​​of the multiple data blocks, using each hash value of the data block as a leaf node; pairing the leaf nodes with each other to calculate the combined hash value to construct a parent node, repeating the node pairing and hash calculation process until a root node is generated; using the hash value of the root node as an identity string;

[0072] Constructing a three-layer coding structure, storing the identity string and intermediate data generated during its generation at the bottom layer, storing resource access requirement information at the middle layer, and storing a digital signature generated using an elliptic curve algorithm at the top layer; serializing the three-layer coding structure into a unified data carrier;

[0073] Initialize a Bloom filter with a bit array length of m and select k different hash functions; input the identity string into the k hash functions in sequence, take the output value of each hash function modulo m to obtain a bit array subscript; set the position of the corresponding subscript in the bit array to 1; generate a feature vector of the Bloom filter; combine the feature vector with the unified data carrier to construct a complete data structure of the blockchain node;

[0074] Based on step S1, this embodiment effectively prevents the leakage and tampering of user identity information through distributed hash algorithms, Merkle trees, Bloom filters and other technical means, thereby improving the security of identity authentication; and the Bloom filter can quickly determine whether the identity identification string exists, reducing unnecessary computing and communication overhead, and improving the efficiency of identity authentication; based on the decentralized nature of blockchain, this embodiment avoids single points of failure and control by centralized institutions, thereby enhancing the reliability and stability of the system.

[0075] S2. Selecting multiple verification nodes in a preset blockchain network to form a verification node cluster, wherein each verification node in the verification node cluster is deployed with a smart contract; executing a corresponding smart contract by each verification node in the verification node cluster, wherein the smart contract verifies the identity string based on a preset consensus rule; when the verification passes, constructing a dynamic access permission control policy based on the resource access requirement information, wherein the dynamic access permission control policy includes a resource access time limit, a resource access depth, and a resource operation permission;

[0076] S21. Select multiple verification nodes from the preset blockchain network to form a verification node cluster based on the node computing power score, historical reliability score, network connection quality score, and storage capacity score. The above-mentioned scoring calculations are all existing technologies and will not be further described here.

[0077] S22. Receive an access request, the access request including an identity string, access resource type information, access operation type information, and access time information; and package the identity string, access resource type information, access operation type information, and access time information into a verification request data packet.

[0078] The verification request data packet is sent to each verification node in the verification node cluster. Each verification node in the verification node cluster deploys the same identity authentication smart contract. The identity authentication smart contract is called by each verification node in the verification node cluster. The identity authentication smart contract is preset with consensus rules. The identity identification string in the verification request data packet is verified based on the consensus rules to obtain a verification result, wherein the consensus rules include:

[0079] Verify the integrity of the identity string by reconstructing the Merkle tree path; verify the timeliness of the identity string based on the time window mechanism; verify the legitimacy of the signature of the identity string based on the asymmetric encryption algorithm;

[0080] S221. Obtain the Merkle tree child node information and node path information corresponding to the target identity string from the local storage of the verification node, wherein the node path information includes the sibling node hash values ​​of each node on the path from the leaf node to the root node; based on the leaf node information and the sibling node hash values, calculate the combined hash layer by layer along the node path to obtain a reconstructed root hash value; compare the reconstructed root hash value with the Merkle root hash value stored in the block header to generate an integrity verification result to ensure that the identity string has not been tampered with;

[0081] S222. Extract the creation timestamp from the identity string to obtain the current time of the verification node; set the sliding time window size based on the service security level; calculate the time difference between the current time and the creation timestamp; compare the time difference with the sliding time window size; record the most recently processed timestamp sequence, perform continuity analysis on the creation timestamp and the timestamp sequence, and generate a timeliness verification result;

[0082] S223. Extract the signature value and public key information from the digital signature of the identity string; query the trusted public key pool maintained by the verification node to confirm the authenticity of the public key information; use the public key information to decrypt the signature value to obtain the original message digest; perform a hash calculation on the original content of the identity string to obtain a recalculated message digest; compare the original message digest with the recalculated message digest to generate a signature legitimacy verification result;

[0083] S224. Process the integrity verification result, the timeliness verification result, and the signature legitimacy verification result in parallel; construct a verification result cache pool, which is managed using a least recently used policy; when the identity string appears repeatedly, query the verification result cache pool and return the cached verification result;

[0084] When the integrity verification result, the timeliness verification result, and the signature legitimacy verification result are all passed, a verification pass certificate containing a verification timestamp, a verification node identifier, and a verification result summary is generated; the verification pass certificate is signed using the private key of the verification node; the signed verification pass certificate is submitted to the blockchain network for record; when any verification result is failed, a verification failure report is generated containing a failed verification link identifier, a description of the failure reason, and a verification node identifier;

[0085] S23. The verification results of each verification node are processed in a consensus manner, specifically including:

[0086] The verification node with the highest reputation value is selected from the verification node cluster as the master verification node; the master verification node collects verification results of each verification node in the verification node cluster, and when the number of consistency verification results exceeds a preset proportion (e.g., 70%) of the total number of verification nodes, determines that the verification is passed and generates a verification pass flag;

[0087] When the verification pass identifier is generated, the access resource type information, access operation type information, and access time information in the verification request data packet are extracted; a three-dimensional access control matrix is ​​constructed based on the access resource type information, access operation type information, and access time information, wherein the coordinate axes of the three-dimensional access control matrix correspond to the resource type, the operation type, and the time dimension, respectively. For example, the resource type may be file A or file B; the operation type may be read or write; and the time dimension may be weekday or weekend.

[0088] Real-time collection of user access behavior characteristics, including historical access frequency, access time, and resource type data. For example, a user accessed file A once a day over the past week, with access concentrated between 9:00 and 10:00 AM. This information is fed into a pre-trained behavior assessment model to determine the user behavior credibility. For example, a model output credibility of 0.9 indicates that the user behavior is relatively credible.

[0089] The access permission levels in the three-dimensional access control matrix are adjusted based on the pre-acquired user behavior credibility to generate a dynamic access permission control policy. For example, if the user behavior credibility is high, the user's access permission level for certain resources can be increased; if the user behavior credibility is low, the user's access permission level for certain resources can be decreased. Ultimately, a dynamic access permission control policy is generated. For example, if the user behavior credibility is 0.9, the user is allowed to read file A on both weekdays and weekends; if the user behavior credibility is 0.5, the user is allowed to read file A only on weekdays.

[0090] Among them, the resource dimension information, operation dimension information and time dimension information in the three-dimensional access control matrix;

[0091] Based on step S2, this embodiment realizes decentralized identity authentication through the combination of blockchain technology and smart contracts, prevents single points of failure and malicious tampering, and effectively improves the security of identity authentication. The application of consensus mechanism and asymmetric encryption algorithm further enhances the security and reliability of the system; the three-dimensional access control matrix combines resource type, operation type and time dimension to achieve more refined access control, and can set different access rights according to different scenarios and needs, effectively protecting sensitive data; by collecting user access behavior feature information in real time and dynamically adjusting access rights in combination with the behavior evaluation model, dynamic adaptive access control is achieved, which can automatically adjust access policies according to user behavior patterns, improving the security and availability of the system;

[0092] S3. Pack the identity string, the access permission control policy, and the verification time information obtained when the verification is successful to generate an authentication block, specifically:

[0093] Receive identity string, access permission control policy and verification time information;

[0094] The identity string is parsed hierarchically to obtain a basic information layer, an attribute information layer, and a signature information layer; the basic information layer includes a user identification code (e.g., "User123") and a version identification code (e.g., "V1.0"); the attribute information layer includes an identity type code (e.g., "normal user" or "administrator," represented by the numbers "0" and "1," respectively) and an expiration date code (e.g., "20241231"); the signature information layer includes a digital signature code (e.g., a hash value "e5b7e995...") and a certification authority code (e.g., "CA001");

[0095] Performing structural processing on the three-dimensional access control matrix in the dynamic access permission control policy, extracting resource dimension information, operation dimension information, and time dimension information from the three-dimensional access control matrix, where the resource dimension includes, for example, file A, file B, and file C; the operation dimension includes, for example, read, write, and execute; and the time dimension includes, for example, weekdays and weekends;

[0096] Based on the sparsity of the three-dimensional access control matrix (e.g., the proportion of non-zero elements in the matrix), a compression encoding method (e.g., run-length encoding or sparse matrix encoding) is selected to encode the resource dimension information, the operation dimension information, and the time dimension information. Assume that file A is readable and writable on weekdays, file B is readable on weekends, and file C is executable on weekdays. Using run-length encoding, the resource dimension information, the operation dimension information, and the time dimension information can be encoded as "A - read-write - weekdays, B - read - weekends, C - execute - weekdays" respectively; thus generating permission matrix encoding data;

[0097] The verification time information is standardized to extract the verification start timestamp (e.g., "1678886400", representing 0:00 on March 15, 2023), the verification end timestamp (e.g., "1678972800", representing 0:00 on March 16, 2023), and the verification duration (e.g., "86400" seconds, representing 24 hours); a time window identifier is generated based on the verification start timestamp and the verification end timestamp, such as "20230315-20230316"; the time window identifier is combined with the verification duration to form time series feature data, such as "20230315-20230316-86400";

[0098] Constructing a block header structure of the authentication block, the block header structure including a version number field, a previous block hash field, a timestamp field, a difficulty target field, and a random number field; combining the hierarchical parsing result of the identity string, the authority matrix encoded data, and the time series feature data to form block body data;

[0099] Constructing a first Merkle tree, dividing the block body data into data segments according to a preset byte length; calculating hash values ​​for each of the data segments to obtain leaf nodes; calculating hash values ​​for each of the leaf nodes layer by layer until a root hash value is obtained; and writing the root hash value into the block header structure;

[0100] Construct a second Merkle tree, using the field values ​​of the block header structure (version number, previous block hash, timestamp, difficulty target, random number, first Merkle tree root hash) and the verification node signature information (e.g., the verification node's digital signature "j7k8l9m0...") as leaf nodes; calculate hash values ​​for the leaf nodes layer by layer until a block identifier hash value (e.g., "n5o6p7q8...") is obtained; combine the block identifier hash value with the block header structure written with the root hash value to generate a final block header; combine the final block header with the block body data to generate an authentication block;

[0101] Based on step S3, this embodiment ensures the integrity and non-tamperability of the authentication block through multi-layer hash calculation and digital signature, preventing the identity, access rights and verification time information from being maliciously modified; by compressing and encoding the access control matrix, the overhead of data storage and transmission is reduced, and the authentication efficiency is improved; by using blockchain technology, the decentralized storage and management of authentication information is realized, and the transparency and credibility of the system are improved.

[0102] S4. Monitoring the number of blocks in the blockchain network. When the number of blocks reaches a preset threshold, selecting a terminal device with remaining computing resources as a new verification node based on the user terminal device information; adding the new verification node to the verification node cluster, and deploying the same smart contract as the original verification node in the new verification node;

[0103] S41. Count the number of blocks in the blockchain network and obtain the block generation rate in the historical time period of the blockchain network, specifically:

[0104] Assume that the blockchain network consists of multiple verification nodes, for example, there are 5 verification nodes initially. Each verification node runs the same smart contract to monitor the network status and execute the consensus algorithm; the smart contract deployed on each verification node begins to count the number of blocks in the blockchain network. Assume that the initial number of blocks is 1000. At the same time, the smart contract also records the block generation time, for example, one block is generated every 10 minutes. The smart contract calculates the trend of block number changes based on the block generation rate within a historical time period (for example, the past 1 hour). For example, if 6 blocks were generated in the past hour, the block generation rate is 6 blocks per hour;

[0105] S42. Calculate the block number trend based on the block generation rate; compare the block number with a preset block threshold; and when the block number exceeds the preset block threshold, trigger the verification node expansion process. Assume that the preset threshold is 1200. When the block number exceeds the preset threshold, for example, when it reaches 1201, the verification node expansion process is triggered.

[0106] S43. After the extension process is triggered, a resource query request is broadcast to the user terminal devices in the blockchain network. Assume that there are 10 user terminal devices in the network.

[0107] Receive device resource information returned by the user terminal device, where the device resource information includes processor usage (e.g., the processor usage of device A is 20%), memory usage (e.g., the memory usage of device A is 30%), storage space margin (e.g., the storage space margin of device A is 500 GB), and network bandwidth margin (e.g., the network bandwidth margin of device A is 100 Mbps);

[0108] Calculate the remaining computing resource score of the user terminal device. For example, the remaining computing resource score of device A can be calculated by weighted calculation based on the remaining resources of its processor, memory, storage space, and network bandwidth. Assume that the score is 85 points.

[0109] At the same time, the smart contract obtains the device type information of the user terminal device, which includes processor specifications (for example, the processor of device A is i7-12700H), memory capacity (for example, the memory of device A is 16GB), storage capacity (for example, the storage capacity of device A is 1TB), and network bandwidth specifications (for example, the network bandwidth of device A is 1Gbps);

[0110] Calculate the basic computing power score of the user terminal device based on the device type information. For example, the basic computing power score of device A can be calculated by weighted calculation based on its processor, memory, storage, and network bandwidth specifications, assuming the score is 90 points;

[0111] The remaining computing resource score and the basic computing power score are weighted to obtain a comprehensive device score. For example, the comprehensive score of device A is (85*0.6)+(90*0.4)=87 points.

[0112] S44. The smart contract obtains the geographical distribution information of the existing verification nodes from the verification node cluster. For example, the five existing verification nodes are located in Asia, Europe, North America, South America, and Oceania respectively.

[0113] Constructing a geographic distribution optimization objective function based on the geographic distribution information, for example, giving priority to user terminal devices with a geographical location significantly different from that of existing verification nodes;

[0114] Furthermore, the objective function F of the distribution optimization is given by the following formula:

[0115] F=α·D avg +β·(1-G std )+γ·C cov ;

[0116] Among them, D avg represents the average distance term, G std Indicates the geographical distribution uniformity, C cov represents the coverage index, α represents the average distance term weight, β represents the distribution uniformity weight, and γ represents the coverage weight;

[0117] Selecting a user terminal device as a new verification node based on the device's comprehensive score and geographic distribution information. For example, assuming that device B has a comprehensive score of 92 and is located in Africa, which meets the geographic distribution optimization goal, device B is selected as the new verification node. The device's comprehensive score includes the remaining computing resource score and the basic computing power score, and the user terminal device information also includes device resource information.

[0118] Select the verification node with the lowest comprehensive device score from the verification node cluster as the data synchronization source node. For example, assuming that verification node 3 has the lowest load, verification node 3 is selected as the data synchronization source node.

[0119] Synchronize the block data, transaction data, and status data in the data synchronization source node to the newly added verification node (device B); verify the data synchronization result in the newly added verification node (device B), for example, check whether the block hash value after synchronization is consistent with the source node. When the data synchronization result is verified, add the newly added verification node (device B) to the verification node cluster;

[0120] When the data synchronization result is verified to be successful, the newly added verification node (device B) is added to the verification node cluster;

[0121] Obtain the smart contract information deployed in the verification node cluster, including the contract code, contract version number (e.g., version 1.0), and contract configuration parameters; verify the integrity of the smart contract information; deploy the smart contract information to the newly added verification node, for example, verifying the hash value of the contract code. Deploy the smart contract information to the newly added verification node (device B);

[0122] Based on step S4, this embodiment dynamically adjusts the number of verification nodes according to the network load to avoid network congestion and performance degradation caused by an insufficient number of nodes, thereby improving the overall throughput and processing capacity of the network. By selecting terminal devices with sufficient computing resources as new verification nodes, the stable operation of the new nodes is ensured, the risk of node failure is reduced, and the stability and reliability of the entire network are improved. By optimizing the objective function through geographical distribution, the concentration of verification nodes in a specific area can be effectively avoided, and the geographical dispersion of nodes can be promoted, thereby enhancing the decentralization and anti-censorship capabilities of the network.

[0123] S5. Broadcasting the newly generated authentication block to all nodes in the blockchain network through the verification node cluster to achieve distributed storage of authentication information, including:

[0124] S51. Receive a newly generated authentication block and extract authentication information from the authentication block, where the authentication information includes an authentication entity identifier (e.g., entity_123456), an authentication timestamp (e.g., 024-02-01 10:30:15), an authentication type flag (e.g., identity_verify), authentication result data, authentication signature data, and an authentication expiration date (e.g., 2025-02-01 10:30:15). Calculate a block hash value of the authentication block using the SHA256 algorithm. Associate the block hash value of the authentication block (e.g., 0x8d7f...e92a) with the latest block hash value in the blockchain network (e.g., 0x9c3e...f81b).

[0125] S52. Obtain network status information of each validator node in the validator node cluster, where the network status information includes node online status (e.g., active), node bandwidth capacity (e.g., 100 Mbps), node latency value (e.g., 50 ms), and node load level (e.g., 45%).

[0126] Calculate the propagation capability score of each verification node based on the network status information. For example, if the bandwidth capacity weight is 0.4, the node delay weight is 0.3, and the load level weight is 0.3, the propagation capability score of node A is 85 points.

[0127] Prioritize validator nodes based on the propagation ability score;

[0128] S53: Build a hierarchical broadcast network of verification nodes. Based on user needs, divide the verification nodes into multiple dissemination tiers according to the dissemination ability scores. For example, nodes with a score of 90 or above are divided into the first tier, nodes with a score of 75-90 are divided into the second tier, and nodes with a score of 60-75 are divided into the third tier.

[0129] Calculate the optimal propagation fan-out number of nodes at each level. The optimal propagation fan-out number is related to the node bandwidth capacity and network latency value, and is expressed as follows:

[0130]

[0131] Among them, B node represents the available bandwidth capacity of the node, S block represents the block data size, η represents the bandwidth reservation coefficient, λ represents the network congestion coefficient, T max Indicates the maximum propagation delay time allowed, L net Indicates the network single-hop delay;

[0132] Based on the quality of network connections between nodes, the optimal propagation path between layers is determined. The generated propagation time series table records the propagation time points of each node. For example, if node A propagates a block to its four child nodes B, C, D, and E at "10:30:16", a propagation time series table between nodes is generated.

[0133] S54: broadcast the authentication block hierarchically in the verification node cluster according to the propagation schedule. First, send the authentication block to the verification nodes of the first level; receive block confirmation information from the verification nodes of the first level; trigger the first level verification nodes to propagate the block to the verification nodes of the second level; and so on until the verification nodes of all levels have completed block reception.

[0134] S55. During the propagation process, monitor the network quality indicators of the block propagation process, including the bandwidth utilization, propagation delay value, and block confirmation rate of the propagation path. When the network quality indicators fall below a preset threshold, recalculate the propagation path, adjust the node propagation hierarchy, and update the propagation time sequence table. For example, when it is detected that the bandwidth utilization of a propagation path is less than 60%, or the propagation delay exceeds 200ms, or the block confirmation rate is less than 95%, trigger propagation path optimization. Re-evaluate the node status, adjust the propagation hierarchy division, update the propagation relationship between nodes, and generate a new propagation time sequence table.

[0135] S56. Distributed storage of the authentication block is performed across the validation node cluster. Each node maintains the complete block data and establishes an index based on block hash, timestamp, authentication entity, and other dimensions. Distributed storage ensures the availability and persistence of authentication information and supports subsequent authentication information query and verification.

[0136] Based on step S5, this embodiment improves the propagation efficiency of the authentication block in a large-scale node network through hierarchical propagation and dynamic optimization; real-time monitoring and adaptive adjustment based on node status ensure the reliability of block propagation; and the designed distributed storage mechanism provides decentralized permanent recording capabilities for authentication information.

[0137] Example 2:

[0138] Figure 2 This is a structural diagram of an extensible blockchain identity authentication system for a distributed resource aggregation scenario in Example 2 of the present invention. Figure 2 As shown, the system includes an identity authentication request processing unit, a verification and permission control unit, and a node expansion and block broadcasting unit, wherein:

[0139] The identity authentication request processing unit receives an identity authentication request submitted by a user, wherein the identity authentication request includes user identity information, resource access requirement information, user terminal device information, and a corresponding timestamp; encrypts the user identity information based on a preset distributed hash algorithm to obtain an identity identification string; and constructs the identity identification string and the resource access requirement information into a data carrier of a blockchain node;

[0140] The verification and permission control unit is used to select multiple verification nodes in a preset blockchain network to form a verification node cluster, each verification node in the verification node cluster is deployed with a smart contract; each verification node in the verification node cluster executes a corresponding smart contract, and the smart contract verifies the identity string based on a preset consensus rule; when the verification is successful, a dynamic access permission control policy is constructed based on the resource access requirement information, and the dynamic access permission control policy includes a resource access time limit, a resource access depth, and a resource operation permission; the identity string, the access permission control policy, and the verification time information obtained when the verification is successful are packaged to generate an authentication block;

[0141] The node expansion and block broadcasting unit is used to monitor the number of blocks in the blockchain network. When the number of blocks reaches a preset threshold, a terminal device with remaining computing resources is selected as a new verification node based on the user terminal device information; the new verification node is added to the verification node cluster, and the same smart contract as the original verification node is deployed in the new verification node; the newly generated authentication block is broadcast to all nodes in the blockchain network through the verification node cluster to realize distributed storage of authentication information.

[0142] Example 3:

[0143] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, a scalable blockchain identity authentication method for a distributed resource aggregation scenario as described in any one of Embodiment 1 is implemented.

[0144] Example 4:

[0145] This embodiment also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, it implements the scalable blockchain identity authentication method for the distributed resource aggregation scenario as described in any one of Example 1.

[0146] It is worth noting that the system, electronic device and computer-readable storage medium described in the present invention are all based on the same inventive concept as the method described in Example 1, and will not be described in detail here.

[0147] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A scalable blockchain identity authentication method for distributed resource aggregation scenarios, characterized by: include: Receive an identity authentication request submitted by a user, wherein the identity authentication request includes user identity information, resource access requirement information, user terminal device information, and a corresponding timestamp; Encrypting the user identity information based on a preset distributed hash algorithm to obtain an identity string, and constructing the identity string and the resource access requirement information into a data carrier of a blockchain node; A plurality of verification nodes are selected from a preset blockchain network to form a verification node cluster, wherein each verification node in the verification node cluster is deployed with a smart contract; a corresponding smart contract is executed by each verification node in the verification node cluster, and the smart contract verifies the identity string based on a preset consensus rule; when the verification passes, a dynamic access permission control policy is constructed based on the resource access requirement information, wherein the dynamic access permission control policy includes a resource access time limit, a resource access depth, and a resource operation permission; Packing the identity string, the access permission control policy, and the verification time information obtained when the verification is successful to generate an authentication block; monitoring the number of blocks in the blockchain network, and when the number of blocks reaches a preset threshold, selecting a terminal device with remaining computing resources as a new verification node based on the user terminal device information; The newly added verification node is added to the verification node cluster, and the same smart contract as the original verification node is deployed in the newly added verification node; the newly generated authentication block is broadcast to all nodes in the blockchain network through the verification node cluster to achieve distributed storage of authentication information.

2. The scalable blockchain identity authentication method for distributed resource aggregation scenarios according to claim 1 is characterized in that: The user identity information is encrypted based on a preset distributed hash algorithm to obtain an identity string, and the identity string and the resource access requirement information are constructed as a data carrier of the blockchain node, specifically: Receive user identity information, divide the user identity information into multiple data blocks, each of which is 1024 bits in size; obtain the processor identifier, memory capacity, and disk serial number of the user terminal device as hardware feature information; Concatenate the hardware feature information and the current timestamp and perform a SHA-256 operation to obtain a random salt value; perform an XOR operation on the random salt value and each of the data blocks to obtain multiple obfuscated data blocks; Sequentially perform encryption transformation on each of the obfuscated data blocks, the encryption transformation comprising: Performing a linear mixing operation to generate intermediate state data, performing a bit cyclic left shift of 8 bits on the intermediate state data to obtain rotated data, rearranging the rotated data according to a preset permutation table to obtain permuted data, performing a nonlinear transformation on the permuted data using an S-box substitution table to obtain transformed data, and performing a modular addition operation on the transformed data and a round constant to obtain a data block hash value; Constructing a Merkle hash tree based on the hash values ​​of the multiple data blocks, using each hash value of the data block as a leaf node; pairing the leaf nodes with each other to calculate the combined hash value to construct a parent node, repeating the node pairing and hash calculation process until a root node is generated; using the hash value of the root node as an identity string; Constructing a three-layer coding structure, storing the identity string and intermediate data generated during its generation at the bottom layer, storing resource access requirement information at the middle layer, and storing a digital signature generated using an elliptic curve algorithm at the top layer; serializing the three-layer coding structure into a unified data carrier; Initialize a Bloom filter with a bit array length of m and select k different hash functions; input the identity string into the k hash functions in sequence, take the output value of each hash function modulo m to obtain a bit array subscript; set the position of the corresponding subscript in the bit array to 1; generate a feature vector of the Bloom filter; and combine the feature vector with the unified data carrier to construct a complete data structure of a blockchain node.

3. The scalable blockchain identity authentication method for distributed resource aggregation scenarios according to claim 1 is characterized in that: A plurality of verification nodes are selected from a preset blockchain network to form a verification node cluster, wherein each verification node in the verification node cluster is deployed with a smart contract; each verification node in the verification node cluster executes a corresponding smart contract, and the smart contract verifies the identity string based on a preset consensus rule; when the verification passes, a dynamic access permission control policy is constructed based on the resource access requirement information, specifically: Based on the node computing power score, historical reliability score, network connection quality score, and storage capacity score, multiple verification nodes are selected from the preset blockchain network to form a verification node cluster; Receive an access request, the access request including an identity string, access resource type information, access operation type information, and access time information; package the identity string, access resource type information, access operation type information, and access time information into a verification request data packet; The verification request data packet is sent to each verification node in the verification node cluster. Each verification node in the verification node cluster deploys the same identity authentication smart contract. The identity authentication smart contract is called by each verification node in the verification node cluster. The identity authentication smart contract is preset with consensus rules. The identity identification string in the verification request data packet is verified based on the consensus rules to obtain a verification result, wherein the consensus rules include: Verify the integrity of the identity string by reconstructing the Merkle tree path; verify the timeliness of the identity string based on the time window mechanism; verify the legitimacy of the signature of the identity string based on the asymmetric encryption algorithm; The verification results of each verification node are processed through consensus, including: Selecting the verification node with the highest reputation value from the verification node cluster as the master verification node; the master verification node collects verification results of each verification node in the verification node cluster, and when the number of consistency verification results exceeds a preset ratio of the total number of verification nodes, determines that the verification is passed and generates a verification pass flag; When the verification pass identifier is generated, the access resource type information, access operation type information, and access time information in the verification request data packet are extracted; a three-dimensional access control matrix is ​​constructed based on the access resource type information, access operation type information, and access time information, wherein the coordinate axes of the three-dimensional access control matrix correspond to the resource type, operation type, and time dimensions, respectively; Collect user access behavior feature information in real time, the user access behavior feature information includes historical access frequency data, historical access time data, and historical access resource type data; adjust the access permission level in the three-dimensional access control matrix according to the pre-acquired user behavior credibility, and generate a dynamic access permission control policy, wherein the resource dimension information, operation dimension information and time dimension information in the three-dimensional access control matrix are 4. The scalable blockchain identity authentication method for distributed resource aggregation scenarios according to claim 3 is characterized in that: Verify the integrity of the identity string by reconstructing the Merkle tree path; verify the timeliness of the identity string based on the time window mechanism; verify the legitimacy of the signature of the identity string based on the asymmetric encryption algorithm. Specifically: Obtain the Merkle tree leaf node information and node path information corresponding to the target identity string from the local storage of the verification node. The node path information includes the sibling node hash values ​​of each node on the path from the leaf node to the root node. Based on the leaf node information and the sibling node hash value, a combined hash is calculated layer by layer along the node path to obtain a reconstructed root hash value; the reconstructed root hash value is compared with the Merkle root hash value stored in the block header to generate an integrity verification result; Extract the creation timestamp from the identity string to obtain the current time of the verification node; Set the sliding time window size based on the business security level; Calculate the time difference between the current time and the creation timestamp; Comparing the time difference with the sliding time window size; Record the most recently processed timestamp sequence, perform continuity analysis on the creation timestamp and the timestamp sequence, and generate a timeliness verification result; Extracting a signature value and public key information from the digital signature of the identity identification string; Query the trusted public key pool maintained by the verification node to confirm the authenticity of the public key information; use the public key information to decrypt the signature value to obtain the original message digest; perform a hash calculation on the original content of the identity string to obtain a recalculated message digest; compare the original message digest with the recalculated message digest to generate a signature legitimacy verification result; Execute the processing of the integrity verification result, the timeliness verification result, and the signature legitimacy verification result in parallel; build a verification result cache pool, and manage the verification result cache pool using a least recently used policy; when the identity string appears repeatedly, query the verification result cache pool and return the cached verification result; When the integrity verification result, the timeliness verification result, and the signature legitimacy verification result are all passed, a verification pass certificate including a verification timestamp, a verification node identifier, and a verification result summary is generated; the verification pass certificate is signed using the private key of the verification node; the signed verification pass certificate is submitted to the blockchain network record; when any verification result is failed, a verification failure report is generated including a failed verification link identifier, a description of the failure reason, and a verification node identifier.

5. The scalable blockchain identity authentication method for distributed resource aggregation scenarios according to claim 1 is characterized in that: Packaging the identity string, the dynamic access permission control policy, and the verification time information to generate an authentication block includes: The identity string is analyzed hierarchically to obtain a basic information layer, an attribute information layer, and a signature information layer; the basic information layer includes a user identification code and a version identification code, the attribute information layer includes an identity type code and an expiration date code, and the signature information layer includes a digital signature code and a certification authority code; Performing structured processing on the three-dimensional access control matrix in the dynamic access permission control policy, extracting resource dimension information, operation dimension information, and time dimension information from the three-dimensional access control matrix; selecting a compression encoding method based on the sparsity of the three-dimensional access control matrix to encode the resource dimension information, the operation dimension information, and the time dimension information to generate permission matrix encoding data; Standardize the verification time information to extract the verification start timestamp, verification end timestamp, and verification duration; generate a time window identifier based on the verification start timestamp and the verification end timestamp; combine the time window identifier with the verification duration to form time series feature data; Constructing a block header structure of the authentication block, the block header structure including a version number field, a previous block hash field, a timestamp field, a difficulty target field, and a random number field; combining the hierarchical parsing result of the identity string, the authority matrix encoded data, and the time series feature data to form block body data; Constructing a first Merkle tree, dividing the block body data into data segments according to a preset byte length; calculating hash values ​​for each of the data segments to obtain leaf nodes; calculating hash values ​​for each of the leaf nodes layer by layer until a root hash value is obtained; and writing the root hash value into the block header structure; Construct a second Merkle tree, using the field values ​​of the block header structure and the verification node signature information as leaf nodes; calculate hash values ​​for the leaf nodes layer by layer until a block identifier hash value is obtained; combine the block identifier hash value with the block header structure written with the root hash value to generate a final block header; and combine the final block header with the block body data to generate an authentication block.

6. The scalable blockchain identity authentication method for distributed resource aggregation scenarios according to claim 1 is characterized in that: monitoring the number of blocks in the blockchain network, and when the number of blocks reaches a preset threshold, selecting a terminal device with remaining computing resources as a new verification node based on the user terminal device information; Adding the newly added verification node to the verification node cluster and deploying the same smart contract as the original verification node in the newly added verification node includes: Counting the number of blocks in the blockchain network; obtaining the block generation rate within a historical period of the blockchain network; calculating the trend of block number changes based on the block generation rate; comparing the block number with a preset block threshold, and triggering a verification node expansion process when the block number exceeds the preset block threshold; Broadcasting a resource query request to a user terminal device in the blockchain network; receiving device resource information returned by the user terminal device, the device resource information including processor usage, memory usage, storage space remaining, and network bandwidth remaining; and calculating the remaining computing resource score of the user terminal device; Obtaining device type information of the user terminal device, the device type information including processor specifications, memory capacity, storage capacity, and network bandwidth specifications; calculating a basic computing power score of the user terminal device based on the device type information; performing a weighted calculation on the remaining computing resource score and the basic computing power score to obtain a comprehensive device score; Obtaining geographic distribution information of existing verification nodes from the verification node cluster; constructing a geographic distribution optimization objective function based on the geographic distribution information; selecting a user terminal device as a new verification node based on the device comprehensive score and the geographic distribution information, wherein the device comprehensive score includes a remaining computing resource score and a basic computing power score, and the user terminal device information also includes device resource information; Selecting a verification node with the lowest comprehensive device score from the verification node cluster as a data synchronization source node; synchronizing block data, transaction data, and status data in the data synchronization source node to the newly added verification node; verifying the data synchronization result in the newly added verification node; and when the data synchronization result passes verification, adding the newly added verification node to the verification node cluster; Obtain smart contract information deployed in the verification node cluster, the smart contract information including the contract code, contract version number, and contract configuration parameters; verify the integrity of the smart contract information; and deploy the smart contract information to the newly added verification node.

7. A scalable blockchain identity authentication system for distributed resource aggregation scenarios, used to implement the scalable blockchain identity authentication method for distributed resource aggregation scenarios as described in any one of claims 1 to 6, characterized in that: It includes an identity authentication request processing unit, a verification and permission control unit, and a node expansion and block broadcasting unit, among which: The identity authentication request processing unit receives an identity authentication request submitted by a user, wherein the identity authentication request includes user identity information, resource access requirement information, user terminal device information, and a corresponding timestamp; encrypts the user identity information based on a preset distributed hash algorithm to obtain an identity identification string; and constructs the identity identification string and the resource access requirement information into a data carrier of a blockchain node; The verification and permission control unit is used to select multiple verification nodes in a preset blockchain network to form a verification node cluster, each verification node in the verification node cluster is deployed with a smart contract; each verification node in the verification node cluster executes a corresponding smart contract, and the smart contract verifies the identity string based on a preset consensus rule; when the verification is successful, a dynamic access permission control policy is constructed based on the resource access requirement information, and the dynamic access permission control policy includes a resource access time limit, a resource access depth, and a resource operation permission; the identity string, the access permission control policy, and the verification time information obtained when the verification is successful are packaged to generate an authentication block; The node expansion and block broadcasting unit is used to monitor the number of blocks in the blockchain network. When the number of blocks reaches a preset threshold, a terminal device with remaining computing resources is selected as a new verification node based on the user terminal device information; the new verification node is added to the verification node cluster, and the same smart contract as the original verification node is deployed in the new verification node; the newly generated authentication block is broadcast to all nodes in the blockchain network through the verification node cluster to realize distributed storage of authentication information.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, it implements the scalable blockchain identity authentication method for the distributed resource aggregation scenario as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, it implements the scalable blockchain identity authentication method for the distributed resource aggregation scenario as described in any one of claims 1 to 6.

Images