Decentralized single sign-on method based on alliance chain

Abstract

The invention provides a decentralized single sign-on method based on an alliance chain, which comprises the following steps that: after a user generates a unique decentralized identifier (DID) by using a public key and a private key, each organization verifies the identity of the user who initiates a registration request through a consensus mechanism, issues a verifiable voucher (VC) if the verification is passed, and after the user holds the verifiable voucher (VC), the user carries out registration on the user through the verifiable voucher (VC); a verifiable voucher VC can be directly submitted to a service provider for identity verification, and nodes in a centralized network verify the verifiable voucher VC by using an intelligent contract technology. According to the invention, the block alliance chain and the distributed identity management are used to decentralize identity management, and the problem of centralized control of identity management is solved.

Description

Technical Field

[0001] The present invention relates to the field of single sign-on, and in particular to a decentralized single sign-on method based on an alliance chain. Background Art

[0002] As more and more applications are added, users need to remember multiple accounts and passwords, which will undoubtedly reduce the user experience. The emergence of single sign-on solves this problem. Users only need to remember a set of usernames and passwords to access multiple systems and services, avoiding the trouble of remembering multiple accounts. It reduces the steps of frequent logins and improves work efficiency, because users can switch between different applications seamlessly. It improves user satisfaction, especially for those who need to operate across multiple systems. In enterprise applications, centralized identity management and authentication reduce security risks caused by weak passwords or password reuse. Stricter password policies and multi-factor authentication (MFA) can be implemented to improve the overall security level. It is easier to monitor and control user access, and by auditing login and logout events, tracking user activities, and helping to discover potential security threats. In the event of a security incident, the user's access rights can be quickly revoked to reduce damage.

[0003] However, in cross-enterprise and cross-organization single sign-on, although identity authentication information can be shared and convenient user experience can be provided, some unique problems are also faced. First, there is the problem of centralized control of identity management. The core of cross-organization single sign-on lies in the trust relationship between multiple organizations, but this trust relationship has the risk of centralized control in general single sign-on systems. That is, if all organizations rely on an identity provider (such as a certain organization), then the control of the provider is very critical. Once the identity provider fails, is attacked, or trust collapses, all organizations that rely on it will be affected. Furthermore, in some scenarios with high security requirements, organizations may be reluctant to hand over all authentication control to a certain organization as a single identity provider. Secondly, there are also certain problems in auditing and tracing. In a cross-organization single sign-on system, the user's operation logs may be distributed in the systems of multiple organizations. How to conduct unified auditing and compliance supervision is a difficult problem. Once a security incident occurs, how to trace the user's operation history and token usage records across organizations, and how to audit whether the data has been tampered with, are important challenges in the cross-organization single sign-on system. Summary of the invention

[0004] The purpose of the present invention is to provide a decentralized single sign-on method based on alliance chain, which not only solves the problem of centralized control of identity management, but also can form a transparent audit chain, and solves the problems of audit and traceability by utilizing the natural non-tamperable characteristics of blockchain data.

[0005] In order to achieve the above object, the present invention is implemented through the following technical solutions:

[0006] A decentralized single sign-on method based on an alliance chain, comprising the steps of:

[0007] After the user uses the public-private key pair to generate a unique decentralized identifier DID, the user initiates a registration request on the consortium chain;

[0008] Each organization verifies the identity of the user who initiated the registration request, and issues a verifiable certificate VC to those who pass the verification;

[0009] After the user holds the verifiable credential VC, the verifiable credential VC is saved locally;

[0010] When initiating an identity authentication request, the verifiable credential VC is submitted directly to the service provider for identity authentication;

[0011] Nodes in the centralized network use smart contract technology to verify the verifiable certificate VC, and verify whether the verifiable certificate VC is valid and issued by a trusted organization through the blockchain distributed ledger;

[0012] After the verifiable credential VC is verified, the user identity authentication is completed and the user logs into the system successfully.

[0013] Furthermore, the user's public key is stored in the DID document associated with the DID, the DID document is stored in the distributed ledger of the alliance chain, and the user's login log is also recorded in the distributed ledger of the alliance chain.

[0014] Furthermore, each organization issues a verifiable credential VC to a user, including the following steps:

[0015]

[0016] Among them, DID u represents the decentralized identifier of user u, C i represents the i-th organization, N represents the number of organizations, h represents the consensus mechanism, and f(Ci,DIDu) represents the organization C i User identity information DID u The validation function.

[0017] Furthermore, VC verification includes the steps of:

[0018] Nodes from different organizations perform verification on the user's authentication request separately;

[0019] The verifiable credential VC information provided by the user is encrypted using the public key of each node and then passed to each node separately;

[0020] Each node uses its own key to verify whether the token is valid. Each node executes the verification function f' separately and returns its own verification result:

[0021] Verification passed, return f'=1;

[0022] If verification fails, return f'=0;

[0023] After the verification results of all nodes are added together, the consensus mechanism h' is used to determine the final verification result:

[0024]

[0025] Among them, VC u represents the verifiable credential VC,k issued by each organization to user u i represents the key of the i-th node, f'(k i ,VC u ) represents the contribution of the i-th node to the user identity authentication result, N represents the number of nodes, and each node represents an independent organization, so N also represents the number of organizations.

[0026] Furthermore, the consensus mechanism is a PoA consensus mechanism or a Byzantine fault-tolerant algorithm.

[0027] Furthermore, the user generates his own key pair K u , generate a decentralized identifier DID through function g u :

[0028] DID u =g(K u )

[0029] The function g is a hash function, an elliptic curve algorithm, a namespace or a random number.

[0030] The advantages of the present invention are:

[0031] Decentralized authentication and authorization: Traditional SSO systems rely on a centralized identity provider, while this system can achieve decentralized authentication. Through smart contracts on the alliance chain, different organizations can reach an agreement through a consensus mechanism to verify the user's identity and authorization information. This improves the transparency and credibility of the system and avoids problems caused by single point failures and trust breakdown.

[0032] The traceability and immutability of identity information and access records. The operations and records of smart contracts cannot be tampered with. By recording the key steps of identity authentication on the blockchain, the traceability of user identity can be achieved, which is helpful for auditing and compliance. All cross-organizational authentication requests and access records can be recorded to ensure their authenticity and security. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A flow chart of obtaining a verifiable credential VC for the present invention;

[0034] Figure 2 This is the identity authentication flow chart of the present invention. DETAILED DESCRIPTION

[0035] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0036] This embodiment discloses a decentralized single sign-on method based on a consortium chain, including issuing a verifiable credential VC to a user and the user initiating identity authentication login. Please refer to Figure 1 and Figure 2 .

[0037] The user generates his own key pair, which is the basis of user identity management. The private key is used to protect the user's identity, and the public key is used to disclose the identity to the outside world. The user uses the public-private key pair to generate a unique decentralized identifier (Decentralized Identifiers, DID). This DID serves as the user's identity identifier and is associated with his public key. The user's public key is stored in the DID document associated with the DID, and the DID document is stored in the distributed ledger of the consortium chain. The user then initiates a registration request on the consortium chain. The user generates his own key pair K u , generate a decentralized identifier DID through function g u , the formula is as follows;

[0038] DID u =g(K u )

[0039] The function g may be based on a hash function, an elliptic curve algorithm, a namespace, or a random number.

[0040] Each organization verifies the identity of the user and prepares to issue a Verifiable Credential (VC) to the user. The VC is signed by multiple organizations, and the signatures of each organization are finally decided through a consensus mechanism, so the credential does not rely on a single organization. Using automatic contract technology, each user organization will automatically authenticate the user. After a sufficient number of organizations verify the user information and sign, the user is granted an authorized credential, and the user's user information is saved on the distributed ledger of the alliance chain. The formula for generating VC is as follows;

[0041]

[0042] Among them, DID urepresents the decentralized identifier of user u, C i represents the i-th organization, N represents the number of organizations, h represents the consensus mechanism, and f(Ci,DIDu) represents the organization C i User identity information DID u The validation function.

[0043] By adding multiple f(C i ,DID u ) are added together, and through the consensus mechanism h, users can obtain identity certificates VC issued by multiple trusted organizations.

[0044] After the user holds VC, he / she saves it in the local wallet. When initiating an identity authentication request, he / she directly submits his / her VC to the service provider for identity authentication. The nodes in the centralized network will automatically verify the VC using smart contract technology, and verify whether the VC is valid and whether it is issued by a trusted organization through the blockchain distributed ledger. Once the VC is verified, the user's identity authentication is completed and the system is successfully logged in. At the same time, the user's login log is recorded on the distributed ledger of the alliance chain.

[0045] The decentralized identity authentication process formula is as follows:

[0046]

[0047] Among them, V represents the final identity verification result, which is based on the joint verification of all participating nodes (organizations). The result is verification passed (True) or verification failed (False). u represents the verifiable credential VC,k issued by each organization to user u i represents the key of the i-th node, f'(k i ,VC u ) is the authentication function executed independently by each node, indicating the contribution of the i-th node to the user authentication result, using the key k of the node i And the received user's VC is verified, and each node uses its own private key to verify to ensure the authenticity of local identity authentication. It is the sum of all node verification results. N is the number of nodes involved in identity verification in a consortium chain or private chain. Each node represents an independent organization. In a decentralized environment, multiple nodes store and verify data in a decentralized manner to avoid single point failure or centralized trust dependence. Each node represents an independent organization, so N also represents the number of organizations. h' is also a consensus mechanism function, which is used to summarize and make decisions on the verification results of all nodes.

[0048] The consensus mechanisms that can be used in this system include but are not limited to:

[0049] PoA (Proof of Authority): Verification is performed through the majority decision of specific trusted nodes;

[0050] BFT (Byzantine Fault Tolerance): Applicable to consortium chains, which allows consensus to be reached even with the existence of some malicious nodes.

[0051] Assume that there are three nodes N=3, which are from three different organizations. A user submits an identity authentication request through the system, and each node performs verification separately.

[0052] The VC information provided by the user is encrypted using the public key of each node and then passed to each node separately.

[0053] Each node uses its own key to verify that the token is valid. Each node executes the verification function f'(k i ,VC u ), and return their respective verification results:

[0054] Node 1: Verification passed, returns f'(k i ,VC u )=1;

[0055] Node 2: Verification failed, returns f'(k i ,VC u )=0;

[0056] Node 3: Verification passed, returns f'(k i ,VC u )=1;

[0057] The verification results of all nodes are summed up to 1+0+1=2. The final verification result is determined using a consensus mechanism. Assuming that the system requires at least 2 / 3 of the nodes to agree that the verification is passed, in this case, the identity verification is successful and V=2 (passed).

[0058] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A decentralized single sign-on method based on alliance chain, characterized in that: Includes steps: After the user uses the public-private key pair to generate a unique decentralized identifier DID, the user initiates a registration request on the consortium chain; Each organization verifies the identity of the user who initiated the registration request, and issues a verifiable certificate VC to those who pass the verification; After the user holds the verifiable credential VC, the verifiable credential VC is saved locally; When initiating an identity authentication request, the verifiable credential VC is submitted directly to the service provider for identity authentication; Nodes in the centralized network use smart contract technology to verify the verifiable certificate VC, and verify whether the verifiable certificate VC is valid and issued by a trusted organization through the blockchain distributed ledger; After the verifiable credential VC is verified, the user identity authentication is completed and the user logs into the system successfully.

2. The decentralized single sign-on method based on alliance chain according to claim 1 is characterized in that: The user's public key is stored in the DID document associated with the DID. The DID document is stored in the distributed ledger of the alliance chain, and the user's login log is also recorded in the distributed ledger of the alliance chain.

3. The decentralized single sign-on method based on alliance chain according to claim 1 is characterized in that: Each organization issues a verifiable credential VC to a user, including the following steps: Among them, DID u represents the decentralized identifier of user u, C i represents the i-th organization, N represents the number of organizations, h represents the consensus mechanism, and f(Ci,DIDu) represents the organization C i User identity information DID u The validation function.

4. The decentralized single sign-on method based on alliance chain according to claim 3 is characterized in that: VC verification includes the following steps: Nodes from different organizations perform verification on the user's authentication request separately; The verifiable credential VC information provided by the user is encrypted using the public key of each node and then passed to each node separately; Each node uses its own key to verify whether the token is valid. Each node executes the verification function f' separately and returns its own verification result: Verification passed, return f'=1; If verification fails, return f'=0; After the verification results of all nodes are added together, the consensus mechanism h' is used to determine the final verification result: Among them, VC u represents the verifiable credential VC,k issued by each organization to user u i represents the key of the i-th node, f'(k i ,VC u ) represents the contribution of the i-th node to the user identity authentication result, N represents the number of nodes, and each node represents an independent organization, so N also represents the number of organizations.

5. The decentralized single sign-on method based on alliance chain according to claim 3 or 4 is characterized in that: The consensus mechanism is a PoA consensus mechanism or a Byzantine fault-tolerant algorithm.

6. The decentralized single sign-on method based on alliance chain according to claim 1 is characterized in that: The user generates his own key pair K u , generate a decentralized identifier DID through function g u : DID u =g(K u ) The function g is a hash function, an elliptic curve algorithm, a namespace or a random number.

Images