A decentralized single sign-on method based on consortium blockchain

Abstract

This invention proposes a decentralized single sign-on method based on a consortium blockchain. After a user generates a unique decentralized identifier (DID) using their public and private keys, various organizations verify the identity of the user initiating the registration request through a consensus mechanism. Upon successful verification, a verifiable credential (VC) is issued. Holding a VC, the user can directly submit it to the service provider for identity verification. Nodes in the centralized network use smart contract technology to verify the VC. This invention uses a blockchain consortium blockchain and distributed identity management to decentralize identity management, solving the problem of centralized control in identity management.

Description

Technical Field

[0001] This invention relates to the field of single sign-on, and more specifically to a decentralized single sign-on method based on a consortium blockchain. Background Technology

[0002] As the number of applications proliferates, users need to remember multiple accounts and passwords, which undoubtedly degrades the user experience. Single sign-on (SSO) solves this problem. Users only need to remember one set of usernames and passwords to access multiple systems and services, avoiding the hassle of remembering multiple accounts. It reduces frequent login steps, improving work efficiency as users can seamlessly switch between different applications. It also increases user satisfaction, especially for users who need to operate across multiple systems. In enterprise applications, centralized identity management and authentication reduce security risks caused by weak passwords or password reuse. It allows for the implementation of stricter password policies and multi-factor authentication (MFA), improving overall security. It makes it easier to monitor and control user access, tracking user activity by auditing login and logout events to help identify potential security threats. In the event of a security incident, user access can be quickly revoked, minimizing damage.

[0003] However, while cross-enterprise and cross-organizational single sign-on (SSO) offers the advantages of shared identity authentication information and a convenient user experience, it also presents some unique challenges. First, there's the issue of centralized identity management control. The core of cross-organizational SSO lies in the trust relationships between multiple organizations, but in typical SSO systems, this trust relationship carries the risk of centralized control. If all organizations rely on a single identity provider (such as a particular organization), that provider's control becomes crucial. If the identity provider malfunctions, is attacked, or experiences a trust breach, all organizations relying on it will be affected. Furthermore, in scenarios with high security requirements, organizations may be unwilling to entrust all authentication control to a single organization as the sole identity provider. Second, there are also issues with auditing and traceability. In cross-organizational SSO systems, user operation logs may be distributed across multiple organizations' systems, making unified auditing and compliance monitoring a challenge. In the event of a security incident, tracing user operation history and token usage records across organizations, and auditing for data tampering, are significant challenges in cross-organizational SSO systems. Summary of the Invention

[0004] The purpose of this invention is to provide a decentralized single sign-on method based on consortium blockchain, which not only solves the problem of centralized control of identity management, but also forms a transparent audit chain. By utilizing the inherent immutability of blockchain data, it solves the problems of auditing and traceability.

[0005] To achieve the above objectives, the present invention employs the following technical solution:

[0006] A decentralized single sign-on method based on a consortium blockchain includes the following steps:

[0007] After generating a unique decentralized identifier (DID) using a public-private key pair, the user initiates a registration request on the consortium blockchain.

[0008] Each organization verifies the identity of the user who initiates the registration request, and issues a verifiable credential (VC) to those who pass the verification.

[0009] After a user holds a verifiable credential (VC), the user will store the verifiable credential (VC) locally.

[0010] When initiating an authentication request, the verifiable credential (VC) is submitted directly to the service provider for authentication.

[0011] Nodes in a centralized network use smart contract technology to verify verifiable credentials (VCs), and verify the validity of VCs and whether they are issued by a trusted organization through the blockchain distributed ledger.

[0012] Once the verifiable credentials (VC) are verified, the user's identity verification is complete, and they successfully log in to the system.

[0013] Furthermore, the user's public key is stored in a DID document associated with the DID, and the DID document is stored in the distributed ledger of the consortium blockchain. The user's login log is also recorded on the distributed ledger of the consortium blockchain.

[0014] Furthermore, the process by which organizations issue verifiable credentials (VCs) to users includes the following steps:

[0015]

[0016] Among them, DID u C represents the decentralized identifier of user u. i Let C represent the i-th organization, N represent the number of organizations, h represent the consensus mechanism, and f(Ci,DIDu) represent the organization C. i User identity information DID u The verification function.

[0017] Furthermore, VC verification includes the following steps:

[0018] Nodes from different organizations perform authentication on the user's authentication request.

[0019] The verifiable credential (VC) information provided by the user is encrypted using the public keys of each node and then transmitted to each node.

[0020] Each node uses its own key to verify the validity of the token. Each node executes the verification function f' independently and returns its own verification result.

[0021] Verification passed, return f' = 1;

[0022] Verification failed, returning f' = 0;

[0023] After summing the verification results of all nodes, the final verification result is determined using the consensus mechanism h':

[0024]

[0025] Among them, VC u This represents the verifiable credential VC,k issued by each organization to user u. i f'(k) represents the key of the i-th node. i ,VC u ) represents the contribution of the i-th node to the user authentication result, and N represents the number of nodes. Each node represents an independent organization, so N also represents the number of organizations.

[0026] Furthermore, the consensus mechanism is either the PoA consensus mechanism or the Byzantine fault-tolerant algorithm.

[0027] Furthermore, users generate their own key pair K u Decentralized identifiers (DIDs) are generated through the function g. u :

[0028] DID u =g(K u )

[0029] Wherein, function g can be a hash function, elliptic curve algorithm, namespace, or random number.

[0030] The advantages of this invention are:

[0031] Decentralized identity verification and authorization: Traditional SSO systems rely on a centralized identity provider, while this system achieves decentralized identity verification. Through smart contracts on a consortium blockchain, different organizations can reach a consensus through a consensus mechanism to verify user identity and authorization information. This improves the system's transparency and trustworthiness, avoiding problems caused by single points of failure and trust collapse.

[0032] The traceability and immutability of identity information and access records, the immutability of smart contract operations and records, and the ability to record key steps of identity authentication on the blockchain enable the traceability of user identities, which is helpful for auditing and compliance. All cross-organizational authentication requests and access records can be recorded to ensure their authenticity and security. Attached Figure Description

[0033] Figure 1 Flowchart for obtaining verifiable credentials in this invention;

[0034] Figure 2 This is a flowchart of the identity authentication process of the present invention. Detailed Implementation

[0035] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0036] This embodiment discloses a decentralized single sign-on method based on a consortium blockchain, comprising two parts: issuing verifiable credentials (VCs) to users and users initiating identity verification login. Please refer to the following for details. Figure 1 and Figure 2 .

[0037] Users generate their own key pairs, which form the basis of user identity management. The private key is used to protect the user's identity, while the public key is used to publicly disclose that identity. Users use their public and private key pairs to generate unique decentralized identifiers (DIDs). This DID serves as the user's identity identifier and is associated with their public key. The user's public key is stored in a DID document associated with the DID, and the DID document is stored in the distributed ledger of the consortium blockchain. The user then initiates a registration request on the consortium blockchain. The user generates their own key pair K. u Decentralized identifiers (DIDs) are generated through the function g. u The formula is as follows;

[0038] DID u =g(K u )

[0039] The function g can be based on a hash function, an elliptic curve algorithm, a namespace, or a random number, etc.

[0040] Each organization verifies the user's identity and prepares to issue a Verifiable Credential (VC). This VC is jointly signed by multiple organizations, and the final decision is made through a consensus mechanism, ensuring the credential is independent of a single organization. Utilizing automated contract technology, each user organization automatically verifies the user's identity. After a sufficient number of organizations verify the user information and sign, the user is granted an authorized credential, and their information is stored on the consortium blockchain's distributed ledger. The formula for generating a VC is as follows;

[0041]

[0042] Among them, DID uC represents the decentralized identifier of user u. i Let C represent the i-th organization, N represent the number of organizations, h represent the consensus mechanism, and f(Ci,DIDu) represent the organization C. i User identity information DID u The verification function.

[0043] By multif(C) i DID u By summing these together and through a consensus mechanism, users can obtain identity credentials (VCs) issued by multiple trusted organizations.

[0044] After acquiring VC, users store it in their local wallets. When initiating an authentication request, they submit their VC directly to the service provider for verification. Nodes in the centralized network automatically verify the VC using smart contract technology, checking its validity and whether it was issued by a trusted organization through the blockchain's distributed ledger. Once the VC is verified, the user's authentication is complete, and they successfully log in to the system. Simultaneously, the user's login log is recorded on the consortium blockchain's distributed ledger.

[0045] The decentralized identity authentication process formula is as follows:

[0046]

[0047] Here, V represents the final authentication result, which is derived based on the joint verification by all participating nodes (organizations). The result is either verification successful (True) or verification failed (False). VC u This represents the verifiable credential VC,k issued by each organization to user u. i f'(k) represents the key of the i-th node. i ,VC u ) is an authentication function executed independently by each node, representing the contribution of the i-th node to the user authentication result, using the node's key k. i The system verifies the received user's VC using its own private key to ensure the authenticity of local authentication. This represents the sum of verification results from all nodes. N is the number of nodes participating in identity verification in a consortium or private blockchain. Each node represents an independent organization. In a decentralized environment, multiple nodes distribute and verify data to avoid single points of failure or centralized trust dependencies. Since each node represents an independent organization, N also represents the number of organizations. h' is also a consensus mechanism function used to summarize and make decisions based on the verification results from all nodes.

[0048] The consensus mechanisms that can be used in this system include, but are not limited to:

[0049] PoA (Proof of Authority): Verification is achieved through a majority decision by specific trusted nodes;

[0050] BFT (Byzantine Fault Tolerance Algorithm): Applicable to consortium blockchains, it can still reach consensus even with the presence of some malicious nodes.

[0051] Suppose there are three nodes N=3, which come from three different organizations. Users submit authentication requests through the system, and each node performs the authentication.

[0052] The VC information provided by the user is encrypted using the public keys of each node and then transmitted to each node.

[0053] Each node uses its own key to verify the validity of the token. Each node executes the verification function f'(k) independently. i ,VC u Each of these methods returns its own verification result.

[0054] Node 1: Validation passed, return f'(k) i ,VC u ) = 1;

[0055] Node 2: Verification failed, return f'(k) i ,VC u ) = 0;

[0056] Node 3: Validation passed, return f'(k) i ,VC u ) = 1;

[0057] The verification results from all nodes are summed to 1 + 0 + 1 = 2. A consensus mechanism is used to determine the final verification result. Assuming the system requires at least 2 / 3 of the nodes to agree on successful verification, then in this case, authentication is successful, and V = 2 (passed).

[0058] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A decentralized single sign-on method based on a consortium blockchain, characterized in that, Including the following steps: After generating a unique decentralized identifier (DID) using a public-private key pair, the user initiates a registration request on the consortium blockchain. Each organization verifies the identity of the user who initiates the registration request, and issues a verifiable credential (VC) to those who pass the verification. After a user holds a verifiable credential (VC), the user will store the verifiable credential (VC) locally. When initiating an authentication request, the verifiable credential (VC) is submitted directly to the service provider for authentication. Nodes in a centralized network use smart contract technology to verify verifiable credentials (VCs), and verify the validity of VCs and whether they are issued by a trusted organization through the blockchain distributed ledger. Once the verifiable credentials (VC) are verified, the user's identity verification is complete, and they successfully log in to the system. The steps involved in an organization issuing verifiable credentials (VC) to users include: in, A decentralized identifier representing user u. Let N represent the i-th organization, N represent the number of organizations, and h represent the consensus mechanism. Indicates organization User identity information The verification function; VC validation includes the following steps: Nodes from different organizations perform authentication on the user's authentication request. The verifiable credential (VC) information provided by the user is encrypted using the public keys of each node and then transmitted to each node. Each node uses its own key to verify the validity of the token, and each node executes the verification function independently. and return their respective verification results: Verification passed, return ; Verification failed, returned ; After summing the verification results of all nodes, the final verification result is determined using the consensus mechanism h': in, This represents the verifiable credential VC issued by each organization to user u. This represents the key of the i-th node. The value represents the contribution of the i-th node to the user authentication result, and N represents the number of nodes. Each node represents an independent organization, so N also represents the number of organizations.

2. The decentralized single sign-on method based on consortium blockchain according to claim 1, characterized in that, The user's public key is stored in a DID document associated with the DID, and the DID document is stored in the distributed ledger of the consortium blockchain. The user's login log is also recorded on the distributed ledger of the consortium blockchain.

3. The decentralized single sign-on method based on consortium blockchain according to claim 1, characterized in that, The consensus mechanism is either the PoA consensus mechanism or the Byzantine fault-tolerant algorithm.

4. The decentralized single sign-on method based on consortium blockchain according to claim 1, characterized in that, Users generate their own key pairs Decentralized identifiers are generated through the function g. : Wherein, function g can be a hash function, elliptic curve algorithm, namespace, or random number.

Images