Multi-domain embedded device digital identity trusted access method based on block chain

Abstract

The invention provides a cross-domain distributed digital identity trusted management method based on a block chain, relates to the technical field of embedded security, and researches a multi-domain node authentication architecture through a centralized and traceable block chain technology in combination with the demand of multi-domain embedded device node certificate management; according to the node trusted access technology based on lightweight remote identity authentication, digital identity trusted authentication oriented to multi-domain users in a distributed environment is realized, and the purpose of supporting completely controllable distributed digital identity security access is achieved.

Description

Technical Field

[0001] The present invention relates to the field of embedded security technology, and in particular provides a blockchain-based multi-domain embedded device digital identity trusted access method. Background Art

[0002] In an embedded system composed of multiple embedded devices, in order to facilitate the management of device nodes, an authentication server is set up to form a relatively independent trust domain. However, a single independent trust domain cannot provide multiple services. Trusted access and management of nodes is the primary task to achieve secure data sharing in embedded systems. Therefore, it is necessary to break through the security of the entire life cycle of digital identities, control the secure access of various nodes in embedded systems, achieve trusted access and effective management of node identities, ensure the security of embedded system nodes, and ensure the secure sharing of sensitive data in embedded systems. In a distributed embedded environment, in order to facilitate the management of device nodes, an authentication server is set up to form a relatively independent trust domain. However, a single independent trust domain cannot provide multiple services. Cross-domain identity access authentication is an urgent problem to be solved in data sharing systems.

[0003] Most of the existing identity authentication mechanisms are built on the public key infrastructure system, using the condom hierarchy authentication protocol to achieve two-way identity authentication. The two parties communicate by issuing certificates or certificate chains to each other. However, in this traditional centralized identity authentication method, the workload of the identity authentication service center will increase exponentially with the increase of access chains. The certificate maintenance process, such as certificate status checking, has large computational and communication overheads. The authentication center is vulnerable to potential attacks, and further improvements are needed in terms of Sybil attacks, third-party data leakage, efficiency, and authentication. Malik proposed applying fine feature extraction and sliding window matching methods to fingerprint extraction for personal authentication. For secure data storage, Ruj proposed a new decentralized access control scheme to support anonymous authentication. For PKI-based authentication protocols, Canett i proposed a modular and composable analysis framework to ensure protocol security. Through an efficient revocation detection process, Wasef proposed a fast message authentication protocol to replace the slower CRL detection process.

[0004] Internationally, research on distributed authentication based on blockchain has begun to emerge. Fromknecht proposed an alternative public decentralized authentication scheme to protect the public ledger of domain names and the corresponding public keys, solving the problems existing in existing certification authorities and trust networks. Lei idi ng combined reaction-based verification with certificate authentication in the blockchain storage system to solve the problem of Sybil attacks in the existing PKI scheme. Matsumoto proposed a blockchain-based PKI to detect the erroneous behavior of CA third parties and the malicious behavior of users, providing sufficient incentives and supervision for the system. Garman used blockchain technology to establish a new anonymous certificate scheme to eliminate the trusted certificate issuing third party, thereby achieving the purpose of decentralization. Fromknecht proposed to use blockchain to establish a new PKI to solve the identity registration problem in traditional PKI. Compared with traditional PKI, Lewison gave the concept of blockchain PKI, indicating that blockchain PKI certificate revocation verification does not require CRLs and OCSP, but only needs to be performed on the independent blockchain copy of the verifier. Shahandashti proposed a threshold attribute-based signature scheme to prove the signer's possession of the signature by revealing the relevant characteristics of the signer. Xue proposed a mutual authentication scheme based on temporary certificates to solve the communication problems between users, gateway nodes, and sensor nodes. The scheme has high security and efficiency. The existing blockchain distributed authentication can only solve some problems of the authentication system, and cannot solve the distributed authentication problem from the system architecture model, as well as the privacy protection problem generated by the authentication process.

[0005] Therefore, it is still necessary to study issues such as distributed authentication model framework, authentication standards, and privacy protection. Summary of the invention

[0006] The purpose of this application is to address the risks of single point attacks, untrustworthiness and easy tampering in the centralized identity information management of embedded devices under multiple trust domains, and propose a multi-domain embedded device digital identity trusted management method based on blockchain to achieve multi-domain embedded device node certificate management and lightweight remote trusted access to embedded devices.

[0007] In order to achieve the above object, the present invention adopts the following technical solution: a blockchain-based multi-domain embedded device digital identity trusted access method, the method comprising:

[0008] Set up one or more CAs in each domain. The CA in the domain stores the certificates of the domain. Use the CAs in multiple domains to build a multi-domain node authentication architecture.

[0009] The sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature, and sends the hash value, random number, and digital signature of its own blockchain certificate public key to the receiving device;

[0010] The receiving device checks the timestamp, queries the blockchain certificate of the sending device based on the hash value, and verifies the authenticity of the received digital signature using the sending device’s public key;

[0011] The receiving device uses the private key corresponding to the blockchain certificate to calculate the digital signature and sends the authentication message to the sending device;

[0012] The sending device receives the authentication message sent by the receiving device, checks the timestamp, queries the blockchain certificate of the receiving device in the blockchain based on the hash value, verifies the authenticity of the digital signature using the public key of the receiving device, confirms that the receiving device has the same key as the sending device, and uses the system's preset symmetric encryption algorithm to calculate and send it to the receiving device;

[0013] After receiving the ciphertext message from the sending device, the receiving device uses the symmetric key to decrypt it, confirming that the sending device has the same key as the receiving device, thus completing the two-way identity authentication between the sending device and the receiving device.

[0014] The blockchain-based multi-domain embedded device digital identity trusted access method provided by the present invention also has such a technical feature that one or more CAs are set in each domain, and the CA in the domain stores the certificate of the domain. The multi-domain node authentication architecture is constructed by the multi-domain CA, including:

[0015] The issuance chain stores all certificates issued by CAs, where the main chain stores CA certificates for each domain, and each CA certificate occupies one block; the subchain stores ordinary certificates, and ordinary certificates for each domain occupy one subchain, and each block in the subchain contains multiple ordinary certificates;

[0016] The revocation chain stores all revoked certificates, where the main chain stores revoked CA certificates and the subchain stores revoked common certificates. Revoked certificates for different domains are stored in different subchains.

[0017] The modification chain stores the certificates modified by hash technology, the main chain stores the initial certificates, and the subchain stores the modified certificates.

[0018] The blockchain-based multi-domain embedded device digital identity trusted access method provided by the present invention also has such a technical feature that the sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature, and sends the hash value, random number, and digital signature of its own blockchain certificate public key to the receiving device, including:

[0019] The sending device reads its own blockchain certificate public key pk in the local blockchain A , calculate its hash value and get H(pk A );

[0020] According to the preset group generator g and group order q, a random number x is randomly sampled from the non-zero integral ring modulo q;

[0021] Calculate g according to the system preset group definition x ;

[0022] Read the local timestamp TS A , get the authentication message m1 = H(pk A )||g x ||TS A ;

[0023] The sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature of the authentication message m1 and obtains d A ;

[0024] The sending device sends the authentication message m1, d A to the receiving device.

[0025] The blockchain-based multi-domain embedded device digital identity trusted access method provided by the present invention also has such a technical feature that the receiving device uses the private key corresponding to the blockchain certificate to calculate the digital signature and send the authentication message to the sending device, including:

[0026] The receiving device obtains a random number y by sampling from a non-zero integral ring modulo q according to the group generator g and the group order q preset by the system;

[0027] Calculate g according to the operation defined by the system preset group y , read the private key b corresponding to the local blockchain certificate;

[0028] Calculate the session key sk = H((g x pk A ) (y+b) );

[0029] Use the system's default symmetric encryption algorithm E to calculate E sk (0);

[0030] Read the local timestamp TS B , get the authentication message m2 = H(pk B )||g y ||E sk (0)||TS B ;

[0031] Use the private key corresponding to the blockchain certificate to calculate the digital signature of m2 and obtain d B ;

[0032] The receiving device sends authentication message m2, d B To the sending device.

[0033] Beneficial Effects

[0034] The present invention proposes a cross-domain distributed digital identity trusted management method based on blockchain. Through centralized and traceable blockchain technology, combined with the needs of multi-domain embedded device node certificate management, a multi-domain node authentication architecture is studied. Node trusted access technology based on lightweight remote identity authentication realizes digital identity trusted authentication for multi-domain users in a distributed environment, achieving the purpose of supporting fully controllable distributed digital identity secure access. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0036] Figure 1 The present invention provides a flow chart of the method. DETAILED DESCRIPTION

[0037] The present application is further described in detail below in conjunction with the accompanying drawings and examples, but it should be noted that these implementation methods are not limitations of the present application, and equivalent changes or substitutions in functions, methods, or structures made by ordinary technicians in the field based on these implementation methods are all within the scope of protection of the present application.

[0038] In the description of the embodiments of the present application, it should be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the creation of the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the creation of the present application.

[0039] In addition, the terms "first", "second", "third", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", etc. may explicitly or implicitly include one or more of the features. In the description of the invention of this application, unless otherwise specified, the meaning of "plurality" is two or more.

[0040] The terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the invention of this application can be understood by specific circumstances.

[0041] like Figure 1 As shown, the embodiment of the present application provides a blockchain-based multi-domain embedded device digital identity trusted access method, the method comprising:

[0042] Set up one or more CAs in each domain. The CA in the domain stores the certificates of the domain. Use the CAs in multiple domains to build a multi-domain node authentication architecture.

[0043] The sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature, and sends the hash value, random number, and digital signature of its own blockchain certificate public key to the receiving device;

[0044] The receiving device checks the timestamp, queries the blockchain certificate of the sending device based on the hash value, and verifies the authenticity of the received digital signature using the sending device’s public key;

[0045] The receiving device uses the private key corresponding to the blockchain certificate to calculate the digital signature and sends the authentication message to the sending device;

[0046] The sending device receives the authentication message sent by the receiving device, checks the timestamp, queries the blockchain certificate of the receiving device in the blockchain based on the hash value, verifies the authenticity of the digital signature using the public key of the receiving device, confirms that the receiving device has the same key as the sending device, and uses the system's preset symmetric encryption algorithm to calculate and send it to the receiving device;

[0047] After receiving the ciphertext message from the sending device, the receiving device uses the symmetric key to decrypt it, confirming that the sending device has the same key as the receiving device, thus completing the two-way identity authentication between the sending device and the receiving device.

[0048] In some embodiments, one or more CAs are set in each domain, and the CA in the domain stores the certificate of the domain. The multi-domain node authentication architecture is constructed by the multi-domain CAs, including:

[0049] The issuance chain stores all certificates issued by CA, where the main chain stores CA certificates for each domain, and each CA certificate occupies one block; the subchain stores ordinary certificates (certificates issued by the domain CA for the domain node), and ordinary certificates for each domain occupy one subchain, and each block in the subchain contains multiple ordinary certificates;

[0050] The revocation chain stores all revoked certificates, where the main chain stores revoked CA certificates and the subchain stores revoked common certificates. Revoked certificates for different domains are stored in different subchains.

[0051] The modification chain stores the certificates modified by hash technology, the main chain stores the initial certificates, and the subchain stores the modified certificates.

[0052] In some embodiments, the sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature, and sends the hash value, random number, and digital signature of the public key of its own blockchain certificate to the receiving device, including:

[0053] The sending device reads its own blockchain certificate public key pk in the local blockchain A , calculate its hash value and get H(pk A );

[0054] According to the preset group generator g and group order q, a random number x is randomly sampled from the non-zero integral ring modulo q;

[0055] Calculate g according to the system preset group definition x ;

[0056] Read the local timestamp TS A , get the authentication message m1 = H(pk A )||g x ||TS A ;

[0057] The sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature of the authentication message m1 and obtains d A ;

[0058] The sending device sends the authentication message m1, dA to the receiving device.

[0059] In some embodiments, the receiving device receives the authentication message sent by the sending device, checks that the error between the timestamp TSA and the local time is within the allowable range, and then queries the blockchain certificate pkA=ga of the sending device in the blockchain according to H(pkA), and then uses the public key of the sending device to verify that dA is the digital signature of m1;

[0060] In some embodiments, the receiving device uses the private key corresponding to the blockchain certificate to calculate the digital signature, and sends the authentication message to the sending device, including:

[0061] The receiving device obtains a random number y by sampling from a non-zero integral ring modulo q according to the group generator g and the group order q preset by the system;

[0062] Calculate g according to the operation defined by the system preset group y, read the private key b corresponding to the local blockchain certificate;

[0063] Calculate the session key sk = H((g x pk A ) (y+b) );

[0064] Use the system's default symmetric encryption algorithm E to calculate E sk (0);

[0065] Read the local timestamp TS B , get the authentication message m2 = H(pk B )||g y ||E sk (0)||TS B ;

[0066] Use the private key corresponding to the blockchain certificate to calculate the digital signature of m2 and obtain d B ;

[0067] The receiving device sends authentication message m2, d B To the sending device.

[0068] In some embodiments, when the sending device receives the authentication message sent by the receiving device, it checks the timestamp TS B The error with the local time is within the allowable range, and then according to H(pk B )Query the blockchain certificate pk of the receiving device in the blockchain B =g b , then use the receiving device's public key to verify d B is the digital signature of m2, and then the sending device calculates the session key sk = H((g y pk B ) (x+a) ), then use sk to decrypt E sk (0), and 0 is obtained, which confirms that the receiving device has the same key as the sending device. Finally, the sending device uses the system's preset symmetric encryption algorithm E to calculate and send E sk (1) To the receiving device.

[0069] In some embodiments, after receiving the ciphertext message sent by the sending device, the receiving device uses the symmetric key sk to decrypt the message and obtains 1, which confirms that the sending device has a common key with the receiving device.

[0070] In the method provided in the above embodiment, the sending device can confirm that it is communicating with the receiving device and has established a session key with the receiving device. At the same time, the receiving device can also confirm that it is communicating with the sending device and has established a session key with the sending device, and the authentication key establishment protocol with confirmation is executed successfully.

[0071] The above is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application shall be included in the protection scope of the present application. The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and variations can be made without departing from the technical principles of the present application, and these improvements and variations should also be regarded as the protection scope of the present application.

Claims

1. A blockchain-based multi-domain embedded device digital identity trusted access method, characterized in that: The method comprises: Set up one or more CAs in each domain. The CA in the domain stores the certificates of the domain. Use the CAs in multiple domains to build a multi-domain node authentication architecture. The sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature, and sends the hash value, random number, and digital signature of its own blockchain certificate public key to the receiving device; The receiving device checks the timestamp, queries the blockchain certificate of the sending device based on the hash value, and verifies the authenticity of the received digital signature using the sending device’s public key; The receiving device uses the private key corresponding to the blockchain certificate to calculate the digital signature and sends the authentication message to the sending device; The sending device receives the authentication message sent by the receiving device, checks the timestamp, queries the blockchain certificate of the receiving device in the blockchain based on the hash value, verifies the authenticity of the digital signature using the public key of the receiving device, confirms that the receiving device has the same key as the sending device, and uses the system's preset symmetric encryption algorithm to calculate and send it to the receiving device; After receiving the ciphertext message from the sending device, the receiving device uses the symmetric key to decrypt it, confirming that the sending device has the same key as the receiving device, thus completing the two-way identity authentication between the sending device and the receiving device.

2. According to the blockchain-based multi-domain embedded device digital identity trusted access method of claim 1, it is characterized in that: The method of setting one or more CAs in each domain, storing the certificates of the domain in the domain CA, and constructing a multi-domain node authentication architecture through multi-domain CAs includes: The issuance chain stores all certificates issued by CAs, where the main chain stores CA certificates for each domain, and each CA certificate occupies one block; the subchain stores ordinary certificates, and ordinary certificates for each domain occupy one subchain, and each block in the subchain contains multiple ordinary certificates; The revocation chain stores all revoked certificates, where the main chain stores revoked CA certificates and the subchain stores revoked common certificates. Revoked certificates for different domains are stored in different subchains. The modification chain stores the certificates modified by hash technology, the main chain stores the initial certificates, and the subchain stores the modified certificates.

3. According to the blockchain-based multi-domain embedded device digital identity trusted access method of claim 1, it is characterized in that: The sending device calculates the digital signature using the private key corresponding to the blockchain certificate, and sends the hash value, random number, and digital signature of the public key of its blockchain certificate to the receiving device, including: The sending device reads its own blockchain certificate public key pk in the local blockchain A , calculate its hash value and get H(pk A ); According to the preset group generator g and group order q, a random number x is randomly sampled from the non-zero integral ring modulo q; Calculate g according to the system preset group definition x ; Read the local timestamp TS A , get the authentication message m1 = H(pk A )||g x ||TS A ; The sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature of the authentication message m1 and obtains d A ; The sending device sends the authentication message m1, d A to the receiving device.

4. The blockchain-based multi-domain embedded device digital identity trusted access method according to claim 1 is characterized in that: The receiving device calculates a digital signature using a private key corresponding to the blockchain certificate and sends an authentication message to the sending device, including: The receiving device obtains a random number y by sampling from a non-zero integral ring modulo q according to the group generator g and the group order q preset by the system; Calculate g according to the operation defined by the system preset group y , read the private key b corresponding to the local blockchain certificate; Calculate the session key sk = H((g x pk A ) (y+b) ); Use the system's default symmetric encryption algorithm E to calculate E sk (0); Read the local timestamp TS B , get the authentication message m2 = H(pk B )||g y ||E sk (0)||TS B ; Use the private key corresponding to the blockchain certificate to calculate the digital signature of m2 and obtain d B ; The receiving device sends authentication message m2, d B To the sending device.

Images