A blockchain-based trusted access method for digital identity in multi-domain embedded devices

Abstract

This application provides a blockchain-based cross-domain distributed digital identity trusted management method, relating to the field of embedded security technology. By combining centralized and traceable blockchain technology with the needs of multi-domain embedded device node certificate management, a multi-domain node authentication architecture is studied. Based on lightweight remote identity authentication node trusted access technology, trusted digital identity authentication for multi-domain users in a distributed environment is realized, achieving the goal of supporting fully controllable distributed digital identity secure access.

Description

Technical Field

[0001] This invention relates to the field of embedded security technology, and in particular provides a blockchain-based method for trusted access to digital identities in multi-domain embedded devices. Background Technology

[0002] In embedded systems composed of multiple embedded devices, authentication servers are set up to form relatively independent trust domains for convenient management of device nodes. However, a single independent trust domain cannot provide a variety of services. Trusted access and management of nodes are the primary tasks for achieving secure data sharing in embedded systems. Therefore, it is necessary to overcome the challenges of digital identity lifecycle security, control the secure access of various nodes in the embedded system, achieve trusted access and effective management of node identities, ensure node security, and guarantee the secure sharing of sensitive data in the embedded system. In distributed embedded environments, authentication servers are set up to form relatively independent trust domains for convenient management of device nodes. However, a single independent trust domain cannot provide a variety of services. Cross-domain identity access authentication is a problem that urgently needs to be solved in data sharing systems.

[0003] Most existing authentication mechanisms are built on public key infrastructure systems (PKI) and use hierarchical authentication protocols (HLPs) to achieve two-way authentication. The authenticating parties communicate by exchanging certificates or certificate chains. However, in this traditional centralized authentication method, the workload of the authentication service center increases exponentially with the number of access chains. Certificate maintenance, such as checking certificate status, incurs significant computational and communication overhead. The authentication center is vulnerable to potential attacks, and further improvements are needed in areas such as Sybil attacks, third-party data leaks, efficiency, and authentication. Malik proposed applying refined feature extraction and sliding window matching to fingerprint extraction for personal authentication. For secure data storage, Ruj proposed a new decentralized access control scheme to support anonymous authentication. For PKI-based authentication protocols, Canetti proposed a modular and composable analysis framework to ensure protocol security. Through an efficient revocation detection process, Wasef proposed a fast message authentication protocol to replace the slow CRL detection process.

[0004] International research on blockchain-based distributed authentication has begun to emerge. Fromknecht proposed an alternative public decentralized authentication scheme to protect the domain name public ledger and corresponding public keys, solving problems existing in current certification authorities and trust networks. Leiding combined reactive verification with certificate authentication in a blockchain storage system to address the Sybil attack problem in existing PKI schemes. Matsumoto proposed a blockchain-based PKI to detect erroneous behavior by third-party CAs and malicious behavior by users, providing sufficient incentives and oversight for the system. Garman used blockchain technology to establish a new anonymous certificate scheme to eliminate trusted third-party certificate issuers, thereby achieving decentralization. Fromknecht proposed using blockchain to establish a new PKI to solve the identity squatting problem in traditional PKI. Compared with traditional PKI, Lewison introduced the concept of blockchain PKI, showing that blockchain PKI certificate revocation verification does not require CRLs and OCSP, but only needs to be performed on the independent blockchain copy of the verifier. Shahandashti proposed a threshold attribute-based signature scheme, which proves the signer's possession of the signature by revealing relevant characteristics of the signer. Xue proposed a mutual authentication scheme based on temporary certificates to solve the communication problem between users, gateway nodes, and sensor nodes. This scheme has high security and efficiency. Existing blockchain distributed authentication can only solve part of the problems of authentication systems and cannot solve the distributed authentication problem from the perspective of system architecture model, nor can it solve the privacy protection issues arising in the authentication process.

[0005] Therefore, further research is still needed on distributed authentication model frameworks, authentication standards, and privacy protection. Summary of the Invention

[0006] The purpose of this application is to address the risks of single point of attack, untrustworthiness, and easy tampering in centralized identity information management of embedded devices under multiple trust domains. It proposes a blockchain-based trusted management method for digital identity of embedded devices in multiple domains, so as to realize node certificate management of embedded devices in multiple domains and lightweight remote trusted access of embedded devices.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: a blockchain-based method for trusted access to digital identity in multi-domain embedded devices, the method comprising:

[0008] Set up one or more CAs in each domain, and store the domain's certificates in the CAs within the domain. Build a multi-domain node authentication architecture through CAs in multiple domains.

[0009] The sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature and sends the hash value, random number, and digital signature of its own blockchain certificate public key to the receiving device.

[0010] The receiving device checks the timestamp, queries the sending device's blockchain certificate in the blockchain based on the hash value, and verifies the authenticity of the received digital signature using the sending device's public key;

[0011] The receiving device uses the private key corresponding to the blockchain certificate to calculate the digital signature and sends the authentication message to the sending device;

[0012] When the sending device receives the authentication message from the receiving device, it checks the timestamp, queries the blockchain certificate of the receiving device in the blockchain according to the hash value, verifies the authenticity of the digital signature using the public key of the receiving device, confirms that the receiving device has the same key as the sending device, calculates and sends the key to the receiving device using the system's preset symmetric encryption algorithm.

[0013] After receiving the encrypted message from the sending device, the receiving device decrypts it using a symmetric key, confirms that the sending device has the same key as the receiving device, and completes the two-way authentication between the sending and receiving devices.

[0014] The blockchain-based multi-domain embedded device digital identity trusted access method provided by this invention also has the following technical features: setting one or more CAs in each domain, storing the domain's certificate in the CA, and constructing a multi-domain node authentication architecture through multi-domain CAs includes:

[0015] The issuance chain stores all certificates issued by CAs. The main chain stores CA certificates for each domain, with each CA certificate occupying one block. The sub-chains store ordinary certificates, with each domain's ordinary certificate occupying one sub-chain. Each block in a sub-chain contains multiple ordinary certificates.

[0016] The revocation chain stores all revoked certificates. The main chain stores revoked CA certificates, and the sub-chains store revoked ordinary certificates. Revocation certificates for different domains are stored in different sub-chains.

[0017] The modified chain stores the certificate modified using hashing technology, the main chain stores the initial certificate, and the sub-chain stores the modified certificate.

[0018] The blockchain-based multi-domain embedded device digital identity trusted access method provided by this invention also has the following technical feature: the sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature, and sends the hash value, random number, and digital signature of its own blockchain certificate public key to the receiving device, including:

[0019] The sending device reads its own blockchain certificate public key from the local blockchain. A Calculate its hash value to obtain H(pk) A );

[0020] Based on the system's preset group generator g and group order q, a random number x is randomly sampled from a non-zero integer ring modulo q.

[0021] Calculate g according to the system's preset group definition. x ;

[0022] Read local timestamp TS A The authentication message m1 = H(pk) is obtained. A )||g x ||TS A ;

[0023] The sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature of the authentication message m1, and obtains d. A ;

[0024] The sending device sends authentication messages m1,d A Give it to the receiving device.

[0025] The blockchain-based multi-domain embedded device digital identity trusted access method provided by this invention also has the following technical feature: the receiving device uses the private key corresponding to the blockchain certificate to calculate the digital signature and sends the authentication message to the sending device, including:

[0026] The receiving device samples a random number y from a non-zero integer ring modulo q based on the group generator g and the order q preset by the system.

[0027] The operation g is calculated based on the system's preset group definition. y Read the private key b corresponding to the local blockchain certificate;

[0028] Calculate the session key sk = H((g) x pk A ) (y+b) );

[0029] Calculate E using the system's preset symmetric encryption algorithm E. sk (0);

[0030] Read local timestamp TS B The authentication message m2 = H(pk) is obtained. B )||g y ||E sk (0)||TS B ;

[0031] The digital signature of m2 is calculated using the private key corresponding to the blockchain certificate, and d is obtained. B ;

[0032] The receiving device sends authentication message m2,d B To the sending device.

[0033] Beneficial effects

[0034] This invention proposes a blockchain-based cross-domain distributed digital identity trusted management method. By combining centralized and traceable blockchain technology with the needs of multi-domain embedded device node certificate management, it studies a multi-domain node authentication architecture. Based on lightweight remote identity authentication node trusted access technology, it realizes trusted digital identity authentication for multi-domain users in a distributed environment, achieving the goal of supporting fully controllable distributed digital identity secure access. Attached Figure Description

[0035] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is a flowchart of the method provided by the present invention. Detailed Implementation

[0037] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. However, it should be noted that these embodiments are not intended to limit the present application. Equivalent transformations or substitutions in function, method, or structure made by those skilled in the art based on these embodiments are all within the protection scope of the present application.

[0038] In the description of the embodiments of this application, it should be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings. They are only for the convenience of describing the creation of this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the creation of this application.

[0039] Furthermore, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first," "second," etc., may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0040] The terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of these terms in this application based on the specific circumstances.

[0041] like Figure 1 As shown in the figure, this application provides a blockchain-based method for trusted access to digital identity in multi-domain embedded devices, the method comprising:

[0042] Set up one or more CAs in each domain, and store the domain's certificates in the CAs within the domain. Build a multi-domain node authentication architecture through CAs in multiple domains.

[0043] The sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature and sends the hash value, random number, and digital signature of its own blockchain certificate public key to the receiving device.

[0044] The receiving device checks the timestamp, queries the sending device's blockchain certificate in the blockchain based on the hash value, and verifies the authenticity of the received digital signature using the sending device's public key;

[0045] The receiving device uses the private key corresponding to the blockchain certificate to calculate the digital signature and sends the authentication message to the sending device;

[0046] When the sending device receives the authentication message from the receiving device, it checks the timestamp, queries the blockchain certificate of the receiving device in the blockchain according to the hash value, verifies the authenticity of the digital signature using the public key of the receiving device, confirms that the receiving device has the same key as the sending device, calculates and sends the key to the receiving device using the system's preset symmetric encryption algorithm.

[0047] After receiving the encrypted message from the sending device, the receiving device decrypts it using a symmetric key, confirms that the sending device has the same key as the receiving device, and completes the two-way authentication between the sending and receiving devices.

[0048] In some embodiments, setting up one or more CAs in each domain, storing the domain's certificates in each CA, and constructing a multi-domain node authentication architecture through multi-domain CAs includes:

[0049] The issuance chain stores all certificates issued by CAs. The main chain stores the CA certificates for each domain, with each CA certificate occupying one block. The sub-chains store ordinary certificates (certificates issued by the domain CA to the nodes of that domain). Each domain's ordinary certificate occupies one sub-chain, and each block in the sub-chain contains multiple ordinary certificates.

[0050] The revocation chain stores all revoked certificates. The main chain stores revoked CA certificates, and the sub-chains store revoked ordinary certificates. Revocation certificates for different domains are stored in different sub-chains.

[0051] The modified chain stores the certificate modified using hashing technology, the main chain stores the initial certificate, and the sub-chain stores the modified certificate.

[0052] In some embodiments, the sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature, and sends the hash value, random number, and digital signature of its own blockchain certificate public key to the receiving device, including:

[0053] The sending device reads its own blockchain certificate public key from the local blockchain. A Calculate its hash value to obtain H(pk) A );

[0054] Based on the system's preset group generator g and group order q, a random number x is randomly sampled from a non-zero integer ring modulo q.

[0055] Calculate g according to the system's preset group definition. x ;

[0056] Read local timestamp TS A The authentication message m1 = H(pk) is obtained. A )||g x ||TS A ;

[0057] The sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature of the authentication message m1, and obtains d. A ;

[0058] The sending device sends an authentication message m1, dA to the receiving device.

[0059] In some embodiments, the receiving device receives the authentication message sent by the sending device, checks that the error between the timestamp TSA and the local time is within the allowable range, then queries the blockchain certificate pkA=ga of the sending device according to H(pkA), and then uses the public key of the sending device to verify that dA is a digital signature about m1.

[0060] In some embodiments, the receiving device uses the private key corresponding to the blockchain certificate to calculate the digital signature and sends the authentication message to the sending device, including:

[0061] The receiving device samples a random number y from a non-zero integer ring modulo q based on the group generator g and the order q preset by the system.

[0062] The operation g is calculated based on the system's preset group definition. yRead the private key b corresponding to the local blockchain certificate;

[0063] Calculate the session key sk = H((g) x pk A ) (y+b) );

[0064] Calculate E using the system's preset symmetric encryption algorithm E. sk (0);

[0065] Read local timestamp TS B The authentication message m2 = H(pk) is obtained. B )||g y ||E sk (0)||TS B ;

[0066] The digital signature of m2 is calculated using the private key corresponding to the blockchain certificate, and d is obtained. B ;

[0067] The receiving device sends authentication message m2,d B To the sending device.

[0068] In some embodiments, when the sending device receives an authentication message from the receiving device, it checks the timestamp TS. B If the error with local time is within the allowable range, then according to H(pk) B ) Query the blockchain certificate of the receiving device in the blockchain. B =g b Then, verify d using the public key of the receiving device. B It's about the digital signature of m2, then the sending device calculates the session key sk = H((g) y pk B ) (x+a) Then use sk to decrypt E. sk If (0) is obtained, it confirms that the receiving device possesses the same key as the sending device. Finally, the sending device uses the system's preset symmetric encryption algorithm E to calculate and send E. sk (1) Give it to the receiving device.

[0069] In some embodiments, after receiving the encrypted message sent by the sending device, the receiving device decrypts it using the symmetric key sk and obtains 1, thus confirming that the sending device has the same key as the receiving device.

[0070] In the method provided in the above embodiments, the sending device can confirm that it is communicating with the receiving device and that a session key has been established with the receiving device. Simultaneously, the receiving device can also confirm that it is communicating with the sending device and that a session key has been established with the sending device, indicating that the authentication key establishment protocol with confirmation has been successfully executed.

[0071] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application. The above description is merely a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of this application, and these improvements and modifications should also be considered within the protection scope of this application.

Claims

1. A blockchain-based method for trusted access to digital identity in multi-domain embedded devices, characterized in that, The method includes: Set up one or more CAs in each domain, and store the domain's certificates in the CAs within the domain. Build a multi-domain node authentication architecture through CAs in multiple domains. The sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature and sends the hash value, random number, and digital signature of its own blockchain certificate public key to the receiving device. The receiving device checks the timestamp, queries the sending device's blockchain certificate in the blockchain based on the hash value, and verifies the authenticity of the received digital signature using the sending device's public key; The receiving device uses the private key corresponding to the blockchain certificate to calculate the digital signature and sends the authentication message to the sending device; When the sending device receives the authentication message from the receiving device, it checks the timestamp, queries the blockchain certificate of the receiving device in the blockchain according to the hash value, verifies the authenticity of the digital signature using the public key of the receiving device, confirms that the receiving device has the same key as the sending device, calculates and sends the key to the receiving device using the system's preset symmetric encryption algorithm. After receiving the encrypted message from the sending device, the receiving device decrypts it using a symmetric key, confirms that the sending device has the same key as the receiving device, and completes the two-way authentication between the sending and receiving devices.

2. The blockchain-based multi-domain embedded device digital identity trusted access method according to claim 1, characterized in that, The step of setting up one or more CAs in each domain, storing the domain's certificates in each CA, and constructing a multi-domain node authentication architecture through multi-domain CAs includes: The issuance chain stores all certificates issued by CAs. The main chain stores CA certificates for each domain, with each CA certificate occupying one block. The sub-chains store ordinary certificates, with each domain's ordinary certificate occupying one sub-chain. Each block in a sub-chain contains multiple ordinary certificates. The revocation chain stores all revoked certificates. The main chain stores revoked CA certificates, and the sub-chains store revoked ordinary certificates. Revocation certificates for different domains are stored in different sub-chains. The modified chain stores the certificate modified using hashing technology, the main chain stores the initial certificate, and the sub-chain stores the modified certificate.

3. The blockchain-based multi-domain embedded device digital identity trusted access method according to claim 1, characterized in that, The sending device calculates a digital signature using the private key corresponding to the blockchain certificate, and sends the hash value, random number, and digital signature of its own blockchain certificate public key to the receiving device, including: The sending device reads its own blockchain certificate public key from the local blockchain. A Calculate its hash value to obtain H(pk) A ); Based on the system's preset group generator g and group order q, a random number x is randomly sampled from a non-zero integer ring modulo q. Calculate g according to the system's preset group definition. x ; Read local timestamp TS A The authentication message m1 = H(pk) is obtained. A )||g x ||TS A ; The sending device uses the private key corresponding to the blockchain certificate to calculate the digital signature of the authentication message m1, and obtains d. A ; The sending device sends authentication messages m1,d A Give it to the receiving device.

4. The blockchain-based multi-domain embedded device digital identity trusted access method according to claim 1, characterized in that, The receiving device calculates a digital signature using the private key corresponding to the blockchain certificate and sends the authentication message to the sending device, including: The receiving device samples a random number y from a non-zero integer ring modulo q based on the group generator g and the order q preset by the system. The operation g is calculated based on the system's preset group definition. y Read the private key b corresponding to the local blockchain certificate; Calculate the session key sk = H((g) x pk A ) (y+b) ); Calculate E using the system's preset symmetric encryption algorithm E. sk (0); Read local timestamp TS B The authentication message m2 = H(pk) is obtained. B )||g y ||E sk (0)||TS B ; The digital signature of m2 is calculated using the private key corresponding to the blockchain certificate, and d is obtained. B ; The receiving device sends authentication messages m2,d B To the sending device.

Images