A dual identity authentication method and system based on smart contracts

Abstract

The present invention proposes a dual identity authentication method and system based on smart contracts on-chain and off-chain. In view of the problem that user identity information is easily tampered with and confidentiality is difficult, the characteristics of the immutability of blockchain on-chain data and the credibility of smart contracts are fully utilized. On the one hand, the off-chain identity encryption + general program authentication process is weakened, and on the other hand, the identity authentication based on the on-chain smart contract is strengthened. By encrypting the identity data on the chain and the smart contract identity authentication based on the on-chain data, the credibility of the identity authentication process is improved to ensure that the user identity information cannot be tampered with. Under normal circumstances, the identity authentication of the user application process is separated from the user encrypted identity authentication process itself, and the identity authentication of the application process uses offline encrypted identity information; the user encrypted identity is periodically compared and verified on the chain and off-chain by sampling to ensure that the off-chain identity information is not tampered with.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain technology, and specifically is a dual identity authentication method based on smart contracts on-chain and off-chain Background Art

[0002] The known user identity information is generally obtained by encrypting the identity information. The user identity authentication process is completed by encrypting and decrypting the encrypted identity data according to the existing rules through a general program. The immutability of the user identity authentication process depends on two points. One is the immutability of the user identity encryption algorithm; the other is the immutability of the identity authentication program. In the general information system environment, these two conditions are difficult to absolutely ensure. With the popularization and application of blockchain, smart contracts, as a trusted program, rely on the redundant and distributed characteristics of blockchain data. It has its own natural immutability, which can better solve the second condition. In addition, the immutability of the data on the blockchain can also better solve the first condition. Summary of the invention

[0003] In view of the deficiencies in the prior art, the object of the present invention is to provide an on-chain and off-chain dual identity authentication method and system based on smart contracts.

[0004] A dual identity authentication method based on smart contracts on and off the chain, comprising the following steps:

[0005] Step S1: construct an identity authentication model, which includes a business system, an off-chain identity subsystem and an on-chain identity subsystem. The user identity management system of the off-chain identity subsystem updates the user identity database by registering user identity information and / or deleting user identity information in the user identity database;

[0006] Step S2: The user identity management system of the off-chain identity subsystem verifies the user identity information in the user identity database through the business system;

[0007] Step S3: The user identity management system of the off-chain identity subsystem randomly samples user identity information in the user identity database to verify credibility;

[0008] The user identity management system of the off-chain identity subsystem in step S1 updates the user identity database by registering user identity information and / or deleting user identity information in the user identity database; specifically:

[0009] When a user registers, the user identity management system generates a corresponding user identity certificate for the new user, stores the certificate in the user identity database, and synchronously calls the on-chain identity management module of the on-chain identity subsystem to store the user identity information on the chain. The on-chain storage specifically stores the user identity information in the blockchain cluster. When a user logs out, the user identity management system of the off-chain identity subsystem deletes the corresponding user identity certificate for the logged-out user, and the on-chain user identity information in the blockchain cluster remains unchanged, thereby ensuring that the user identity information cannot be tampered with.

[0010] Furthermore, step S3 is specifically as follows:

[0011] Step S31: setting the sampling time interval;

[0012] Step S32: performing random sampling in the user identity database using random numbers at the sampling time interval of step S31, wherein the random numbers are generated by a random number table, random number dice or playing cards;

[0013] Step S33: If the number of user identity information obtained in step S32 is less than the preset threshold m, all of them are used as sampling points; otherwise, the number of sampling points is not less than n; where n <m;

[0014] Step S34: calling the smart contract to match the off-chain data with the on-chain data; the off-chain data is the sampled user identity information, and the on-chain data is the on-chain user identity information in the blockchain cluster;

[0015] Step S34 is specifically as follows:

[0016] Step S341: the smart contract module directly performs ciphertext matching;

[0017] Step S342: the smart contract module generates plain text according to the established decryption algorithm and performs matching;

[0018] Step S343: The smart contract module generates a hash value for matching;

[0019] Step S35: During the smart contract matching process of step S34, if it is found that the off-chain data and the on-chain data cannot match, an alarm will be immediately issued and recorded; if the match is successful, the sample number will be recorded.

[0020] Furthermore, random sampling is performed by random numbers in step S32; specifically:

[0021] Step S321: Obtain the total number of user identity information in the user identity database:

[0022] Step S322: numbering each user identity information in the user identity database;

[0023] Step S323: Generate a number of random numbers that are not greater than the total number of user identity information;

[0024] Step S324: using the random number obtained in step S323 as a serial number, and matching the corresponding user identity information in step S322;

[0025] Step S325: extract the corresponding user identity information in the matching step S322 as a random sampling sample.

[0026] Furthermore, in step S22, each user identity information in the user identity database is numbered; specifically:

[0027] Step S221: serialize each user identity information in the user identity database;

[0028] Step S222: number the matching methods of different types of user identity information in the user identity database, and select the matching method between off-chain data and on-chain data according to the number; specifically:

[0029] The user identity information number for sensitive information is a ciphertext matching method; sensitive information includes medical information and financial information;

[0030] The user identity information number of the online form-type information is a decryption matching method; the online form-type information includes library user information and system administrator information;

[0031] The user identity information number of the consistent information is a hash value matching method; the consistent information includes account information and password information.

[0032] Furthermore, sampling weights are allocated to user identity information of different types of information, and random sampling is performed on different types of user identity information according to the allocated weights.

[0033] A smart contract-based on-chain and off-chain dual identity authentication system, used for the above-mentioned smart contract-based on-chain and off-chain dual identity authentication method, the system comprising:

[0034] The off-chain identity subsystem includes a user identity management system and a user identity database. The user identity management system is used to store user identity information. The user identity management system is used to register and / or delete user identity information in the user identity database.

[0035] Business system, the off-chain identity subsystem is connected to the on-chain identity subsystem through the business system;

[0036] The on-chain identity subsystem includes an on-chain identity information management module, a smart contract module and a blockchain cluster. The on-chain identity information management module is used to store the registered user identity information on the blockchain cluster. The smart contract module is used to verify and match the user identity information in the user identity database and the user identity information in the blockchain cluster or to perform random sampling verification on the user identity information in the user identity database and the user identity information in the blockchain cluster.

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] The present invention aims to solve the problem that user identity information is easy to be tampered with and confidentiality is difficult to maintain. It makes full use of the characteristics of the immutability of blockchain data and the credibility of smart contracts, weakens the off-chain identity authentication process, that is, reduces the reliance on the traditional centralized identity authentication system, and strengthens the identity authentication based on the on-chain smart contract, thereby improving the credibility of the identity authentication process and ensuring that user identity information cannot be tampered with. Furthermore, by serializing the user identity information in the database to perform random sampling and assigning different matching methods to different types of user identity information, the verification efficiency is improved. Furthermore, by assigning weights to different types of user identity information, the flexibility of random sampling is also improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A structural principle diagram of an on-chain and off-chain dual identity authentication method based on smart contracts provided by the present invention. DETAILED DESCRIPTION

[0040] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, in the description of the present invention, it should be noted that the terms "center", "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside" and the like indicate the orientation or position relationship based on the orientation or position relationship shown in the accompanying drawings, which is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In addition, the terms "No. 1", "No. 2" and "No. 3" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. The present invention is further explained below in conjunction with specific embodiments.

[0041] See also Figure 1 , a dual identity authentication method based on smart contracts on-chain and off-chain, in one example, includes the following steps:

[0042] Step S1: construct an identity authentication model, which includes a business system, an off-chain identity subsystem and an on-chain identity subsystem. The user identity management system of the off-chain identity subsystem updates the user identity database by registering user identity information and / or deleting user identity information in the user identity database;

[0043] Step S2: The user identity management system of the off-chain identity subsystem verifies the user identity information in the user identity database through the business system;

[0044] Step S3: The user identity management system of the off-chain identity subsystem randomly samples user identity information in the user identity database to verify credibility;

[0045] The user identity management system of the off-chain identity subsystem in step S1 updates the user identity database by registering user identity information and / or deleting user identity information in the user identity database; specifically:

[0046] When a user registers, the user identity management system generates a corresponding user identity certificate for the new user, stores the certificate in the user identity database, and synchronously calls the on-chain identity management module of the on-chain identity subsystem to store the user identity information on the chain. The on-chain storage specifically stores the user identity information in the blockchain cluster. When a user logs out, the user identity management system of the off-chain identity subsystem deletes the corresponding user identity certificate for the logged-out user, and the on-chain user identity information in the blockchain cluster remains unchanged, thereby ensuring that the user identity information cannot be tampered with.

[0047] In order to ensure that the user identity information cannot be tampered with, the present invention proposes a random sampling off-chain and on-chain data trust verification process. By considering the tampering of user identity information as a low-probability event, each tampering of user identity occurs independently. According to the law of large numbers, when the amount of user identity information is greater than a certain scale, it can be regarded as a normal distribution. Based on the above reasons, sampling detection can be used to verify on-chain and off-chain data, and the sampling results can fully cover all data and have good representativeness.

[0048] Furthermore, in one example, step S3 is specifically:

[0049] Step S31: setting the sampling time interval;

[0050] Step S32: performing random sampling in the user identity database using random numbers at the sampling time interval of step S31, wherein the random numbers are generated by a random number table, random number dice or playing cards;

[0051] Step S33: If the number of user identity information obtained in step S32 is less than the preset threshold m, all of them are used as sampling points; otherwise, the number of sampling points is not less than n; where n <m;

[0052] Step S34: calling the smart contract to match the off-chain data with the on-chain data; the off-chain data is the sampled user identity information, and the on-chain data is the on-chain user identity information in the blockchain cluster;

[0053] Step S34 is specifically as follows:

[0054] Step S341: the smart contract module directly performs ciphertext matching;

[0055] Step S342: the smart contract module generates plain text according to the established decryption algorithm and performs matching;

[0056] Step S343: The smart contract module generates a hash value for matching;

[0057] Step S35: During the smart contract matching process of step S34, if it is found that the off-chain data and the on-chain data cannot match, an alarm will be immediately issued and recorded; if the match is successful, the sample number will be recorded.

[0058] Furthermore, random sampling is performed by random numbers in step S32; specifically:

[0059] Step S321: Obtain the total number of user identity information in the user identity database:

[0060] Step S322: numbering each user identity information in the user identity database;

[0061] Step S323: Generate a number of random numbers that are not greater than the total number of user identity information;

[0062] Step S324: using the random number obtained in step S323 as a serial number, and matching the corresponding user identity information in step S322;

[0063] Step S325: extract the corresponding user identity information in the matching step S322 as a random sampling sample.

[0064] A dual identity authentication system based on a smart contract and on-chain, used for the above-mentioned dual identity authentication method based on a smart contract and on-chain, in one example, the system includes:

[0065] The off-chain identity subsystem includes a user identity management system and a user identity database. The user identity management system is used to store user identity information. The user identity management system is used to register and / or delete user identity information in the user identity database.

[0066] Business system, the off-chain identity subsystem is connected to the on-chain identity subsystem through the business system;

[0067] The on-chain identity subsystem includes an on-chain identity information management module, a smart contract module and a blockchain cluster. The on-chain identity information management module is used to store the registered user identity information on the blockchain cluster. The smart contract module is used to verify and match the user identity information in the user identity database and the user identity information in the blockchain cluster or to perform random sampling verification on the user identity information in the user identity database and the user identity information in the blockchain cluster.

[0068] The verification process of user identity information during the user application business system is the same as the normal user identity information verification process, which is completed through ordinary procedures based on the identity information in the off-chain database to complete the encryption and decryption process and matching authentication process. This can effectively ensure the authentication efficiency of user identity information.

[0069] In summary, through this random sampling detection method of on-chain and off-chain user identity information, on the one hand, the immutability of the blockchain ensures the immutability of the user identity encryption algorithm; on the other hand, the credibility of the smart contract ensures the immutability of the identity authentication program, thereby effectively ensuring the credibility and immutability of the user identity authentication process. At the same time, this method can also ensure the real-time and high availability of the user identity authentication process.

[0070] Furthermore, in step S22, each user identity information in the user identity database is numbered; specifically:

[0071] Step S221: serialize each user identity information in the user identity database;

[0072] Step S222: number the matching methods of different types of user identity information in the user identity database, and select the matching method between off-chain data and on-chain data according to the number; specifically:

[0073] The user identity information number for sensitive information is a ciphertext matching method; sensitive information includes medical information and financial information;

[0074] The user identity information number of the online form-type information is a decryption matching method; the online form-type information includes library user information and system administrator information;

[0075] The user identity information number of the consistent information is a hash value matching method; the consistent information includes account information and password information.

[0076] Furthermore, sampling weights are allocated to user identity information of different types of information, and random sampling is performed on different types of user identity information according to the allocated weights.

[0077] The specific implementation modes as described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation mode of the present invention and is not intended to limit the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A dual identity authentication method based on smart contracts, characterized in that: The following steps are involved: Step S1: construct an identity authentication model, which includes a business system, an off-chain identity subsystem and an on-chain identity subsystem. The user identity management system of the off-chain identity subsystem updates the user identity database by registering user identity information and / or deleting user identity information in the user identity database; Step S2: The user identity management system of the off-chain identity subsystem verifies the user identity information in the user identity database through the business system; Step S3: The user identity management system of the off-chain identity subsystem randomly samples user identity information in the user identity database to verify credibility; The user identity management system of the off-chain identity subsystem in step S1 updates the user identity database by registering user identity information and / or deleting user identity information in the user identity database; specifically: When a user registers, the user identity management system generates a corresponding user identity certificate for the new user, stores the certificate in the user identity database, and synchronously calls the on-chain identity management module of the on-chain identity subsystem to store the user identity information on the chain. The on-chain storage specifically stores the user identity information in the blockchain cluster. When a user logs out, the user identity management system of the off-chain identity subsystem deletes the corresponding user identity certificate for the logged-out user, and the on-chain user identity information in the blockchain cluster remains unchanged, thereby ensuring that the user identity information cannot be tampered with.

2. According to claim 1, a dual identity authentication method based on smart contracts on the chain and off the chain, characterized in that: Step S3 is specifically as follows: Step S31: setting the sampling time interval; Step S32: performing random sampling in the user identity database using random numbers at the sampling time interval of step S31, wherein the random numbers are generated by a random number table, random number dice or playing cards; Step S33: If the amount of user identity information obtained in step S32 is less than a preset threshold m, all of them are used as sampling points; Otherwise, the number of sampling points shall be no less than n, where n <m; Step S34: calling the smart contract to match the off-chain data with the on-chain data; the off-chain data is the sampled user identity information, and the on-chain data is the on-chain user identity information in the blockchain cluster; Step S34 is specifically as follows: Step S341: the smart contract module directly performs ciphertext matching; Step S342: the smart contract module generates plain text according to the established decryption algorithm and performs matching; Step S343: The smart contract module generates a hash value for matching; Step S35: During the smart contract matching process of step S34, if it is found that the off-chain data and the on-chain data cannot match, an alarm will be immediately issued and recorded; if the match is successful, the sample number will be recorded.

3. According to claim 2, a dual identity authentication method based on smart contracts on the chain and off the chain, characterized in that: The random sampling by random numbers in step S32 is specifically: Step S321: Obtain the total number of user identity information in the user identity database: Step S322: numbering each user identity information in the user identity database; Step S323: Generate a number of random numbers that are not greater than the total number of user identity information; Step S324: using the random number obtained in step S323 as a serial number, and matching the corresponding user identity information in step S322; Step S325: extract the corresponding user identity information in the matching step S322 as a random sampling sample.

4. According to claim 3, a dual identity authentication method based on smart contracts on the chain and off the chain, characterized in that: Step S22 is to number each user identity information in the user identity database; specifically: Step S221: serialize each user identity information in the user identity database; Step S222: number the matching methods of different types of user identity information in the user identity database, and select the matching method between off-chain data and on-chain data according to the number; specifically: The user identity information number for sensitive information is a ciphertext matching method; sensitive information includes medical information and financial information; The user identity information number of the online form-type information is a decryption matching method; the online form-type information includes library user information and system administrator information; The user identity information number of the consistent information is a hash value matching method; the consistent information includes account information and password information.

5. According to claim 4, a dual identity authentication method based on smart contracts on the chain and off the chain, characterized in that: Sampling weights are assigned to user identity information of different types of information, and different types of user identity information are randomly sampled according to the assigned weights.

6. A dual identity authentication system based on smart contracts, used for the dual identity authentication method based on smart contracts as claimed in any one of claims 1 to 5, characterized in that: The system comprises: The off-chain identity subsystem includes a user identity management system and a user identity database. The user identity management system is used to store user identity information. The user identity management system is used to register and / or delete user identity information in the user identity database. Business system, the off-chain identity subsystem is connected to the on-chain identity subsystem through the business system; The on-chain identity subsystem includes an on-chain identity information management module, a smart contract module and a blockchain cluster. The on-chain identity information management module is used to store the registered user identity information on the blockchain cluster. The smart contract module is used to verify and match the user identity information in the user identity database and the user identity information in the blockchain cluster or to perform random sampling verification on the user identity information in the user identity database and the user identity information in the blockchain cluster.

Images