Internet of vehicles identity cross-domain authentication system based on block chain

Abstract

The invention relates to the technical field of Internet of Vehicles, in particular to an Internet of Vehicles identity cross-domain authentication system based on a block chain. The system comprises an identity management module, a block chain network module, an authentication service module and a data sharing module. The existence of dictionary attack resistance and brute force attack resistance has no influence on the validity of the signature result, so that when the signature request passes verification, the signature request frequency and the random number generation mode are further monitored in real time through the monitoring unit, frequent signature requests and abnormal random number generation are found and early warned in time, and the verification efficiency of the signature request is improved. The internet-of-vehicles system can be effectively prevented from being illegally accessed through biological feature verification, the security of the system is further improved, cross-domain identity authentication is achieved through the block chain technology, interoperability and data sharing between different trust domains are supported, and the security of the internet-of-vehicles system is improved. And the vehicle user can complete cross-domain authentication only by sending the obtained certificate, so that the authentication process is simplified.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Vehicles, and in particular to an Internet of Vehicles identity cross-domain authentication system based on blockchain. Background Art

[0002] The Internet of Vehicles is a system that uses moving vehicles as sensing objects. Different areas are divided according to geographical locations. Each area is independent of each other and managed by their own trusted organizations. With the help of communication technology, network connections between vehicles and cloud platforms, vehicles and vehicles, vehicles and roads, and vehicles and people are achieved, thereby improving traffic operation efficiency. Blockchain is a chain data structure that generates and combines blocks in chronological order. It has the characteristics of being tamper-proof, transaction searchable, highly secure, and highly private. With the continuous development of blockchain technology, blockchain technology is increasingly being used in the field of authentication.

[0003] With the rapid increase in the number and popularity of Internet of Vehicles application services and the continuous increase in the number of users, the security of the Internet of Vehicles environment is an issue that needs attention. For the Internet of Vehicles system, there is a risk of vehicle information being stolen and tampered with, which further affects the healthy operation of the Internet of Vehicles system. Smart vehicles have the ability to communicate with other entities in the network and can share information such as vehicle status, road conditions, and traffic events with other vehicles, which enables drivers to obtain real-time traffic information, thereby planning the best driving route, improving driving experience and safety, and effectively avoiding traffic congestion and accidents. However, while the Internet of Vehicles brings convenience to people's lives, it also brings new hidden dangers. The openness of its communication makes the network vulnerable to malicious attacks by adversaries, which poses a huge threat to the safe operation of the network and the privacy of users. Anonymous authentication schemes allow vehicles to authenticate their identities without leaking privacy, which has positive significance for the development and application of the Internet of Vehicles.

[0004] The Chinese patent document with publication number CN119364359A discloses a lightweight cross-domain identity authentication method and system in a vehicle networking environment, the method comprising: a vehicle and each roadside unit register with a trusted institution; the vehicle and the first roadside unit mutually authenticate to establish a first communication key; the vehicle to be cross-domain sends a cross-domain notification to the first roadside unit using the first communication key, and the first roadside unit sends the cross-domain notification to the second roadside unit; the second roadside unit determines whether it is the first time to communicate with the vehicle to be cross-domain based on the cross-domain notification; if so, the second roadside unit obtains the authentication parameters of the vehicle to be cross-domain; if not, the second roadside unit reads the authentication parameters of the vehicle to be cross-domain; the vehicle to be cross-domain drives to the domain of the second roadside unit, and the vehicle to be cross-domain and the second roadside unit mutually authenticate to establish a second communication key based on the authentication parameters; it can be seen that existing authentication schemes, such as schemes based on public key infrastructure and schemes based on identity, have difficulties in maintaining certificate revocation lists and problems of key and pseudonym hosting, respectively. In addition, the privacy issues of centralized management and cross-domain authentication have greatly restricted the development of the Internet of Vehicles. Moreover, the signature verification process of the existing cross-domain authentication system lacks the monitoring results of the signature process, making it difficult to timely detect the existence of anti-dictionary attacks and anti-brute force attacks, resulting in low authentication security. Summary of the invention

[0005] To this end, the present invention provides a cross-domain vehicle network identity authentication system based on blockchain to overcome the problem in the prior art that the system lacks verification in the digital signature process and is difficult to effectively prevent dictionary attacks and brute force attacks, resulting in low system security.

[0006] To achieve the above purpose, the present invention provides a blockchain-based cross-domain vehicle network identity authentication system. An identity management module, which is used to store and manage the identity information of vehicles and users; A blockchain network module, which is used to store the identity identifiers of each vehicle and user in the form of blockchain certificates, and store access records on the blockchain; An authentication service module, which is used to receive cross-domain authentication requests from vehicles and users, and authenticate the cross-domain authentication requests. After the authentication is passed, the vehicle and the user are allowed to access the requested service; Among them, by analyzing the real-time request frequency and the real-time request frequency change rate, it is determined whether frequent signature requests and frequent signature request risks occur, and whether the authentication is passed based on the verification results and monitoring results; A data sharing module is connected to the authentication service module to monitor in real time the cross-domain identity authentication and service access status issued by each vehicle user, determine the frequency of completing cross-domain transmission based on the access records, and adjust the number of node deployments of the blockchain based on the frequency of completing cross-domain transmission.

[0007] Furthermore, the authentication service module includes a sending unit, a receiving unit, a monitoring unit and a detection unit, wherein: The sending unit is used to enable the sender to sign the message content using its private key, generate a digital signature, and send the message and the digital signature to the recipient; The receiving unit is used to verify the digital signature using the public key of the sender to obtain a verification result, including a first verification result and a second verification result; The monitoring unit is used to monitor the digital signature process in real time and obtain monitoring results; The detection unit is used to determine whether the authentication is passed based on the first verification result and the monitoring result, and to determine whether the authentication is passed based on the second verification result and the biometric verification.

[0008] Furthermore, the verification process of the receiving unit includes: Use the public key to decrypt the signature of the received message content to obtain the original message digest; Calculate the hash value of the message content based on the original message digest and the hash function to obtain the current message digest; Compare the byte contents of the original message digest and the current message digest to obtain the verification result.

[0009] Furthermore, the verification result includes a first verification result and a second verification result, wherein: The first verification result is that the byte contents of the original message digest and the current message digest are consistent; The second verification result is that the byte contents of the original message digest and the current message digest are inconsistent.

[0010] Furthermore, the monitoring unit includes a recording subunit, a first monitoring subunit and a second monitoring subunit, wherein: The recording subunit is used to record the timestamp, random number and signature result of each signature; The first monitoring subunit is used to determine whether frequent signature requests occur based on the real-time request frequency, and determine whether frequent signature request risks occur based on the real-time request frequency change rate; The second monitoring subunit is used to analyze whether the generation mode of the random number is abnormal.

[0011] Furthermore, the first monitoring subunit determines whether frequent signature requests occur based on the real-time request frequency, including: Analyze the timestamps of signature requests at standard monitoring periods; Calculate the number of signature requests within the standard monitoring period based on the timestamp to obtain the real-time request frequency; Compare the real-time request frequency with the signature request threshold, When the real-time request frequency is greater than the signature request threshold, it is determined that frequent signature requests occur; When the real-time request frequency is less than or equal to the signature request threshold, whether a frequent signature request risk occurs is determined based on the real-time request frequency change rate.

[0012] Furthermore, the first monitoring subunit determines whether a frequent signature request risk occurs based on the real-time request frequency change rate, including: Draw a curve of real-time request frequency versus unit time; Get the slope of the change curve and obtain the real-time request frequency change rate; Compare the real-time request frequency change rate with the standard request frequency change rate, When the real-time request frequency change rate is greater than the standard request frequency change rate, it is determined that there is a risk of frequent signature requests; When the real-time request frequency change rate is less than or equal to the standard request frequency change rate, it is determined that there is no risk of frequent signature requests.

[0013] Further, determining whether the authentication is passed based on the second verification result and the biometric verification includes, Collect the user's biometrics and compare them with the information stored in the identity management module. If the biometrics match, authentication is passed and access is allowed; If the biometrics do not match, access is denied; Among them, biometrics include fingerprint information and voice information.

[0014] Further, determining the frequency of completing the cross-domain transmission based on the access record includes: Get the time period between the request initiation time and the completion time; Divide the period into time windows of fixed length; For each time window, determining an access mode based on a total cross-domain transmission number and a standard cross-domain transmission number, including a first access mode and a second access mode; In the first access mode, the frequency of completing the cross-domain transmission is calculated; The frequency of completing cross-domain transmission is the ratio of the number of cross-domain transmissions of the user within the time window to the length of the time window. The first access mode is a high-frequency access mode, and the second access mode is a low-frequency access mode.

[0015] Furthermore, the number of nodes deployed in the blockchain is adjusted based on the frequency of completing cross-domain transmission, including: When the frequency of completing cross-domain transmission is greater than the frequency threshold, increase the number of blockchain nodes deployed; When the frequency of completing cross-domain transmission is less than or equal to the frequency threshold, reduce the number of deployed blockchain nodes.

[0016] Compared with the prior art, the beneficial effect of the present invention is that by adopting a cryptographic hash algorithm with strong anti-collision properties and utilizing the distributed structure and consensus mechanism of the blockchain, it is possible to effectively resist collision attacks and ensure the security of the system and the integrity of the data. When performing cross-domain authentication, the vehicle will use its private key to sign the sent information. The signature is a unique identifier generated based on the vehicle private key and the message content, which is non-repudiation and uniqueness. After receiving the information, the receiver can use the sender's public key to verify the signature, thereby confirming the legitimacy of the source of the information. Since the existence of anti-dictionary attack and anti-brute force attack has no effect on the validity of the signature result, when the signature request verification is passed, the signature request frequency and the random number generation mode are further monitored in real time by the monitoring unit, and frequent signature requests and abnormal random number generation are timely discovered and warned to prevent private key leakage and signature forgery. Biometric verification can effectively prevent illegal access to the Internet of Vehicles system, further improving the security of the system. Through real-time monitoring and dynamic adjustment, the stability and efficiency of the system in high concurrency scenarios are ensured. Blockchain technology is used to realize cross-domain identity authentication, and interoperability and data sharing between different trust domains are supported. Vehicle users only need to send previously obtained credentials to complete cross-domain authentication, simplifying the authentication process.

[0017] Furthermore, by combining digital signature verification and biometric verification, the security of the system can be effectively improved. In the event of digital signature verification failure, biometric verification provides an additional means of identity confirmation to ensure that only legitimate users can access the system.

[0018] Furthermore, the original message digest is processed by a hash function to obtain the current information digest, so that the decrypted digest is compared byte by byte with the calculated digest. If the byte contents of the two are exactly the same, it means that the byte contents of the original message digest and the current information digest are consistent. At this time, the message may not have been tampered with and the signature is valid. However, if there is resistance to dictionary attacks and brute force cracking attacks, the attack principles of dictionary attacks and brute force cracking are to try all combination passwords. Assuming that A has cracked the login passwords of users and vehicles through some attack methods, the sender's private key can be successfully cracked, thereby forging a signature, making the signature of any message look valid. Therefore, the digital signature process is monitored by a monitoring unit to determine whether there is frequent signing, so as to determine whether there is a situation and risk of an attacker cracking the private key; if the byte contents of the two are inconsistent, it is determined that the byte contents of the original message digest and the current information digest are inconsistent. In this case, biometrics are used for comparison to determine whether the access is normal. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1This is a schematic diagram of the structure of a cross-domain Internet of Vehicles identity authentication system based on blockchain according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of the authentication service module according to an embodiment of the present invention; Figure 3 A schematic diagram of the structure of a monitoring unit according to an embodiment of the present invention; Figure 4 The figure is a flow chart of determining whether frequent signature requests occur based on the real-time request frequency according to an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0021] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0022] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0023] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0024] See also Figure 1 As shown, it is a structural diagram of a vehicle networking identity cross-domain authentication system based on blockchain according to an embodiment of the present invention. The present invention provides a vehicle networking identity cross-domain authentication system based on blockchain, including: An identity management module, which is used to store and manage the identity information of vehicles and users, including vehicle identifiers, user information, and certificates; A blockchain network module, which is used to store the identity identifiers of each vehicle and user in the form of blockchain certificates, and store access records on the blockchain; An authentication service module, which is used to receive cross-domain authentication requests from vehicles and users, and authenticate the cross-domain authentication requests. After the authentication is passed, the vehicle and the user are allowed to access the requested service; The data sharing module is connected to the authentication service module to monitor the cross-domain identity authentication and service access status issued by each vehicle user in real time, determine the frequency of completing cross-domain transmission based on the access records, and adjust the number of node deployments of the blockchain according to the frequency of completing cross-domain transmission.

[0025] In this embodiment, a decentralized blockchain network is established in which all participants (such as vehicles, service providers, users, etc.) can interact, and vehicle manufacturers register the identity information of new vehicles on the blockchain, including vehicle identification numbers (VIN), manufacturer information, owner information, etc.

[0026] By adopting a cryptographic hash algorithm with strong anti-collision properties and utilizing the distributed structure and consensus mechanism of blockchain, it is possible to effectively resist collision attacks and ensure the security of the system and the integrity of the data. When performing cross-domain authentication, the vehicle will use its private key to sign the information sent. The signature is a unique identifier generated based on the vehicle private key and the message content, which is non-repudiation and unique. After receiving the information, the receiver can use the sender's public key to verify the signature, thereby confirming the legitimacy of the source of the information. Since the existence of anti-dictionary attack and anti-brute force attack has no effect on the validity of the signature result, when the signature request verification is passed, the signature request frequency and random number generation mode are further monitored in real time through the monitoring unit, and frequent signature requests and abnormal random number generation are timely discovered and warned to prevent private key leakage and signature forgery. Biometric verification can effectively prevent illegal access to the Internet of Vehicles system, further improving the security of the system. Through real-time monitoring and dynamic adjustment, the stability and efficiency of the system in high concurrency scenarios are ensured. Blockchain technology is used to achieve cross-domain identity authentication, supporting interoperability and data sharing between different trust domains. Vehicle users only need to send previously obtained credentials to complete cross-domain authentication, simplifying the authentication process.

[0027] See also Figure 2 As shown, it is a schematic diagram of the structure of the authentication service module of an embodiment of the present invention; Specifically, the authentication service module includes a sending unit, a receiving unit, a monitoring unit and a detection unit, wherein: The sending unit is used to enable the sender to sign the message content using its private key, generate a digital signature, and send the message and the digital signature to the recipient; The receiving unit is used to verify the digital signature using the public key of the sender to obtain a verification result, including a first verification result and a second verification result; The monitoring unit is used to monitor the digital signature process in real time and obtain monitoring results; The detection unit is used to determine whether the authentication is passed based on the first verification result and the monitoring result, and to determine whether the authentication is passed based on the second verification result and the biometric verification.

[0028] In this embodiment, the system consists of a traffic control center, roadside units, vehicle users and a blockchain network. Through vehicle registration and credential feedback, that is, when the vehicle is registered, the roadside unit feeds back the vehicle's identification information to the vehicle user in the form of a credential. When the user's vehicle enters a new roadside unit, identity authentication is required. The vehicle only needs to send the credentials obtained before, and it can obtain the required information after successful authentication. When the vehicle enters the roadside unit domain, the roadside unit will immediately lock the vehicle, that is, record the driving status of all vehicles entering the domain in real time. If the vehicle violates the rules or an accident occurs, the roadside unit will immediately obtain the information of the illegal vehicle and record it; if it is necessary to obtain the information of the vehicle in the roadside unit domain, the new roadside unit will authenticate the vehicle and the user to obtain the required information. For example, after the first successful authentication, the vehicle will feedback an identification containing the vehicle user information, by encrypting the vehicle identification information, encrypting it with the public key of the new roadside unit, generating a ciphertext, and sending the ciphertext to the new roadside unit. After receiving the ciphertext, the new roadside unit uses the private key to decrypt the ciphertext and verify the validity of the ciphertext. If the verification is successful, the new roadside unit generates a message request and signs the request with the private key to generate a signature, and then sends it to the roadside unit. When the roadside unit receives the signature from the new roadside unit, it uses the public key of the new roadside unit to verify the signature. If the verification is successful, the roadside unit will obtain the information of the vehicle in its domain and generate information. The roadside unit signs the information with its own private key, generates a signature, and sends it back to the new roadside unit. The signature received by the new roadside unit is verified using the public key of the roadside unit. If the verification is successful, the new roadside unit sends the extracted information to the vehicle user.

[0029] By combining digital signature verification and biometric verification, the security of the system can be effectively improved. In the event of digital signature verification failure, biometric verification provides an additional means of identity confirmation to ensure that only legitimate users can access the system.

[0030] Specifically, the verification process of the receiving unit includes: Use the public key to decrypt the signature of the received message content to obtain the original message digest; Calculate the hash value of the message content based on the original message digest and the hash function to obtain the current message digest; Compare the byte contents of the original message digest and the current message digest to obtain the verification result.

[0031] The original message digest is processed by a hash function to obtain the current message digest, and the decrypted digest is compared byte by byte with the calculated digest. If the byte contents of the two are exactly the same, it means that the byte contents of the original message digest and the current message digest are consistent. At this time, the message may not have been tampered with and the signature is valid. However, if there is resistance to dictionary attacks and brute force attacks, the attack principles of dictionary attacks and brute force attacks are to try all combination passwords. Assume that A has cracked the login passwords of users and vehicles through some attack methods, that is, the sender's private key can be successfully cracked, thereby forging a signature, making the signature of any message look valid. Therefore, the digital signature process is monitored by a monitoring unit to determine whether there is frequent signing, so as to determine whether there is a situation and risk of an attacker cracking the private key; if there is inconsistency in the byte contents of the two, it is determined that the byte contents of the original message digest and the current message digest are inconsistent. In this case, biometrics are used for comparison to determine whether the access is normal.

[0032] Specifically, the verification result includes a first verification result and a second verification result, wherein: The first verification result is that the byte contents of the original message digest and the current message digest are consistent; The second verification result is that the byte contents of the original message digest and the current message digest are inconsistent.

[0033] See also Figure 3 As shown, it is a schematic diagram of the structure of the monitoring unit according to an embodiment of the present invention; Specifically, the monitoring unit includes a recording subunit, a first monitoring subunit and a second monitoring subunit, wherein: The recording subunit is used to record the timestamp, random number and signature result of each signature; The first monitoring subunit is used to determine whether frequent signature requests occur based on the real-time request frequency, and determine whether frequent signature request risks occur based on the real-time request frequency change rate; The second monitoring subunit is used to analyze whether the generation mode of the random number is abnormal.

[0034] In this embodiment, pattern recognition technology is used to detect whether there are predictable or repeated patterns in the random number sequence. Repeated value detection is to check whether there are repeated values ​​in the random number sequence; abnormal patterns are the same random numbers appearing multiple times in a short period of time. Periodicity detection is to use Fourier transform or autocorrelation analysis to check whether there is periodicity in the random number sequence. The abnormal pattern is that the random number sequence shows obvious periodicity.

[0035] See also Figure 4 As shown, it is a flow chart of determining whether frequent signature requests occur based on real-time request frequency according to an embodiment of the present invention; Specifically, the first monitoring subunit determines whether frequent signature requests occur based on the real-time request frequency, including: Step S101, analyzing the timestamp of the signature request with a standard monitoring period; Step S102, calculating the number of signature requests within the standard monitoring period based on the timestamp to obtain the real-time request frequency; Step S103, comparing the real-time request frequency with the signature request threshold, and determining whether frequent signature requests occur based on the comparison result; When the real-time request frequency is greater than the signature request threshold, it is determined that frequent signature requests occur; When the real-time request frequency is less than or equal to the signature request threshold, whether a frequent signature request risk occurs is determined based on the real-time request frequency change rate.

[0036] In this embodiment, the standard monitoring period is set to 1 minute, and the signature request threshold is set to 5 times, which means that if the number of signature requests exceeds the set threshold in a short period of time, an attack is considered to exist. At the same time, the degree of change in the request frequency per unit time is analyzed to determine whether there is a risk of frequent signature requests. If the risk of frequent signature requests is detected, the alarm module triggers an alarm to notify the system administrator to conduct further investigation, thereby improving the timeliness of the early warning.

[0037] Specifically, the first monitoring subunit determines whether there is a risk of frequent signature requests based on the real-time request frequency change rate, including: Draw a curve of real-time request frequency versus unit time; Get the slope of the change curve and obtain the real-time request frequency change rate; Compare the real-time request frequency change rate with the standard request frequency change rate, When the real-time request frequency change rate is greater than the standard request frequency change rate, it is determined that there is a risk of frequent signature requests; When the real-time request frequency change rate is less than or equal to the standard request frequency change rate, it is determined that there is no risk of frequent signature requests.

[0038] In this embodiment, the standard request frequency change rate is a preset warning threshold of the request frequency growth rate, which is used to measure the abnormality of the request volume growth per unit time. It is used to identify whether there is a risk pattern of accelerated growth by monitoring the slope change of the request frequency curve. The set standard request frequency change rate is 2 times / minute. For example, in the current monitoring period, the request volume in the first minute is 3 times, the request volume in the second minute is 5 times, and the request volume in the third minute is 7 times. The change rate increases by 2 times per minute. The real-time request frequency change rate is 2 times / minute, and no alarm is triggered.

[0039] By monitoring the real-time request frequency change rate, we can prevent "slow start attacks" - attackers initially keep a low request volume to avoid threshold detection, and then suddenly accelerate to break through the defense. For example, in the credit card signature service, a normal user will not suddenly increase from 2 requests to 8 requests within 1 minute. This sudden change indicates an attack. Specifically, based on the second verification result and biometric verification, determining whether the authentication is passed includes: Collect the user's biometrics and compare them with the information stored in the identity management module. If the biometrics match, authentication is passed and access is allowed; If the biometrics do not match, access is denied; Among them, biometrics include fingerprint information and voice information.

[0040] In this embodiment, biometric matching is a process of comparing the biometric with the biometric template pre-stored in the system to determine whether the two belong to the same biological individual; when the attacker tries to access the system with the cracked password, the mobile device screen in the vehicle will display A's fingerprint information F, and the audio device will record the voice information V, which will be compared with the original information in the Internet of Vehicles system. Therefore, it is impossible for A to illegally access the Internet of Vehicles system by relying on only these two attack methods, thereby effectively preventing dictionary attacks and brute force attacks.

[0041] Specifically, the frequency of completing cross-domain transmission based on access records includes: Get the time period between the request initiation time and the completion time; Divide the period into time windows of fixed length; For each time window, determining an access mode based on a total cross-domain transmission number and a standard cross-domain transmission number, including a first access mode and a second access mode; In the first access mode, the frequency of completing the cross-domain transmission is calculated; The frequency of completing cross-domain transmission is the ratio of the number of cross-domain transmissions of the user within the time window to the length of the time window. The first access mode is a high-frequency access mode, and the second access mode is a low-frequency access mode.

[0042] The time window in this embodiment may be hourly, daily or weekly.

[0043] Specifically, the number of nodes deployed in the blockchain is adjusted based on the frequency of completing cross-domain transmissions, including: When the frequency of completing cross-domain transmission is greater than the frequency threshold, increase the number of blockchain nodes deployed; When the frequency of completing cross-domain transmission is less than or equal to the frequency threshold, reduce the number of deployed blockchain nodes.

[0044] In this embodiment, the time window set is 10 times / hour as the frequency threshold per hour. The number of deployed blockchain nodes is increased as the number of new nodes = the current number of nodes × (frequency of completing cross-domain transmission / frequency threshold), rounded up; the number of deployed blockchain nodes is reduced as the number of new nodes = the current number of nodes × (frequency of completing cross-domain transmission / frequency threshold), rounded down, but not less than the minimum value; for example, if the current number of nodes is 5 and the frequency of completing cross-domain transmission is 15 times / hour (exceeding the threshold by 50%), then the number of new nodes = 5×1015=7.5, rounded up to 8 nodes; if the current number of nodes is 5 and the frequency of completing cross-domain transmission is 8 times / hour (lower than the threshold by 20%), then the number of new nodes = 5×108=4, which is directly adjusted to 4 nodes (not less than the minimum value of 3).

[0045] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0046] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A blockchain-based cross-domain vehicle network identity authentication system, characterized in that: include, An identity management module, which is used to store and manage the identity information of vehicles and users; A blockchain network module, which is connected to the identity management module and is used to store the identity identifiers of each vehicle and user in the form of blockchain certificates, and to store access records on the blockchain; An authentication service module, which is used to receive cross-domain authentication requests from vehicles and users, and authenticate the cross-domain authentication requests. After the authentication is passed, the vehicle and the user are allowed to access the requested service; Among them, by analyzing the real-time request frequency and the real-time request frequency change rate, it is determined whether frequent signature requests and frequent signature request risks occur, and whether the authentication is passed based on the verification results and monitoring results; A data sharing module is connected to the blockchain network module and the authentication service module to monitor in real time the cross-domain identity authentication and service access status issued by each vehicle user, determine the frequency of completing cross-domain transmission based on the access records, and adjust the number of blockchain node deployments based on the frequency of completing cross-domain transmission.

2. The blockchain-based Internet of Vehicles identity cross-domain authentication system according to claim 1 is characterized in that: The authentication service module includes a sending unit, a receiving unit, a monitoring unit and a detection unit, wherein: The sending unit is used to enable the sender to sign the message content using its private key, generate a digital signature, and send the message and the digital signature to the recipient; The receiving unit is used to verify the digital signature using the public key of the sender to obtain a verification result, including a first verification result and a second verification result; The monitoring unit is used to monitor the digital signature process in real time and obtain monitoring results; The detection unit is used to determine whether the authentication is passed based on the first verification result and the monitoring result, and to determine whether the authentication is passed based on the second verification result and the biometric verification.

3. The blockchain-based cross-domain vehicle network identity authentication system according to claim 2 is characterized in that: The verification process of the receiving unit includes: Use the public key to decrypt the signature of the received message content to obtain the original message digest; Calculate the hash value of the message content based on the original message digest and the hash function to obtain the current message digest; Compare the byte contents of the original message digest and the current message digest to obtain the verification result.

4. The blockchain-based cross-domain vehicle network identity authentication system according to claim 3 is characterized in that: The verification result includes a first verification result and a second verification result, wherein: The first verification result is that the byte contents of the original message digest and the current message digest are consistent; The second verification result is that the byte contents of the original message digest and the current message digest are inconsistent.

5. The blockchain-based cross-domain vehicle network identity authentication system according to claim 4 is characterized in that: The monitoring unit includes a recording subunit, a first monitoring subunit and a second monitoring subunit, wherein: The recording subunit is used to record the timestamp, random number and signature result of each signature; The first monitoring subunit is used to determine whether frequent signature requests occur based on the real-time request frequency, and determine whether frequent signature request risks occur based on the real-time request frequency change rate; The second monitoring subunit is used to analyze whether the generation mode of the random number is abnormal.

6. The blockchain-based cross-domain vehicle network identity authentication system according to claim 5 is characterized in that: The first monitoring subunit determines whether frequent signature requests occur based on the real-time request frequency, including: Analyze the timestamps of signature requests at standard monitoring periods; Calculate the number of signature requests within the standard monitoring period based on the timestamp to obtain the real-time request frequency; Compare the real-time request frequency with the signature request threshold, When the real-time request frequency is greater than the signature request threshold, it is determined that frequent signature requests occur; When the real-time request frequency is less than or equal to the signature request threshold, whether a frequent signature request risk occurs is determined based on the real-time request frequency change rate.

7. The blockchain-based Internet of Vehicles identity cross-domain authentication system according to claim 6 is characterized in that: The first monitoring subunit determines whether there is a risk of frequent signature requests based on the real-time request frequency change rate, including: Draw a curve of real-time request frequency versus unit time; Get the slope of the change curve and obtain the real-time request frequency change rate; Compare the real-time request frequency change rate with the standard request frequency change rate, When the real-time request frequency change rate is greater than the standard request frequency change rate, it is determined that there is a risk of frequent signature requests; When the real-time request frequency change rate is less than or equal to the standard request frequency change rate, it is determined that there is no risk of frequent signature requests.

8. The blockchain-based Internet of Vehicles identity cross-domain authentication system according to claim 2 is characterized in that: Determining whether authentication is successful based on the second verification result and the biometric verification includes, Collect the user's biometrics and compare them with the information stored in the identity management module. If the biometrics match, authentication is passed and access is allowed; If the biometrics do not match, access is denied; Among them, biometrics include fingerprint information and voice information.

9. The blockchain-based Internet of Vehicles identity cross-domain authentication system according to claim 1 is characterized in that: The frequency of completing cross-domain transfers based on access records includes: Get the time period between the request initiation time and the completion time; Divide the period into time windows of fixed length; For each time window, determining an access mode based on a total cross-domain transmission number and a standard cross-domain transmission number, including a first access mode and a second access mode; In the first access mode, the frequency of completing the cross-domain transmission is calculated; The frequency of completing cross-domain transmission is the ratio of the number of cross-domain transmissions of the user within the time window to the length of the time window. The first access mode is a high-frequency access mode, and the second access mode is a low-frequency access mode.

10. The blockchain-based Internet of Vehicles identity cross-domain authentication system according to claim 1 is characterized in that: Adjusting the number of blockchain node deployments based on the frequency of completing cross-domain transmissions includes: When the frequency of completing cross-domain transmission is greater than the frequency threshold, increase the number of blockchain nodes deployed; When the frequency of completing cross-domain transmission is less than or equal to the frequency threshold, reduce the number of deployed blockchain nodes.

Images