Convenient cross-domain identity authentication system and method

Abstract

The invention discloses a convenient cross-domain identity authentication system and method, and aims to improve the safety and efficiency in an image and video sharing scene. The system is based on a block chain technology, realizes identity authentication and information sharing, and ensures data transmission security and identity authentication reliability. Through the steps of opening an account in a block chain, generating a temporary public and private key pair, issuing transaction information, verifying a user temporary identifier and the like, the system realizes accurate identification and authority control of a user identity, and meanwhile, the storage and computing resource requirements are reduced. The method is particularly suitable for a data sharing environment needing high security, and a secure and efficient data sharing platform is provided for users.

Description

Technical Field

[0001] The present invention relates to a convenient cross-domain identity authentication system, and also relates to a corresponding image sharing cross-domain identity authentication method / video sharing cross-domain identity authentication method, belonging to the technical field of network identity authentication. Background Art

[0002] Driven by the deep integration of informatization and networking, technologies such as the Internet of Things, mobile Internet, and industrial Internet have developed rapidly, marking that human society has fully entered the information age of "Internet of Everything". This era has brought new challenges such as openness, large-scale and complexity to information systems. The importance of network security is becoming increasingly prominent. It is not only related to national security strategy, but also involves personal data security, becoming a key support for the development of the information age. In this context, the establishment of trust relationships between network entities has become particularly critical, and it is the cornerstone for maintaining a safe and orderly cyberspace. Blockchain technology, with its characteristics of being tamper-proof, unforgeable and traceable, provides new ideas and solutions for the construction of a network trust system.

[0003] In the Chinese patent application with publication number CN118381635A, a cross-domain identity authentication method and system based on blockchain is disclosed. This technical solution establishes a secure network access channel between the browser used by the visitor and the enterprise intranet; verifies the information entered by the visitor by calling the account verification smart contract deployed on the alliance chain, and the smart contract connects to the database to verify whether the account password is correct; obtains the visitor's IP address, determines whether it is the first login from a new IP address, and uses identity recognition to re-confirm the visitor's identity; establishes a terminal management and control system on the server to improve the security of secure cross-domain login; establishes a data access permission control and audit mechanism; establishes a security assessment and vulnerability scanning mechanism, and continuously evaluates system security.

[0004] However, the above technical solution requires recording a large amount of account opening data in the blockchain system. Over time, the accumulation of this data will lead to an increasing demand for storage space. At the same time, the computing resources required to process this data will also increase, which will have an adverse impact on the scalability and performance of the blockchain system. Summary of the invention

[0005] The primary technical problem to be solved by the present invention is to provide a convenient cross-domain identity authentication system.

[0006] Another technical problem to be solved by the present invention is to provide a convenient image sharing cross-domain identity authentication method.

[0007] Another technical problem to be solved by the present invention is to provide a convenient video sharing cross-domain identity authentication method.

[0008] In order to achieve the above technical objectives, the present invention adopts the following technical solutions:

[0009] According to a first aspect of an embodiment of the present invention, a convenient cross-domain identity authentication system is provided, comprising: a resource management module, a business proxy module, a local domain user management module, an access control module, an external domain user authentication module, a trusted platform module, an encryption and decryption module, and a blockchain module;

[0010] The resource management module is responsible for sending a list of external resources to users in the domain, interacting with the blockchain module, receiving / sending domain resource information and external resource summary information; at the same time, the resource management module also communicates with the access control module, receives / sends resource management information, and sends access requests to the aforementioned business proxy module;

[0011] The business proxy module processes cross-domain access, receives and initiates external access requests, and receives / sends a temporary ID to the access control module;

[0012] The local domain user management module is responsible for receiving / sending login information of local domain users, and interacting with the access control module to receive permission information of local domain users and send login results of local domain users;

[0013] The external domain user authentication module cooperates with the access control module to receive the cross-domain authentication result and send a cross-domain authentication request; the external domain user authentication module also receives the cross-domain authentication request sent by the blockchain module, and sends the cross-domain authentication result to the outside;

[0014] The trusted platform module exchanges signature information with the access control module and is responsible for receiving / sending signature data;

[0015] The encryption and decryption module interacts with the access control module to receive / send data to be encrypted and decrypted;

[0016] The blockchain module is responsible for receiving / sending blockchain-related data with external systems.

[0017] Preferably, the resource management module includes a resource publishing submodule and a resource receiving submodule;

[0018] The resource publishing submodule publishes resources shared by the domain to the outside through the blockchain system; the resource receiving submodule receives resources from the outside domain through the blockchain system, and pushes all external resources accessible to the user in combination with the permissions of the users in the domain.

[0019] Preferably, the business proxy module includes: a GB / T 28181 protocol standard proxy submodule, a GA / T1400 protocol standard proxy submodule and a business submodule;

[0020] The business submodule interacts with users in this domain. On the one hand, it receives and modifies user requests and sends the modified request messages to the business submodule of the external domain peer system. On the other hand, it receives requests from the external domain and interacts with the GB / T 28181 protocol standard proxy submodule or the GB / T 28181 protocol standard proxy submodule according to the content of the request. The GB / T 28181 protocol standard proxy submodule and the GB / T 28181 protocol standard proxy submodule interact with the information system in this domain respectively.

[0021] Preferably, the local domain user management module includes an account management submodule and a password policy submodule;

[0022] The account management submodule is used to complete the account opening and account cancellation of individuals who need to access external resources; the password policy submodule is used to set the user's password complexity and password validity period policy.

[0023] Preferably, the access control module includes a permission management submodule and a user status management submodule;

[0024] The authority management submodule sets the authority for the users in the domain for use by the resource management module; the user status management submodule records the users who are in the logged-in state and generates a temporary identity for them.

[0025] Preferably, the external domain user authentication module includes a cross-domain user authentication submodule;

[0026] The cross-domain user authentication submodule receives a real identity request from the blockchain system, verifies the request message, interacts with the access control module to obtain the real identity, and sends a response message.

[0027] Preferably, the blockchain module includes a transaction information receiving submodule and a transaction information sending submodule;

[0028] The transaction information receiving submodule periodically obtains the latest transaction information from the blockchain system; the transaction information sending submodule sends the transaction information to the resource management module or the external domain user authentication module according to the type of transaction information, or publishes the transaction information through the blockchain system according to the interface information of the blockchain system.

[0029] Preferably, the trusted platform module is implemented by a CCM3310S-T chip.

[0030] According to a second aspect of an embodiment of the present invention, a convenient image sharing cross-domain identity authentication method is provided, wherein the shared information includes image data, and the method includes the following steps:

[0031] S1: Use the above cross-domain identity authentication system to complete the account opening in the blockchain system and save the authentication credentials returned by the blockchain system;

[0032] S2: The cross-domain identity authentication system uses the authentication credentials to log in to the blockchain system, generates a temporary public-private key pair, publishes the "public key-transaction information" through the blockchain system, and synchronizes data in the blockchain system;

[0033] S3: The cross-domain identity authentication system of the information sharing domain publishes externally accessible shared information through the blockchain and synchronizes data in the blockchain system;

[0034] S4: The user in the information receiving domain completes account opening in the cross-domain identity authentication system of the domain;

[0035] S5: The user in the information receiving domain logs into the cross-domain identity authentication system of the domain;

[0036] S6: The cross-domain identity authentication system of the information receiving domain returns a list of accessible external domain resources according to the user's authority;

[0037] S7: The user in the information receiving domain initiates a cross-domain access request for shared information;

[0038] S8: The cross-domain identity authentication system of the information receiving domain randomly generates a unique temporary ID for the user in this domain, and marks the date, time and validity period for the temporary ID to form a temporary identification, and signs the temporary identification with the temporary private key of the information receiving domain. The temporary identification and the wallet address of the information receiving domain are extended in the cross-domain access request message. The "user temporary identification-transaction information" is published through the blockchain system;

[0039] S9: The cross-domain identity authentication system of the information sharing domain finds the temporary public key according to the wallet address, and then uses the temporary public key to verify the temporary identity and obtain the temporary ID from it;

[0040] S10: Determine whether the signature verification is passed; if the signature verification is passed and the cross-domain identity authentication system needs to know the real identity of the external domain visitor, special transaction information is published through the blockchain; if the signature verification fails, an error report is returned to the information receiving domain;

[0041] S11: The information system in this domain opens access rights for the cross-domain identity authentication system of the information sharing domain. The cross-domain identity authentication system of the information sharing domain accesses the information system according to the GB / T28181 protocol standard or the GA / T 1400 protocol standard through the access rights and requests to obtain relevant shared information.

[0042] S12: The cross-domain identity authentication system of the information receiving domain receives a request to obtain the user's real identity from the blockchain system, and uses the private key to recover the temporary ID from the transaction content;

[0043] S13: The information system in this domain returns data to the cross-domain identity authentication system of the information sharing domain according to the request.

[0044] S14: The cross-domain identity authentication system of the information receiving domain uses the temporary public key of the cross-domain identity authentication system of the information sharing domain to encrypt the user's account, and then sends the ciphertext to the cross-domain identity authentication system of the information sharing domain in the form of an extended URL;

[0045] S15: The user in the information receiving domain receives the data.

[0046] According to a third aspect of an embodiment of the present invention, a convenient video sharing cross-domain identity authentication method is provided, comprising the following steps:

[0047] S01: Use the above cross-domain identity authentication system to complete account opening in the blockchain system and save the authentication credentials returned by the blockchain system;

[0048] S02: The cross-domain identity authentication system uses the authentication credentials to log in to the blockchain system, generates a temporary public-private key pair, publishes the "public key-transaction information" through the blockchain system, and synchronizes data in the blockchain system;

[0049] S03: The cross-domain identity authentication system of the information sharing domain publishes externally accessible shared information through the blockchain and synchronizes data in the blockchain system;

[0050] S04: The user in the information receiving domain completes account opening in the cross-domain identity authentication system of the domain;

[0051] S05: The user in the information receiving domain logs into the cross-domain identity authentication system of the domain;

[0052] S06: The cross-domain identity authentication system of the information receiving domain returns a list of accessible external domain resources according to the user's authority;

[0053] S07: A user in the information receiving domain initiates a cross-domain access request for shared information;

[0054] S08: The cross-domain identity authentication system of the information receiving domain randomly generates a unique temporary ID for the user in this domain, and marks the date, time and validity period for the temporary ID to form a temporary identifier. The temporary identifier is then signed using the temporary private key of the information receiving domain. The temporary identifier and the wallet address of the information receiving domain are extended in the cross-domain access request header field, and the "user temporary identifier-transaction information" is published through the blockchain.

[0055] S09: The cross-domain identity authentication system of the information sharing domain finds the temporary public key according to the wallet address, and then uses the temporary public key to verify the temporary identity and obtain the temporary ID from it;

[0056] S010: Determine whether the signature verification is passed; if the signature verification is passed and the cross-domain identity authentication system needs to know the real identity of the external domain visitor, special transaction information is published through the blockchain; if the signature verification fails, an error report is returned to the information receiving domain;

[0057] S011: The information system opens access rights for the cross-domain identity authentication system of the information sharing domain. The cross-domain identity authentication system of the information sharing domain accesses the information system through the access rights in accordance with the GB / T 28181 protocol standard or the GA / T 1400 protocol standard to request to obtain relevant shared information.

[0058] S012: The information system generates a response message according to the GB / T 28181 protocol and sends it to the cross-domain identity authentication system of the information sharing domain;

[0059] S013: The cross-domain identity authentication system of the information sharing domain forwards the response message to the cross-domain identity authentication system of the information receiving domain;

[0060] S014: The cross-domain identity authentication system of the information receiving domain forwards a response message to the user, and the user prepares to receive the video stream according to the information in the response message;

[0061] S015: The information system sends the video stream to the user in the information receiving domain;

[0062] S016: The cross-domain identity authentication system of the information receiving domain uses the temporary public key of the cross-domain identity authentication system of the information sharing domain to encrypt the user's account, and then sends the ciphertext to the cross-domain identity authentication system of the information sharing domain.

[0063] Compared with the prior art, the present invention realizes an efficient and secure identity authentication mechanism by constructing a cross-domain identity authentication system based on blockchain, and especially optimizes the sharing process of image and video data. The system uses the characteristics of blockchain that cannot be tampered with and transparency to provide a solid trust foundation for cross-domain identity authentication, and ensures the authenticity of user identity and reasonable control of access rights by generating temporary public and private key pairs, publishing transaction information, and verifying user temporary identification through blockchain. The present invention not only enhances the security of data sharing, but also effectively reduces the storage and computing burden of the blockchain system by reducing the necessary information storage on the blockchain. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 A system deployment diagram for implementing the present invention;

[0065] Figure 2 A schematic diagram of the structure of a cross-domain identity authentication system provided by an embodiment of the present invention;

[0066] Figure 3 An information interaction diagram of an image sharing cross-domain identity authentication method provided by an embodiment of the present invention;

[0067] Figure 4 An information interaction diagram of a video sharing cross-domain identity authentication method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0068] The technical content of the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0069] The present invention provides a convenient and secure cross-domain identity authentication system and method, which is particularly suitable for image and video sharing scenarios. The system implements identity authentication and information sharing through blockchain technology, ensuring the security of data transmission and the reliability of identity authentication. Figure 1 As shown in the figure, the system includes three main parts: information receiving domain, information sharing domain and blockchain, which are interconnected through the network. Among them, in the information receiving domain, the cross-domain identity authentication system is directly connected to the user network and is responsible for processing the user's identity authentication and information request. This domain sends a real identity response to the information sharing domain, and sends a wallet address and public key to the blockchain, and receives the wallet address and public key from the blockchain to ensure the security of the transaction. The information sharing domain includes a cross-domain identity authentication system and an information system, wherein the cross-domain identity authentication system is connected to the information system through the network to obtain data in the information system. In addition, the information sharing domain sends a wallet address, public key and real identity request to the blockchain, and receives the corresponding information from the blockchain.

[0070] Compared with the prior art, the main technical concept of the present invention is to use the immutability and transparency of blockchain to provide a decentralized trust foundation for cross-domain identity authentication. The corresponding cross-domain identity authentication system adopts a modular design, including resource management module, business proxy module, local domain user management module, access control module, external domain user authentication module, trusted platform module and encryption and decryption module, etc. Each module has specific functions and responsibilities, and works together to complete cross-domain identity authentication and information sharing.

[0071] In addition, the trusted platform module can be implemented using chips such as CCM3310S-T, CCM3310S-H and CCM3320S to provide hardware-level security protection, including key management, system integrity verification, digital signature and identity authentication, and other functions, thereby enhancing the security of the entire cross-domain identity authentication system. Through this design, the present invention not only improves the efficiency and security of cross-domain identity authentication, but also reduces the performance overhead of the blockchain system, because the blockchain system only stores the minimum necessary information. The present invention is particularly suitable for image and video sharing application scenarios that require high security and reliability, and can provide users with a convenient and secure data sharing platform.

[0072] First embodiment

[0073] like Figure 2 As shown, a convenient cross-domain identity authentication system provided by the first embodiment of the present invention includes: a resource management module, a business proxy module, a local domain user management module, an access control module, an external domain user authentication module, a trusted platform module, an encryption and decryption module and a blockchain module.

[0074] Among them, the resource management module is responsible for sending the external resource list to the users in this domain, and interacting with the blockchain module to receive / send the resource information in this domain and the summary information of external resources; at the same time, the resource management module also communicates with the access control module, receives / sends the resource management information, and sends the access request to the aforementioned business proxy module; the business proxy module handles cross-domain access, receives and initiates external access requests, and receives / sends the temporary ID to the access control module; the user management module in this domain is responsible for receiving / sending the login information of the users in this domain, and interacts with the access control module to receive the permission information of the users in this domain and send the login results of the users in this domain; the external domain user authentication module collaborates with the access control module to receive the cross-domain authentication results and send the cross-domain authentication requests; the external domain user authentication module also receives the cross-domain authentication requests sent by the blockchain module and sends the cross-domain authentication results to the outside; the trusted platform module exchanges signature information with the access control module and is responsible for receiving / sending signature data; the encryption and decryption module interacts with the access control module to receive / send the data to be encrypted and decrypted; the blockchain module is responsible for receiving / sending the blockchain-related data with the external system.

[0075] In one embodiment of the present invention, the resource management module includes: a resource publishing submodule and a resource receiving submodule. Among them, the resource publishing submodule publishes resources shared by the domain to the outside through the blockchain system. The resource receiving submodule receives resources from the external domain through the blockchain system, and pushes all external resources accessible to the user in combination with the permissions of the user in the domain.

[0076] In one embodiment of the present invention, the business proxy module includes: a GB / T 28181 protocol standard proxy submodule, a GA / T 1400 protocol standard proxy submodule and a business submodule. The business submodule interacts with users in the local domain, on the one hand, receives user requests, adds necessary information to the request message, and sends the modified request message to the business submodule of the external domain peer system. On the other hand, it receives requests from the external domain, and interacts with the GB / T 28181 protocol standard proxy submodule or the GB / T 28181 protocol standard proxy submodule according to the content of the request. The GB / T 28181 protocol standard proxy submodule and the GB / T 28181 protocol standard proxy submodule interact with the information system in the local domain respectively.

[0077] In one embodiment of the present invention, the domain user management module includes: an account management submodule and a password policy submodule. The account management submodule is used to complete the account opening and account cancellation of individuals who need to access external resources. The password policy submodule is used to set the user's password complexity and password validity period policy.

[0078] In one embodiment of the present invention, the access control module includes: a rights management submodule and a user status management submodule. The rights management submodule sets rights for users in the domain for use by the resource management module. The user status management submodule records users in the logged-in state and generates a temporary identity for them.

[0079] In one embodiment of the present invention, the external domain user authentication module includes: a cross-domain user authentication sub-module, which functions to receive a real identity request from the blockchain system, verify the request message, interact with the access control module to obtain the real identity, and send a response message.

[0080] The Trusted Platform Module is a microchip embedded in a hardware device such as a computer motherboard. It aims to enhance the security of the entire computer system by providing security-related functions, can provide hardware-level protection for sensitive data, keys and other information in the system, and can be used to verify the integrity of the system startup process, etc. In one embodiment of the present invention, the model of the microchip is CCM3310S-T (or CCM3310S-H, CCM3320S, etc., but not limited to this). CCM3310S-T is an automotive-grade security chip independently developed by Guoxin Technology. It uses a 32-bit CPU security core CS0 with independent intellectual property rights, has 32K bytes of SRAM, 16K bytes of ROM and 256K bytes of EFLASH storage resources, as well as DMA / EDMA, 2 timers, watchdog and timer modules. For further description of CCM3310S-T, please refer to the following link: http: / / www.fai thi ot.com / content s / 11 / 179.html, which will not be repeated here.

[0081] The main functions of the trusted platform module include: key management, system integrity verification, digital signature and identity authentication.

[0082] Among them, key management means that encryption keys can be securely generated, stored and managed within the trusted platform module. For example, it can generate symmetric keys for encrypting hard disk data, or asymmetric key pairs (public and private keys) for digital signatures and identity authentication. Since the keys are stored in a protected area inside the hardware, they are less likely to be stolen or tampered with than those stored at the software level, thereby improving the security of the keys.

[0083] System integrity verification means that when the computer starts, the trusted platform module can perform hash operations on key components in the startup process (such as BIOS, boot loader, operating system kernel, etc.), and compare the obtained hash value with the legal hash value pre-stored in the chip. If there is an inconsistency, it means that the system may have been tampered with. The trusted platform module can take corresponding measures, such as preventing the system from starting or issuing a warning to the administrator, to ensure that the system is started according to the trusted configuration.

[0084] Digital signature means: using the private key stored in it, the trusted platform module can digitally sign data, files, etc. to prove the source and integrity of the data. For example, in some scenarios where the authenticity of a document needs to be guaranteed, the recipient of the document signed by the trusted platform module can use the corresponding public key to verify the signature and confirm whether the document comes from a trusted source and has not been tampered with.

[0085] Identity authentication means that it can assist in the identity authentication of users or devices based on the information such as keys stored in it. For example, in an enterprise network environment, when a computer accesses the network, it can use the relevant information in the trusted platform module to prove its legitimacy to the server, thus achieving more secure and reliable network access.

[0086] In one embodiment of the present invention, the encryption and decryption module includes: an encryption submodule and a decryption submodule, which are used to encrypt plaintext data or decrypt ciphertext data. The blockchain module includes: a transaction information receiving submodule and a transaction information sending submodule. Among them, the transaction information receiving submodule periodically obtains the latest transaction information from the blockchain system. The transaction information sending submodule sends the transaction information to the resource management module or the external domain user authentication module according to the type of transaction information, or publishes the transaction information through the blockchain system according to the interface information of the blockchain system.

[0087] Second embodiment

[0088] like Figure 3 As shown, a convenient image sharing cross-domain identity authentication method provided by the second embodiment of the present invention uses image data as shared information and specifically includes the following steps:

[0089] S1: Use the above cross-domain identity authentication system to complete the account opening in the blockchain system, and save the authentication credentials returned by the blockchain system, namely the certificate and private key.

[0090] S2: The cross-domain identity authentication system uses the authentication credentials to log in to the blockchain system, generates a temporary public-private key pair, publishes the “public key-transaction information” through the blockchain system, and synchronizes data in the blockchain system.

[0091] In step S2, when the cross-domain identity authentication system attempts to log in to the blockchain system for the first time, it must publish its wallet address and a pair of temporary public and private keys by creating and publishing a transaction. In this transaction, the publisher and the receiver both refer to the same entity, namely the cross-domain identity authentication system itself that is logging in.

[0092] S3: The cross-domain identity authentication system of the information sharing domain publishes externally accessible shared information through the blockchain and synchronizes data in the blockchain system.

[0093] S4: The user in the information receiving domain completes account opening in the cross-domain identity authentication system of the domain.

[0094] S5: The user in the information receiving domain logs in to the cross-domain identity authentication system of the domain.

[0095] Step S5 describes the process of the user logging into the cross-domain identity authentication system. In this step, the authentication method is not limited to a specific mechanism, but can adopt any existing authentication method. For example, the traditional account plus password method can be used for authentication, or an authentication method based on biometrics, such as fingerprint recognition, can be used.

[0096] S6: The cross-domain identity authentication system of the information receiving domain returns a list of accessible external domain resources according to the user's permissions.

[0097] S7: The user in the information receiving domain initiates a cross-domain access request for shared information.

[0098] S8: The cross-domain identity authentication system of the information receiving domain randomly generates a unique temporary ID for the user in this domain, and marks the date, time and validity period for the temporary ID to form a temporary identification, and signs the temporary identification with the temporary private key of the information receiving domain. The temporary identification and the wallet address of the information receiving domain are extended in the cross-domain access request message, and the "user temporary identification-transaction information" is published through the blockchain system.

[0099] S9: The cross-domain identity authentication system of the information sharing domain finds the temporary public key according to the wallet address, uses the temporary public key to verify the temporary identification, and obtains the temporary ID from it.

[0100] S10: Determine whether the signature verification is passed. If the signature verification is passed and the cross-domain identity authentication system needs to know the true identity of the external domain visitor, special transaction information is published through the blockchain. If the signature verification fails, an error report is returned to the information receiving domain.

[0101] Step S10 involves a special transaction information processing method. In this step, the information sharing domain, as the sender, sends special transaction information to the information receiving domain. The content of this transaction is a temporary ID encrypted using the temporary public key of the information receiving domain. This design ensures the security and privacy of the information, because only the information receiving domain with the corresponding private key can decrypt and identify the real temporary ID.

[0102] S11: The information system in this domain opens access rights for the cross-domain identity authentication system of the information sharing domain. The cross-domain identity authentication system of the information sharing domain accesses the information system through the access rights in accordance with the GB / T28181 protocol standard or the GA / T 1400 protocol standard to request to obtain relevant shared information.

[0103] S12: The cross-domain identity authentication system of the information receiving domain receives a request to obtain the user's real identity from the blockchain system, and uses the private key to recover the temporary ID from the transaction content.

[0104] S13: The information system in this domain returns data to the cross-domain identity authentication system of the information sharing domain according to the request.

[0105] S14: The cross-domain identity authentication system of the information receiving domain uses the temporary public key of the cross-domain identity authentication system of the information sharing domain to encrypt the user's account, and then sends the ciphertext to the cross-domain identity authentication system of the information sharing domain by means of an extended URL.

[0106] S15: The user in the information receiving domain receives the data.

[0107] To sum up, the image sharing cross-domain identity authentication method provided by the second embodiment of the present invention ensures the security of image data during cross-domain transmission and the reliability of authentication through steps such as creating a temporary key pair, publishing shared information, generating and verifying a temporary ID, while reducing system performance overhead and improving authentication efficiency and the convenience of data sharing.

[0108] Third embodiment

[0109] like Figure 4 As shown, a convenient video sharing cross-domain identity authentication method provided by the third embodiment of the present invention uses video data as shared information, and specifically includes the following steps:

[0110] S01: Use the above cross-domain identity authentication system to complete account opening in the blockchain system, and save the authentication credentials returned by the blockchain system, namely the certificate and private key.

[0111] S02: The cross-domain identity authentication system uses the authentication credentials to log in to the blockchain system, generates a temporary public-private key pair, publishes the “public key-transaction information” through the blockchain system, and synchronizes data in the blockchain system.

[0112] Step S02 describes in detail the first interaction process between the cross-domain identity authentication system and the blockchain system. Specifically, when the cross-domain identity authentication system logs into the blockchain system for the first time, it needs to publish its wallet address and a pair of temporary public and private keys by creating and publishing a transaction. In this transaction, the identities of the publisher and the receiver refer to the same entity, that is, the cross-domain identity authentication system itself that performs the login operation.

[0113] S03: The cross-domain identity authentication system of the information sharing domain publishes externally accessible shared information through the blockchain and synchronizes data in the blockchain system.

[0114] S04: The user in the information receiving domain completes account opening in the cross-domain identity authentication system of the domain.

[0115] S05: The user in the information receiving domain logs in to the cross-domain identity authentication system of the domain.

[0116] Step S05 involves the process of the user logging into the cross-domain identity authentication system. In this step, the authentication method is not limited to a specific mechanism, but can adopt any existing authentication method. For example, the user can choose to use the traditional account plus password method for authentication, or can use an authentication method based on biometrics, such as fingerprint recognition.

[0117] S06: The cross-domain identity authentication system of the information receiving domain returns a list of accessible external domain resources according to the user's authority.

[0118] S07: The user in the information receiving domain initiates a cross-domain access request for shared information.

[0119] S08: The cross-domain identity authentication system of the information receiving domain randomly generates a unique temporary ID for the user in this domain, and marks the date, time and validity period for the temporary ID to form a temporary identification, and then signs the temporary identification with the temporary private key of the information receiving domain. In the cross-domain access request, the header field is extended to carry the temporary identification and the wallet address of the information receiving domain, and the "user temporary identification-transaction information" is published through the blockchain.

[0120] S09: The cross-domain identity authentication system of the information sharing domain finds the temporary public key according to the wallet address, and then uses the temporary public key to verify the temporary identification and obtain the temporary ID from it.

[0121] S010: Determine whether the signature verification is passed. If the signature verification is passed and the cross-domain identity authentication system needs to know the true identity of the external domain visitor, special transaction information will be published through the blockchain. If the signature verification fails, an error report will be returned to the information receiving domain.

[0122] Step S010 describes a special transaction information processing method. In this step, the information sharing domain acts as a sender and sends special transaction information to the information receiving domain. The request content of this transaction is a temporary ID encrypted using the temporary public key of the information receiving domain. This design ensures the security and privacy of the information, because only the information receiving domain with the corresponding private key can decrypt and identify the real temporary ID.

[0123] S011: The information system opens access rights for the cross-domain identity authentication system of the information sharing domain. The cross-domain identity authentication system of the information sharing domain accesses the information system through the access rights in accordance with the GB / T 28181 protocol standard or the GA / T 1400 protocol standard to request relevant shared information.

[0124] S012: The information system generates a response message according to the GB / T 28181 protocol and sends it to the cross-domain identity authentication system of the information sharing domain.

[0125] S013: The cross-domain identity authentication system of the information sharing domain forwards the response message to the cross-domain identity authentication system of the information receiving domain.

[0126] S014: The cross-domain identity authentication system of the information receiving domain forwards a response message to the user, and the user prepares to receive the video stream according to the information in the response message.

[0127] S015: The information system sends the video stream to the user in the information receiving domain.

[0128] S016: The cross-domain identity authentication system of the information receiving domain uses the temporary public key of the cross-domain identity authentication system of the information sharing domain to encrypt the user's account, and then sends the ciphertext to the cross-domain identity authentication system of the information sharing domain.

[0129] To sum up, the video sharing cross-domain identity authentication method provided in the third embodiment of the present invention implements the steps of user account opening, generating temporary public-private key pairs, publishing accessible video information, processing cross-domain access requests, and verifying user temporary IDs through blockchain technology, thereby ensuring the security of video data in cross-domain transmission and the reliability of authentication. At the same time, encryption technology is used to protect user account information, reduce the performance overhead of the blockchain system, and improve the efficiency and security of video sharing.

[0130] It should be noted that the above embodiments are only examples, and the technical solutions of the various embodiments can be combined, all within the protection scope of the present invention.

[0131] The above is a detailed description of the cross-domain identity authentication method and system provided by the present invention. For those skilled in the art, any obvious changes made to it without departing from the essence of the present invention will constitute an infringement of the patent right of the present invention and will bear corresponding legal responsibilities.

Claims

1. A convenient cross-domain identity authentication system, characterized by include: Resource management module, business proxy module, local domain user management module, access control module, external domain user authentication module, trusted platform module, encryption and decryption module and blockchain module; The resource management module is responsible for sending a list of external resources to users in the domain, interacting with the blockchain module, receiving / sending domain resource information and external resource summary information; at the same time, the resource management module also communicates with the access control module, receives / sends resource management information, and sends access requests to the aforementioned business proxy module; The business proxy module processes cross-domain access, receives and initiates external access requests, and receives / sends a temporary ID to the access control module; The local domain user management module is responsible for receiving / sending login information of local domain users, and interacting with the access control module to receive permission information of local domain users and send login results of local domain users; The external domain user authentication module cooperates with the access control module to receive the cross-domain authentication result and send a cross-domain authentication request; the external domain user authentication module also receives the cross-domain authentication request sent by the blockchain module, and sends the cross-domain authentication result to the outside; The trusted platform module exchanges signature information with the access control module and is responsible for receiving / sending signature data; The encryption and decryption module interacts with the access control module to receive / send data to be encrypted and decrypted; The blockchain module is responsible for receiving / sending blockchain-related data with external systems.

2. The cross-domain identity authentication system as claimed in claim 1, characterized in that The resource management module includes a resource publishing submodule and a resource receiving submodule; The resource publishing submodule publishes resources shared by the domain to the outside through the blockchain system; the resource receiving submodule receives resources from the outside domain through the blockchain system, and pushes all external resources accessible to the user in combination with the permissions of the users in the domain.

3. The cross-domain identity authentication system as claimed in claim 1, characterized in that The business proxy module includes: GB / T28181 protocol standard proxy submodule, GA / T 1400 protocol standard proxy submodule and business submodule; wherein, The business submodule interacts with users in this domain. On the one hand, it receives and modifies user requests and sends the modified request messages to the business submodule of the external domain peer system. On the other hand, it receives requests from the external domain and interacts with the GB / T 28181 protocol standard proxy submodule or the GB / T 28181 protocol standard proxy submodule according to the content of the request. The GB / T 28181 protocol standard proxy submodule and the GB / T 28181 protocol standard proxy submodule interact with the information system in this domain respectively.

4. The cross-domain identity authentication system as claimed in claim 1, characterized in that The local domain user management module includes an account management submodule and a password policy submodule; wherein, The account management submodule is used to complete the account opening and account cancellation of individuals who need to access external resources; the password policy submodule is used to set the user's password complexity and password validity period policy.

5. The cross-domain identity authentication system as claimed in claim 1, characterized in that The access control module includes a rights management submodule and a user status management submodule; wherein, The authority management submodule sets the authority for the users in the domain for use by the resource management module; the user status management submodule records the users who are in the logged-in state and generates a temporary identity for them.

6. The cross-domain identity authentication system as claimed in claim 1, characterized in that The external domain user authentication module includes a cross-domain user authentication submodule; wherein, The cross-domain user authentication submodule receives a real identity request from the blockchain system, verifies the request message, interacts with the access control module to obtain the real identity, and sends a response message.

7. The cross-domain identity authentication system as claimed in claim 1, characterized in that The blockchain module includes a transaction information receiving submodule and a transaction information sending submodule; wherein, The transaction information receiving submodule periodically obtains the latest transaction information from the blockchain system; the transaction information sending submodule sends the transaction information to the resource management module or the external domain user authentication module according to the type of transaction information, or publishes the transaction information through the blockchain system according to the interface information of the blockchain system.

8. The cross-domain identity authentication system as claimed in claim 1, characterized in that The trusted platform module is implemented by the CCM3310S-T chip.

9. A convenient cross-domain identity authentication method for image sharing, wherein the shared information includes image data, characterized in that The steps include: S1: Use the cross-domain identity authentication system described in any one of claims 1 to 8 to complete account opening in the blockchain system, and save the authentication credentials returned by the blockchain system; S2: The cross-domain identity authentication system uses the authentication credentials to log in to the blockchain system, generates a temporary public-private key pair, publishes "public key-transaction information" through the blockchain system, and synchronizes data in the blockchain system; S3: The cross-domain identity authentication system of the information sharing domain publishes externally accessible shared information through the blockchain and synchronizes data in the blockchain system; S4: The user in the information receiving domain completes account opening in the cross-domain identity authentication system of the domain; S5: The user in the information receiving domain logs into the cross-domain identity authentication system of the domain; S6: The cross-domain identity authentication system of the information receiving domain returns a list of accessible external domain resources according to the user's authority; S7: The user in the information receiving domain initiates a cross-domain access request for shared information; S8: The cross-domain identity authentication system of the information receiving domain randomly generates a unique temporary ID for the user in this domain, and marks the date, time and validity period for the temporary ID to form a temporary identification. The temporary identification is signed with the temporary private key of the information receiving domain, and the temporary identification and the wallet address of the information receiving domain are extended in the cross-domain access request message. The "user temporary identification-transaction information" is published through the blockchain system; S9: The cross-domain identity authentication system of the information sharing domain finds the temporary public key according to the wallet address, and then uses the temporary public key to verify the temporary identity and obtain the temporary ID from it; S10: Determine whether the signature verification is passed; if the signature verification is passed and the cross-domain identity authentication system needs to know the real identity of the external domain visitor, special transaction information is published through the blockchain; if the signature verification fails, an error report is returned to the information receiving domain; S11: The information system in this domain opens access rights for the cross-domain identity authentication system of the information sharing domain. The cross-domain identity authentication system of the information sharing domain accesses the information system according to the GB / T28181 protocol standard or the GA / T 1400 protocol standard through the access rights and requests to obtain relevant shared information. S12: The cross-domain identity authentication system of the information receiving domain receives a request to obtain the user's real identity from the blockchain system, and uses the private key to recover the temporary ID from the transaction content; S13: The information system in this domain returns data to the cross-domain identity authentication system of the information sharing domain according to the request. S14: The cross-domain identity authentication system of the information receiving domain uses the temporary public key of the cross-domain identity authentication system of the information sharing domain to encrypt the user's account, and then sends the ciphertext to the cross-domain identity authentication system of the information sharing domain in the form of an extended URL; S15: The user in the information receiving domain receives the data.

10. A convenient video sharing cross-domain identity authentication method, characterized in that The steps include: S01: Use the cross-domain identity authentication system described in any one of claims 1 to 8 to complete account opening in the blockchain system, and save the authentication credentials returned by the blockchain system; S02: The cross-domain identity authentication system uses the authentication credentials to log in to the blockchain system, generates a temporary public-private key pair, publishes "public key-transaction information" through the blockchain system, and synchronizes data in the blockchain system; S03: The cross-domain identity authentication system of the information sharing domain publishes externally accessible shared information through the blockchain and synchronizes data in the blockchain system; S04: The user in the information receiving domain completes account opening in the cross-domain identity authentication system of the domain; S05: The user in the information receiving domain logs into the cross-domain identity authentication system of the domain; S06: The cross-domain identity authentication system of the information receiving domain returns a list of accessible external domain resources according to the user's authority; S07: A user in the information receiving domain initiates a cross-domain access request for shared information; S08: The cross-domain identity authentication system of the information receiving domain randomly generates a unique temporary ID for the user in this domain, and marks the date, time and validity period for the temporary ID to form a temporary identification, and then signs the temporary identification with the temporary private key of the information receiving domain. In the cross-domain access request, the header field is extended to carry the temporary identification and the wallet address of the information receiving domain, and the "user temporary identification-transaction information" is published through the blockchain; S09: The cross-domain identity authentication system of the information sharing domain finds the temporary public key according to the wallet address, and then uses the temporary public key to verify the temporary identity to obtain the temporary ID; S010: Determine whether the signature verification is passed; if the signature verification is passed and the cross-domain identity authentication system needs to know the real identity of the external domain visitor, special transaction information is published through the blockchain; if the signature verification fails, an error report is returned to the information receiving domain; S011: The information system opens access rights for the cross-domain identity authentication system of the information sharing domain. The cross-domain identity authentication system of the information sharing domain accesses the information system through the access rights in accordance with the GB / T 28181 protocol standard or the GA / T 1400 protocol standard to request to obtain relevant shared information. S012: The information system generates a response message according to the GB / T 28181 protocol and sends it to the cross-domain identity authentication system of the information sharing domain; S013: The cross-domain identity authentication system of the information sharing domain forwards the response message to the cross-domain identity authentication system of the information receiving domain; S014: The cross-domain identity authentication system of the information receiving domain forwards a response message to the user, and the user prepares to receive the video stream according to the information in the response message; S015: The information system sends the video stream to the user in the information receiving domain; S016: The cross-domain identity authentication system of the information receiving domain uses the temporary public key of the cross-domain identity authentication system of the information sharing domain to encrypt the user's account, and then sends the ciphertext to the cross-domain identity authentication system of the information sharing domain.

Images