A convenient cross-domain identity authentication system and method

Abstract

The application discloses a convenient cross-domain identity authentication system and method, aiming to improve the security and efficiency in image and video sharing scenarios. The system is based on blockchain technology, realizing identity authentication and information sharing, ensuring data transmission security and identity authentication reliability. Through the steps of opening an account in the blockchain, generating a temporary public-private key pair, publishing transaction information, and verifying user temporary identification, the system realizes accurate identification of user identity and permission control, while reducing storage and computing resource requirements. The application is particularly suitable for data sharing environments that require high security, providing a safe and efficient data sharing platform for users.

Description

Technical Field

[0001] This invention relates to a convenient cross-domain identity authentication system, as well as a corresponding cross-domain identity authentication method for image sharing / video sharing, belonging to the field of network identity authentication technology. Background Technology

[0002] Driven by the deep integration of informatization and networking, technologies such as the Internet of Things (IoT), mobile internet, and the industrial internet have developed rapidly, marking humanity's full entry into the information age of "Internet of Everything." This era brings new challenges to information systems, including openness, large scale, and complexity. The importance of cybersecurity is increasingly prominent; it not only relates to national security strategy but also involves personal data security, becoming a key support for the development of the information age. Against this backdrop, establishing trust relationships between network entities becomes particularly crucial, serving as the cornerstone for maintaining a secure and orderly cyberspace. Blockchain technology, with its immutable, unforgeable, and traceable characteristics, provides new ideas and solutions for building a network trust system.

[0003] Chinese patent application CN118381635A discloses a blockchain-based cross-domain identity authentication method and system. This technical solution establishes a secure network access channel between the visitor's browser and the enterprise intranet; verifies the information entered by the visitor by calling an account verification smart contract deployed on a consortium blockchain; the smart contract connects to a database to verify the correctness of the account and password; obtains the visitor's IP address, determines whether it is a new IP address logging in for the first time, and uses identity recognition to perform secondary confirmation of the visitor's identity; establishes a terminal management system on the server to improve the security of secure cross-domain login; establishes a data access permission control and auditing mechanism; and establishes a security assessment and vulnerability scanning mechanism to continuously evaluate system security.

[0004] However, the aforementioned technical solutions require recording a large amount of account opening data within the blockchain system. Over time, the accumulation of this data leads to a continuous increase in storage space requirements, and simultaneously, the computing resources needed to process this data also grow, adversely affecting the scalability and performance of the blockchain system. Summary of the Invention

[0005] The primary technical problem to be solved by this invention is to provide a convenient cross-domain identity authentication system.

[0006] Another technical problem that this invention aims to solve is to provide a convenient cross-domain identity authentication method for image sharing.

[0007] Another technical problem to be solved by the present invention is to provide a convenient cross-domain identity authentication method for video sharing.

[0008] To achieve the above-mentioned technical objectives, the present invention adopts the following technical solution:

[0009] According to a first aspect of the present invention, a convenient cross-domain identity authentication system is provided, comprising: a resource management module, a business agent module, a local domain user management module, an access control module, an external domain user authentication module, a trusted platform module, an encryption / decryption module, and a blockchain module;

[0010] The resource management module is responsible for sending a list of external resources to users in the local domain and interacting with the blockchain module to receive / send local domain resource information and external resource summary information. At the same time, the resource management module also communicates with the access control module to receive / send resource management information and send access requests to the aforementioned business agent module.

[0011] The business proxy module handles cross-domain access, receives and initiates external access requests, and receives / sends temporary IDs to the access control module.

[0012] The local domain user management module is responsible for receiving / sending the login information of local domain users, and interacting with the access control module to receive the permission information of local domain users and send the login results of local domain users.

[0013] The external domain user authentication module collaborates with the access control module to receive cross-domain authentication results and send cross-domain authentication requests; the external domain user authentication module also receives cross-domain authentication requests sent by the blockchain module and sends cross-domain authentication results to the outside.

[0014] The trusted platform module exchanges signature information with the access control module and is responsible for receiving / sending signature data;

[0015] The encryption / decryption module interacts with the access control module to receive / send data to be encrypted and data to be decrypted;

[0016] The blockchain module is responsible for receiving / sending blockchain-related data to external systems.

[0017] Preferably, the resource management module includes a resource publishing submodule and a resource receiving submodule;

[0018] The resource publishing submodule publishes resources shared by this domain to external entities through the blockchain system; the resource receiving submodule receives resources from external domains through the blockchain system and, in conjunction with the permissions of users in this domain, pushes all external resources that users can access to them.

[0019] Preferably, the service proxy module includes: a GB / T 28181 protocol standard proxy submodule, a GA / T1400 protocol standard proxy submodule, and a service submodule;

[0020] The business submodule interacts with users in this domain. On one hand, it receives and modifies user requests, sending the modified request message to the business submodule of the peer system in the external domain. On the other hand, it receives requests from external domains and, based on the content of the requests, interacts with the GB / T 28181 protocol standard proxy submodule or the GB / T 28181 protocol standard proxy submodule. The GB / T 28181 protocol standard proxy submodule and the GB / T 28181 protocol standard proxy submodule respectively interact with the information systems within this domain.

[0021] Preferably, the local user management module includes an account management submodule and a password policy submodule;

[0022] The account management submodule is used to open and close accounts for individuals who need to access external resources; the password policy submodule is used to set the password complexity and password validity period policy for users.

[0023] Preferably, the access control module includes a permission management submodule and a user status management submodule;

[0024] The permission management submodule sets permissions for users in this domain, which are then used by the resource management module; the user status management submodule records users who are logged in and generates temporary identities for them.

[0025] Preferably, the external domain user authentication module includes a cross-domain user authentication submodule;

[0026] The cross-domain user authentication submodule receives a real identity request from the blockchain system, verifies the request message, interacts with the access control module to obtain the real identity, and sends a response message.

[0027] Preferably, the blockchain module includes a transaction information receiving submodule and a transaction information sending submodule;

[0028] The transaction information receiving submodule periodically obtains the latest transaction information from the blockchain system; the transaction information sending submodule sends the transaction information to the resource management module or the external domain user authentication module according to the type of transaction information, or publishes the transaction information through the blockchain system according to the interface information of the blockchain system.

[0029] Preferably, the trusted platform module is implemented using a CCM3310S-T chip.

[0030] According to a second aspect of the present invention, a convenient cross-domain identity authentication method for image sharing is provided, wherein the shared information includes image data, and includes the following steps:

[0031] S1: Use the above cross-domain identity authentication system to complete the account opening in the blockchain system and save the authentication credentials returned by the blockchain system;

[0032] S2: The cross-domain identity authentication system uses authentication credentials to log in to the blockchain system, generates a temporary public-private key pair, publishes "public key-transaction information" through the blockchain system, and synchronizes data in the blockchain system.

[0033] S3: The cross-domain identity authentication system in the information sharing domain publishes externally accessible shared information through the blockchain and synchronizes data within the blockchain system;

[0034] S4: Users in the information receiving domain complete account opening in the cross-domain identity authentication system of this domain;

[0035] S5: The cross-domain authentication system for users in the information receiving domain to log in to this domain;

[0036] S6: The cross-domain authentication system of the information receiving domain returns a list of accessible external domain resources based on the user's permissions;

[0037] S7: A user in the information receiving domain initiates a cross-domain access request to share information;

[0038] S8: The cross-domain identity authentication system of the information receiving domain randomly generates a unique temporary ID for users in this domain, and marks the date, time and validity period of the temporary ID to form a temporary identifier. The temporary identifier is signed using the temporary private key of the information receiving domain. The temporary identifier and the wallet address of the information receiving domain are carried in the extended header field of the cross-domain access request message. The "user temporary identifier-transaction information" is published through the blockchain system.

[0039] S9: A cross-domain identity authentication system for information sharing domains finds the temporary public key based on the wallet address, then uses the temporary public key to verify the temporary identifier and obtains the temporary ID from it;

[0040] S10: Determine whether the signature verification is successful; if the signature verification is successful and the cross-domain identity authentication system needs to know the real identity of the external domain visitor, then publish special transaction information through the blockchain; if the signature verification fails, then return an error report to the information receiving domain.

[0041] S11: Information systems within this domain grant access permissions to cross-domain identity authentication systems in the information sharing domain. Cross-domain identity authentication systems in the information sharing domain access the information systems through these access permissions in accordance with the GB / T28181 protocol standard or the GA / T 1400 protocol standard to request relevant shared information.

[0042] S12: The cross-domain identity authentication system of the information receiving domain receives a request from the blockchain system to obtain the user's real identity and uses the private key to recover the temporary ID from the transaction content;

[0043] S13: Information systems within this domain return data to the cross-domain identity authentication system of the information sharing domain upon request.

[0044] S14: The cross-domain authentication system of the information receiving domain uses the temporary public key of the cross-domain authentication system of the information sharing domain to encrypt the user's account, and then sends the ciphertext to the cross-domain authentication system of the information sharing domain via an extended URL.

[0045] S15: User data received in the information receiving domain.

[0046] According to a third aspect of the present invention, a convenient cross-domain identity authentication method for video sharing is provided, comprising the following steps:

[0047] S01: Use the above cross-domain identity authentication system to complete the account opening in the blockchain system and save the authentication credentials returned by the blockchain system;

[0048] S02: The cross-domain identity authentication system uses authentication credentials to log in to the blockchain system, generates a temporary public-private key pair, publishes "public key-transaction information" through the blockchain system, and synchronizes data in the blockchain system.

[0049] S03: The cross-domain identity authentication system in the information sharing domain publishes externally accessible shared information through blockchain and synchronizes data within the blockchain system;

[0050] S04: Users in the information receiving domain complete account opening in the cross-domain identity authentication system of this domain;

[0051] S05: The cross-domain authentication system for users in the information receiving domain to log in to this domain;

[0052] S06: The cross-domain authentication system of the information receiving domain returns a list of accessible external domain resources based on the user's permissions;

[0053] S07: A user in the information receiving domain initiates a cross-domain access request to share information;

[0054] S08: The cross-domain identity authentication system of the information receiving domain randomly generates a unique temporary ID for users in this domain, and marks the date, time and validity period of the temporary ID to form a temporary identifier. Then, the temporary identifier is signed using the temporary private key of the information receiving domain. The temporary identifier and the wallet address of the information receiving domain are carried in the extended header field of the cross-domain access request, and "user temporary identifier - transaction information" is published through the blockchain.

[0055] S09: Cross-domain identity authentication system in the information sharing domain finds the temporary public key based on the wallet address, then uses the temporary public key to verify the temporary identifier and obtains the temporary ID from it;

[0056] S010: Determine whether the signature verification is successful; if the signature verification is successful and the cross-domain identity authentication system needs to know the real identity of the external domain visitor, then publish special transaction information through the blockchain; if the signature verification fails, then return an error report to the information receiving domain.

[0057] S011: The information system grants access permissions to the cross-domain identity authentication system in the information sharing domain. The cross-domain identity authentication system in the information sharing domain accesses the information system through this access permission in accordance with the GB / T 28181 protocol standard or the GA / T 1400 protocol standard to request relevant shared information.

[0058] S012: The information system generates a response message according to the GB / T 28181 protocol and sends it to the cross-domain identity authentication system in the information sharing domain;

[0059] S013: The cross-domain authentication system of the information sharing domain forwards the response message to the cross-domain authentication system of the information receiving domain;

[0060] S014: The cross-domain authentication system of the information receiving domain forwards a response message to the user, and the user prepares to receive the video stream based on the information in the response message;

[0061] S015: The information system sends the video stream to the user in the information receiving domain;

[0062] S016: The cross-domain authentication system of the information receiving domain uses the temporary public key of the cross-domain authentication system of the information sharing domain to encrypt the user's account, and then sends the ciphertext to the cross-domain authentication system of the information sharing domain.

[0063] Compared with existing technologies, this invention constructs a blockchain-based cross-domain identity authentication system, achieving an efficient and secure identity authentication mechanism, with particular optimization of the image and video data sharing process. This system leverages the immutability and transparency of blockchain to provide a solid foundation of trust for cross-domain identity authentication. Through steps such as generating temporary public-private key pairs, publishing transaction information, and verifying temporary user identifiers via blockchain, it ensures the authenticity of user identities and the reasonable control of access permissions. This invention not only enhances the security of data sharing but also effectively reduces the storage and computational burden of the blockchain system by minimizing the necessary information storage on the blockchain. Attached Figure Description

[0064] Figure 1 This is a system deployment diagram for implementing the present invention;

[0065] Figure 2 This is a schematic diagram of the cross-domain identity authentication system provided in an embodiment of the present invention;

[0066] Figure 3 This is an information interaction diagram of the image sharing cross-domain identity authentication method provided in an embodiment of the present invention;

[0067] Figure 4 This is an information interaction diagram of the video sharing cross-domain identity authentication method provided in an embodiment of the present invention. Detailed Implementation

[0068] The technical content of the present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0069] This invention provides a convenient and secure cross-domain identity authentication system and method, particularly suitable for scenarios involving image and video sharing. The system utilizes blockchain technology to achieve identity authentication and information sharing, ensuring the security of data transmission and the reliability of identity authentication. Figure 1 As shown, the system comprises three main parts: an information receiving domain, an information sharing domain, and a blockchain, all interconnected via a network. In the information receiving domain, the cross-domain identity authentication system connects directly to the user's network, handling user authentication and information requests. This domain sends a verified identity response to the information sharing domain and sends its wallet address and public key to the blockchain, while simultaneously receiving wallet addresses and public keys from the blockchain to ensure transaction security. The information sharing domain includes the cross-domain identity authentication system and an information system. The cross-domain identity authentication system connects to the information system via the network to access data within the information system. Furthermore, the information sharing domain sends its wallet address, public key, and verified identity request to the blockchain and receives corresponding information from the blockchain.

[0070] Compared with existing technologies, the main technical concept of this invention lies in utilizing the immutability and transparency of blockchain to provide a decentralized trust foundation for cross-domain identity authentication. The corresponding cross-domain identity authentication system adopts a modular design, including a resource management module, a business agent module, a local domain user management module, an access control module, an external domain user authentication module, a trusted platform module, and an encryption / decryption module. Each module has specific functions and responsibilities, working together to complete cross-domain identity authentication and information sharing.

[0071] Furthermore, the trusted platform module can be implemented using chips such as CCM3310S-T, CCM3310S-H, and CCM3320S to provide hardware-level security protection, including key management, system integrity verification, digital signatures, and identity authentication, thereby enhancing the security of the entire cross-domain identity authentication system. Through this design, this invention not only improves the efficiency and security of cross-domain identity authentication but also reduces the performance overhead of the blockchain system, as the blockchain system only stores the minimum necessary information. This invention is particularly suitable for image and video sharing applications requiring high security and reliability, providing users with a convenient and secure data sharing platform.

[0072] First Embodiment

[0073] like Figure 2 As shown, the first embodiment of the present invention provides a convenient cross-domain identity authentication system, including: a resource management module, a business agent module, a local domain user management module, an access control module, an external domain user authentication module, a trusted platform module, an encryption / decryption module, and a blockchain module.

[0074] The system comprises the following modules: Resource Management Module: Sends external resource lists to users within the domain and interacts with the Blockchain Module to receive / send local resource information and aggregated external resource information; Access Control Module: Communicates with the Access Control Module to receive / send resource management information and sends access requests to the aforementioned Business Agent Module; Business Agent Module: Handles cross-domain access, receives and initiates external access requests, and receives / sends temporary IDs to the Access Control Module; Local User Management Module: Receives / sends login information for local users and interacts with the Access Control Module to receive local user permission information and send login results; External User Authentication Module: Collaborates with the Access Control Module to receive cross-domain authentication results and send cross-domain authentication requests; External User Authentication Module: Receives cross-domain authentication requests from the Blockchain Module and sends cross-domain authentication results externally; Trusted Platform Module: Exchanges signature information with the Access Control Module and receives / sends signature data; Encryption / Decryption Module: Interacts with the Access Control Module to receive / send data to be encrypted and decrypted; Blockchain Module: Receives / sends blockchain-related data to external systems.

[0075] In one embodiment of the present invention, the resource management module includes a resource publishing submodule and a resource receiving submodule. The resource publishing submodule publishes resources shared externally from the local domain through a blockchain system. The resource receiving submodule receives resources from external domains through the blockchain system and, based on the permissions of users in the local domain, pushes all external resources accessible to those users.

[0076] In one embodiment of the present invention, the service proxy module includes: a GB / T 28181 protocol standard proxy submodule, a GA / T 1400 protocol standard proxy submodule, and a service submodule. The service submodule interacts with users in the local domain. On one hand, it receives user requests, adds necessary information to the request message, and sends the modified request message to the service submodule of the peer system in the external domain. On the other hand, it receives requests from external domains and, based on the content of the request, interacts with either the GB / T 28181 protocol standard proxy submodule or the GB / T 28181 protocol standard proxy submodule. The GB / T 28181 protocol standard proxy submodule and the GB / T 28181 protocol standard proxy submodule respectively interact with information systems within the local domain.

[0077] In one embodiment of the present invention, the domain user management module includes an account management submodule and a password policy submodule. The account management submodule is used to handle the opening and closing of accounts for individuals who need to access external resources. The password policy submodule is used to set the password complexity and password validity period policy for users.

[0078] In one embodiment of the present invention, the access control module includes a permission management submodule and a user status management submodule. The permission management submodule sets permissions for users within the domain, which are then used by the resource management module. The user status management submodule records users who are currently logged in and generates temporary identities for them.

[0079] In one embodiment of the present invention, the external domain user authentication module includes a cross-domain user authentication submodule, which is used to receive a real identity request from the blockchain system, verify the request message, interact with the access control module to obtain the real identity, and send a response message.

[0080] A Trusted Platform Module (TPM) is a microchip embedded in hardware devices such as computer motherboards. It aims to enhance the security of the entire computer system by providing security-related functions, offering hardware-level protection for sensitive data, keys, and other information within the system, and can be used to verify the integrity of the system startup process. In one embodiment of this invention, the microchip is designated CCM3310S-T (or CCM3310S-H, CCM3320S, etc., but not limited to these). The CCM3310S-T is an automotive-grade security chip independently developed by Guoxin Technology. It employs a proprietary 32-bit CPU security core CS0, possesses 32KB of SRAM, 16KB of ROM, and 256KB of EFLASH storage resources, as well as DMA / EDMA, two timers, a watchdog timer, and a timer module. Further details about the CCM3310S-T can be found at the following link: http: / / www.faithiot.com / contents / 11 / 179.html, and will not be elaborated upon here.

[0081] The main functions of this trusted platform module include: key management, system integrity verification, digital signature, and identity authentication.

[0082] Key management refers to the secure generation, storage, and management of encryption keys within the trusted platform module. For example, it can generate symmetric keys for encrypting hard drive data, or asymmetric key pairs (public and private keys) for digital signatures and authentication. Because the keys are stored in a protected area within the hardware, they are less susceptible to theft or tampering compared to storage at the software level, thus improving key security.

[0083] System integrity verification refers to the process where, during computer startup, the Trusted Platform Module performs hash calculations on various critical components (such as the BIOS, bootloader, and operating system kernel) and compares the resulting hash values ​​with legitimate hash values ​​pre-stored in the chip. If an inconsistency is found, it indicates that the system may have been tampered with. The Trusted Platform Module can then take appropriate measures, such as preventing system startup or issuing a warning to the administrator, to ensure that the system boots according to a trusted configuration.

[0084] Digital signature refers to the ability of a trusted platform module to digitally sign data, files, etc., using its stored private key to prove the source and integrity of the data. For example, in scenarios where the authenticity of documents needs to be guaranteed, after a document is signed by the trusted platform module, the recipient can use the corresponding public key to verify the signature and confirm that the document comes from a trusted source and has not been tampered with.

[0085] Identity authentication refers to the process of verifying the identity of a user or device based on information such as keys stored within the system. For example, in an enterprise network environment, when a computer connects to the network, it uses relevant information in the trusted platform module to prove its legitimacy to the server, achieving more secure and reliable network access.

[0086] In one embodiment of the present invention, the encryption / decryption module includes an encryption submodule and a decryption submodule, which are used to encrypt plaintext data or decrypt ciphertext data. The blockchain module includes a transaction information receiving submodule and a transaction information sending submodule. The transaction information receiving submodule periodically obtains the latest transaction information from the blockchain system. The transaction information sending submodule, depending on the type of transaction information, sends the transaction information to the resource management module or the external user authentication module, or publishes the transaction information through the blockchain system according to the blockchain system's interface information.

[0087] Second Embodiment

[0088] like Figure 3 As shown, the second embodiment of the present invention provides a convenient cross-domain identity authentication method for image sharing, which uses image data as shared information, and specifically includes the following steps:

[0089] S1: Use the above cross-domain identity authentication system to complete the account opening in the blockchain system and save the authentication credentials returned by the blockchain system, namely the certificate and private key.

[0090] S2: The cross-domain identity authentication system uses authentication credentials to log in to the blockchain system, generates a temporary public-private key pair, publishes "public key-transaction information" through the blockchain system, and synchronizes data in the blockchain system.

[0091] In step S2, when the cross-domain identity authentication system attempts to log in to the blockchain system for the first time, it must publish its wallet address and a temporary public-private key pair by creating and publishing a transaction. In this transaction, the publisher and receiver refer to the same entity, namely the cross-domain identity authentication system itself that is performing the login.

[0092] S3: The cross-domain identity authentication system of the information sharing domain publishes externally accessible shared information through the blockchain and synchronizes data within the blockchain system.

[0093] S4: Users in the information receiving domain complete account opening in the cross-domain identity authentication system of this domain.

[0094] S5: Cross-domain authentication system for users in the information receiving domain to log in to this domain.

[0095] Step S5 describes the process of a user logging into the cross-domain authentication system. In this step, the authentication method is not limited to a specific mechanism; any existing authentication method can be used. For example, traditional username and password authentication can be used, or biometric authentication methods such as fingerprint recognition can be employed.

[0096] S6: The cross-domain authentication system of the information receiving domain returns a list of accessible external domain resources based on the user's permissions.

[0097] S7: A user in the information receiving domain initiates a cross-domain access request to share information.

[0098] S8: The cross-domain identity authentication system of the information receiving domain randomly generates a unique temporary ID for users in this domain, and marks the date, time and validity period of the temporary ID to form a temporary identifier. The temporary identifier is signed using the temporary private key of the information receiving domain. The temporary identifier and the wallet address of the information receiving domain are carried in the extended header field of the cross-domain access request message, and "user temporary identifier - transaction information" is published through the blockchain system.

[0099] S9: A cross-domain identity authentication system for information sharing domains. It finds the temporary public key based on the wallet address, uses the temporary public key to verify the temporary identifier, and obtains the temporary ID from it.

[0100] S10: Determine if the signature verification passes. If the signature verification passes and the cross-domain authentication system needs to know the true identity of the external domain visitor, then publish special transaction information via the blockchain. If the signature verification fails, return an error report to the receiving domain.

[0101] Step S10 involves a special transaction information processing method. In this step, the information sharing domain, as the sender, sends special transaction information to the information receiving domain. The content of this transaction is a temporary ID encrypted using the temporary public key of the information receiving domain. This design ensures the security and privacy of the information, because only the information receiving domain, possessing the corresponding private key, can decrypt and identify the real temporary ID.

[0102] S11: Information systems within this domain grant access permissions to cross-domain identity authentication systems within the information sharing domain. Cross-domain identity authentication systems within the information sharing domain access the information systems through these access permissions in accordance with the GB / T28181 protocol standard or the GA / T 1400 protocol standard to request relevant shared information.

[0103] S12: The cross-domain identity authentication system of the information receiving domain receives a request from the blockchain system to obtain the user's real identity and uses the private key to recover the temporary ID from the transaction content.

[0104] S13: Information systems within this domain return data to the cross-domain identity authentication system of the information sharing domain upon request.

[0105] S14: The cross-domain authentication system of the information receiving domain uses the temporary public key of the cross-domain authentication system of the information sharing domain to encrypt the user's account, and then sends the ciphertext to the cross-domain authentication system of the information sharing domain via an extended URL.

[0106] S15: User data received in the information receiving domain.

[0107] In summary, the image sharing cross-domain authentication method provided in the second embodiment of the present invention ensures the security of image data and the reliability of authentication during cross-domain transmission by creating temporary key pairs, publishing sharing information, generating and verifying temporary IDs, while reducing system performance overhead and improving authentication efficiency and data sharing convenience.

[0108] Third Embodiment

[0109] like Figure 4 As shown, the third embodiment of the present invention provides a convenient cross-domain identity authentication method for video sharing, which uses video data as sharing information, and specifically includes the following steps:

[0110] S01: Use the above cross-domain identity authentication system to complete the account opening in the blockchain system and save the authentication credentials returned by the blockchain system, namely the certificate and private key.

[0111] S02: The cross-domain identity authentication system uses authentication credentials to log in to the blockchain system, generates a temporary public-private key pair, publishes "public key-transaction information" through the blockchain system, and synchronizes data in the blockchain system.

[0112] Step S02 details the initial interaction process between the cross-domain identity authentication system and the blockchain system. Specifically, when the cross-domain identity authentication system logs into the blockchain system for the first time, it needs to publish its wallet address and a temporary public-private key pair by creating and publishing a transaction. In this transaction, the publisher and receiver refer to the same entity, namely the cross-domain identity authentication system itself that performs the login operation.

[0113] S03: The cross-domain identity authentication system in the information sharing domain publishes externally accessible shared information through the blockchain and synchronizes data within the blockchain system.

[0114] S04: Users in the information receiving domain complete account opening in the cross-domain identity authentication system of this domain.

[0115] S05: Cross-domain authentication system for users of the information receiving domain to log in to this domain.

[0116] Step S05 involves the process of a user logging into the cross-domain authentication system. In this step, the authentication method is not limited to a specific mechanism; any existing authentication method can be used. For example, a user can choose to authenticate using a traditional username and password, or they can use biometric authentication methods such as fingerprint recognition.

[0117] S06: The cross-domain authentication system of the information receiving domain returns a list of accessible external domain resources based on the user's permissions.

[0118] S07: A user in the information receiving domain initiates a cross-domain access request for shared information.

[0119] S08: The cross-domain identity authentication system of the information receiving domain randomly generates a unique temporary ID for users in this domain, and marks the date, time and validity period of the temporary ID to form a temporary identifier. Then, the temporary identifier is signed using the temporary private key of the information receiving domain. The temporary identifier and the wallet address of the information receiving domain are carried in the extended header field of the cross-domain access request, and "user temporary identifier - transaction information" is published through the blockchain.

[0120] S09: The cross-domain identity authentication system in the information sharing domain finds the temporary public key based on the wallet address, then uses the temporary public key to verify the temporary identifier and obtains the temporary ID from it.

[0121] S010: Determine if the signature verification passes. If the signature verification passes and the cross-domain identity authentication system needs to know the true identity of the external domain visitor, then publish special transaction information via the blockchain. If the signature verification fails, return an error report to the receiving domain.

[0122] Step S010 describes a special transaction information processing method. In this step, the information sharing domain, as the sender, sends special transaction information to the information receiving domain. The request content of this transaction is a temporary ID encrypted using the temporary public key of the information receiving domain. This design ensures the security and privacy of the information, because only the information receiving domain, possessing the corresponding private key, can decrypt and identify the real temporary ID.

[0123] S011: The information system grants access permissions to the cross-domain identity authentication system in the information sharing domain. The cross-domain identity authentication system in the information sharing domain accesses the information system through this access permission in accordance with the GB / T 28181 protocol standard or the GA / T 1400 protocol standard to request relevant shared information.

[0124] S012: The information system generates a response message according to the GB / T 28181 protocol and sends it to the cross-domain identity authentication system in the information sharing domain.

[0125] S013: The cross-domain authentication system of the information sharing domain forwards the response message to the cross-domain authentication system of the information receiving domain.

[0126] S014: The cross-domain authentication system of the information receiving domain forwards a response message to the user, and the user prepares to receive the video stream based on the information in the response message.

[0127] S015: The information system sends the video stream to the user in the information receiving domain.

[0128] S016: The cross-domain authentication system of the information receiving domain uses the temporary public key of the cross-domain authentication system of the information sharing domain to encrypt the user's account, and then sends the ciphertext to the cross-domain authentication system of the information sharing domain.

[0129] In summary, the video sharing cross-domain identity authentication method provided in the third embodiment of the present invention uses blockchain technology to implement steps such as user account opening, generating temporary public-private key pairs, publishing accessible video information, processing cross-domain access requests, and verifying user temporary IDs. This ensures the security of video data and the reliability of authentication during cross-domain transmission. At the same time, it protects user account information through encryption technology, reduces the performance overhead of the blockchain system, and improves the efficiency and security of video sharing.

[0130] It should be noted that the above embodiments are merely illustrative examples. The technical solutions of each embodiment can be combined, and all are within the protection scope of this invention.

[0131] The cross-domain identity authentication method and system provided by this invention have been described in detail above. Any obvious modifications made by those skilled in the art without departing from the essential content of this invention will constitute an infringement of the patent rights of this invention and will incur corresponding legal liability.

Claims

1. A convenient cross-domain identity authentication system, characterized in that... It includes a resource management module, a business agent module, a local domain user management module, an access control module, an external domain user authentication module, a trusted platform module, an encryption / decryption module, and a blockchain module; The access control module includes a permission management submodule and a user status management submodule; wherein, the permission management submodule sets permissions for users in this domain for use by the resource management module; the user status management submodule records users who are logged in and generates temporary identities for them; The resource management module is responsible for sending a list of external resources to users in the local domain and interacting with the blockchain module to receive / send local domain resource information and external resource summary information. At the same time, the resource management module also communicates with the access control module to receive / send resource management information and send access requests to the aforementioned business agent module. The local domain user management module is responsible for receiving / sending the login information of local domain users, and interacting with the access control module to receive the permission information of local domain users and send the login results of local domain users. The external domain user authentication module collaborates with the access control module to receive cross-domain authentication results and send cross-domain authentication requests; the external domain user authentication module also receives cross-domain authentication requests sent by the blockchain module and sends cross-domain authentication results to the outside. The trusted platform module exchanges signature information with the access control module and is responsible for receiving / sending signature data; the encryption / decryption module interacts with the access control module; the blockchain module is responsible for receiving / sending blockchain-related data to external systems. The business proxy module handles cross-domain access and receives / sends temporary IDs to the access control module. Specifically, the cross-domain authentication system of the information receiving domain randomly generates a unique temporary ID for each user in that domain, and marks the temporary ID with its date, time, and validity period, forming a temporary identifier. The temporary identifier is signed using the temporary private key of the information receiving domain. The temporary identifier and the wallet address of the information receiving domain are carried in the extended header field of the cross-domain access request message, and "User Temporary Identifier - Transaction Information" is published through the blockchain system. The cross-domain authentication system of the information sharing domain finds the temporary public key based on the wallet address, uses the temporary public key to verify the temporary identifier, and obtains the temporary ID from it.

2. The cross-domain identity authentication system as described in claim 1, characterized in that... The resource management module includes a resource publishing submodule and a resource receiving submodule; The resource publishing submodule publishes resources shared by this domain to external entities through the blockchain system; the resource receiving submodule receives resources from external domains through the blockchain system and, in conjunction with the permissions of users in this domain, pushes all accessible external resources to users.

3. The cross-domain identity authentication system as described in claim 1, characterized in that... The service proxy module includes: a GB / T28181 protocol standard proxy submodule, a GA / T1400 protocol standard proxy submodule, and a service submodule; wherein... The business submodule interacts with users in this domain. On the one hand, it receives and modifies user requests, and sends the modified request message to the business submodule of the peer system in the external domain. On the other hand, it receives requests from external domains and interacts with the GB / T 28181 protocol standard proxy submodule or the GB / T 28181 protocol standard proxy submodule according to the content of the request. The GB / T 28181 protocol standard proxy submodule and the GB / T 28181 protocol standard proxy submodule interact with the information system within this domain.

4. The cross-domain identity authentication system as described in claim 1, characterized in that... The domain user management module includes an account management submodule and a password policy submodule; wherein... The account management submodule is used to open and close accounts for individuals who need to access external resources; the password policy submodule is used to set the password complexity and password validity period policy for users.

5. The cross-domain identity authentication system as described in claim 1, characterized in that... The external domain user authentication module includes a cross-domain user authentication submodule; wherein... The cross-domain user authentication submodule receives a real identity request from the blockchain system, verifies the request message, interacts with the access control module to obtain the real identity, and sends a response message.

6. The cross-domain identity authentication system as described in claim 1, characterized in that... The blockchain module includes a transaction information receiving submodule and a transaction information sending submodule; wherein... The transaction information receiving submodule periodically obtains the latest transaction information from the blockchain system; the transaction information sending submodule sends the transaction information to the resource management module or the external domain user authentication module according to the type of transaction information, or publishes the transaction information through the blockchain system according to the interface information of the blockchain system.

7. The cross-domain identity authentication system as described in claim 1, characterized in that... The trusted platform module is implemented using the CCM3310S-T chip.

8. A convenient cross-domain identity authentication method for image sharing, wherein the shared information includes image data, characterized in that... Includes the following steps: S1: Use the cross-domain identity authentication system described in any one of claims 1 to 7 to complete the account opening in the blockchain system and save the authentication credentials returned by the blockchain system; S2: The cross-domain identity authentication system uses authentication credentials to log in to the blockchain system, generates a temporary public-private key pair, publishes "public key-transaction information" through the blockchain system, and synchronizes data in the blockchain system; S3: The cross-domain identity authentication system in the information sharing domain publishes externally accessible shared information through the blockchain and synchronizes data within the blockchain system; S4: Users in the information receiving domain complete account opening in the cross-domain identity authentication system of this domain; S5: The cross-domain authentication system for users in the information receiving domain to log in to this domain; S6: The cross-domain authentication system of the information receiving domain returns a list of accessible external domain resources based on the user's permissions; S7: A user in the information receiving domain initiates a cross-domain access request to share information; S8: The cross-domain identity authentication system of the information receiving domain randomly generates a unique temporary ID for users in this domain, and marks the date, time and validity period of the temporary ID to form a temporary identifier. The temporary identifier is signed using the temporary private key of the information receiving domain. The temporary identifier and the wallet address of the information receiving domain are carried in the extended header field of the cross-domain access request message. The "user temporary identifier-transaction information" is published through the blockchain system. S9: A cross-domain identity authentication system for information sharing domains finds the temporary public key based on the wallet address, then uses the temporary public key to verify the temporary identifier and obtains the temporary ID from it; S10: Determine whether the signature verification is successful; if the signature verification is successful and the cross-domain identity authentication system needs to know the real identity of the external domain visitor, then publish special transaction information through the blockchain; if the signature verification fails, then return an error report to the information receiving domain. S11: Information systems within this domain grant access permissions to cross-domain identity authentication systems in the information sharing domain. Cross-domain identity authentication systems in the information sharing domain access the information systems through these access permissions in accordance with the GB / T 28181 protocol standard or the GA / T1400 protocol standard to request relevant shared information. S12: The cross-domain identity authentication system of the information receiving domain receives a request from the blockchain system to obtain the user's real identity and uses the private key to recover the temporary ID from the transaction content; S13: Information systems within this domain return data to the cross-domain identity authentication system of the information sharing domain upon request. S14: The cross-domain authentication system of the information receiving domain uses the temporary public key of the cross-domain authentication system of the information sharing domain to encrypt the user's account, and then sends the ciphertext to the cross-domain authentication system of the information sharing domain via an extended URL. S15: User data received in the information receiving domain.

9. A convenient cross-domain identity authentication method for video sharing, wherein the shared information includes video data, characterized in that... Includes the following steps: S01: Use the cross-domain identity authentication system described in any one of claims 1 to 7 to complete the account opening in the blockchain system and save the authentication credentials returned by the blockchain system; S02: The cross-domain identity authentication system uses authentication credentials to log in to the blockchain system, generates a temporary public-private key pair, publishes "public key-transaction information" through the blockchain system, and synchronizes data in the blockchain system; S03: The cross-domain identity authentication system in the information sharing domain publishes externally accessible shared information through blockchain and synchronizes data within the blockchain system; S04: Users in the information receiving domain complete account opening in the cross-domain identity authentication system of this domain; S05: The cross-domain authentication system for users in the information receiving domain to log in to this domain; S06: The cross-domain authentication system of the information receiving domain returns a list of accessible external domain resources based on the user's permissions; S07: A user in the information receiving domain initiates a cross-domain access request to share information; S08: The cross-domain identity authentication system of the information receiving domain randomly generates a unique temporary ID for users in this domain, and marks the date, time and validity period of the temporary ID to form a temporary identifier. Then, the temporary identifier is signed using the temporary private key of the information receiving domain. The temporary identifier and the wallet address of the information receiving domain are carried in the extended header field of the cross-domain access request, and "user temporary identifier - transaction information" is published through the blockchain. S09: Cross-domain identity authentication system in the information sharing domain finds the temporary public key based on the wallet address, and then uses the temporary public key to verify the temporary identifier to obtain the temporary ID; S010: Determine whether the signature verification is successful; if the signature verification is successful and the cross-domain identity authentication system needs to know the real identity of the external domain visitor, then publish special transaction information through the blockchain; if the signature verification fails, then return an error report to the information receiving domain. S011: The information system grants access permissions to the cross-domain identity authentication system in the information sharing domain. The cross-domain identity authentication system in the information sharing domain accesses the information system through this access permission in accordance with the GB / T 28181 protocol standard or the GA / T1400 protocol standard to request relevant shared information. S012: The information system generates a response message according to the GB / T 28181 protocol and sends it to the cross-domain identity authentication system in the information sharing domain; S013: The cross-domain authentication system of the information sharing domain forwards the response message to the cross-domain authentication system of the information receiving domain; S014: The cross-domain authentication system of the information receiving domain forwards a response message to the user, and the user prepares to receive the video stream based on the information in the response message; S015: The information system sends the video stream to the user in the information receiving domain; S016: The cross-domain authentication system of the information receiving domain uses the temporary public key of the cross-domain authentication system of the information sharing domain to encrypt the user's account, and then sends the ciphertext to the cross-domain authentication system of the information sharing domain.

Images