Layered and distributed identity authentication method, storage medium and electronic equipment

Abstract

The invention provides a layered and distributed identity authentication method, a storage medium and electronic equipment. The method comprises the following steps: S1, constructing a block chain encryption environment and completing layered and distributed registration of a user; s2, when the first user proposes identity authentication to the second user, judging whether the first user and the second user are in the same hierarchy, and if yes, performing same-hierarchy verification; if not, performing S3; s3, performing cross-level verification by using father nodes when the first user and the second user register; according to the invention, efficient identity verification can be realized among nodes of different levels, communication overhead is reduced, and security is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a layered distributed identity authentication method, a storage medium and an electronic device. Background Art

[0002] With the development of blockchain technology and quantum computing, the security issues of distributed systems have become increasingly severe. In particular, the powerful computing power of quantum computers will destroy authentication methods based on traditional cryptography, such as RSA and ECC, which poses a huge threat to the current authentication systems that use these algorithms. In order to meet this challenge, post-quantum cryptography provides several possible directions for quantum computing-resistant authentication. Lattice-based cryptography is one of the most mature and widely studied post-quantum cryptography methods. Because it is based on mathematical problems such as LWE (Learning With Errors) and SIS (Short Integer Solution), it is considered to have strong quantum computing resistance. Lyubashevsky proposed a lattice-based zero-knowledge proof scheme, which generates commitment values ​​through random vectors and combines Fiat-Shamir transformation to realize non-interactive zero-knowledge proof. This method has been widely used in subsequent lattice signature and authentication protocols. Peikert's research further developed the NIZK (Non-Interactive Zero-Knowledge) proof based on LWE, optimized the efficiency and security of the proof, and provided feasibility for larger-scale applications. Ducas and Micciancio improved the short lattice signature scheme under the standard model, providing a shorter signature length and higher computational efficiency, and providing a more practical solution for lattice-based identity authentication systems. In addition, Xu et al. proposed a lattice-based lightweight identity authentication protocol for Internet of Things (IoT) devices, demonstrating its efficiency and security in resource-constrained environments. Hossain et al. designed a lattice-based identity authentication framework suitable for edge computing and cloud computing environments, combining signature and authentication techniques of lattice cryptography to resist quantum attacks. Although these lattice-based zero-knowledge proof and identity authentication schemes are superior in anti-quantum computing, most existing schemes lack hierarchical design and are difficult to support the identity authentication requirements between multi-level nodes in blockchain environments. Specifically, these schemes are usually designed for flat network structures and do not fully consider the trust relationship and authentication requirements between nodes at different levels. In a hierarchical system, authentication between different levels requires more efficient and secure mechanisms to maintain the overall trust chain of the system, and these traditional schemes cannot effectively cope with such complex scenarios. To address this problem, this paper introduces the LATTE encryption scheme and improves it, combining it with lattice-based non-interactive zero-knowledge proof (NIZK) to propose a hierarchical distributed identity authentication mechanism suitable for blockchain. The LATTE encryption scheme provides a secure, efficient and flexible way to manage identity authentication and authorization between nodes at different levels through identity-based encryption and key delegation functions.In a multi-level system, the LATTE scheme not only simplifies complex key management, but also enables efficient encryption delegation between different levels, so that the authentication process can be dynamically adjusted, enhancing the flexibility and security of the system in a multi-level trust chain environment. In addition to lattice-based research, other post-quantum cryptography directions have also proposed quantum-resistant authentication schemes. The McEliece public key encryption system based on code cryptography and the Rainbow signature scheme based on multivariate polynomial cryptography, etc., use their respective mathematical problems to provide quantum-resistant security. However, these schemes generally face the problems of large key size and high computational complexity, which limits their widespread adoption in practical applications. More importantly, these schemes are mainly designed for single-level authentication scenarios and also lack support and optimization for hierarchical structures. Most of the existing hierarchical distributed authentication systems are based on classical cryptographic schemes. For example, the hierarchical authentication framework based on blockchain relies on classical public key infrastructure and symmetric encryption technology to achieve authentication. Similarly, the multi-server hierarchical authentication based on blockchain uses a multi-level server architecture to achieve cross-organizational authentication and permission management, but relies on the classical elliptic curve algorithm for authentication. In addition, the Consortium Blockchain-Based Hierarchical Identity Authentication (CBHIA) proposed a hierarchical identity authentication mechanism in a consortium chain environment, using the multi-level structure of the blockchain to enhance the decentralization and scalability of the system. Although the system achieves cross-organizational identity authentication through blockchain technology, it relies on classical encryption algorithms. In general, these traditional solutions have significant deficiencies in anti-quantum computing. Summary of the invention

[0003] The present invention solves the problems of complex key management and insufficient flexibility in a hierarchical structure, and proposes a hierarchical distributed identity authentication method, storage medium and electronic device, which can achieve efficient identity authentication between nodes at different levels, while reducing communication overhead and improving security.

[0004] In order to achieve the above objectives, the following technical solutions are proposed: A hierarchical distributed identity authentication method comprises the following steps: S1, build a blockchain encryption environment and complete user hierarchical distributed registration; S2, when the first user asks the second user for identity authentication, determine whether the first user and the second user are at the same level, if so, perform same-level verification; if not, proceed to S3; S3, using the parent node when the first user and the second user registered to perform cross-level verification.

[0005] The authentication mechanism of the present invention can realize efficient identity authentication between nodes at different levels, while reducing communication overhead and improving security.

[0006] Preferably, the process of constructing the blockchain encryption environment is as follows: A hierarchical structure framework including a root layer, an intermediate layer and a user layer is adopted. The root layer is connected to several levels of intermediate layers, and the intermediate layer is connected to the user layer. Global parameters are generated at the root layer and the public part is uploaded to the blockchain. The generation of keys is passed down layer by layer.

[0007] The construction process of the blockchain encryption environment of the present invention is as follows: a hierarchical structure framework is adopted, and the hierarchical structure framework includes a root layer (Root Level), an intermediate layer (Intermediate Level) and a user layer (User Level). The root layer is located at the top, and is connected to several intermediate layers from top to bottom. The user layer is connected to the intermediate layer. The system initialization setting is performed at the root layer, and global parameters are generated, and the public part is uploaded to the blockchain. The root layer is used as the key generation center KGC (root node) to select a large integer N, and the integer polynomial ring Rq modulo q = Z q [x] / x N +1, with a discrete Gaussian distribution D centered at 0 and with a standard deviation of σ σ ; KGC runs the LATTE.KeyGen algorithm to generate the master public key h and the master private key matrix S0; the master public key and the selected global parameters are made public and uploaded to the blockchain to ensure that all nodes and users can access these parameters and work in the same secure environment, and the key generation is passed down layer by layer.

[0008] Preferably, the process of user hierarchical distributed registration is as follows: The new user sends a unique identifier and timestamp to the first node in the middle layer at the user layer to make a registration request. After the first node passes the verification, it becomes the parent node of the new user. The new user becomes a new node. The parent node assigns the new node a private key matrix, an identity matrix and a private key, and uploads the identity matrix and registration certificate to the blockchain.

[0009] Before a new user joins the present invention, he / she needs to send a registration request to a certain node and send his / her unique identifier ID NEW and timestamp T. The node will determine whether the identifier has been used and whether the timestamp T is valid. If both are valid, the registration is successful and the node will become the parent node of the new user.

[0010] Preferably, the first node verification process is as follows: Determine whether the timestamp is within the allowed range. If not, verification fails. If yes, determine whether there is a unique identifier on the blockchain. If not, verification succeeds. If yes, verification fails.

[0011] The first node verification process of the present invention is as follows: First, verify whether the timestamp T is within the allowed range, otherwise reject. If T is within the allowed time, verify whether the ID exists on the blockchain new If ID new If it already exists, it means it has been registered and will be rejected and an error message will be returned to the user node. Otherwise, the verification is successful.

[0012] Preferably, the process in which the parent node assigns the private key matrix, identity matrix and private key to the new node is as follows: The parent node generates the private key matrix of the new node using the LATTE.Delegate algorithm and its own private key matrix, and generates the identity matrix and private key of the new node using the LATTE.Extract algorithm.

[0013] The parent node of the present invention uses its private key matrix and the LATTE.Delegate algorithm to generate the private key matrix S of the new node. new , use the LATTE.Extract algorithm to generate the private key sk of the new node new and the identity matrix A new The key is transmitted to the new node through a secure channel to prevent key leakage. The introduction of LATTE further solves the problem of complex key management and insufficient flexibility in the hierarchical structure, making the authentication mechanism more suitable for quantum security and multi-level trust management in large-scale blockchain networks.

[0014] Preferably, the cross-level verification process is as follows: The first user uses its first parent node and the second parent node of the second user to perform one-way verification on the second user. After the verification is successful, the second user verifies the identity of the first user in the same one-way authentication method. If the identity of the second user is confirmed, the authentication process is completed, and the authentication result and the current timestamp are uploaded to the blockchain.

[0015] Preferably, the one-way verification process is as follows: The first user sends a request to its first parent node for identity authentication with the second user, and the request information includes the unique identifiers of the first user and the second user and the current timestamp; the first parent node forwards the request to the second parent node of the second user, and the second parent node notifies the second user to perform identity authentication; The first user generates a random vector and calculates a commitment value, and sends the commitment value and a current timestamp to the first parent node; The first parent node will generate a challenge value using the Fiat-Shamir transform and send the challenge value to the first user and to the second user through the second parent node; The first user generates a response value using a private key and a challenge value to the first parent node; The first parent node sends the commitment value, the response value and the current timestamp to the second user via the second parent node; The second user recalculates the challenge value based on the acquired data, and if the new challenge value meets the verification condition, the identity of the first user is confirmed.

[0016] In the hierarchical distributed identity authentication, the verification is divided into two parts: cross-level verification and same-level verification. Both are implemented using lattice-based non-interactive zero-knowledge proofs, and the authentication results are uploaded to the blockchain. In this scheme, the generation of keys is passed down layer by layer. Therefore, there is a close relationship between the key of each user and the key of its parent node. In order to ensure the security and correctness of the authentication, cross-level authentication must be implemented through the parent node. The same-level authentication does not involve the relationship between superiors and subordinates, so the authentication is simpler and is completed directly between nodes at the same level without the intervention of the middle layer. In addition, the transmission of keys forms a trust chain between the parent node and the child node, and the identity authentication on the same trust chain only requires one-way authentication.

[0017] Preferably, the same-level verification process is as follows: it only needs to be performed directly between the two nodes of the first user and the second user. The first user initiates an authentication application and generates a challenge value at his own user node. The subsequent steps are the same as the cross-level verification process.

[0018] For same-level authentication, it only needs to be done directly between two nodes without involving the participation of other parent nodes or higher-level nodes.

[0019] A storage medium stores instructions, which, when executed, can implement a hierarchical distributed identity authentication method as described in any one of claims 7 to 9.

[0020] An electronic device comprises a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed, can implement a hierarchical distributed identity authentication method as described in any one of claims 7 to 9.

[0021] The beneficial effects of the present invention are as follows: by using the improved LATTE encryption scheme and the lattice-based NIZK, the authentication mechanism designed in this paper can achieve efficient identity authentication between nodes at different levels, while reducing communication overhead and improving security. The introduction of LATTE further solves the problems of complex key management and insufficient flexibility in the hierarchical structure, making the authentication mechanism more suitable for quantum security and multi-level trust management in large-scale blockchain networks. The transfer of keys forms a trust chain between the parent node and the child node, and identity authentication on the same trust chain only requires one-way authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1It is a flow chart of the method of the present invention.

[0023] Figure 2 It is a schematic diagram of the hierarchical structure framework of the present invention. DETAILED DESCRIPTION

[0024] Embodiment 1: This embodiment proposes a hierarchical distributed identity authentication method. Figure 1 , specifically including the following steps: S1, build a blockchain encryption environment, complete the system initialization settings, and the user performs hierarchical distributed registration in the blockchain encryption environment; the construction process of the blockchain encryption environment of the present invention is as follows: adopt a hierarchical structure framework, refer to Figure 2 The hierarchical structure framework includes the root level, the intermediate level and the user level. The root level is located at the top and is connected to several intermediate levels from top to bottom. The user level is connected to the intermediate level. The system initialization is performed at the root level, global parameters are generated, and the public part is uploaded to the blockchain. The root level is used as the key generation center KGC (root node) to select a large integer N, and the integer polynomial ring Rq=Z modulo q q [x] / x N +1, with a discrete Gaussian distribution D centered at 0 and with a standard deviation of σ σ ; KGC runs the LATTE.KeyGen algorithm to generate the master public key h and the master private key matrix S0; the master public key and the selected global parameters are made public and uploaded to the blockchain to ensure that all nodes and users can access these parameters and work in the same secure environment, and the key generation is passed down layer by layer.

[0025] Before a new user joins the present invention, he / she needs to send a registration request to a certain node and send his / her unique identifier ID NEW and timestamp T. The node will determine whether the identifier has been used and whether the timestamp T is valid. If both are valid, the registration is successful and the node will become the parent node of the new user.

[0026] The first node verification process of the present invention is as follows: First, verify whether the timestamp T is within the allowed range, otherwise reject. If T is within the allowed time, verify whether the ID exists on the blockchain new If ID new If it already exists, it means it has been registered and will be rejected and an error message will be returned to the user node. Otherwise, the verification is successful.

[0027] The parent node of the present invention uses its private key matrix and the LATTE.Delegate algorithm to generate the private key matrix S of the new node. new , use the LATTE.Extract algorithm to generate the private key sk of the new nodenew and the identity matrix A new The key is transmitted to the new node through a secure channel to prevent key leakage. The introduction of LATTE further solves the problem of complex key management and insufficient flexibility in the hierarchical structure, making the authentication mechanism more suitable for quantum security and multi-level trust management in large-scale blockchain networks.

[0028] The specific process of the registration phase is as follows: before a new user joins, he / she must send a registration request to a certain node, which will become the parent node of the new user.

[0029] Step 1: The new user node selects a unique identity ID new , and generates the current timestamp T, with ID new Sent together to the parent node to submit the registration application.

[0030] Step 2: After receiving the application, the parent node first verifies whether the timestamp T is within the allowed range. If T is within the allowed time, it verifies whether the ID exists on the blockchain. new , otherwise reject. If ID new If it already exists, it means it has been registered and will be rejected and an error message will be returned to the user node.

[0031] Step 3: The parent node uses its private key matrix and the LATTE.Delegate algorithm to generate the private key matrix Snew of the new node, and uses the LATTE.Extract algorithm to generate the private key sk of the new node new and the identity matrix A new and transmitted to the new node through a secure channel to prevent the key from being leaked.

[0032] Step 4: The parent node converts the identity matrix A of the new node new And the registration proof is uploaded to the blockchain to ensure the transparency and verifiability of the registration process.

[0033] S2, when two users authenticate each other, for example, the first user authenticates the identity of the second user, first determine whether the second user and the first user are at the same level, if so, perform same-level authentication; if not, consider that the second user and the first user are at different levels, and proceed to S3; S3, using the parent node when the second user and the first user registered to perform cross-level verification.

[0034] The authentication mechanism of the present invention can realize efficient identity authentication between nodes at different levels, while reducing communication overhead and improving security.

[0035] This embodiment also provides a storage medium storing instructions capable of implementing the above-mentioned hierarchical distributed identity authentication method.

[0036] This embodiment also proposes an electronic device, including a processor and a memory, wherein the memory stores instructions or programs that can be run on the processor, and when the instructions or programs are executed, the above-mentioned hierarchical distributed identity authentication method is implemented.

[0037] Embodiment 2: This embodiment optimizes cross-level authentication based on embodiment 1 and proposes a hierarchical distributed identity authentication method. Figure 1 , specifically including the following steps: S1, build a blockchain encryption environment, complete the system initialization settings, and the user performs hierarchical distributed registration in the blockchain encryption environment; the construction process of the blockchain encryption environment of the present invention is as follows: adopt a hierarchical structure framework, refer to Figure 2 The hierarchical structure framework includes the root level, the intermediate level and the user level. The root level is located at the top and is connected to several intermediate levels from top to bottom. The user level is connected to the intermediate level. The system initialization is performed at the root level, global parameters are generated, and the public part is uploaded to the blockchain. The root level is used as the key generation center KGC (root node) to select a large integer N, and the integer polynomial ring Rq=Z modulo q q [x] / x N +1, with a discrete Gaussian distribution D centered at 0 and with a standard deviation of σ σ ; KGC runs the LATTE.KeyGen algorithm to generate the master public key h and the master private key matrix S0; the master public key and the selected global parameters are made public and uploaded to the blockchain to ensure that all nodes and users can access these parameters and work in the same secure environment, and the key generation is passed down layer by layer.

[0038] Before a new user joins the present invention, he / she needs to send a registration request to a certain node and send his / her unique identifier ID NEW and timestamp T. The node will determine whether the identifier has been used and whether the timestamp T is valid. If both are valid, the registration is successful and the node will become the parent node of the new user.

[0039] The first node verification process of the present invention is as follows: First, verify whether the timestamp T is within the allowed range, otherwise reject. If T is within the allowed time, verify whether the ID exists on the blockchain new If ID new If it already exists, it means it has been registered and will be rejected and an error message will be returned to the user node. Otherwise, the verification is successful.

[0040] The parent node of the present invention uses its private key matrix and the LATTE.Delegate algorithm to generate the private key matrix S of the new node. new, use the LATTE.Extract algorithm to generate the private key sk of the new node new and the identity matrix A new The key is transmitted to the new node through a secure channel to prevent key leakage. The introduction of LATTE further solves the problem of complex key management and insufficient flexibility in the hierarchical structure, making the authentication mechanism more suitable for quantum security and multi-level trust management in large-scale blockchain networks.

[0041] The specific process of the registration phase is as follows: before a new user joins, he / she must send a registration request to a certain node, which will become the parent node of the new user.

[0042] Step 1: The new user node selects a unique identity ID new , and generates the current timestamp T, with ID new Sent together to the parent node to submit the registration application.

[0043] Step 2: After receiving the application, the parent node first verifies whether the timestamp T is within the allowed range. If T is within the allowed time, it verifies whether the ID exists on the blockchain. new , otherwise reject. If ID new If it already exists, it means it has been registered and will be rejected and an error message will be returned to the user node.

[0044] Step 3: The parent node uses its private key matrix and the LATTE.Delegate algorithm to generate the private key matrix Snew of the new node, and uses the LATTE.Extract algorithm to generate the private key sk of the new node new and the identity matrix A new and transmitted to the new node through a secure channel to prevent the key from being leaked.

[0045] Step 4: The parent node converts the identity matrix A of the new node new And the registration proof is uploaded to the blockchain to ensure the transparency and verifiability of the registration process.

[0046] S2, when two users authenticate each other, for example, the first user authenticates the identity of the second user, first determine whether the second user and the first user are at the same level, if so, perform same-level authentication; if not, consider that the second user and the first user are at different levels, and proceed to S3; S3, using the parent node when the second user and the first user registered to perform cross-level verification.

[0047] The authentication mechanism of the present invention can realize efficient identity authentication between nodes at different levels, while reducing communication overhead and improving security.

[0048] In the hierarchical distributed identity authentication, the verification is divided into two parts: cross-level verification and same-level verification. Both are implemented using lattice-based non-interactive zero-knowledge proofs, and the authentication results are uploaded to the blockchain. In this scheme, the generation of keys is passed down layer by layer. Therefore, there is a close relationship between the key of each user and the key of its parent node. In order to ensure the security and correctness of the authentication, cross-level authentication must be implemented through the parent node. The same-level authentication does not involve the relationship between superiors and subordinates, so the authentication is simpler and is completed directly between nodes at the same level without the intervention of the middle layer. In addition, the transmission of keys makes a trust chain between the parent node and the child node, and the identity authentication on the same trust chain only requires one-way authentication. Here we take the cross-level authentication (user A and user B) on different trust chains as an example to illustrate the complete process.

[0049] Step 1: User A sends a request to its parent node P A Send an authentication request, indicating that identity authentication is required with user B. The request information contains user A's identity ID. A , the target user B's identity ID B and the current timestamp T A .P A After receiving the request from user A, forward the request to user B's parent node P B .P B After receiving the request, user B is notified to perform identity authentication.

[0050] Step 2: User A proves his identity to user B. User A generates a random vector v A , and calculate the commitment value c A , and then the commitment value c A and timestamp T A Submit to its parent node.

[0051] c A =A A ·v A mod q.

[0052] Among them, A A is the identity matrix of user A.

[0053] Step 3: P A Generate challenge using Fiat-Shamir transform A , set the challenge value e A Sent to users A and P B , by P B E A Forwarded to user B.

[0054] e A =H(c A ,TA ,block_hash,A A ).

[0055] Where block_hash is the hash of the latest block on the blockchain.

[0056] Step 4: User A receives e A Later, use your own private key sk A Calculate a response value r A , and r A Sent to the parent node.

[0057] r A =v A +e A ·sk A .

[0058] Step 5: P A User A's certificate (c A ,r A ,T A ) and send it to P B , P B The received (c A ,r A ,T A ) is sent to user B.

[0059] Step 6: User B receives P B Proof (c A ,r A ,T A ) and then verify T A And the validity of the block hash block_hash. Then recalculate the challenge value e A '=H(c A ,T A ,block_hash,A A ), verify A A ·r A =c A +e A '·y A Is mod q true? If so, the verification is successful and the identity of user A is confirmed.

[0060] Among them, y A Obtained and published in the LATTE.Extract algorithm.

[0061] Step 7: Repeat the above steps to verify the identity of user B. If the identity of user B is also successfully verified, the authentication process is completed. The authentication result and timestamp are uploaded to the blockchain to ensure that the results are open and transparent for easy auditing.

[0062] This embodiment also provides a storage medium storing instructions capable of implementing the above-mentioned hierarchical distributed identity authentication method.

[0063] This embodiment also proposes an electronic device, including a processor and a memory, wherein the memory stores instructions or programs that can be run on the processor, and when the instructions or programs are executed, the above-mentioned hierarchical distributed identity authentication method is implemented.

[0064] Embodiment 3: This embodiment optimizes the layered authentication based on the embodiment 2 and proposes a layered distributed identity authentication method. Figure 1 , specifically including the following steps: S1, build a blockchain encryption environment, complete the system initialization settings, and the user performs hierarchical distributed registration in the blockchain encryption environment; the construction process of the blockchain encryption environment of the present invention is as follows: adopt a hierarchical structure framework, refer to Figure 2 The hierarchical structure framework includes the root level, the intermediate level and the user level. The root level is located at the top and is connected to several intermediate levels from top to bottom. The user level is connected to the intermediate level. The system initialization is performed at the root level, global parameters are generated, and the public part is uploaded to the blockchain. The root level is used as the key generation center KGC (root node) to select a large integer N, and the integer polynomial ring Rq=Z modulo q q [x] / x N +1, with a discrete Gaussian distribution D centered at 0 and with a standard deviation of σ σ ; KGC runs the LATTE.KeyGen algorithm to generate the master public key h and the master private key matrix S0; the master public key and the selected global parameters are made public and uploaded to the blockchain to ensure that all nodes and users can access these parameters and work in the same secure environment, and the key generation is passed down layer by layer.

[0065] Before a new user joins the present invention, he / she needs to send a registration request to a certain node and send his / her unique identifier ID NEW and timestamp T. The node will determine whether the identifier has been used and whether the timestamp T is valid. If both are valid, the registration is successful and the node will become the parent node of the new user.

[0066] The first node verification process of the present invention is as follows: First, verify whether the timestamp T is within the allowed range, otherwise reject. If T is within the allowed time, verify whether the ID exists on the blockchain new If ID new If it already exists, it means it has been registered and will be rejected and an error message will be returned to the user node. Otherwise, the verification is successful.

[0067] The parent node of the present invention uses its private key matrix and the LATTE.Delegate algorithm to generate the private key matrix S of the new node. new , use the LATTE.Extract algorithm to generate the private key sk of the new node new and the identity matrix A new The key is transmitted to the new node through a secure channel to prevent key leakage. The introduction of LATTE further solves the problem of complex key management and insufficient flexibility in the hierarchical structure, making the authentication mechanism more suitable for quantum security and multi-level trust management in large-scale blockchain networks.

[0068] The specific process of the registration phase is as follows: before a new user joins, he / she must send a registration request to a certain node, which will become the parent node of the new user.

[0069] Step 1: The new user node selects a unique identity ID new , and generates the current timestamp T, with ID new Sent together to the parent node to submit the registration application.

[0070] Step 2: After receiving the application, the parent node first verifies whether the timestamp T is within the allowed range. If T is within the allowed time, it verifies whether the ID exists on the blockchain. new , otherwise reject. If ID new If it already exists, it means it has been registered and will be rejected and an error message will be returned to the user node.

[0071] Step 3: The parent node uses its private key matrix and the LATTE.Delegate algorithm to generate the private key matrix Snew of the new node, and uses the LATTE.Extract algorithm to generate the private key sk of the new node new and the identity matrix A new and transmitted to the new node through a secure channel to prevent the key from being leaked.

[0072] Step 4: The parent node converts the identity matrix A of the new node new And the registration proof is uploaded to the blockchain to ensure the transparency and verifiability of the registration process.

[0073] S2, when two users authenticate each other, for example, the first user authenticates the identity of the second user, first determine whether the second user and the first user are at the same level, if so, perform same-level authentication; if not, consider that the second user and the first user are at different levels, and proceed to S3; S3, using the parent node when the second user and the first user registered to perform cross-level verification.

[0074] The authentication mechanism of the present invention can realize efficient identity authentication between nodes at different levels, while reducing communication overhead and improving security.

[0075] In the hierarchical distributed identity authentication, the verification is divided into two parts: cross-level verification and same-level verification. Both are implemented using lattice-based non-interactive zero-knowledge proofs, and the authentication results are uploaded to the blockchain. In this scheme, the generation of keys is passed down layer by layer. Therefore, there is a close relationship between the key of each user and the key of its parent node. In order to ensure the security and correctness of the authentication, cross-level authentication must be implemented through the parent node. The same-level authentication does not involve the relationship between superiors and subordinates, so the authentication is simpler and is completed directly between nodes at the same level without the intervention of the middle layer. In addition, the transmission of keys makes a trust chain between the parent node and the child node, and the identity authentication on the same trust chain only requires one-way authentication. Here we take the cross-level authentication (user A and user B) on different trust chains as an example to illustrate the complete process.

[0076] Step 1: User A sends a request to its parent node P A Send an authentication request, indicating that identity authentication is required with user B. The request information contains user A's identity ID. A , the target user B's identity ID B and the current timestamp T A .P A After receiving the request from user A, forward the request to user B's parent node P B .P B After receiving the request, user B is notified to perform identity authentication.

[0077] Step 2: User A proves his identity to user B. User A generates a random vector v A , and calculate the commitment value c A , and then the commitment value c A and timestamp T A Submit to its parent node.

[0078] c A =A A ·v A mod q.

[0079] Among them, A A is the identity matrix of user A.

[0080] Step 3: P A Generate challenge using Fiat-Shamir transform A , set the challenge value e A Sent to users A and P B , by P B EA Forwarded to user B.

[0081] e A =H(c A ,T A ,block_hash,A A ).

[0082] Where block_hash is the hash of the latest block on the blockchain.

[0083] Step 4: User A receives e A Later, use your own private key sk A Calculate a response value r A , and r A Sent to the parent node.

[0084] r A =v A +e A ·sk A .

[0085] Step 5: P A User A's certificate (c A ,r A ,T A ) and send it to P B , P B The received (c A ,r A ,T A ) is sent to user B.

[0086] Step 6: User B receives P B Proof (c A ,r A ,T A ) and then verify T A And the validity of the block hash block_hash. Then recalculate the challenge value e A '=H(c A ,T A ,block_hash,A A ), verify A A ·r A =c A +e A '·y A Is mod q true? If so, the verification is successful and the identity of user A is confirmed.

[0087] Among them, y A Obtained and published in the LATTE.Extract algorithm.

[0088] Step 7: Repeat the above steps to verify the identity of user B. If the identity of user B is also successfully verified, the authentication process is completed. The authentication result and timestamp are uploaded to the blockchain to ensure that the results are open and transparent for easy auditing.

[0089] For authentication at the same level, it only needs to be done directly between two nodes without involving other parent nodes or higher-level nodes. The user initiates the authentication application by himself, and generates the challenge value in Step 3. Taking user A and user D as an example, the details are as follows: Step 1: User A sends an authentication request to user D, indicating that identity authentication is required with user D. The request information contains user A's identity ID A , the target user D's identity ID D and the current timestamp T A .

[0090] Step 2: User A proves his identity to user D. User A generates a random vector v A , and calculate the commitment value c A , and then the commitment value c A and timestamp T A Submit to user D.

[0091] c A =A A ·v A mod q.

[0092] Among them, A A is the identity matrix of user A.

[0093] Step 3: User A generates a challenge e using the Fiat-Shamir transform A , set the challenge value e A Sent to user D.

[0094] e A =H(c A ,T A ,Dlock_hash,A A ).

[0095] Where Dlock_hash is the hash of the latest block on the blockchain.

[0096] Step 4: User A calculates e A Later, use your own private key sk A Calculate a response value r A , and r A Sent to user D.

[0097] r A =v A +eA ·sk A .

[0098] Step 5: User A sends the certificate of user A (c A ,r A ,T A ) is sent to user D.

[0099] Step 6: User D receives the certificate from user A (c A ,r A ,T A ) and then verify T A and the validity of the block hash Dlock_hash. Then recalculate the challenge value e A '=H(c A ,T A ,Dlock_hash,A A ), verify A A ·r A =c A +e A '·y A Is mod q true? If so, the verification is successful and the identity of user A is confirmed.

[0100] Among them, y A Obtained and published in the LATTE.Extract algorithm.

[0101] Step 7: Repeat the above steps to verify the identity of user D. If the identity of user D is also successfully verified, the authentication process is completed. The authentication result and timestamp are uploaded to the blockchain to ensure that the results are open and transparent for easy auditing.

[0102] This embodiment also provides a storage medium storing instructions capable of implementing the above-mentioned hierarchical distributed identity authentication method.

[0103] This embodiment also proposes an electronic device, including a processor and a memory, wherein the memory stores instructions or programs that can be run on the processor, and when the instructions or programs are executed, the above-mentioned hierarchical distributed identity authentication method is implemented.

Claims

1. A hierarchical distributed identity authentication method, characterized in that: The following steps are involved: S1, build a blockchain encryption environment and complete user hierarchical distributed registration; S2, when the first user asks the second user for identity authentication, determine whether the first user and the second user are at the same level, if so, perform same-level verification; if not, proceed to S3; S3, using the parent node when the first user and the second user registered to perform cross-level verification.

2. A hierarchical distributed identity authentication method according to claim 1, characterized in that: The process of building a blockchain encryption environment is as follows: A hierarchical structure framework including a root layer, an intermediate layer and a user layer is adopted. The root layer is connected to several levels of intermediate layers, and the intermediate layer is connected to the user layer. Global parameters are generated at the root layer and the public part is uploaded to the blockchain. The generation of keys is passed down layer by layer.

3. A hierarchical distributed identity authentication method according to claim 2, characterized in that: The process of user hierarchical distributed registration is as follows: The new user sends a unique identifier and timestamp to the first node in the middle layer at the user layer to make a registration request. After the first node passes the verification, it becomes the parent node of the new user. The new user becomes a new node. The parent node assigns the new node a private key matrix, an identity matrix and a private key, and uploads the identity matrix and registration certificate to the blockchain.

4. A hierarchical distributed identity authentication method according to claim 3, characterized in that: The first node verification process is as follows: Determine whether the timestamp is within the allowed range. If not, verification fails. If yes, determine whether there is a unique identifier on the blockchain. If not, verification succeeds. If yes, verification fails.

5. A hierarchical distributed identity authentication method according to claim 3, characterized in that: The process of the parent node assigning the new node the private key matrix, identity matrix and private key is as follows: The parent node generates the private key matrix of the new node using the LATTE.Delegate algorithm and its own private key matrix, and generates the identity matrix and private key of the new node using the LATTE.Extract algorithm.

6. A hierarchical distributed identity authentication method according to any one of claims 3 to 5, characterized in that: The cross-level verification process is as follows: The first user uses its first parent node and the second parent node of the second user to perform one-way verification on the second user. After the verification is successful, the second user verifies the identity of the first user in the same one-way authentication method. If the identity of the second user is confirmed, the authentication process is completed, and the authentication result and the current timestamp are uploaded to the blockchain.

7. A hierarchical distributed identity authentication method according to claim 6, characterized in that: The one-way verification process is as follows: the first user sends a request to its first parent node to perform identity authentication with the second user, and the request information includes the unique identifiers of the first user and the second user and the current timestamp; the first parent node forwards the request to the second parent node of the second user, and the second parent node notifies the second user to perform identity authentication; The first user generates a random vector and calculates a commitment value, and sends the commitment value and a current timestamp to the first parent node; The first parent node will generate a challenge value using the Fiat-Shamir transform and send the challenge value to the first user and to the second user through the second parent node; The first user generates a response value using a private key and a challenge value to the first parent node; The first parent node sends the commitment value, the response value and the current timestamp to the second user via the second parent node; The second user recalculates the challenge value based on the acquired data, and if the new challenge value meets the verification condition, the identity of the first user is confirmed.

8. A hierarchical distributed identity authentication method according to claim 7, characterized in that: The same-level verification process is as follows: it only needs to be carried out directly between the two nodes of the first user and the second user. The first user initiates an authentication application by himself and generates a challenge value at his own user node. The subsequent steps are the same as the cross-level verification process.

9. A storage medium storing instructions, wherein when the instructions are executed, the characteristics are: A hierarchical distributed identity authentication method as described in claim 7 or 8 can be implemented.

10. An electronic device comprising a processor and a memory and a program or instruction stored in the memory and executable on the processor, characterized in that: When the program or instruction is executed, it can implement a hierarchical distributed identity authentication method as described in claim 7 or 8.

Images