A Blockchain-Assisted Cross-Domain Identity Authentication Method and System Based on Merkle Signatures

Abstract

This invention belongs to the field of industrial IoT information security technology, and discloses a blockchain-assisted cross-domain identity authentication method and system for industrial IoT devices based on improved Merkle signatures. The method includes four core steps: system initialization, identity registration, cross-domain identity authentication, and key negotiation. This invention improves the Merkle signature scheme through a blockchain-assisted cross-domain authentication architecture and block structure design, employing strategies such as parameterization, pre-allocation of key and signature verification paths, and message pre-encoding to complete identity authentication between devices in different management domains and negotiate and generate session keys. It allows for flexible performance adjustments for different IoT scenarios, with low computational and storage costs, thus achieving flexible, efficient, secure, and low-latency cross-domain identity authentication for industrial IoT devices.

Description

Technical Field

[0001] This invention relates to the field of industrial Internet of Things (IoT) information security technology, and more specifically, to a blockchain-assisted cross-domain identity authentication method and system based on Merkle signatures. Background Technology

[0002] The Industrial Internet of Things (IIoT), comprising interconnected sensors, instruments, and devices integrated with industrial applications, plays a crucial role in addressing various industry-related challenges, such as smart manufacturing and improved productivity. IIoT devices are typically deployed in remote, distributed environments and divided into different management domains. As industrial processes become increasingly complex, collaboration between multiple management domains is critical. Because adversaries can gain unauthorized access to networks to inject forged data, industrial security principles require these domains to remain relatively independent, with access to sensitive data limited to authorized entities. Therefore, ensuring secure cross-domain authentication between IIoT devices is essential for facilitating safe and efficient smart industrial production.

[0003] To address this situation, traditional authentication mechanisms have been widely proposed, such as public key infrastructure (PKI) schemes and identity-based cryptography (IBC) schemes. However, these schemes rely on centralized institutions, and the exponential growth in the scale of the Industrial Internet of Things (IIoT) has led to enormous overhead in managing certificates, increasing the risk of single points of failure. Furthermore, due to significant differences in network architecture, device computing, and storage resources across management domains, these schemes exhibit poor cross-domain adaptability.

[0004] The decentralized and tamper-proof nature of blockchain makes it possible to establish collaborative relationships in trustless distributed networks. Consortium blockchains allow multiple organizations to jointly maintain a distributed ledger, making them particularly suitable for cross-domain authentication. However, a significant problem with these methods is the frequent query and update operations; due to the communication and time costs of consensus, these schemes are not feasible in IoT environments.

[0005] In summary, the problems with existing technologies are:

[0006] (1) In the context of industrial IoT with complex environment and limited resources, the centralized nodes in the traditional PKI-based authentication system may be overloaded in cross-domain communication, resulting in low efficiency of certificate and key management. At the same time, these schemes have poor adaptability between different network architectures and domains with limited computing and storage resources.

[0007] (2) Existing blockchain-based authentication schemes have solved the problem of centralized authentication, but they generally suffer from frequent ledger query and update operations. Due to the high communication and time costs of consensus, these schemes are difficult to apply directly to the Industrial Internet of Things.

[0008] (3) Existing cross-domain authentication methods often combine blockchain with traditional authentication mechanisms. However, in the authentication process based on PKI and IBC, frequent bilinear pairing and elliptic curve multiplication greatly increase the computational load and may even require dedicated hardware. In addition, homomorphic encryption-based schemes are often unsuitable for resource-constrained IoT environments. In contrast, authentication schemes based on Merkle signatures rely solely on secure cryptographic hash functions, thus simplifying the implementation process and accelerating authentication across heterogeneous domains. With the rapid development of quantum computing, quantum-safe Merkle signature schemes can provide long-term security for IoT devices with long lifecycles. However, current similar schemes lack adaptability in heterogeneous management domains with different real-time and storage limitations, resulting in high computational or storage costs. Summary of the Invention

[0009] To address the problems existing in the prior art, this invention provides a blockchain-assisted cross-domain identity authentication method for industrial IoT devices based on Merkle signatures. The technical solution is as follows:

[0010] The first aspect of this invention provides a blockchain-assisted cross-domain identity authentication method for industrial IoT devices based on improved Merkle signatures. Through a blockchain-assisted cross-domain authentication architecture and block structure design, an improved Merkle signature scheme is used to complete identity authentication between devices in different management domains, and a session key is negotiated to achieve secure, reliable, and efficient cross-domain authentication and communication. The cross-domain identity authentication method includes the following steps:

[0011] The system initialization steps involve nodes in each domain determining common parameters, including blockchain system common parameters and cryptographic schemes, and authentication proxy servers in each domain generating signature key sequences and master public keys according to the Merkle signature scheme and uploading them to the blockchain network.

[0012] In the identity registration process, the industrial IoT device generates a key seed and requests the domain authentication proxy server to generate the complete key required for cross-domain authentication. The domain authentication proxy server generates a device pseudonym and key pair based on the request, uploads them to the blockchain network, and distributes the key pair to the corresponding industrial IoT device. The industrial IoT device then verifies the validity of the key.

[0013] The cross-domain authentication process involves the following steps: A first industrial IoT device located in one management domain signs the authentication request to be sent, and then sends the authentication request with the attached signature and signature verification path to a second industrial IoT device in another management domain. The second industrial IoT device performs a timeliness check on the received authentication request. If the check passes, it forwards the authentication request to the domain authentication proxy server in its own management domain. Subsequently, it calculates the estimated master public key of the first industrial IoT device based on the signature, queries the public key of the first industrial IoT device in the blockchain ledger through the domain authentication proxy server in its own management domain, and calculates a partial session key. Then, it returns the master public key and partial session key of the first industrial IoT device to the second industrial IoT device. The second industrial IoT device verifies whether the received master public key is equal to the estimated master public key of the first industrial IoT device. If they are equal, it attaches the partial session key to the authentication confirmation message and returns it to the first industrial IoT device, requesting the first industrial IoT device to perform authentication. The signature verification path and partial session key are obtained by the first industrial IoT device from the domain authentication proxy server in its own management domain before sending the authentication request.

[0014] In the key negotiation step, the second industrial IoT device calculates the complete session key based on the partial session key. After receiving the authentication confirmation message, the first industrial IoT device performs timeliness and legality checks on the received authentication confirmation message, and then calculates the complete session key based on the partial session key in the authentication confirmation message.

[0015] In one embodiment, the blockchain-assisted cross-domain authentication architecture consists of an entity layer, a proxy layer, and a blockchain layer. The entity layer includes industrial IoT devices and domain authentication proxy servers. The proxy layer includes blockchain proxy servers in all domains. The blockchain layer is a consortium blockchain abstraction layer composed of domain authentication proxy server nodes and blockchain proxy server nodes, and includes two parts: a blockchain ledger and smart contracts.

[0016] In one implementation, the blockchain-assisted cross-domain authentication architecture specifically includes the following components:

[0017] Industrial IoT devices are used to perform signature generation or verification during cross-domain authentication processes;

[0018] Domain proxy authentication server is used to manage identities within its domain and participate in the blockchain network. When the local blockchain view is incomplete, it forwards query requests to the blockchain network.

[0019] A blockchain proxy server is established, with all blockchain proxy servers jointly maintaining the consortium blockchain and retaining a complete copy of the blockchain ledger. Cross-domain authentication credentials are sent to the blockchain proxy server through the domain proxy authentication server and uploaded or updated to the blockchain ledger. The blockchain proxy server provides blockchain query services for inter-domain authentication, searching for the corresponding target device's cross-domain authentication credentials in the blockchain ledger when a new cross-domain authentication request is verified or a blockchain view is missing. The cross-domain authentication credentials include the device's ID and master public key.

[0020] A blockchain ledger is used to store cross-domain records and cross-domain identity credentials of nodes within each domain.

[0021] Smart contracts are advanced functional interfaces that run on blockchain systems, providing interfaces for uploading, updating, querying, and deleting identity credentials, as well as public key query interfaces.

[0022] In one implementation, the block structure design employs a nested Merkle-Prefix tree structure. While storing cross-domain authentication credentials for the block storage node, the nested Merkle-Prefix tree also stores and enables fast indexing of hash public key information. The nested Merkle-Prefix tree is part of a perfect binary balanced tree. Each non-leaf node in the tree contains a prefix root of a subtree rooted at that node. The prefix root's corresponding prefix tree summarizes the cross-domain authentication credentials of devices in different domains under the current non-leaf node in dictionary order of device ID. This prefix root, together with the time-updated authentication credential information digest, is digested to obtain the state root. The state root, along with the block number, the previous block hash, the current block hash, and the timestamp, is included in the block header of the block structure design.

[0023] In one implementation, the system initialization step includes:

[0024] S101: Common parameters are determined among nodes in each domain, including common parameters of the blockchain system and cryptographic schemes; all nodes participating in the cross-domain authentication system share the signature parameter w and the one-way secure hash function and the second-preimage resistant secure hash function. , Where n is the number of bits in the output of the message digest hash function, and m is the number of bits in the output of other hash functions;

[0025] S102: Domain authentication proxy server within each domain Randomly select a seed of length m bits and generate a seed sequence using a pseudo-random number generator. ,in Given the height of the Merkle tree, calculate ,in The number of key blocks, for each seed in the seed sequence. Using a pseudo-random number generator to generate A random number is used as the private key. Calculate the public key Obtain the private key sequence and public key sequence ,in, , ,Will As leaf nodes of a Merkle tree, a domain authentication proxy server is constructed. public key Subsequently Will Uploaded to the blockchain ledger, where for Device identifier, These are common parameters for domain A.

[0026] In one implementation, the identity registration step includes:

[0027] S201: First Industrial IoT Device to be Registered Generate random numbers ,send Domain authentication proxy server to this management domain ,in For the first industrial IoT device The device identifier;

[0028] S202: use Generate key seed sequence ,in Where q is a positive integer, for The latest private key, k is a fixed key generation parameter and is a positive integer; based on Generate Merkle key pairs and the master key ; Calculate kana ;

[0029] S203: right Obtain a signature by signing. ;

[0030] S204: Upload to blockchain proxy server Execute the query contract; when the query is successful, it will... Return to ,in for arrive The signature verification path;

[0031] S205: Received Then, use from The path verification process begins to obtain the estimated value of the master public key. , among which, when The key is considered valid at that time.

[0032] In one implementation, the cross-domain identity authentication step includes:

[0033] S301: The first industrial IoT device located in management domain A To the first industrial IoT device located in management domain B Before requesting authentication, please... Request the next verification path and part of the session key Similarly, located in management domain B Before certification Request the next verification path , ,in It is a random number. Elliptic curve generation base point;

[0034] S302: Perform message precoding, the specific method is as follows: Generate a random number Calculate the current summary and checksum ,in The timestamp is the first time the digest is calculated, and MSG is the message or command information to be sent. for After splitting the bits into their i-th groups, repeat the above steps R times to find a random number that minimizes the checksum. ;

[0035] S303: by For seed generation Subsequently generated signature ;

[0036] S304: Towards Send authentication request ,in For authentication identifiers, This is the current timestamp. for The katakana;

[0037] S305: After receiving the authentication request, determine and Whether it is true or false is used to check the timeliness of the message, among which The timestamp when the request was received. The message delay threshold is used to meet the timeliness requirement. Forward arrive ,in The result is a random number, which will then be... Divided into share Calculate the public key estimate ;

[0038] S306: Upon receiving the forwarded authentication request, first search in the local blockchain view. When a view is missing, the query message will be forwarded to the blockchain proxy server, which will then invoke the query contract to retrieve the view. and After successful query Calculate partial session key Then Return to ,in for Current signature verification path;

[0039] S307: After receiving a valid result, according to and calculate Master key estimation ,if If the authentication is successful, then one-way identity authentication is successful; otherwise... An alert will be uploaded;

[0040] S308: Perform the same process as S302 to S304, and send. arrive ,in Include Valid signature and ; Perform the same procedure as S305 to S307, and successfully verify. Two-way authentication was successful after signing.

[0041] In one implementation, the key negotiation step includes:

[0042] After step S306 is completed, Calculate session key And return to ; Successfully verified Forward the message arrive ,in For key negotiation request identifier, Calculate session key ,because , and Shared temporary session key .

[0043] Based on the same inventive concept, a second aspect of this invention provides a blockchain-assisted cross-domain identity authentication system based on Merkle signatures, implemented using a blockchain-assisted cross-domain authentication architecture and block structure. The blockchain-assisted cross-domain identity authentication system includes:

[0044] The system initialization module is used by nodes in each domain to determine common parameters, including common parameters of the blockchain system and cryptographic schemes. Each domain authentication proxy server generates a signature key sequence and a master public key according to the Merkle signature scheme and uploads them to the blockchain network.

[0045] The identity registration module is used by industrial IoT devices to generate key seeds and request the domain authentication proxy server to generate the complete key required for cross-domain communication. The domain authentication proxy server generates a device pseudonym and key pair based on the request, uploads them to the blockchain network, and distributes the key pair to the corresponding industrial IoT devices. The industrial IoT devices then verify the validity of the key.

[0046] The cross-domain authentication module is used to sign the authentication request to be sent by a first industrial IoT device located in one management domain, and then send the authentication request with the attached signature and signature verification path to a second industrial IoT device in another management domain. The second industrial IoT device performs a timeliness check on the received authentication request. If it passes the timeliness check, it forwards the authentication request to the domain authentication proxy server of its own management domain. Then, it calculates the estimated master public key of the first industrial IoT device based on the signature, queries the public key of the first industrial IoT device in the blockchain ledger through the domain authentication proxy server of its own management domain, and calculates a partial session key. Then, it returns the master public key and partial session key of the first industrial IoT device to the second industrial IoT device. The second industrial IoT device verifies whether the received master public key is equal to the estimated master public key of the first industrial IoT device. If they are equal, it attaches the partial session key to the authentication confirmation message and returns it to the first industrial IoT device, requesting the first industrial IoT device to perform authentication. The signature verification path and partial session key are obtained by the first industrial IoT device from the domain authentication proxy server of its own management domain before sending the authentication request.

[0047] The key negotiation module is used by the second industrial IoT device to calculate the complete session key based on a partial session key. After receiving the authentication confirmation message, the first industrial IoT device performs timeliness and legality checks on the received authentication confirmation message, and then calculates the complete session key based on the partial session key in the authentication confirmation message.

[0048] In one embodiment, the blockchain-assisted cross-domain authentication architecture consists of an entity layer, a proxy layer, and a blockchain layer. The entity layer includes industrial IoT devices and domain authentication proxy servers. The proxy layer includes blockchain proxy servers in all domains. The blockchain layer is a consortium blockchain abstraction layer composed of domain authentication proxy server nodes and blockchain proxy server nodes, and includes two parts: a blockchain ledger and smart contracts.

[0049] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0050] This invention provides a blockchain-assisted cross-domain identity authentication method for industrial IoT devices based on improved Merkle signatures. The method comprises four core steps: system initialization, identity registration, cross-domain identity authentication, and key negotiation. Through a blockchain-assisted cross-domain authentication architecture and block structure design, this invention improves the Merkle signature scheme using strategies such as parameterization, pre-allocation of key and signature verification paths, and message pre-encoding to complete identity authentication between devices in different management domains and negotiate and generate session keys. It allows for flexible performance adjustments for different IoT scenarios, with low computational and storage costs, thereby achieving flexible, efficient, secure, and low-latency cross-domain identity authentication for industrial IoT devices. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 This is a schematic diagram of a blockchain-assisted cross-domain authentication architecture provided in an embodiment of the present invention.

[0053] Figure 2 This is a schematic diagram of each step in the blockchain-assisted cross-domain identity authentication method for industrial IoT devices based on improved Merkle signatures provided in this embodiment of the invention.

[0054] In the diagram: S1, System initialization steps. S2, Identity registration steps. S3, Cross-domain authentication steps. S4, Key negotiation steps. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] Example 1

[0057] This embodiment discloses a blockchain-assisted cross-domain identity authentication method based on Merkle signatures. It is implemented based on a blockchain-assisted cross-domain authentication architecture and block structure. The blockchain-assisted cross-domain identity authentication method includes:

[0058] S1: System initialization steps, each node in the domain determines the public parameters, including the public parameters of the blockchain system and the cryptographic scheme, and each domain authentication proxy server generates a signature key sequence and a master public key according to the Merkle signature scheme and uploads them to the blockchain network;

[0059] S2: Identity registration step. The industrial IoT device generates a key seed and requests the domain authentication proxy server to generate the complete key required for cross-domain authentication. The domain authentication proxy server generates a device pseudonym and key pair based on the request, uploads them to the blockchain network, and distributes the key pair to the corresponding industrial IoT device. Then, the industrial IoT device verifies the validity of the key.

[0060] S3: Cross-domain authentication step. The first industrial IoT device located in one management domain signs the authentication request to be sent, and then sends the authentication request with the attached signature and signature verification path to a second industrial IoT device in another management domain. The second industrial IoT device performs a timeliness check on the received authentication request. If it passes the timeliness check, it forwards the authentication request to the domain authentication proxy server of its own management domain. Then, it calculates the estimated master public key of the first industrial IoT device based on the signature. It calls the interface of the domain authentication proxy server of its own management domain to query the public key of the first industrial IoT device in the blockchain ledger and calculates a partial session key. Then, it returns the master public key and partial session key of the first industrial IoT device to the second industrial IoT device. The second industrial IoT device verifies whether the received master public key is equal to the estimated master public key of the first industrial IoT device. If they are equal, it attaches the partial session key to the authentication confirmation message and returns it to the first industrial IoT device, requesting the first industrial IoT device to perform authentication. The signature verification path and partial session key are obtained by the first industrial IoT device from the domain authentication proxy server of its own management domain before sending the authentication request.

[0061] S4: Key negotiation step, the second industrial IoT device calculates the complete session key based on the partial session key, and after receiving the authentication confirmation message, the first industrial IoT device performs timeliness and legality checks on the received authentication confirmation message, and then calculates the complete session key based on the partial session key in the authentication confirmation message.

[0062] Specifically, the S3 cross-domain authentication process is performed between industrial IoT devices in two different management domains, such as the first industrial IoT device in management domain A. The second industrial IoT device in management domain B The first industrial IoT device located in management domain A To industrial IoT devices located in management domain B Before requesting authentication, It will send to the domain authentication proxy server The system requests the signature verification path and a portion of the session key required for authentication, then signs the authentication request to be sent to the device. Send an authentication request with a signature and signature verification path. Similarly, for the second industrial IoT device located in management domain B... To the first industrial IoT device located in management domain A Before requesting authentication, It will send to the domain authentication proxy server The signature verification path and part of the session key required for the authentication application.

[0063] It should be noted that in the "complete session key", the session key is the symmetric key used by both parties to encrypt messages transmitted in subsequent communications; the key in the "complete key" is the secret information used by both parties to achieve identity authentication, which in this invention refers to the public and private keys of the Merkle signature scheme.

[0064] In the key negotiation step of S4 device Upon receiving the authentication confirmation message, the message's legitimacy will be verified according to the verification method in step S3 (including validity checks, master public key estimation calculations, and comparisons).

[0065] In one implementation, such as Figure 1 As shown, the blockchain-assisted cross-domain authentication architecture consists of an entity layer, a proxy layer, and a blockchain layer. The entity layer includes industrial IoT devices and domain authentication proxy servers; the proxy layer includes blockchain proxy servers in all domains; and the blockchain layer is a consortium blockchain abstraction layer composed of domain authentication proxy server nodes and blockchain proxy server nodes, including a blockchain ledger and smart contracts.

[0066] In one implementation, the blockchain-assisted cross-domain authentication architecture specifically includes the following components:

[0067] Industrial IoT devices are used to perform signature generation or verification during cross-domain authentication processes;

[0068] Domain proxy authentication server is used to manage identities within its domain and participate in the blockchain network. When the local blockchain view is incomplete, it forwards query requests to the blockchain network.

[0069] A blockchain proxy server is established, with all blockchain proxy servers jointly maintaining the consortium blockchain and retaining a complete copy of the blockchain ledger. Cross-domain authentication credentials are sent to the blockchain proxy server through the domain proxy authentication server and uploaded or updated to the blockchain ledger. The blockchain proxy server provides blockchain query services for inter-domain authentication, searching for the corresponding target device's cross-domain authentication credentials in the blockchain ledger when a new cross-domain authentication request is verified or a blockchain view is missing. The cross-domain authentication credentials include the device's ID and master public key.

[0070] A blockchain ledger is used to store cross-domain records and cross-domain identity credentials of nodes within each domain.

[0071] Smart contracts are advanced functional interfaces that run on blockchain systems, providing interfaces for uploading, updating, querying, and deleting identity credentials, as well as public key query interfaces.

[0072] In practical implementation, Industrial Internet of Things (IIoT) devices refer to interconnected sensors, instruments, and other equipment capable of collecting, storing, and sharing real-time data. Resources are highly limited, and only simple signature generation or verification is performed during cross-domain authentication. Domain proxy authentication servers retain only a partial blockchain view, rather than a complete copy of the ledger. The blockchain ledger is a shared database distributed across nodes, storing cross-domain records and cross-domain identity credentials for nodes within each domain, and is not controlled by any single node or a small number of nodes.

[0073] In one implementation, the block structure design employs a nested Merkle-Prefix tree structure. While storing cross-domain authentication credentials for the block storage node, the nested Merkle-Prefix tree also stores and enables fast indexing of hash public key information. The nested Merkle-Prefix tree is part of a perfect binary balanced tree. Each non-leaf node in the tree contains a prefix root of a subtree rooted at that node. The prefix root's corresponding prefix tree summarizes the cross-domain authentication credentials of devices in different domains under the current non-leaf node in dictionary order of device ID. This prefix root, together with the time-updated authentication credential information digest, is digested to obtain the state root. The state root, along with the block number, the previous block hash, the current block hash, and the timestamp, is included in the block header of the block structure design.

[0074] Specifically, if necessary, identity credentials stored in any block can be effectively verified through the latest block without traversing the entire blockchain ledger, thus ensuring efficient cross-domain identity verification.

[0075] Figure 2 This is a schematic diagram of each step in the blockchain-assisted cross-domain identity authentication method for industrial IoT devices based on improved Merkle signatures provided in this embodiment of the invention.

[0076] In one implementation, the system initialization step includes:

[0077] S101: Common parameters are determined among nodes in each domain, including common parameters of the blockchain system and cryptographic schemes; all nodes participating in the cross-domain authentication system share the signature parameter w and the one-way secure hash function and the second-preimage resistant secure hash function. , Where n is the number of bits in the output of the message digest hash function, and m is the number of bits in the output of other hash functions;

[0078] S102: Domain authentication proxy server within each domain Randomly select a seed of length m bits and generate a seed sequence using a pseudo-random number generator. ,in Given the height of the Merkle tree, calculate ,in The number of key blocks, for each seed in the seed sequence. Using a pseudo-random number generator to generate A random number is used as the private key. Calculate the public key Obtain the private key sequence and public key sequence ,in, , ,Will As leaf nodes of a Merkle tree, a domain authentication proxy server is constructed. public key Subsequently Will Uploaded to the blockchain ledger, where for Device identifier, These are common parameters for domain A.

[0079] In the specific implementation process, before cross-domain authentication is performed, common parameters need to be determined among the domain nodes. These parameters are configured in the initial block to ensure transparency to each node.

[0080] In one implementation, the identity registration step includes:

[0081] S201: First Industrial IoT Device to be Registered Generate random numbers ,send Domain authentication proxy server to this management domain ,in For the first industrial IoT device The device identifier;

[0082] S202: use Generate key seed sequence ,in Where q is a positive integer, for The latest private key, k is a fixed key generation parameter and is a positive integer; based on Generate Merkle key pairs and the master key ; Calculate kana ;

[0083] S203: right Obtain a signature by signing. ;

[0084] S204: Upload to blockchain proxy server Execute the query contract; when the query is successful, it will... Return to ,in for arrive The signature verification path;

[0085] S205: Received Then, use from The path verification process begins to obtain the estimated value of the master public key. , among which, when The key is considered valid at that time.

[0086] Specifically, S202 uses the same process as in step S102 to generate a Merkle key pair. and public key .

[0087] S203 can be achieved through the following method:

[0088] Computational Summary ,Will Bitwise partitioning is divided into After obtaining the parts Each part is [length] Bit; will Treat as an integer and calculate Partial partitioning for Each part was obtained ; Calculate the message group to be signed A signature is then generated. ,in for sub-items, , This refers to a single item within a group.

[0089] In one implementation, the cross-domain identity authentication step includes:

[0090] S301: The first industrial IoT device located in management domain A To the first industrial IoT device located in management domain B Before requesting authentication, please... Request the next verification path and part of the session key Similarly, located in management domain B Before certification Request the next verification path , ,in It is a random number. Elliptic curve generation base point;

[0091] S302: Perform message precoding, the specific method is as follows: Generate a random number Calculate the current summary and checksum ,in The timestamp is the first time the digest is calculated, and MSG is the message or command information to be sent. for After splitting the bits into their i-th groups, repeat the above steps R times to find a random number that minimizes the checksum. ;

[0092] S303: by For seed generation Then, the same process as S203 is executed to generate... signature ;

[0093] S304: Towards Send authentication request ,in For authentication identifiers, This is the current timestamp. for The katakana;

[0094] S305: After receiving the authentication request, determine and Whether it is true or false is used to check the timeliness of the message, among which The timestamp when the request was received. The message delay threshold is used to meet the timeliness requirement. Forward arrive ,in The result is a random number, which will then be... Divided into share Calculate the public key estimate ;

[0095] S306: Upon receiving the forwarded authentication request, first search in the local blockchain view. When a view is missing, the query message will be forwarded to the blockchain proxy server, which will then invoke the query contract to retrieve the view. and After successful query Calculate partial session key Then Return to ,in for Current signature verification path;

[0096] S307: After receiving a valid result, according to and calculate Master key estimation ,if If the authentication is successful, then one-way identity authentication is successful; otherwise... An alert will be uploaded;

[0097] S308: Perform the same process as S302 to S304, and send. arrive ,in Include Valid signature and ; Perform the same procedure as S305 to S307, and successfully verify. Two-way authentication was successful after signing.

[0098] Specifically, S302 Perform message precoding to speed up signature verification, since the number of hash operations required to generate a signature depends on... arrive The total distance (calculated from the checksum) of the message that requires the fewest hash operations. Its signature verification speed is the fastest.

[0099] In one implementation, the key negotiation step includes:

[0100] After step S306 is completed, Calculate session key And return to ; Successfully verified Forward the message arrive ,in For key negotiation request identifier, Calculate session key ,because , and Shared temporary session key .

[0101] This invention implements a lightweight cross-domain identity authentication scheme for resource-constrained industrial IoT devices. It utilizes a Merkle-Prefix tree for efficient public key state management, deploys a consortium blockchain to provide inter-domain trust for cross-domain devices, and employs an improved Merkle signature scheme for device authentication. Simultaneously, it uses key negotiation to ensure the authenticity and integrity of data transmitted during cross-domain connections. This invention avoids the trust and reliability risks associated with centralized authentication architectures, achieving efficient key querying and management. Furthermore, this invention improves upon traditional Merkle signature schemes by applying strategies such as parameterization, pre-allocation of key and signature verification paths, and message precoding. This allows for flexible performance adjustments for different IoT scenarios, with low computational and storage costs, thereby achieving flexible, efficient, secure, and low-latency cross-domain identity authentication for industrial IoT devices.

[0102] Example 2

[0103] Based on the same inventive concept, this embodiment discloses a blockchain-assisted cross-domain identity authentication system based on Merkle signatures. The system is implemented based on a blockchain-assisted cross-domain authentication architecture and block structure, and includes:

[0104] The system initialization module is used by nodes in each domain to determine common parameters, including common parameters of the blockchain system and cryptographic schemes. Each domain authentication proxy server generates a signature key sequence and a master public key according to the Merkle signature scheme and uploads them to the blockchain network.

[0105] The identity registration module is used by industrial IoT devices to generate key seeds and request the domain authentication proxy server to generate the complete key required for cross-domain communication. The domain authentication proxy server generates a device pseudonym and key pair based on the request, uploads them to the blockchain network, and distributes the key pair to the corresponding industrial IoT devices. The industrial IoT devices then verify the validity of the key.

[0106] The cross-domain authentication module is used to sign the authentication request to be sent by a first industrial IoT device located in one management domain, and then send the authentication request with the attached signature and signature verification path to a second industrial IoT device in another management domain. The second industrial IoT device performs a timeliness check on the received authentication request. If it passes the timeliness check, it forwards the authentication request to the domain authentication proxy server of its own management domain. Then, it calculates the estimated master public key of the first industrial IoT device based on the signature, queries the public key of the first industrial IoT device in the blockchain ledger through the domain authentication proxy server of its own management domain, and calculates a partial session key. Then, it returns the master public key and partial session key of the first industrial IoT device to the second industrial IoT device. The second industrial IoT device verifies whether the received master public key is equal to the estimated master public key of the first industrial IoT device. If they are equal, it attaches the partial session key to the authentication confirmation message and returns it to the first industrial IoT device, requesting the first industrial IoT device to perform authentication. The signature verification path and partial session key are obtained by the first industrial IoT device from the domain authentication proxy server of its own management domain before sending the authentication request.

[0107] The key negotiation module is used by the second industrial IoT device to calculate the complete session key based on a partial session key. After receiving the authentication confirmation message, the first industrial IoT device performs timeliness and legality checks on the received authentication confirmation message, and then calculates the complete session key based on the partial session key in the authentication confirmation message.

[0108] Since the system described in Embodiment 2 of this invention is the system used to implement the blockchain-assisted cross-domain identity authentication method based on the improved Merkle signature in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this system based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All systems used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0109] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0110] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0111] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various modifications and variations to the embodiments of the invention without departing from the spirit and scope of the invention. Thus, if these modifications and variations of the embodiments of the invention fall within the scope of the claims of the invention and their equivalents, the invention also intends to include these modifications and variations.

Claims

1. A blockchain-assisted cross-domain identity authentication method based on Merkle signatures, characterized in that, Based on a blockchain-assisted cross-domain authentication architecture and block structure, the block structure adopts a nested Merkle-Prefix tree structure. While storing the cross-domain authentication credentials of the nodes, the nested Merkle-Prefix tree also stores and enables fast indexing of hash public key information. The nested Merkle-Prefix tree is part of a perfect binary balanced tree. Each non-leaf node in the tree contains a prefix root of a subtree rooted at that node. The prefix root's corresponding prefix tree summarizes the cross-domain credentials of devices in different domains under the current non-leaf node in dictionary order of device ID. The prefix root, together with the time-updated identity credential information digest, is used to calculate the state tree root. The state tree root, along with the block number, the previous block hash, the current block hash, and the timestamp, is included in the block header of the block structure. The blockchain-assisted cross-domain identity authentication method includes: The system initialization steps involve nodes in each domain determining common parameters, including blockchain system common parameters and cryptographic schemes, and authentication proxy servers in each domain generating signature key sequences and master public keys according to the Merkle signature scheme and uploading them to the blockchain network. In the identity registration process, the industrial IoT device generates a key seed and requests the domain authentication proxy server to generate the complete key required for cross-domain authentication. The domain authentication proxy server generates a device pseudonym and key pair based on the request, uploads them to the blockchain network, and distributes the key pair to the corresponding industrial IoT device. The industrial IoT device then verifies the validity of the key. The cross-domain authentication process involves the following steps: A first industrial IoT device located in one management domain signs the authentication request to be sent, and then sends the authentication request with the attached signature and signature verification path to a second industrial IoT device in another management domain. The second industrial IoT device performs a timeliness check on the received authentication request. If the check passes, it forwards the authentication request to the domain authentication proxy server in its own management domain. Subsequently, it calculates the estimated master public key of the first industrial IoT device based on the signature, queries the public key of the first industrial IoT device in the blockchain ledger through the domain authentication proxy server in its own management domain, and calculates a partial session key. Then, it returns the master public key and partial session key of the first industrial IoT device to the second industrial IoT device. The second industrial IoT device verifies whether the received master public key is equal to the estimated master public key of the first industrial IoT device. If they are equal, it attaches the partial session key to the authentication confirmation message and returns it to the first industrial IoT device, requesting the first industrial IoT device to perform authentication. The signature verification path and partial session key are obtained by the first industrial IoT device from the domain authentication proxy server in its own management domain before sending the authentication request. In the key negotiation step, the second industrial IoT device calculates the complete session key based on the partial session key. After receiving the authentication confirmation message, the first industrial IoT device performs timeliness and legality checks on the received authentication confirmation message, and then calculates the complete session key based on the partial session key in the authentication confirmation message.

2. The blockchain-assisted cross-domain identity authentication method based on Merkle signatures as described in claim 1, characterized in that, The blockchain-assisted cross-domain authentication architecture consists of an entity layer, a proxy layer, and a blockchain layer. The entity layer includes industrial IoT devices and domain authentication proxy servers. The proxy layer includes blockchain proxy servers in all domains. The blockchain layer is a consortium blockchain abstraction layer composed of domain authentication proxy server nodes and blockchain proxy server nodes, and includes two parts: a blockchain ledger and smart contracts.

3. The blockchain-assisted cross-domain identity authentication method based on Merkle signatures as described in claim 2, characterized in that, The blockchain-assisted cross-domain authentication architecture specifically includes the following components: Industrial IoT devices are used to perform signature generation or verification during cross-domain authentication processes; Domain proxy authentication server is used to manage identities within its domain and participate in the blockchain network. When the local blockchain view is incomplete, it forwards query requests to the blockchain network. Blockchain proxy servers, all of which work together to maintain the consortium blockchain and retain a complete copy of the blockchain ledger; Cross-domain authentication credentials will be sent to the blockchain proxy server through the domain proxy authentication server and uploaded or updated to the blockchain ledger; The blockchain proxy server provides blockchain query services for inter-domain authentication. When a new cross-domain authentication request is verified or the blockchain view is missing, it searches the blockchain ledger for the cross-domain authentication identity credentials of the corresponding target device. The cross-domain authentication identity credentials include the ID and master public key of each device. A blockchain ledger is used to store cross-domain records and cross-domain identity credentials of nodes within each domain. Smart contracts are advanced functional interfaces that run on blockchain systems, providing interfaces for uploading, updating, querying, and deleting identity credentials, as well as public key query interfaces.

4. The blockchain-assisted cross-domain identity authentication method based on Merkle signatures as described in claim 1, characterized in that, System initialization steps include: S101: Common parameters are determined among nodes in each domain, including common parameters of the blockchain system and cryptographic schemes; all nodes participating in the cross-domain authentication system share the signature parameter w and the one-way secure hash function and the second-preimage resistant secure hash function. , Where n is the number of bits in the output of the message digest hash function, and m is the number of bits in the output of other hash functions; S102: Domain authentication proxy server within each domain Randomly select a seed of length m bits and generate a seed sequence using a pseudo-random number generator. ,in Given the height of the Merkle tree, calculate ,in The number of key blocks, for each seed in the seed sequence. Using a pseudo-random number generator to generate A random number is used as the private key. Calculate the public key Obtain the private key sequence and public key sequence ,in, , ,Will As leaf nodes of a Merkle tree, a domain authentication proxy server is constructed. public key Subsequently Will Uploaded to the blockchain ledger, where for Device identifier, For common parameters of domain A.

5. The blockchain-assisted cross-domain identity authentication method based on Merkle signatures as described in claim 1, characterized in that, The identity registration process includes: S201: First Industrial IoT Device to be Registered Generate random numbers ,send Domain authentication proxy server to this management domain ,in For the first industrial IoT device The device identifier; S202: use Generate key seed sequence ,in where q is a positive integer. for The latest private key, where k is a fixed key generation parameter and is a positive integer; based on Generate Merkle key pairs and the master key ; Calculate kana ; S203: right Obtain a signature by signing. ; S204: Upload to blockchain proxy server Execute the query contract; when the query is successful, it will... Return to ,in for arrive The signature verification path; S205: Received After that, use from The path verification process begins to obtain the estimated value of the master public key. , among which, when The key is considered valid at that time.

6. The blockchain-assisted cross-domain identity authentication method based on Merkle signatures as described in claim 1, characterized in that, Cross-domain identity authentication steps include: S301: The first industrial IoT device located in management domain A To the first industrial IoT device located in management domain B Before requesting authentication, please... Request the next verification path and part of the session key Similarly, located in management domain B Before certification Request the next verification path , ,in It is a random number. Elliptic curve generation base point; S302: Perform message precoding, the specific method is as follows: Generate a random number Calculate the current summary and checksum ,in The timestamp is the first time the digest is calculated, and MSG is the message or command information to be sent. for After splitting the bits into their i-th groups, repeat the above steps R times to find a random number that minimizes the checksum. ; S303: by For seed generation Subsequently generated signature ; S304: Towards Send authentication request ,in For authentication identifiers, This is the current timestamp. for The katakana; S305: After receiving the authentication request, determine and Whether it is true or false is used to check the timeliness of the message, among which The timestamp when the request was received. The message delay threshold is used to meet the timeliness requirement. Forward arrive ,in The result is a random number, which will then be... Divided into share Calculate the public key estimate ; S306: Upon receiving the forwarded authentication request, first search in the local blockchain view. When a view is missing, the query message will be forwarded to the blockchain proxy server, which will then invoke the query contract to retrieve the view. and After successful query Calculate partial session key Then Return to ,in for Current signature verification path; S307: After receiving a valid result, according to and calculate Master key estimation ,if If the authentication is successful, then one-way identity authentication is successful; otherwise... An alert will be uploaded; S308: Perform the same process as S302 to S304, and send. arrive ,in Include Valid signature and ; Perform the same procedure as S305 to S307, and successfully verify. Two-way authentication was successful after signing.

7. The blockchain-assisted cross-domain identity authentication method based on Merkle signatures as described in claim 6, characterized in that, The key negotiation steps include: After step S306 is completed, Calculate session key And return to ; Successfully verified Forward the message arrive ,in For key negotiation request identifier, Calculate session key ,because , and Shared temporary session key .

8. A blockchain-assisted cross-domain identity authentication system based on Merkle signatures, characterized in that, Based on a blockchain-assisted cross-domain authentication architecture and block structure, the block structure adopts a nested Merkle-Prefix tree structure. While storing the cross-domain authentication credentials of the nodes, the nested Merkle-Prefix tree also stores and enables fast indexing of hash public key information. The nested Merkle-Prefix tree is part of a perfect binary balanced tree. Each non-leaf node in the tree contains a prefix root of a subtree rooted at that node. The prefix root's corresponding prefix tree summarizes the cross-domain credentials of devices in different domains under the current non-leaf node in dictionary order of device ID. The prefix root, together with the time-updated identity credential information digest, is used to calculate the state tree root. The state tree root, along with the block number, the previous block hash, the current block hash, and the timestamp, is included in the block header of the block structure. The blockchain-assisted cross-domain identity authentication system includes: The system initialization module is used by nodes in each domain to determine common parameters, including common parameters of the blockchain system and cryptographic schemes. Each domain authentication proxy server generates a signature key sequence and a master public key according to the Merkle signature scheme and uploads them to the blockchain network. The identity registration module is used by industrial IoT devices to generate key seeds and request the domain authentication proxy server to generate the complete key required for cross-domain communication. The domain authentication proxy server generates a device pseudonym and key pair based on the request, uploads them to the blockchain network, and distributes the key pair to the corresponding industrial IoT devices. The industrial IoT devices then verify the validity of the key. The cross-domain authentication module is used to sign the authentication request to be sent by a first industrial IoT device located in one management domain, and then send the authentication request with the attached signature and signature verification path to a second industrial IoT device in another management domain. The second industrial IoT device performs a timeliness check on the received authentication request. If it passes the timeliness check, it forwards the authentication request to the domain authentication proxy server of its own management domain. Then, it calculates the estimated master public key of the first industrial IoT device based on the signature, queries the public key of the first industrial IoT device in the blockchain ledger through the domain authentication proxy server of its own management domain, and calculates a partial session key. Then, it returns the master public key and partial session key of the first industrial IoT device to the second industrial IoT device. The second industrial IoT device verifies whether the received master public key is equal to the estimated master public key of the first industrial IoT device. If they are equal, it attaches the partial session key to the authentication confirmation message and returns it to the first industrial IoT device, requesting the first industrial IoT device to perform authentication. The signature verification path and partial session key are obtained by the first industrial IoT device from the domain authentication proxy server of its own management domain before sending the authentication request. The key negotiation module is used by the second industrial IoT device to calculate the complete session key based on a partial session key. After receiving the authentication confirmation message, the first industrial IoT device performs timeliness and legality checks on the received authentication confirmation message, and then calculates the complete session key based on the partial session key in the authentication confirmation message.

9. The blockchain-assisted cross-domain identity authentication system based on Merkle signatures as described in claim 8, characterized in that, The blockchain-assisted cross-domain authentication architecture consists of an entity layer, a proxy layer, and a blockchain layer. The entity layer includes industrial IoT devices and domain authentication proxy servers. The proxy layer includes blockchain proxy servers in all domains. The blockchain layer is a consortium blockchain abstraction layer composed of domain authentication proxy server nodes and blockchain proxy server nodes, and includes two parts: a blockchain ledger and smart contracts.

Images