A method and system for using trusted anonymous accounts in a multi-identity network system

Abstract

The present invention provides a method and system for using a trusted anonymous account in a multi-identity network system, comprising the following sub-steps: Step S1, generating a mnemonic and a random number seed, and generating a master key and a master chain code for a SIM card using the random number seed; Step S2, submitting the master key of the SIM card to a bookkeeping node in the corresponding identity space to register the SIM card key; Step S3, the user invoking the private network resources of the MIN network; Step S4, performing identity signing and signature verification in the MIN network; Step S5, the SIM card performing network group addressing in the MIN network. The present invention introduces the SIM card as a trusted hardware carrier, and in conjunction with the multi-identity network system of the sovereign network and the national secret algorithm, generates a master key and a master chain code to construct a trusted anonymous account. This anonymous account can support cross-platform and cross-network authentication access in the multi-identity network system, meeting the practical application requirements of network digital identities for achieving cross-domain mutual trust and anonymous access.

Description

Technical Field

[0001] The present invention relates to a method for using a trusted account in a network, in particular to a method for using a trusted anonymous account in a multi-identity network system, and further to a system adopting the method for using a trusted anonymous account in a multi-identity network system. Background Art

[0002] The concept of network digital identity has naturally formed with the popularization of the Internet and communication networks. To date, there is no unified concept and accurate definition of network digital identity globally, and the Internet and communication networks have different definitions of digital identity.

[0003] For example, from the perspective of the Internet, digital identity is considered to be a code issued by the resident identity network authentication service system to the network certificate application system to identify the resident's personal identity; or, digital identity is considered to solve the identification and trust of digital space objects, use network information systems to securely transmit, store, use and manage, and give objects a unique corresponding digital identification and associated attribute statements.

[0004] From the communication network side, the International Telecommunication Union Standardization Bureau believes that digital identity is the identification of an individual or entity in a digital communication and network environment, allowing it to authenticate and access various online services and applications.

[0005] With the rapid development of the Internet and communication networks, the speed of integration between the two has accelerated, and they have become key core components and important infrastructure supporting the digital world. Especially after network digital identity entered the "digital identity application period", whether from the definition of digital identity or in actual application, network digital identity has become a key link in the construction of the trust system and support for digital ecological governance in the digital world, and has posed higher challenges and demands for achieving cross-domain mutual trust and anonymous access.

[0006] However, traditional networks currently face significant technical challenges, including reliance on centralized management for identity authentication, difficulty ensuring anonymity, and fragile data security. These challenges make them unable to meet the practical application needs of achieving cross-domain mutual trust and anonymous access for digital identities. Therefore, it is crucial to develop a trustworthy anonymous account solution to overcome these technical challenges. Summary of the Invention

[0007] The technical problem to be solved by this invention is the need to provide a method for using trusted anonymous accounts in a multi-identity network system. This method aims to introduce a SIM card as a trusted hardware carrier, cooperate with the multi-identity network system of the sovereign network, generate a master key and a master chain code to build a trusted anonymous account. This solves the technical problems of identity authentication relying on centralized management, difficulty in ensuring anonymity, and fragile data security in traditional networks, and meets the practical application requirements of network digital identities to achieve cross-domain mutual trust and anonymous access. Furthermore, a system that adopts this method for using trusted anonymous accounts in a multi-identity network system is further provided.

[0008] To this end, the present invention provides a method for using a trusted anonymous account in a multi-identity network system, comprising the following sub-steps:

[0009] Step S1: Generate a mnemonic and a random number seed, and use the random number seed to generate the master key and master chain code of the SIM card;

[0010] Step S2: submitting the master key of the SIM card to the accounting node of the corresponding identification space to realize SIM card key registration;

[0011] Step S3, the user calls the private network resources of the MIN network;

[0012] Step S4: identity signing and signature verification on the MIN network;

[0013] Step S5, the SIM card performs network packet addressing in the MIN network;

[0014] Wherein, the step S1 includes the following sub-steps:

[0015] Step S101: first, generate a random number, then convert the random number into a mnemonic, and determine the random number seed through the mnemonic;

[0016] Step S102: performing iterative calculation based on the random number seed to generate an intermediate value, and combining and calculating the intermediate value to generate a master key and a master chain code corresponding to the SIM card.

[0017] A further improvement of the present invention is that step S101 includes the following sub-steps:

[0018] Step S1011, generating and returning a first 128-bit random number;

[0019] Step S1012: Obtain a 132-bit second random number using the SM3 hash algorithm and the Chinese character table, and convert the second random number into 12 Chinese mnemonics;

[0020] Step S1013: Send the Chinese mnemonic back to the user for confirmation, and use the second random number corresponding to the Chinese mnemonic confirmed by the user as a random number seed.

[0021] A further improvement of the present invention is that in step S1012, the first random number is first hashed using the SM3 hash algorithm, and then the first 4 bits of data of the hash processing result are taken and spliced ​​with the first random number; then, the 132-bit second random number obtained after splicing is divided into 12 groups of character strings; finally, the 12 groups of character strings are respectively converted into 12 Chinese mnemonics using a Chinese character table.

[0022] A further improvement of the present invention is that step S102 includes the following sub-steps:

[0023] Step S1021: First, perform an iterative operation based on the random number seed using the SM3 hash algorithm, and use the formula Generate intermediate values To the middle value ,at this time , i represents the number of iterative operations, S represents the random number seed; then, the master private key is calculated by the formula , calculate the master private key; finally, process the master private key through the SM2 algorithm to obtain the master public key corresponding to the SIM card;

[0024] Step S1022: First, perform an iterative operation based on the random number seed using the SM3 hash algorithm, and use the formula Generate intermediate values To the middle value ,at this time , i represents the number of iterative operations, S represents the random number seed; then, the main chain code is , calculate the master chain code of the SIM card.

[0025] A further improvement of the present invention is that step S2 includes the following sub-steps:

[0026] Step S201: Submit the master key of the SIM card to the accounting node of the corresponding identification space;

[0027] Step S202: After receiving the key registration request from the client, the accounting node checks the format of the key registration request and verifies the content of the key registration request.

[0028] Step S203: After verification, the accounting node encapsulates the key registration request as a normal transaction and puts it into the transaction pool;

[0029] Step S204: At the beginning of each consensus round, all accounting nodes extract ordinary transactions from the transaction pool and generate blocks. The blocks are then sent to all voting nodes. The voting nodes that receive the blocks verify the block header and each transaction content.

[0030] Step S205: When the voting node receives all blocks or waits until timeout, it packages the voting information of all blocks and sends it to the rotating accounting node;

[0031] In step S206, the rotating accounting node counts the voting information of each voting node, deletes the blocks that receive more than a preset threshold of rejection votes, which is half the number of voting nodes, and approves the blocks that receive more than a preset threshold of approval votes.

[0032] Step S207: After completing the voting statistics for all blocks, the rotating accounting node generates a block header, writes the vote count and block hash value, sets a timestamp, and publishes the block header to the blockchain network.

[0033] In step S208, after receiving the block group header sent by the rotating accounting node, all nodes in the blockchain network first perform verification until the verification is passed, submit the block group and update the parameters, extract the key registration information from the block transaction, and store it in the user information table.

[0034] A further improvement of the present invention is that step S3 includes the following sub-steps:

[0035] Step S301: MIN-VPN is started. Bidirectional authentication is performed between the MIN-VPN and the MIN-Proxy. If authentication succeeds, the startup is successful; if authentication fails, the startup fails. MIN-VPN refers to a dedicated network architecture for a multi-identity network system, and MIN-Proxy refers to a dedicated network proxy for forwarding requests and responses in the multi-identity network system.

[0036] In step S302, the user enters their user account and password on the MIN-VPN login interface to log in. MIN-VPN then checks whether the local MIN identity corresponding to the user exists. If so, the user account, password, and MIN identity flag are sent to the VMS server. In this case, the MIN identity flag indicates existence. If not, the process returns to step S1, using the SIM card to generate a master key for the user. The user account, password, MIN identity flag, and master public key are then sent to the VMS server. In this case, the MIN identity flag indicates non-existence. MIN refers to a multi-identity network system, and the VMS server refers to the server of the VPN management system.

[0037] Step S303: After receiving the information, the VMS server forwards the user account and password to the directory service AD ​​to authenticate the user information. If the authentication fails, a login failure is returned to MIN-VPN. If the authentication succeeds, the process jumps to step S304.

[0038] Step S304: If the MIN identity flag is not present, send the user's master public key to the multi-identity management system MIS to register the MIN identity and return the MIN identity and token; if the MIN identity flag is present, directly return the MIN identity and token;

[0039] Step S305: MIN-VPN receives the login success message, constructs a multi-identity network packet containing the user account and token, reads the master private key, and signs the multi-identity network packet;

[0040] Step S306: Connect to VPN-Server and send a signed multi-identity network packet. The multi-identity router MIR requests the user's MIN certificate from the multi-identity management system MIS based on the obtained user account. VPN-Server refers to a virtual private network server.

[0041] Step S307: Before the multi-identity router MIR forwards the multi-identity network packet to the VPN-Server, the multi-identity network packet is signature-verified.

[0042] Step S308: The signature verification is successful, and the user account and token are successfully sent to the VPN-Server;

[0043] Step S309: The VPN-Server receives the user account and token, and sends the token and user account to the VMS server. The VMS server successfully verifies the token, retrieves the user access control list, and returns it to the VPN-Server.

[0044] Step S310: MIN-VPN successfully connects to VPN-Server, and the user clicks on the website to access. VPN-Server receives the multi-identifier network packet, retrieves the user access control list, and performs permission control.

[0045] A further improvement of the present invention is that step S4 includes the following sub-steps:

[0046] Step S401: Signing is performed based on the user's master private key. After confirming that the master private key is not empty, the corresponding signature method is selected according to the public key generation algorithm in the KeyParam key parameter. The master private key is then converted to the private key type of the SM2 algorithm, and the p.Sign digital signature method is called to sign.

[0047] Step S402: Signature verification is implemented based on the user's master public key. After verifying that the master public key is not empty, the corresponding verification method is first selected according to the public key generation algorithm in the KeyParam key parameter, and then the master public key is type-converted to the public key type of the SM2 algorithm, and the p.Sign verification method is called for verification.

[0048] A further improvement of the present invention is that step S5 includes the following sub-steps:

[0049] Step S501, a multi-identification network packet flows in;

[0050] Step S502: Read the data link layer data segment and decode the multi-identifier network packet using TLV encoding. The multi-identifier network packet includes four areas: an identification area, a signature area, a read-only area, and a variable area. Each area consists of one or more TLV-encoded triplets. The TLV encoding divides the binary data block into three intervals: the first interval is the Type field, indicating the type of the current data block; the middle interval is the Length field, indicating the length of the Value field; and the last interval is the Value field, which is used to store the data block.

[0051] Step S503, determining whether the decoding of the multi-identifier network packet is successful. If not, the multi-identifier network packet is discarded and the processing flow ends; if yes, jump to step S504;

[0052] Step S504: Check the destination identifier field of the multi-identifier network packet to determine whether there is an unprocessed identifier in the destination identifier field. If there is no identifier in the destination identifier field or the identifier has been processed, the multi-identifier network packet is discarded and the processing flow ends. If there is an unprocessed identifier in the destination identifier field, jump to step S505.

[0053] Step S505: Read the next unprocessed identifier and determine whether the current multi-identity router can parse and process the identifier based on the identifier type number of the identifier. If not, that is, it cannot parse and process the identifier, then return to step S504 to continue to determine whether there is another unprocessed identifier in the destination identifier area; if so, jump to step S506;

[0054] Step S506: Invoke the processing flow, read and parse the value of the identifier, and call the corresponding processing function based on the identifier value and the identifier type number to process the multi-identifier network packet, including checking the cache, recording the return path, checking the forwarding information table, and forwarding the network packet out of the specified port;

[0055] Step S507, determine whether the processing of the multi-identifier network group is successful. If not, return to step S504 to continue to determine whether there is an unprocessed identifier in the destination identifier area; if so, the processing flow ends.

[0056] A further improvement of the present invention is that it further includes anonymous account mapping and logging steps, wherein the anonymous account mapping and logging steps include:

[0057] Step A1, by formula Map each anonymous account registered to the MIN network to a globally unique anonymous account through the SIM card ;in, represents a hash function, Represents the master private key, Represents the main chain code, Represents user information;

[0058] Step A2: In the event of a cyberattack or data leak, the multilateral co-managed log system within the multi-identity network system will use the formula Automatically record attack behaviors, and the automatically recorded logs use a blockchain chain structure. Indicates the j transactions, j Indicates the sequence number of the transaction, Indicates the j −1 operation log hash value.

[0059] The present invention also provides a system for using a trusted anonymous account in a multi-identity network system, which adopts the method for using a trusted anonymous account in a multi-identity network system as described above and includes:

[0060] The SIM card generates a master key module, which is used to generate a mnemonic and a random number seed, and generates the master key and master chain code of the SIM card through the random number seed;

[0061] A SIM card key registration module is used to submit the master key of the SIM card to the accounting node of the corresponding identification space to implement SIM card key registration;

[0062] MIN network private network resource calling module, used to call the private network resources of the MIN network;

[0063] MIN network identity signature and verification module, used for identity signature and verification on the MIN network;

[0064] The network packet addressing module is used for the SIM card to perform network packet addressing in the MIN network.

[0065] Compared with the existing technology, the beneficial effects of the present invention are as follows: first, a mnemonic and a random number seed are generated, and the master key and master chain code of the SIM card are generated through the random number seed. Then, the master key of the SIM card is submitted to the accounting node of the corresponding identification space to realize the SIM card key registration, so as to call the private network resources of the MIN network, perform the MIN network identity signature and signature verification, and realize the network group addressing of the SIM card in the MIN network. Therefore, the present invention introduces the SIM card as a trusted hardware carrier, and cooperates with the multi-identity network system and national secret algorithm of the sovereign network to generate the master key and master chain code to build a trusted anonymous account. The anonymous account can support cross-platform and cross-network authentication access in the multi-identity network system, avoid the privacy leakage risk of traditional centralized accounts, solve the technical problems of identity authentication relying on centralized management, difficulty in ensuring anonymity, and fragile data security in traditional networks, and meet the practical application needs of network digital identity to achieve cross-domain mutual trust and anonymous access. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 This is a schematic diagram of the workflow of an embodiment of the present invention;

[0067] Figure 2 1 is a schematic diagram of a mnemonic confirmation process according to an embodiment of the present invention;

[0068] Figure 3 This is a schematic diagram of a master key generation process according to an embodiment of the present invention;

[0069] Figure 4 This is a schematic diagram of a private network resource call link of a MIN network according to an embodiment of the present invention;

[0070] Figure 5 This is a schematic diagram of a multi-identity network grouping according to an embodiment of the present invention;

[0071] Figure 6 This is a flowchart of multi-identifier network grouping processing according to an embodiment of the present invention;

[0072] Figure 7 This is a schematic diagram of concurrent processing of a multi-identity router according to an embodiment of the present invention. DETAILED DESCRIPTION

[0073] Before describing the specific embodiments of the present invention in detail, the key terms and related technologies of the present invention are first explained.

[0074] CT stands for Communication Technology; IT stands for Internet Technology; ESN stands for Equipment Serial Number; SIM stands for Subscriber Identity Model; IMEI stands for International Mobile Equipment Identity; TMSI stands for Temporary Mobile Subscriber Identity; URI stands for Uniform Resource Identifier; SUPI stands for Subscription Permanent Identifier; SUCI stands for Subscription Concealed Identifier; PEI stands for Permanent Equipment Identifier; S-NSSAI stands for Single Network Slice Selection Assistance Information; TAID stands for Trusted Anonymous Identity.

[0075] As CT communication network technology and digital identity technology converge, the first generation of mobile communication technology, 1G, began using digital identity technology to identify entities, but this presented significant security vulnerabilities. Although 1G, a first-generation mobile communication network technology represented by AMPS, was an analog cellular mobile communication system, users and terminal devices still used digital identification within the system.

[0076] The second generation of mobile communication technology (2G) has achieved a solution to separate the "device" and "SIM" identity, effectively reducing security risks. The second generation of mobile communication network technology, represented by GSM, pioneered the use of a "device-SIM" separation method, with the mobile phone and SIM card together forming the mobile communication terminal device.

[0077] Third-generation mobile communication technology (3G) provides two-way authentication capabilities and further enriches service identification types. 3G, represented by WCDMA, upgrades the SIM card to the Universal Subscriber Identity Module (USIM) and further supports two-way authentication between the terminal and the network. 3G mobile communication networks offer users a richer and expanded range of services, including circuit-switched (CS) and packet-switched (PS). Service identification now includes not only the MSISDN in the CS domain but also the access point name (APN) in the PS domain.

[0078] Fourth-generation mobile communication technology (4G) introduced new IP multimedia identities, enabling IP-based unified communications and identity management. 4G, represented by LTE, halted the evolution of the CS domain, with the IP Multimedia Subsystem (IMS) domain taking over audio and video services.

[0079] 5G, the fifth generation of mobile communications technology, introduces new service identifiers to enable secure and flexible network slicing services and unified user identity management. In 5G, the User Permanent Identifier (SUPI) is equivalent to the IMSI in LTE. While its format is identical to the IMSI, the SUPI is never transmitted over the air interface to prevent user tracking through wireless signal monitoring. The User Hidden Identifier (SUCI) is a privacy-preserving identifier that includes the hidden SUPI and can be transmitted over the air interface. Every terminal device accessing the 5G mobile communications network must have a Permanent Equipment Identifier (PEI), which corresponds to the IMEI in LTE networks.

[0080] Overall, the evolution from 1G to 5G has seen the continuous deepening of the integration of digital identity technology and mobile communication networks, effectively achieving the separation and independent development of device, user, and service identification. While the user-centric system is expected to persist, the increasing diversification of network terminals and the continued expansion of service types will lead to further innovation and change in the specific forms of user, device, and service identification. Accordingly, digital identity technology in mobile networks will also follow this trend, evolving to meet new challenges and demands.

[0081] In the trusted anonymous identity solution, the CT system primarily focuses on user number accounts, card keys, and the HLR (Home Location Register) user center, focusing on account management, rights management, identity authentication, and communication encryption and decryption. At the IT system level, it encompasses user number accounts, card keys, and the IDaaS (Identity as a Service) user center, similarly focusing on account management, rights management, and identity authentication, while also extending to service encryption and decryption requirements. This two-way design combines core capabilities from the communications and information technology fields, laying the foundation for building a secure and unified identity management system.

[0082] In the TAID architecture, the entire system begins with user authentication and continues through the authorized circulation and management of data. Specifically, business applications A, B, and C are connected to data permission management to ensure the trusted storage and computation of user data. Furthermore, the Account Center, Risk Center, Permission Center, Authentication Center, and Audit Center form the core modules, responsible for account lifecycle management, business risk control, functional permission control, account authentication, and audit traceability, respectively. This clear division of labor further enhances the system's security and stability.

[0083] Furthermore, the centralized, unified, and trusted password-based account system demonstrates significant advantages. First, the unified mobile phone number account, combined with the real-name system, ensures the legitimacy and security of accounts through electronic signature technology. Second, the Super SIM card incorporates a cryptographic security chip, which, combined with the computing power provided by a cryptographic resource pool, effectively enhances the system's password protection capabilities. Finally, the mobile network offers extensive coverage, the computing network provides data processing services, and the blockchain platform ensures the trusted storage and circulation of data. The synergistic effect of these infrastructures lays a solid foundation for future development in related fields.

[0084] The Multi-Identifier Network system utilizes a multi-identifier management mechanism that integrates future networks with existing IP networks. The Multi-Identifier Network system, abbreviated as MIN or MIN Network (MIN stands for Multi-Identifier Network), is the world's first system to support the construction of a multilaterally managed sovereign internet. It aims to address the security, governance, and evolution challenges facing the current internet architecture. The core concept of the MIN Network is to achieve sovereign independence and interoperability in cyberspace by supporting multiple identifiers (such as identity, content, and geolocation) and decentralized management.

[0085] The Multi-Identifier Network (MIN) is the world's first system supporting the construction of a multilaterally managed sovereign internet. It aims to address the security, governance, and evolution challenges facing the current internet architecture. The core concept of the MIN network is to achieve sovereignty and interoperability in cyberspace by supporting multiple identifiers (such as identity, content, and geolocation) and decentralized management. The MIN network primarily consists of a Multi-Identifier Management System (MIS) and a Multi-Identifier Router (MIR). Within the MIS, the MIN network's identity management system is governed through a multilaterally managed consortium blockchain mechanism, using a one-country-one-vote voting system to manage top-level identifier domains. Each country maintains internal autonomy through a scalable, hierarchical consortium blockchain. The Multi-Identifier Router (MIR) supports multiple identifiers, including identity, content, services, and IP addresses, enabling parallel coexistence of network layers. MIN utilizes the HPT algorithm, a hash table and prefix tree, to support multi-identifier translation and addressing for tens of billions of entries.

[0086] The MIN network has the following outstanding advantages:

[0087] MIN supports multiple identifiers (such as identity, content, and IP) and can flexibly use different identifiers for addressing and routing based on the application scenario. This allows MIN to not only meet the needs of the traditional Internet, but also adapt to emerging fields such as the Internet of Things, Industrial Internet, and Internet of Vehicles.

[0088] Second, decentralized governance: MIN uses blockchain technology and a consortium chain voting mechanism to ensure fairness and transparency in global network management, avoiding the unilateral monopoly problem brought about by the current centralized DNS management.

[0089] 3. High security and data traceability. The MIN network uses asymmetric encryption technology to achieve data traceability, ensuring the security and privacy of data transmission. MIN's design provides inherent security features and can defend against various network attacks. MIN integrates multiple security technologies, such as signature cryptography, identity verification, and behavior detection, to build a dynamic security protection model to effectively resist various network attacks.

[0090] MIN's multi-identity routing mechanism and hierarchical management structure based on the alliance chain make it highly scalable. Whether in small-scale enterprise private networks or global sovereign Internet scenarios, MIN can provide flexible solutions.

[0091] 5. Compatible with existing network systems. MIN is compatible with existing IPv4 and IPv6 network architectures, supports gradual evolution and transition, and does not require complete replacement of existing network equipment, reducing migration costs.

[0092] 6. Identity-driven: MIN uses identity as its core identifier, supports the registration and verification of users' real identities, and enhances network security and transparency. The binding of identity identifiers to devices ensures the traceability of network behavior.

[0093] In general, the core advantages of MIN are multilateral co-management and decentralized management. Combined with the support of multiple identifiers and a powerful security mechanism, it has the characteristics of multi-identity management, decentralized governance, identity-driven and data traceability, enabling it to adapt to the development needs of future networks.

[0094] One prior art technique related to the present invention utilizes the Internet Protocol (IP), also known as the Internet Protocol. This is the network layer communication protocol within the Internet Protocol package, used for packet switching across network boundaries. Its routing function enables interconnection and essentially establishes the Internet.

[0095] IP is the primary protocol at the network layer of the TCP / IP protocol suite. Its mission is to deliver data packets from a source host to a destination host based solely on the IP address in the packet header. To accomplish this, the IP protocol defines the packet structure that encapsulates the data to be delivered. It also defines the addressing method used to label datagrams with source and destination information.

[0096] The characteristic of the IP address system is that each terminal is assigned a network address. Each packet carries this address, which serves as the basis for network nodes to forward packets. The currently widely used IPv4 packet structure uses a 32-bit address field, which is roughly equivalent to a 9-digit decimal number. With telephone numbers in major Chinese cities now almost all using 8-bit numbers, a 32-bit address field is undoubtedly insufficient for terminal identification worldwide. Consequently, recognizing this address crisis in the early 1990s, the IETF began work on IPv6 specifications. IPv6 uses a 128-bit address field, and it appears that this numbering resource will meet practical needs for a considerable period of time. While expanding the address field seems natural, two other issues related to this expansion are of particular interest: the promotion of IPv6 and the difficulties that the IP network's addressing scheme presents for high-speed packet forwarding. The promotion of IPv6 is extremely slow. On the one hand, this reflects that IPv4 can still cope with current practical needs through CIDR address segmentation, address reuse of proxy servers, and dynamic address allocation by ISPs. But on a larger scale, it reflects that the IP address method is too closely related to the way the network operates. It requires changing the user's communication program and the packet forwarding module of the router, which affects almost all devices on the network. The number upgrade work that can be completed overnight on the traditional telephone network may take more than ten years to complete on the IP network.

[0097] In traditional telecommunications networks, the numbers that identify transceiver terminals and the channel identifiers that guide information forwarding are relatively separate. This makes sense, as the potential number of transceiver terminals may be in the tens or even hundreds of millions, while the information forwarding operations involved in a switch or router are merely selecting from dozens, or at most hundreds, of output ports. On IP networks, finding a suitable output port among no more than a thousand requires searching through tens of millions of records.

[0098] This related prior art suffers from the following shortcomings: IP network security issues encompass both network security and information security. Network security refers to the ability of public infrastructure providing network services to be attacked or damaged, such as compromised domain name servers or routers, or maliciously blocked. Information security, on the other hand, refers to the ability of information transmitted online or stored on servers to be leaked or overwritten. Information encryption and secure, effective access methods are network-related issues, not inherently network-related ones. Because information is exposed electronically on the network, maintaining its security is more difficult.

[0099] The introduction of the TCP / IP protocol seemingly solved the fundamental problem of data transmission across the vast internet, establishing a set of basic rules for data transmission. To facilitate the identification of each computer's location and find a recognizable destination for data transmission, the IP protocol assigned each node on the network an address, known as an IP address. IP addresses are written using a four-segment dotted decimal format, such as "211.214.1.XXX." However, due to the principle of non-repetition, unordered and complex IP combinations placed a burden on computer operators, who found it difficult to easily process a series of unordered numbers. Consequently, the unordered and complex IP addresses indirectly raised the barrier to internet use and became a limiting factor in its application.

[0100] Another prior art related to the present invention uses Named Data Networking (NDN), proposed in 2010. Its predecessor is Content-Centric Networking (CCN). It uses receiver-driven pull-based communication semantics to replace the sender-driven push-based communication semantics of IP networks. In NDN, content consumers obtain content by sending interest packets to the network. Any intermediate router or content producer that caches the corresponding content responds with a data packet upon receiving the interest. Each interest can pull a piece of data, and there is a one-to-one correspondence between interests and data. NDN designs a pending interest table (PIT) to support a stateful forwarding plane. Each PIT entry records the network interface from which the interest was received. All PIT entries on the interest forwarding path construct a reverse path. The corresponding data only needs to be returned along the reverse path constructed by the PIT. Through this pull-based interaction, NDN decouples content from producers, better supporting content distribution. To protect content security, NDN requires producers to sign each data they send. This allows consumers to trust the content itself, regardless of how or where it was obtained. Due to NDN's disruptive architectural design, its compatibility with existing network architectures remains to be determined.

[0101] This existing technology has the following shortcomings: Although NDN enhances data integrity, source authentication, and correctness through a content signing mechanism, it still faces many privacy and security risks: Name privacy, hierarchical names in interest packets can leak content information, especially when the name structure is very intuitive, which may lead to user privacy leakage; cache privacy, attackers can obtain access information about cached content through timing analysis; content privacy, although the data packet is signed, the content itself is not encrypted, so it cannot prevent data leakage; signature privacy, the signature can reveal the identity of the producer, thereby infringing the privacy of individuals or organizations.

[0102] Furthermore, NDN may be vulnerable to various attacks, including denial of service (DoS) attacks, protocol attacks, and timing attacks. Denial of service (DoS) attacks involve sending a large number of Interest packets, overflowing the router's PIT table and thereby blocking legitimate requests. Because NDN Interest packets do not contain source addresses, attackers are difficult to track. Attackers can generate large numbers of invalid Interest packets through botnets, leading to cache contamination, bandwidth consumption, and network resource exhaustion. Protocol and timing attacks exploit NDN's prefix matching mechanism to infer the content requested by consumers, thereby violating name privacy. Timing attacks, on the other hand, measure response times to infer whether content is cached, thereby gaining cache privacy.

[0103] To this end, the present invention proposes a method for using trusted anonymous accounts in a multi-identity network system, using a SIM card to access the MIN network for identity registration and login. First, in step S1, a master key is generated using the SIM card. This process is divided into two steps: the first step is to use the card to generate a mnemonic corresponding to a random number, and after user confirmation, output the random seed; the second step is to calculate the master key and master chain code using the random seed, thereby ensuring the security and computational efficiency of key generation. The multi-identity management system (MIS) in the MIN network connects to the operator's database in real time to verify the legitimacy of the anonymous account corresponding to the master key and master chain code, ensuring the uniqueness and accuracy of user identities.

[0104] In this process, an anonymous account serves as the identity and the card serves as the security hardware, establishing a trusted account system with the real-name mobile phone number as the ID. This system provides unified user identity, trusted authentication of the number and card, and capability call authorization services, enabling cross-platform account data interoperability and compliant capability data output. Leveraging the Super SIM card's national security chip and key storage capabilities, combined with PKI asymmetric encryption technology and cryptographic algorithms, this invention creates a new type of mobile smart password key, providing highly secure identity authentication and data encryption transmission capabilities in application scenarios such as the Internet of People and the Internet of Things.

[0105] In a multi-identity network system, various data exist in the form of identifiers. For example, when an individual registers an identity, he or she needs to provide the multi-identity management system MIS with the application prefix, user level, user name, real name, telephone number, ID number, fingerprint, face, iris data, public key, description information and the timestamp of application submission.

[0106] When an organization registers an identity, it needs to provide information such as its organization code, address, legal representative's name, ID number, and bank account number. Multi-Identity Routers (MIRs) and other devices can register device identities. Registration requires providing a public key of appropriate strength and electronically signing the submitted application.

[0107] When a user registers their user identity, in addition to basic user information, they must also provide their public key to the Multi-Identity Management System (MIS). Once the MIS approves the registration request, it issues a certificate to the user and stores it on the blockchain. Thereafter, all interactions between the user and the MIS require the user to sign with their private key. The MIS verifies the signature, and only after verification can further operations be performed. It is important to note that each registered prefix is ​​associated with a unique MIN certificate. The MIS also provides a query interface for user MIN certificates. The Multi-Identity Router (MI) can obtain the MIN certificate corresponding to a prefix from the MIS, thereby performing security verification on Interest packets.

[0108] The preferred embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0109] like Figures 1 to 7 As shown, this embodiment provides a method for using a trusted anonymous account in a multi-identity network system, including the following sub-steps:

[0110] Step S1: Generate a mnemonic and a random number seed, and use the random number seed to generate the master key and master chain code of the SIM card;

[0111] Step S2: submitting the master key of the SIM card to the accounting node of the corresponding identification space to realize SIM card key registration;

[0112] Step S3, the user calls the private network resources of the MIN network;

[0113] Step S4: identity signing and signature verification on the MIN network;

[0114] Step S5, the SIM card performs network packet addressing in the MIN network;

[0115] Wherein, the step S1 includes the following sub-steps:

[0116] Step S101: first, generate a random number, then convert the random number into a mnemonic, and determine the random number seed through the mnemonic;

[0117] Step S102: performing iterative calculation based on the random number seed to generate an intermediate value, and combining and calculating the intermediate value to generate a master key and a master chain code corresponding to the SIM card.

[0118] In this embodiment, step S101 is used to generate a mnemonic and a random number seed, such as Figure 2 As shown, it preferably includes the following sub-steps:

[0119] Step S1011: The SIM card application generates and returns a 128-bit first random number E, and returns the first random number E to the service application;

[0120] Step S1012: Obtain a 132-bit second random number using the SM3 hash algorithm and the Chinese character table, and convert the second random number into 12 Chinese mnemonics for easy user understanding and confirmation;

[0121] Step S1013: Send the Chinese mnemonic back to the user for confirmation, and use the second random number corresponding to the Chinese mnemonic confirmed by the user as the random number seed. S .

[0122] More preferably, Figure 2 As shown, in step S1012 of this embodiment, the first random number E is first hashed using the SM3 hash algorithm, and then the first 4 bits of the hash result C are taken and concatenated with the first random number E; then, the 132-bit second random number obtained after concatenation is divided into 12 groups of character strings; finally, the 12 groups of character strings are converted into 12 Chinese mnemonics using a Chinese character table. The process of converting to Chinese mnemonics is as follows: a Chinese character table is pre-set in the system, for example, a Chinese character table containing 2048 different Chinese characters is pre-set, and then the 11-bit character strings are mapped to different Chinese characters according to pre-set mapping rules. The Chinese character table and its mapping rules described in this embodiment can be set and adjusted according to actual conditions.

[0123] In this embodiment, step S102 is used to generate a master key; the master key includes a master public key and a master private key. In step S102, the SIM card application is based on the confirmed 132-bit random number seed. SThe PBKDF2 key derivation algorithm, based on the SM3 hash algorithm, is preferably used to generate the master private key, master public key, and corresponding master chain code. This algorithm iteration count is 128 to ensure the high security of the generated keys. Furthermore, to ensure computational efficiency, this embodiment further simplifies the complexity of the key generation algorithm, enabling the entire key generation process to be completed in approximately one second.

[0124] Specifically, such as Figure 3 As shown, step S102 in this embodiment includes the following sub-steps:

[0125] Step S1021: First, perform an iterative operation based on the random number seed using the SM3 hash algorithm, and use the formula Generate intermediate values To the middle value ,at this time , i Indicates the sequence number of the iterative operation, S Represents the random number seed; then, the master private key is obtained through the formula , calculate the master private key, the master private key is recorded as ; Finally, the master private key is processed by the SM2 algorithm to obtain the master public key corresponding to the SIM card;

[0126] Step S1022: First, perform an iterative operation based on the random number seed using the SM3 hash algorithm, and use the formula Generate intermediate values To the middle value ,at this time , i Indicates the sequence number of the iterative operation, S Represents the random number seed; then, the main chain code is , calculate the master chain code of the SIM card The master chain code of the SIM card described in this embodiment is used to derive subkeys in subsequent steps, thereby supporting hierarchical identity management and authentication operations in a multi-identity network system.

[0127] Therefore, this embodiment combines the advantages of the SM3 hash algorithm and the computing power of the SIM card, and provides users with a secure and efficient master key generation solution for the specific application environment of this embodiment. Moreover, the master key generation solution can be completed entirely within the SIM card without relying on an external network, effectively avoiding man-in-the-middle attacks and information leakage problems in data transmission, and providing a better foundation for data protection and privacy security.

[0128] Step S2 in this embodiment is used to implement SIM card key registration.

[0129] When a user registers an identity, he uses a registration client, which can be either an IP node or a MIN node.

[0130] Step S2 in this embodiment preferably includes the following sub-steps:

[0131] Step S201: Submit the master key of the SIM card to the accounting node of the corresponding identification space;

[0132] In step S202, after receiving the key registration request from the client, the accounting node will check the format of the key registration request and verify the content of the key registration request. During this process, it will first check whether the user information already exists in the local database and perform basic verification on some of the content, such as the user's ID number and mobile phone number. If the result of any of the above steps is negative, such as the request format is incorrect or the content verification fails, an error message will be returned to the client.

[0133] Step S203: After verification, the accounting node encapsulates the key registration request as a normal transaction and puts it into the transaction pool. Encapsulation as a normal transaction refers to the decentralized structure encapsulation in the conventional blockchain, and the encapsulated block contains information such as transaction records and hash values.

[0134] At the beginning of each consensus round, all accounting nodes extract ordinary transactions from the transaction pool and generate blocks. The blocks are then sent to all voting nodes. The voting nodes that receive the blocks verify the block header and each transaction content. Each transaction is verified according to the rules pre-set by the voting nodes, such as verifying keywords according to a custom filter list, to form a voting result.

[0135] Step S205: When the voting node receives all blocks or waits until timeout, it packages the voting information of all blocks and sends it to the rotating accounting node;

[0136] In step S206, the rotating accounting node counts the voting information of each voting node and deletes blocks that receive more than a preset threshold of rejection votes, which is half the number of voting nodes. Blocks that receive more than a preset threshold of approval votes are approved. Therefore, for a block, if it receives more than half of the number of rejection votes from the voting nodes, the block in memory will be deleted; if it receives more than half of the number of approval votes from the voting nodes, the block will be approved.

[0137] Step S207: After completing the voting statistics for all blocks, the rotating accounting node generates a block header, writes the vote count and block hash value, sets a timestamp, and publishes the block header to the blockchain network.

[0138] In step S208, all nodes in the blockchain network, upon receiving the block group header sent by the rotating accounting node, first verify it. If verification is successful, they submit the block group and update the parameters. They extract the key registration information from the block's transactions and store it in the user information table. If verification fails, it is discarded.

[0139] In this embodiment, step S3 is used by the user to call the MIN network private network resources, such as Figure 4 As shown, it preferably includes the following sub-steps:

[0140] Step S301: MIN-VPN is started, and bidirectional authentication is performed between the MIN-VPN and the MIN-Proxy. If the authentication succeeds, the startup is successful; if the authentication fails, the startup fails. MIN-VPN refers to a dedicated virtual private network architecture in a multi-identity network system, and MIN-Proxy refers to a dedicated network proxy server in the multi-identity network system used to forward requests and responses, converting network packets and forwarding them to the VPN-Server. The VPN-Server does not support IP communication, but the bidirectional authentication used in this embodiment is based on IP communication.

[0141] In step S302, the user enters their user account and password on the MIN-VPN login interface and clicks / to log in. MIN-VPN then checks whether the user's corresponding MIN identity exists locally. If so, the user account, password, and MIN identity flag are sent to the VMS server. In this case, the MIN identity flag indicates existence. If not, the process returns to step S1, where a master key is generated for the user using the SIM card. The user account, password, MIN identity flag, and master public key are then sent to the VMS server. In this case, the MIN identity flag indicates non-existence. The VMS server refers to the service / server of the VPN management system. VMS stands for Virtual Management System.

[0142] Step S303: After receiving the information, the VMS server forwards the user account and password to the directory service AD ​​to authenticate the user information. If the authentication fails, it returns a login failure to MIN-VPN. If the authentication succeeds, it jumps to step S304. AD refers to Active Directory.

[0143] Step S304: If the MIN identity flag is not present, send the user's master public key to the multi-identity management system MIS to register the MIN identity and return the MIN identity and token; if the MIN identity flag is present, directly return the MIN identity and token;

[0144] In step S305, the MIN-VPN receives a successful login message, creates a blank multi-identity network group, adds the user account and token as fields to the multi-identity network group, constructs a multi-identity network group containing the user account and token, reads the master private key, and signs the multi-identity network group, i.e., signing is performed based on the user's master private key in step S401; the multi-identity network group is also called a multi-identity network packet.

[0145] Step S306: Connect to the VPN-Server and send a signed multi-identity network packet. The multi-identity router (MIR) requests the user's MIN certificate from the multi-identity management system (MIS) based on the obtained user account. The MIN certificate refers to a multi-identity network certificate that includes the user's public key and is used to obtain the user's master public key and verify the correctness of the signature in the message based on the master public key. VPN-Server refers to a virtual private network server.

[0146] Step S307: Before the multi-identity router MIR forwards the multi-identity network packet to the VPN-Server, the multi-identity network packet is signature-verified, i.e., the signature verification is implemented based on the user's master public key in step S402;

[0147] Step S308: The signature verification is successful, and the user account and token are successfully sent to the VPN-Server;

[0148] Step S309: The VPN-Server receives the user account and token, and sends the token and user account to the VMS server. The VMS server successfully verifies the token, retrieves the user access control list (ACL), and returns it to the VPN-Server.

[0149] Step S310: MIN-VPN successfully connects to VPN-Server, and the user clicks on the website to access. VPN-Server receives the multi-identifier network packet, retrieves the user access control list, and performs permission control.

[0150] In step S301 of this embodiment, during the two-way authentication process between the MIN-VPN and the MIN-Proxy, the MIN-Proxy dedicated network proxy server based on TLS / SSL is used to implement the two-way authentication. First, the MIN client sends its own client certificate to the MIN-Proxy. Then, after receiving the client certificate, the MIN-Proxy verifies it and, after verifying the client certificate, requests a server certificate from the VPN-Server. Finally, the MIN client obtains the VPN-Server's server certificate through the VPN-Proxy and verifies the server certificate, thereby completing the two-way authentication process.

[0151] In this embodiment, step S4 is used to implement the MIN network identity signature and signature verification. Step S4 preferably includes the following sub-steps:

[0152] Step S401: Signing is performed based on the user's master private key calculated in step S102. After confirming that the master private key is not empty, the corresponding signature method is first selected according to the public key generation algorithm in the KeyParam key parameter. Then, the master private key (such as id.Prikey) is type-converted to the private key type of the SM2 algorithm, such as the parameter p of the sm2.Sm2PrivateKey type, and the p.Sign digital signature method is called to sign. Among them, KeyParam is a key parameter used to specify the public key generation algorithm. The SM2 algorithm is a public key cryptography algorithm based on elliptic curves and is used for digital signatures and encryption. The signature of this embodiment uses the SM2WithSM3 algorithm by default.

[0153] Step S402 verifies the signature based on the user's master public key calculated in step S102. After verifying that the master public key is not null, the corresponding verification method is selected based on the public key generation algorithm in the KeyParam key parameter. The master public key (such as id.Pubkey) is then converted to a public key type for the SM2 algorithm, such as parameter p of type sm2.Sm2PublicKey. The p.Sign verification method is then called for verification. This embodiment uses the SM2WithSM3 algorithm by default.

[0154] Step S5 in this embodiment is used to implement the network packet addressing process of the SIM card in the MIN. Figure 6 As shown, step S5 preferably includes the following sub-steps:

[0155] Step S501, a multi-identification network packet flows in;

[0156] Step S502, read a data link layer data segment from the network, and decode the multi-identifier network packet through TLV encoding; wherein the multi-identifier network packet includes four areas, such as Figure 5 As shown in the figure, the four areas are the identification area, signature area, read-only area, and variable area. Each area consists of one or more TLV-encoded triplets (i.e., Type / Length / Value). TLV encoding divides the binary data block into three intervals. The first interval is the Type field, which indicates the type of the current data block; the middle interval is the Length field, which indicates the length of the Value field; and the last interval is the Value field, which is used to store the data block.

[0157] Step S503, determining whether the decoding of the multi-identifier network packet is successful. If not, the multi-identifier network packet is discarded and the processing flow ends; if yes, jump to step S504;

[0158] Step S504: Check the destination identifier field of the multi-identifier network packet to determine whether there is an unprocessed identifier in the destination identifier field. If there is no identifier in the destination identifier field or the identifier has been processed, the multi-identifier network packet is discarded and the processing flow ends. If there is an unprocessed identifier in the destination identifier field, jump to step S505.

[0159] Step S505: Read the next unprocessed identifier and determine whether the current multi-identity router can parse and process the identifier based on the identifier type number of the identifier. If not, that is, it cannot parse and process the identifier, then return to step S504 to continue to determine whether there is another unprocessed identifier in the destination identifier area; if so, jump to step S506;

[0160] Step S506: Process the multi-identifier network packet according to the identifier semantics, i.e., call the processing flow, read and parse the identifier value, and call the corresponding processing function based on the identifier value and the identifier type number to process the multi-identifier network packet, including checking the cache, recording the return path, checking the forwarding information table, and forwarding the network packet out the designated port;

[0161] Step S507, determine whether the processing of the multi-identifier network group is successful. If not, return to step S504 to continue to determine whether there is an unprocessed identifier in the destination identifier area; if so, the processing flow ends.

[0162] This embodiment provides a single-thread (single-processor) network packet processing process through steps S501 to S507, and provides a flow chart of a network packet forwarder processing a network packet. Figure 6 The figure shows the complete process of a single-core router processing a network packet.

[0163] Since the support of multiple identifiers by the multi-identity router MIR can be completely isolated from each other, in the software-implemented forwarder, a multi-core processor can be used to forward network packets carrying different identifiers. Therefore, in step S5 of this embodiment, when a multi-identity network packet carrying multiple identifiers enters the multi-identity router MIR, the multi-identity router MIR processes the multiple identifiers concurrently, such as Figure 7 The FIB table refers to the Forwarding Information Base, which is a query forwarding table used to implement query and forwarding processing in the identification processing unit.

[0164] In this embodiment, the process of concurrently processing multiple identifiers by the multi-identity router MIR includes:

[0165] Step B1, extracting all identifiers in the multi-identity network group, and determining the identifier types supported by the multi-identity router MIR through an identifier filter;

[0166] Step B2: Duplicate the data according to the number of supported identifiers and send them to different identifier processing units for processing. After receiving the processing task, the different identifier processing units independently complete the processing of the multi-identifier network group and then summarize the processing results to the decision unit;

[0167] In step B3, the decision unit selects a processing result to be adopted according to the order of the identifiers in the multi-identifier network group.

[0168] For example, in Figure 7 In this example, identifiers 101 and 103 carried in the multi-identifier network packet are both identifier types supported by the current router. Therefore, the incoming network packet is duplicated and distributed to two different identifier processing units for processing. These different identifier processing units can independently run on different CPUs or CPU cores. After receiving the multi-identifier network packet processing task, each identifier processing unit independently completes processing of the multi-identifier network packet and aggregates the processing results to the decision unit.

[0169] like Figure 7 As shown, identifier 103 has a higher priority in the network packet than identifier 101. Therefore, if the processing result of identifier 103 is normal, that is, the result of the identifier processing unit is not to discard the multi-identifier network packet, the decision unit adopts the processing result of the identifier processing unit corresponding to identifier 103 and ignores the result of the identifier processing unit corresponding to identifier 101. Only when the processing result corresponding to identifier 103 is to discard the multi-identifier network packet does the decision unit adopt the processing result of the identifier processing unit corresponding to identifier 101.

[0170] Therefore, in the parallel multi-identity router (MIR) of this embodiment, all identifiers in the multi-identity network group are first extracted. After receiving the processing task for the multi-identity network group, different identifier processing units independently complete the processing of the multi-identity network group. Subsequently, each identifier processing unit summarizes the processing results to the decision unit. The decision unit determines which identifier processing unit's processing result to use based on the order of the identifiers in the multi-identity network group.

[0171] In this embodiment, a mnemonic and a random number seed are first generated. The random number seed is then used to generate the SIM card's master key and master chain code. The SIM card's master key is then submitted to the accounting node of the corresponding identity space to register the SIM card key. This allows the MIN network's private network resources to be accessed, the MIN network identity to be signed and verified, and network group addressing for the SIM card within the MIN network to be performed. Therefore, the SIM card is introduced as a trusted hardware carrier, and in conjunction with the sovereign network's multi-identity network system and national secret algorithms, a master key and master chain code are generated to construct a trusted anonymous account. This anonymous account supports cross-platform and cross-network authentication and access within the multi-identity network system, avoiding the privacy risks associated with traditional centralized accounts. This addresses the technical issues of identity authentication relying on centralized management, difficulty ensuring anonymity, and fragile data security in traditional networks, meeting the practical application requirements of achieving cross-domain mutual trust and anonymous access for network digital identities. The system architecture designed in this embodiment supports multilateral co-management of global top-level identities and independent local management of subordinate identities, effectively achieving cross-domain mutual trust and anonymous access.

[0172] Mathematical modeling analysis shows that in the MIN network, the security and anonymity of identity authentication are exponentially improved. Assuming that the probability of identity fraud in the traditional IP network is In this embodiment, the random number generated by the SIM card is and the master private key , combined with the main chain code Perform identity mapping. Master private key By the initial random seed S Generate, see step S1 for details. R Dynamically generated within the SIM card by each specific mapping instance.

[0173] This embodiment also preferably includes anonymous account mapping and log recording steps, which include step A1 and step A2.

[0174] Step A1, by formula Map each anonymous account registered to the MIN network to a unique anonymous account through the SIM card ;in, represents a hash function, Represents the master private key, Represents the main chain code, Represents user information, including user mobile phone number, ID card number and other information.

[0175] This embodiment breaks through the single addressing mechanism of traditional IP networks and realizes the coexistence and dynamic mapping of multiple identifiers such as identity identifier (ID), content identifier (CID), and location identifier (LID) on the basis of a multi-identification network system, thus ensuring the sovereignty, independence, mutual trust and intercommunication of cyberspace.

[0176] This embodiment randomly generates a mnemonic in step S1 and derives the master key With the main chain code , and then combine the mapping of the hash algorithm to obtain a unique anonymous account This anonymous account supports cross-platform and cross-network authentication access, completely avoiding the privacy leakage risk of traditional centralized accounts. On this basis, a two-way authentication process based on PKI (Public Key Infrastructure) and national secret algorithms (such as SM2 / SM4 algorithms) is designed in the network access and data interaction of step S3, which not only ensures the anonymity of access, but also realizes the simultaneous completion of data encryption and identity authentication. Specifically, when the anonymous account When making a network request, the system will perform on-chain verification. The verification process does not reveal the real identity, and authorization confirmation is completed only through zero-knowledge proof.

[0177] Preferably, this embodiment employs a trusted anonymous authentication and cross-domain mutual recognition mechanism. By incorporating PKI asymmetric encryption and zero-knowledge proof (ZKP) technology, identity authentication and resource access rights can be completed when users access the MIN network without revealing their true identity. Furthermore, hardware isolation of the SIM card and on-chain log storage ensure that the access path is tamper-proof and highly secure.

[0178] In step A2 of this embodiment, in the event of a network attack or data leakage, the multilateral co-managed log system in the multi-identity network system will use the formula Automatically record attack behaviors. The automatically recorded logs use a blockchain chain structure, and all operations are tamper-proof. Indicates the j transactions, Indicates the j −1 operation log hash value, j Indicates the serial number of the transaction. This not only supports the rapid tracing of attack behaviors, but also serves as legal evidence in cyberspace.

[0179] This embodiment realizes distributed on-chain log recording and behavior tracing. The MIN network has a built-in multilateral co-managed blockchain log, and each anonymous account All operations are recorded synchronously and cannot be tampered with. When an attack occurs, the system can quickly trace the source based on timestamp and signature verification, providing the attacker's behavior path and evidence chain.

[0180] This embodiment further provides a system for using a trusted anonymous account in a multi-identity network system, which adopts the above-described method for using a trusted anonymous account in a multi-identity network system and includes:

[0181] The SIM card generates a master key module, which is used to generate a mnemonic and a random number seed, and generates the master key and master chain code of the SIM card through the random number seed;

[0182] A SIM card key registration module is used to submit the master key of the SIM card to the accounting node of the corresponding identification space to implement SIM card key registration;

[0183] MIN network private network resource calling module, used to call the private network resources of the MIN network;

[0184] MIN network identity signature and verification module, used for identity signature and verification on the MIN network;

[0185] The network packet addressing module is used for the SIM card to perform network packet addressing in the MIN network.

[0186] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A method for using a trusted anonymous account in a multi-identity network system, characterized in that: The following sub-steps are included: Step S1: Generate a mnemonic and a random number seed, and use the random number seed to generate the master key and master chain code of the SIM card; Step S2: submitting the master key of the SIM card to the accounting node of the corresponding identification space to realize SIM card key registration; Step S3, the user calls the private network resources of the MIN network; Step S4: identity signing and signature verification on the MIN network; Step S5, the SIM card performs network packet addressing in the MIN network; Wherein, the step S1 includes the following sub-steps: Step S101: first, generate a random number, then convert the random number into a mnemonic, and determine the random number seed through the mnemonic; Step S102: performing iterative calculation based on the random number seed to generate an intermediate value, and combining and calculating the intermediate value to generate a master key and a master chain code corresponding to the SIM card; The step S101 includes the following sub-steps: Step S1011, generating and returning a first 128-bit random number; Step S1012: Obtain a 132-bit second random number using the SM3 hash algorithm and the Chinese character table, and convert the second random number into 12 Chinese mnemonics; Step S1013: Send the Chinese mnemonic back to the user for confirmation, and use the second random number corresponding to the Chinese mnemonic confirmed by the user as a random number seed; The step S102 includes the following sub-steps: Step S1021: First, perform an iterative operation based on the random number seed using the SM3 hash algorithm, and use the formula Generate intermediate values To the middle value ,at this time , i represents the number of iterative operations, S represents the random number seed; then, the master private key is calculated by the formula , calculate the master private key; finally, process the master private key through the SM2 algorithm to obtain the master public key corresponding to the SIM card; Step S1022: First, perform an iterative operation based on the random number seed using the SM3 hash algorithm, and use the formula Generate intermediate values To the middle value ,at this time , i represents the number of iterative operations, S represents the random number seed; then, the main chain code is , calculate the master chain code of the SIM card.

2. The method for using a trusted anonymous account in a multi-identity network system according to claim 1, characterized in that: In step S1012, the first random number is first hashed using the SM3 hash algorithm, and then the first 4 bits of the hash result are taken and concatenated with the first random number; then, the 132-bit second random number obtained after the concatenation is divided into 12 groups of character strings; finally, the 12 groups of character strings are respectively converted into 12 Chinese mnemonics using a Chinese character table.

3. The method for using a trusted anonymous account in a multi-identity network system according to claim 1 or 2, characterized in that: The step S2 includes the following sub-steps: Step S201: Submit the master key of the SIM card to the accounting node of the corresponding identification space; Step S202: After receiving the key registration request from the client, the accounting node checks the format of the key registration request and verifies the content of the key registration request. Step S203: After verification, the accounting node encapsulates the key registration request as a normal transaction and puts it into the transaction pool; Step S204: At the beginning of each consensus round, all accounting nodes extract ordinary transactions from the transaction pool and generate blocks. The blocks are then sent to all voting nodes. The voting nodes that receive the blocks verify the block header and each transaction content. Step S205: When the voting node receives all blocks or waits until timeout, it packages the voting information of all blocks and sends it to the rotating accounting node; In step S206, the rotating accounting node counts the voting information of each voting node, deletes the blocks that receive more than a preset threshold of rejection votes, which is half the number of voting nodes, and approves the blocks that receive more than a preset threshold of approval votes. Step S207: After completing the voting statistics for all blocks, the rotating accounting node generates a block header, writes the vote count and block hash value, sets a timestamp, and publishes the block header to the blockchain network. In step S208, after receiving the block group header sent by the rotating accounting node, all nodes in the blockchain network first perform verification until the verification is passed, submit the block group and update the parameters, extract the key registration information from the block transaction, and store it in the user information table.

4. The method for using a trusted anonymous account in a multi-identity network system according to claim 1 or 2, characterized in that: The step S3 includes the following sub-steps: Step S301: MIN-VPN is started. Bidirectional authentication is performed between the MIN-VPN and the MIN-Proxy. If authentication succeeds, the startup is successful; if authentication fails, the startup fails. MIN-VPN refers to a dedicated network architecture for a multi-identity network system, and MIN-Proxy refers to a dedicated network proxy for forwarding requests and responses in the multi-identity network system. In step S302, the user enters their user account and password on the MIN-VPN login interface to log in. MIN-VPN then checks whether the local MIN identity corresponding to the user exists. If so, the user account, password, and MIN identity flag are sent to the VMS server. In this case, the MIN identity flag indicates existence. If not, the process returns to step S1, using the SIM card to generate a master key for the user. The user account, password, MIN identity flag, and master public key are then sent to the VMS server. In this case, the MIN identity flag indicates non-existence. MIN refers to a multi-identity network system, and the VMS server refers to the server of the VPN management system. Step S303: After receiving the information, the VMS server forwards the user account and password to the directory service AD ​​to authenticate the user information. If the authentication fails, a login failure is returned to MIN-VPN. If the authentication succeeds, the process jumps to step S304. Step S304: If the MIN identity flag is not present, send the user's master public key to the multi-identity management system MIS to register the MIN identity and return the MIN identity and token; if the MIN identity flag is present, directly return the MIN identity and token; Step S305: MIN-VPN receives the login success message, constructs a multi-identity network packet containing the user account and token, reads the master private key, and signs the multi-identity network packet; Step S306: Connect to VPN-Server and send a signed multi-identity network packet. The multi-identity router MIR requests the user's MIN certificate from the multi-identity management system MIS based on the obtained user account. VPN-Server refers to a virtual private network server. Step S307: Before the multi-identity router MIR forwards the multi-identity network packet to the VPN-Server, the multi-identity network packet is signature-verified. Step S308: The signature verification is successful, and the user account and token are successfully sent to the VPN-Server; Step S309: The VPN-Server receives the user account and token, and sends the token and user account to the VMS server. The VMS server successfully verifies the token, retrieves the user access control list, and returns it to the VPN-Server. Step S310: MIN-VPN successfully connects to VPN-Server, and the user clicks on the website to access. VPN-Server receives the multi-identifier network packet, retrieves the user access control list, and performs permission control.

5. The method for using a trusted anonymous account in a multi-identity network system according to claim 1 or 2, characterized in that: The step S4 includes the following sub-steps: Step S401: Signing is performed based on the user's master private key. After confirming that the master private key is not empty, the corresponding signature method is selected according to the public key generation algorithm in the KeyParam key parameter. The master private key is then converted to the private key type of the SM2 algorithm, and the p.Sign digital signature method is called to sign. Step S402: Signature verification is implemented based on the user's master public key. After verifying that the master public key is not empty, the corresponding verification method is first selected according to the public key generation algorithm in the KeyParam key parameter, and then the master public key is type-converted to the public key type of the SM2 algorithm, and the p.Sign verification method is called for verification.

6. The method for using a trusted anonymous account in a multi-identity network system according to claim 1 or 2, characterized in that: The step S5 includes the following sub-steps: Step S501, a multi-identification network packet flows in; Step S502: Read the data link layer data segment and decode the multi-identifier network packet using TLV encoding. The multi-identifier network packet includes four areas: an identification area, a signature area, a read-only area, and a variable area. Each area consists of one or more TLV-encoded triplets. The TLV encoding divides the binary data block into three intervals: the first interval is the Type field, indicating the type of the current data block; the middle interval is the Length field, indicating the length of the Value field; and the last interval is the Value field, which is used to store the data block. Step S503, determining whether the decoding of the multi-identifier network packet is successful. If not, the multi-identifier network packet is discarded and the processing flow ends; if yes, jump to step S504; Step S504: Check the destination identifier field of the multi-identifier network packet to determine whether there is an unprocessed identifier in the destination identifier field. If there is no identifier in the destination identifier field or the identifier has been processed, the multi-identifier network packet is discarded and the processing flow ends. If there is an unprocessed identifier in the destination identifier field, jump to step S505. Step S505: Read the next unprocessed identifier and determine whether the current multi-identity router can parse and process the identifier based on the identifier type number of the identifier. If not, that is, it cannot parse and process the identifier, then return to step S504 to continue to determine whether there is another unprocessed identifier in the destination identifier area; if so, jump to step S506; Step S506: Invoke the processing flow, read and parse the value of the identifier, and call the corresponding processing function based on the identifier value and the identifier type number to process the multi-identifier network packet, including checking the cache, recording the return path, checking the forwarding information table, and forwarding the network packet out of the specified port; Step S507, determine whether the processing of the multi-identifier network group is successful. If not, return to step S504 to continue to determine whether there is an unprocessed identifier in the destination identifier area; if so, the processing flow ends.

7. The method for using a trusted anonymous account in a multi-identity network system according to claim 1 or 2, characterized in that: The anonymous account mapping and logging steps are further included, and the anonymous account mapping and logging steps include: Step A1, by formula Map each anonymous account registered to the MIN network to a globally unique anonymous account through the SIM card ;in, represents a hash function, Represents the master private key, Represents the main chain code, Represents user information; Step A2: In the event of a cyberattack or data leak, the multilateral co-managed log system within the multi-identity network system will use the formula Automatically record attack behaviors, and the automatically recorded logs use a blockchain chain structure. Indicates the j transactions, j Indicates the sequence number of the transaction, Indicates the j −1 operation log hash value.

8. A system for using trusted anonymous accounts in a multi-identity network system, characterized in that: The method for using a trusted anonymous account in a multi-identity network system according to any one of claims 1 to 7 is adopted, and includes: The SIM card generates a master key module, which is used to generate a mnemonic and a random number seed, and generates the master key and master chain code of the SIM card through the random number seed; A SIM card key registration module is used to submit the master key of the SIM card to the accounting node of the corresponding identification space to implement SIM card key registration; MIN network private network resource calling module, used to call the private network resources of the MIN network; MIN network identity signature and verification module, used for identity signature and verification on the MIN network; The network packet addressing module is used for the SIM card to perform network packet addressing in the MIN network.

Images