User certificate dynamic update cross-domain authentication system and method based on block chain

Abstract

The invention discloses a user credential dynamic update cross-domain authentication system and method based on a block chain, the system comprises a user, a terminal and a block chain module, the block chain module comprises a block credential storage module, a block credential storage module, a block credential storage module and a block credential storage module, the block credential storage module is provided with a plurality of blocks, and each block stores block chain transaction data and version data; and the intelligent contract registration verification module performs single-point registration according to the user and the terminal and the registration node, and performs multi-point authentication between the user and the terminal and the registration node and each block chain node. According to the scheme, the problems that when a traditional public key-based signature verification method is used for cross-domain authentication, a public key voucher is static and is easy to analyze by an enemy, a public key voucher exposure surface is difficult to control due to cross-domain authentication voucher circulation, a voucher updating process is complex, single sign-on fails, single-point data is lost and the like are solved.

Description

Technical Field

[0001] The present invention relates to the field of identity authentication technology, and in particular to a blockchain-based cross-domain authentication system and method for dynamically updating user credentials. Background Art

[0002] Identity authentication, also known as "identity verification" or "identity identification," is the process of confirming the identity of an operator in a computer or computer network system, thereby determining whether the user has access to and permission to use certain resources. Identity authentication enables the reliable and effective enforcement of access policies for computer and network systems, preventing attackers from impersonating legitimate users to gain access to resources, ensuring system and data security and protecting the legitimate interests of authorized users.

[0003] Currently, traditional identity authentication technology is relatively mature, and its current status is as follows: (1) Traditional authentication binds the user ID and public key as static public credentials for verification during registration. Static credentials can be easily intercepted and analyzed by adversaries and used to impersonate user logins. (2) Traditional user authentication credential updates require repeated registration operations, lacking a dynamic self-update mechanism for user authentication credentials, and users cannot limit the number of times the credential can be used; (3) Traditional cross-domain authentication requires negotiation and sharing of user credentials, and the initially registered key management center cannot effectively control the exposure of credential transfers; (4) Traditional multi-user authentication relies on a centralized single-point trusted third party, which carries the risk of single-point login failure and single-point data loss, causing authentication services to become unavailable. Summary of the Invention

[0004] In response to the above technical problems, the present invention provides a blockchain-based cross-domain authentication system and method for dynamically updating user credentials.

[0005] The present invention is achieved by adopting the following technical solutions: In the first aspect, a cross-domain authentication system for dynamically updating user credentials based on blockchain includes a user and a terminal, and a blockchain module, wherein the blockchain module includes the following submodules: Block evidence module: Set up multiple blocks, each of which stores blockchain transaction data and version data; Smart contract registration and verification module: Single-point registration is performed based on the user, terminal, and registration node, while multi-point authentication is performed between the user, terminal, registration node, and each blockchain node.

[0006] Furthermore, the blockchain transaction data stored in each block includes shared time, data and signature; the version data includes block hash, timestamp and Merkle root, where the block hash of the genesis block is empty.

[0007] Furthermore, the registration node interacts with each blockchain node through the alliance consensus ledger.

[0008] Blockchain, with its weak centralization, high degree of autonomy, and immutability, provides blockchain evidence storage services, as well as registration and verification services based on smart contracts. Once a user registers their identity with any blockchain-connected identity provider, their public credentials are publicly recorded on the consensus chain across all blockchain nodes.

[0009] On the other hand, a blockchain-based user credential dynamic update cross-domain authentication method is implemented based on the blockchain-based user credential dynamic update cross-domain authentication system, including a registration process and an authentication process, and the participants include users, authentication nodes and blockchain nodes; wherein, when registering a password, the default user, authentication node and blockchain node have been issued a signature verification key and negotiated encryption key information.

[0010] Specifically, the registration process includes the following sub-steps: Step A1: User Enter a unique identifier on the client and set the password string , the client background automatically sets the counter =1, the authentication credentials are calculated as: ; in, Indicates that a hash operation is performed on the data in the brackets. Indicates the number of times the hash function operation is performed; Represents bitwise exclusive OR; Step A2: The user sends registration information to the authentication end. The registration information is represented as: ; Among them, || is a connector, Indicates that the sender encrypts the information in the brackets; Indicates the sender's signature on all the previous data. If there is specific content in the brackets, it means the signature of all the data in the brackets; Step A3: After decryption, the authenticator stores the credentials ,at this time =1; the authenticator has a valid certificate After signing, initiate a request to upload the certificate to the chain; Step A4: After the blockchain verifies the signature, it records the chain certificate and returns the chain record result to the authentication node; Step A5: The authenticator returns the user registration result.

[0011] Specifically, the authentication process includes the following sub-steps: Step B1: User enters a unique identifier and set the password string , calculate the following parameters respectively: ; ; ; Step B2: User initiates authentication request || ; Step B3: The authenticator verifies the signature and decrypts it, queries the local blockchain account book to retrieve the user authentication certificate, and then performs authentication. If successful, the certificate and counter are updated.

[0012] Specifically, the authentication step B3 includes: Judgment parameters and ,like , then the authentication fails; if the two are different, then calculate ; Further judgment, if ,and , the authentication succeeds; otherwise, the authentication fails.

[0013] Specifically, the further determination of authentication success further includes: After successful authentication, the password Updated to ,counter , authentication server storage ; The authenticator updates the chain certificate to , initiate a chain record request after signing; After the blockchain system verifies the signature, it executes the chain record, and the blockchain system authenticator returns the chain record result {0,1}|| , the authenticator returns the user authentication result {0,1}|| ; Among them, {0,1} indicates whether the query message returns valid or invalid, successful or failed.

[0014] The beneficial effects of the present invention are as follows: the present invention solves the problems that when the traditional public key signature verification method is used for cross-domain authentication, the public key certificate is static and easy to be analyzed by the adversary, the exposure of the public key certificate caused by the cross-domain authentication certificate flow is difficult to control, the certificate update process is complicated, and single sign-on fails, single point data is lost, etc. Each time a user performs an authentication, his public certificate can be automatically updated and the old public certificate automatically becomes invalid, thereby achieving effective control of the exposure of the user's credential flow without the need for the user to repeatedly register and update the certificate. In addition, the method adopts the advantages of blockchain-based public consensus, multi-ledger backup, non-tamperability, and automatic execution of smart contracts to reduce data loss and the risk of authentication service unavailability. A multi-effect improvement in security, convenience and usability is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying any creative work.

[0016] Figure 1 This is an architecture diagram of a cross-domain authentication system for dynamically updating user credentials based on blockchain in an embodiment of the present invention; Figure 2 A flowchart of the registration process in an embodiment of the present invention; Figure 3 This is a flow chart of the authentication process in an embodiment of the present invention; Figure 4 Schematic diagram of the authentication execution process in an embodiment of the present invention. DETAILED DESCRIPTION

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0018] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0019] The following is combined with Figure 1-4 , some embodiments of the present invention are described in detail. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0020] The present invention proposes a cross-domain authentication system for dynamically updating user credentials based on blockchain. In a preferred embodiment, the system is as follows: Figure 1 As shown, it includes users and terminals, as well as a blockchain module. The blockchain module includes the following submodules: Block evidence module: Set up multiple blocks, each of which stores blockchain transaction data and version data; Smart contract registration and verification module: Single-point registration is performed based on the user, terminal, and registration node, while multi-point authentication is performed between the user, terminal, registration node, and each blockchain node.

[0021] In this embodiment, according to Figure 1 It can be seen that the blockchain transaction data stored in each block includes shared time, data and signature; the version data includes block hash, timestamp and Merkle root, among which the block hash of the genesis block is empty; the registration node and each blockchain node interact through the alliance consensus ledger.

[0022] In one embodiment, a cross-domain authentication system dynamically updates user credentials based on blockchain. Blockchain has the characteristics of weak centralization, high autonomy, and non-tamperability, and provides block evidence services, registration and verification services based on smart contracts. After a user registers his / her identity with any identity provider connected to the blockchain, his / her public credentials are publicly recorded on the consensus chain of each blockchain node. Registered users can automatically query the ledger and perform authentication based on smart contracts at any blockchain node, reducing the risk of single sign-on failure and data loss from a system management perspective. The user's public chain-recorded credentials are valid only once. After each authentication, a new credential chain is generated, and the old credentials are invalidated. This effectively meets the requirements for controlling the exposure of credential circulation without requiring users to re-register, improving authentication security while also taking into account ease of use.

[0023] According to the above-mentioned blockchain-based user credential dynamic update cross-domain authentication system, the present invention also proposes a blockchain-based user credential dynamic update cross-domain authentication method. The detailed process includes registration and authentication processes. The meaning of the protocol symbols is shown in Table 1. By default, when registering the password, the user, authentication node, blockchain node and other participants have been issued signature verification keys, negotiated encryption keys and other information.

[0024] Table 1 Meaning of protocol symbols In this embodiment, the registration process is as follows Figure 2 As shown: 1) User Enter a unique identifier on the client and set a password , the client backend automatically sets the counter cnt=1 to calculate the authentication credentials ; 2) User sends registration information To the authentication end; 3) After decryption, the authenticator stores the credentials .at this time =1; 4) The authenticator checks the certificate After signing, initiate a request to upload the certificate to the chain; 5) Blockchain verification signature postscript chain certificate; 6) The blockchain returns the verification node’s chain record result; 7) The authenticator returns the user registration result.

[0025] In this embodiment, the authentication process is as follows: Figure 3 As shown: 1) User input unique identifier , password ,calculate: ; ; ; 2) User initiates authentication request || ; 3) The authenticator verifies the signature and decrypts it, queries the local blockchain account book to retrieve the user authentication certificate, and then performs the authentication. If successful, the certificate and counter are updated.

[0026] The authentication process is as follows Figure 4 As shown: First, determine if , the authentication fails; otherwise, the calculation ; Judge, if and , the authentication succeeds; otherwise, the authentication fails.

[0027] If the authentication is successful, the password will be further Updated to ,counter Authentication server storage ; Authentication is successful, the authenticator updates the chain certificate to , after signing, initiate a chain record request. After the blockchain system verifies the signature, it executes the chain record. The blockchain system authenticator returns the chain record result {0,1}|| The authenticator returns the user authentication result {0,1}|| .

[0028] The present invention proposes a cross-domain authentication method for dynamically updating user credentials based on blockchain, which solves the problems that when the traditional public key signature method is used for cross-domain authentication, the public key certificate is static and easy to be analyzed by the adversary, the exposure of the public key certificate caused by the cross-domain authentication credential flow is difficult to control, the credential update process is complicated, and there are problems such as single-point login failure and single-point data loss. Each time a user performs authentication, his or her public credentials can be automatically updated and the old public credentials automatically become invalid, thereby achieving effective control of the exposure of the user credential flow without the need for the user to repeatedly register and update the credentials. In addition, this method uses the advantages of blockchain-based public consensus, multi-ledger backup, non-tamperability, and automatic execution of smart contracts to reduce data loss and the risk of authentication service unavailability. A multi-effect improvement in security, convenience and usability is achieved.

[0029] For the sake of simplicity, the aforementioned embodiments are described as a series of actions. However, those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are preferred embodiments, and the actions involved are not necessarily required by this application.

[0030] The above embodiments describe the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions are merely illustrative of the principles of the present invention. Without departing from the spirit and scope of the present invention, modifications and variations made by those skilled in the art without departing from the spirit and scope of the present invention should be within the scope of protection of the appended claims.

Claims

1. A cross-domain authentication system for dynamic updating of user credentials based on blockchain, characterized by: It includes users and terminals, as well as a blockchain module, which includes the following submodules: Block evidence module: Set up multiple blocks, each of which stores blockchain transaction data and version data; Smart contract registration and verification module: Single-point registration is performed based on the user, terminal, and registration node, while multi-point authentication is performed between the user, terminal, registration node, and each blockchain node.

2. The blockchain-based user credential dynamic update cross-domain authentication system according to claim 1, characterized in that: The blockchain transaction data stored in each block includes shared time, data, and signature; the version data includes block hash, timestamp, and Merkle root, where the block hash of the genesis block is empty.

3. The cross-domain authentication system for dynamic updating of user credentials based on blockchain as claimed in claim 1, characterized in that: The registration node interacts with each blockchain node through the alliance consensus ledger.

4. A cross-domain authentication method for dynamic updating of user credentials based on blockchain, implemented based on a cross-domain authentication system for dynamic updating of user credentials based on blockchain according to any one of claims 1 to 3, characterized in that: It includes the registration process and the authentication process, and the participants include users, authentication nodes and blockchain nodes; among them, when registering the password, it is assumed that the user, authentication node and blockchain node have been issued a signature verification key and negotiated encryption key information.

5. The cross-domain authentication method for dynamically updating user credentials based on blockchain as claimed in claim 4 is characterized in that: The registration process specifically includes the following sub-steps: Step A1: User Enter a unique identifier on the client and set the password string , the client background automatically sets the counter =1, the authentication credentials are calculated as: ； in, Indicates that a hash operation is performed on the data in the brackets. Indicates the number of times the hash function operation is performed; Represents bitwise exclusive OR; Step A2: The user sends registration information to the authentication end. The registration information is represented as: ； Among them, || is a connector, Indicates that the sender encrypts the information in the brackets; Indicates the sender's signature on all the previous data. If there is specific content in the brackets, it means the signature of all the data in the brackets; Step A3: After decryption, the authenticator stores the credentials ,at this time =1; the authenticator has a valid certificate After signing, initiate a request to upload the certificate to the chain; Step A4: After the blockchain verifies the signature, it records the chain certificate and returns the chain record result to the authentication node; Step A5: The authenticator returns the user registration result.

6. The cross-domain authentication method for dynamically updating user credentials based on blockchain as claimed in claim 5, characterized in that: The authentication process specifically includes the following sub-steps: Step B1: User enters a unique identifier and set the password string , calculate the following parameters respectively: ； ； ； Step B2: User initiates authentication request || ; Step B3: The authenticator verifies the signature and decrypts it, queries the local blockchain account book to retrieve the user authentication certificate, and then performs authentication. If successful, the certificate and counter are updated.

7. The cross-domain authentication method for dynamically updating user credentials based on blockchain as claimed in claim 6, characterized in that: The authentication step B3 specifically includes: Judgment parameters and ,like , then the authentication fails; if the two are different, then calculate ; Further judgment, if ,and , the authentication succeeds; otherwise, the authentication fails.

8. The cross-domain authentication method for dynamically updating user credentials based on blockchain as claimed in claim 7, characterized in that: The further determination of authentication success further includes: After successful authentication, the password Updated to ,counter , authentication server storage ; The authenticator updates the chain certificate to , initiate a chain record request after signing; After the blockchain system verifies the signature, it executes the chain record, and the blockchain system authenticator returns the chain record result {0,1}|| , the authenticator returns the user authentication result {0,1}|| ; Among them, {0,1} indicates whether the query message returns valid or invalid, successful or failed.

Images