Blockchain-based dynamic updating of user credentials cross-domain authentication system and method

Abstract

The application discloses a kind of user credential dynamic updating cross-domain authentication system and method based on blockchain, system includes user and terminal, and blockchain module, the blockchain module includes: block storage module, set multiple blocks, each block stores blockchain transaction data and version data;Intelligent contract registration verification module, according to user and terminal and registration node carry out single-point registration, while user and terminal and registration node and each blockchain node carry out multi-point authentication between each other.This scheme solves the problem that public key certificate is static and easy to be analyzed by enemy when traditional public key signature verification method is used for cross-domain authentication, the problem that public key certificate exposure surface is difficult to control caused by cross-domain authentication certificate circulation, the problem that certificate update process is complex, and the problem that single sign-on fails and single-point data is lost.

Description

Technical Field

[0001] This invention relates to the field of identity authentication technology, and in particular to a cross-domain authentication system and method for dynamically updating user credentials based on blockchain. Background Technology

[0002] Identity authentication, also known as "identity verification" or "identity authentication," refers to the process of confirming the identity of an operator in a computer and computer network system, thereby determining whether the user has the right to access and use certain resources. Identity authentication enables access policies of computer and network systems to be enforced reliably and effectively, preventing attackers from impersonating legitimate users to gain access to resources, ensuring system and data security, and protecting the legitimate interests of authorized users.

[0003] Current traditional identity authentication technologies are relatively mature, and their current technological status is as follows:

[0004] (1) Traditional authentication binds the user ID and public key as a static public credential for verification during registration. Static credentials are easily intercepted and analyzed by adversaries to impersonate users and log in.

[0005] (2) Traditional user authentication credential updates require repeated registration operations and lack a self-dynamic update mechanism for user authentication credentials, so users cannot limit the number of times the credential can be used.

[0006] (3) Traditional cross-domain authentication requires negotiation and sharing of user credentials, and the key management center at the initial registration cannot effectively control the exposure of credentials;

[0007] (4) Traditional multi-user authentication relies on a centralized single-point trusted third party, which poses risks of single sign-on failure and single-point data loss, resulting in the unavailability of authentication services. Summary of the Invention

[0008] To address the aforementioned technical issues, this invention provides a blockchain-based cross-domain authentication system and method for dynamically updating user credentials.

[0009] This invention is achieved using the following technical solution:

[0010] Firstly, a blockchain-based cross-domain authentication system for dynamically updating user credentials includes users and terminals, as well as a blockchain module, which includes the following sub-modules:

[0011] Block storage module: Sets up multiple blocks, each of which stores blockchain transaction data and version data;

[0012] Smart contract registration and verification module: performs single-point registration based on the user and terminal and the registration node, and performs multi-point authentication between the user and terminal, the registration node, and various blockchain nodes.

[0013] Furthermore, the blockchain transaction data stored in each block includes the sharing time, data, and signature; the version data includes the block hash, timestamp, and Merkle root, wherein the block hash of the genesis block is empty.

[0014] Furthermore, the registered node interacts with each blockchain node through a consortium consensus ledger.

[0015] Blockchain, with its characteristics of weak centralization, high autonomy, and immutability, provides block-based evidence storage services and smart contract-based registration and verification services. After a user registers their identity with any identity provider connected to the blockchain, their public credentials are publicly recorded on the consensus chain across all blockchain nodes.

[0016] On the other hand, the blockchain-based user credential dynamic update cross-domain authentication method is implemented based on the aforementioned blockchain-based user credential dynamic update cross-domain authentication system, including a registration process and an authentication process, with participants including users, authentication nodes, and blockchain nodes; wherein, when registering the password, by default, users, authentication nodes, and blockchain nodes have been assigned signature verification keys and negotiated encryption key information.

[0017] Specifically, the registration process includes the following sub-steps:

[0018] Step A1: User Enter a unique identifier in the client. and setting password string The client-side backend automatically sets the counter. =1, calculate the authentication certificate as follows:

[0019] ;

[0020] in, This indicates that a hash operation will be performed on the data within the parentheses. Indicates the number of times the hash function operation was performed; Indicates bitwise XOR;

[0021] Step A2: The user sends registration information to the authentication terminal. The registration information is represented as follows:

[0022] ;

[0023] Where || is the connector, This indicates that the sender has encrypted the information within the parentheses; This indicates the sender's signature on all preceding data. If there is specific content within the parentheses, it indicates a signature on all data within the parentheses.

[0024] Step A3: After decryption, the authenticator stores the credential. ,at this time =1; The authenticator verifies the credentials. After signing, initiate a request to upload the credential to the blockchain;

[0025] Step A4: After verifying the signature, the blockchain records the chain certificate and returns the chain record result to the authentication node;

[0026] Step A5: The authenticator returns the user registration result.

[0027] Specifically, the authentication process includes the following sub-steps:

[0028] Step B1: User inputs a unique identifier and setting password string Calculate the following parameters respectively:

[0029] ;

[0030] ;

[0031] ;

[0032] Step B2: The user initiates an authentication request. || ;

[0033] Step B3: After verifying and decrypting the signature and retrieving the user's authentication credentials from the local blockchain ledger, the authenticator performs the authentication. If successful, the credentials and counter are updated.

[0034] Specifically, step B3, which performs authentication, includes:

[0035] Determine parameters and ,like If the two are different, then authentication fails; if they are different, then the calculation is performed. ;

[0036] Further judgment, if ,and If the result is positive, authentication is successful; otherwise, authentication fails.

[0037] Specifically, the further determination after successful authentication also includes:

[0038] After successful authentication, the password credentials will be sent. Updated to ,counter Authentication server storage ;

[0039] The certifier updates the chain certificate to After signing, initiate a chain-recording request;

[0040] After the blockchain system verifies the signature, it executes the chain recording. The blockchain system certifier returns the chain recording result {0,1}|| The authenticator returns the user authentication result {0,1}|| Where {0,1} indicates whether the query message returned is valid or invalid, successful or unsuccessful.

[0041] The beneficial effects of this invention are as follows: This invention solves the problems of static and immutable public key credentials, which are easily analyzed by adversaries, the difficulty in controlling the public key credential exposure surface caused by cross-domain authentication credential transfer, the complexity of credential update processes, and single sign-on failures and single-point data loss when using traditional public key signature-based methods for cross-domain authentication. Each time a user performs authentication, their public credentials are automatically updated, and old public credentials automatically become invalid, achieving effective control over the user's credential transfer exposure surface without requiring users to repeatedly register and update credentials. Furthermore, this method utilizes the advantages of blockchain-based public consensus, multi-ledger backup, immutability, and automatic smart contract execution to reduce the risk of data loss and authentication service unavailability. This achieves a multi-faceted improvement in security, convenience, and availability. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0043] Figure 1 This is a diagram illustrating the architecture of a blockchain-based cross-domain authentication system for dynamically updating user credentials in an embodiment of the present invention.

[0044] Figure 2 This is a schematic diagram of the registration process in an embodiment of the present invention;

[0045] Figure 3 This is a schematic diagram of the authentication process in an embodiment of the present invention;

[0046] Figure 4 This is a schematic diagram of the authentication execution process in an embodiment of the present invention. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0048] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0049] The following is in conjunction with the appendix Figure 1-4 The following describes some embodiments of the present invention in detail. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0050] This invention proposes a blockchain-based cross-domain authentication system for dynamically updating user credentials. In a preferred embodiment, the system is as follows: Figure 1 As shown, it includes users and terminals, as well as a blockchain module. The blockchain module includes the following sub-modules:

[0051] Block storage module: Sets up multiple blocks, each of which stores blockchain transaction data and version data;

[0052] Smart contract registration and verification module: performs single-point registration based on the user and terminal and the registration node, and performs multi-point authentication between the user and terminal, the registration node, and various blockchain nodes.

[0053] In this embodiment, according to Figure 1 It can be seen that: the blockchain transaction data stored in each block includes the shared time, data, and signature; the version data includes the block hash, timestamp, and Merkle root, where the block hash of the genesis block is empty; registered nodes interact with each other through the consortium consensus ledger.

[0054] In one embodiment, a cross-domain authentication system based on blockchain dynamically updates user credentials. Blockchain, with its characteristics of weak centralization, high autonomy, and immutability, provides block-based evidence storage services, smart contract-based registration, and verification services. After a user registers their identity with any blockchain-connected identity provider, their public credentials are publicly shared on all blockchain nodes. Registered users can automatically query the ledger and perform authentication on any blockchain node based on smart contracts, reducing the risk of single sign-on failure and data loss from a system management perspective. A user's public credentials are valid only once; a new credential chain is generated after each authentication, while the old credentials become invalid. This effectively meets the requirements for controlling the exposure surface of credentials without requiring users to re-register, improving authentication security while maintaining ease of use.

[0055] Based on the aforementioned blockchain-based user credential dynamic update cross-domain authentication system, this invention also proposes a blockchain-based user credential dynamic update cross-domain authentication method. The detailed process includes registration and authentication processes, and the meanings of protocol symbols are shown in Table 1. By default, when registering the password, the user, authentication node, blockchain node, and other participating parties have been assigned signature verification keys and negotiated encryption keys and other information.

[0056] Table 1. Meaning of Protocol Symbols

[0057]

[0058] In this embodiment, the registration process is as follows: Figure 2 As shown:

[0059] 1) User Enter a unique identifier in the client. and setting password The client-side backend automatically sets a counter cnt=1 to calculate authentication credentials. ;

[0060] 2) User sends registration information For the authentication end;

[0061] 3) After decryption, the authenticator stores the credential. .at this time =1;

[0062] 4) The certifying party verifies the credentials. After signing, initiate a request to upload the credential to the blockchain;

[0063] 5) Blockchain verification of the signed post-chain certificate;

[0064] 6) The blockchain returns the chain record result from the certified node;

[0065] 7) The certifying party returns the user registration result.

[0066] In this embodiment, the authentication process is as follows: Figure 3 As shown:

[0067] 1) User input unique identifier Password ,calculate:

[0068] ;

[0069] ;

[0070] ;

[0071] 2) User initiates authentication request || ;

[0072] 3) After the authenticator verifies and decrypts the signature, retrieves the user's authentication credentials from the local blockchain ledger, and performs authentication, the credentials and counter are updated if successful.

[0073] The authentication process is as follows Figure 4 As shown:

[0074] First, determine if... If the authentication fails, the verification will fail; otherwise, the calculation will be performed. ;

[0075] Determine if and If the result is positive, authentication is successful; otherwise, authentication fails.

[0076] If authentication is successful, the password credentials will then be sent. Updated to ,counter Authentication server storage Authentication successful; the authenticator updates the blockchain certificate. After signing, a chain recording request is initiated. The blockchain system verifies the signature and executes the chain recording. The blockchain system's authenticator returns the chain recording result: {0,1}|| The authenticator returns the user authentication result: {0,1}|| .

[0077] This invention proposes a blockchain-based method for dynamically updating user credentials for cross-domain authentication. It addresses the problems of traditional public key verification methods for cross-domain authentication, such as static public key credentials that are easily analyzed by adversaries, difficulty in controlling the public key credential exposure during cross-domain authentication credential transfer, complex credential update processes, and single sign-on failures and data loss. Each time a user performs authentication, their public credentials are automatically updated, and old public credentials automatically become invalid, achieving effective control over the exposure of user credentials without requiring users to repeatedly register and update credentials. Furthermore, this method leverages the advantages of blockchain-based public consensus, multi-ledger backup, immutability, and automatic smart contract execution to reduce the risk of data loss and authentication service unavailability. This achieves a multi-faceted improvement in security, convenience, and availability.

[0078] For the foregoing embodiments, in order to simplify the description, they are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to this application, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to this application.

[0079] The above embodiments describe the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Modifications and variations made by those skilled in the art without departing from the spirit and scope of the invention should be within the protection scope of the appended claims.

Claims

1. A cross-domain authentication method for dynamically updating user credentials based on blockchain, characterized in that, The process includes registration and authentication, with participants including users, authentication nodes, and blockchain nodes. When registering the password, users, authentication nodes, and blockchain nodes are automatically assigned signature verification keys and negotiated encryption key information. The registration process specifically includes the following sub-steps: Step A1: User Enter a unique identifier in the client. and setting password string The client-side backend automatically sets the counter. =1, calculate the authentication certificate as follows: ； in, This indicates that a hash operation will be performed on the data within the parentheses. Indicates the number of times the hash function operation was performed; Indicates bitwise XOR; Step A2: The user sends registration information to the authentication terminal. The registration information is represented as follows: ； Where || is the connector, This indicates that the sender has encrypted the information within the parentheses; This indicates the sender's signature on all preceding data. If there is specific content within the parentheses, it indicates a signature on all data within the parentheses. Step A3: After decryption, the authenticator stores the credential. ,at this time =1; The authenticator verifies the credentials. After signing, initiate a request to upload the credential to the blockchain; Step A4: After verifying the signature, the blockchain records the chain certificate and returns the chain record result to the authentication node; Step A5: The authenticator returns the user registration result; The authentication process specifically includes the following sub-steps: Step B1: User inputs a unique identifier and setting password string Calculate the following parameters respectively: ； ； ； Step B2: The user initiates an authentication request. || ; Step B3: After verifying and decrypting the signature and retrieving the user's authentication credentials from the local blockchain ledger, the authenticator performs the authentication. If successful, the credentials and counter are updated.

2. The cross-domain authentication method for dynamically updating user credentials based on blockchain as described in claim 1, characterized in that, Step B3, which involves performing authentication, specifically includes: Determine parameters and ,like If the two are different, then authentication fails; if they are different, then the calculation is performed. ; Further judgment, if ,and If the result is positive, authentication is successful; otherwise, authentication fails.

3. The cross-domain authentication method for dynamically updating user credentials based on blockchain as described in claim 2, characterized in that, The further determination of successful authentication also includes: After successful authentication, the password credentials will be sent. Updated to ,counter Authentication server storage ; The certifier updates the chain certificate to After signing, initiate a chain-recording request; After the blockchain system verifies the signature, it executes the chain recording. The blockchain system certifier returns the chain recording result {0,1}|| The authenticator returns the user authentication result {0,1}|| Where {0,1} indicates whether the query message returned is valid or invalid, successful or unsuccessful.

4. A blockchain-based cross-domain authentication system for dynamically updating user credentials, used to implement the blockchain-based cross-domain authentication method for dynamically updating user credentials as described in any one of claims 1 to 3, characterized in that, This includes users and terminals, as well as a blockchain module, which includes the following sub-modules: Block storage module: Sets up multiple blocks, each of which stores blockchain transaction data and version data; Smart contract registration and verification module: performs single-point registration based on the user and terminal and the registration node, and performs multi-point authentication between the user and terminal, the registration node, and various blockchain nodes.

5. The blockchain-based cross-domain authentication system for dynamic updating of user credentials as described in claim 4, characterized in that, The blockchain transaction data stored in each block includes the shared time, data, and signature; the version data includes the block hash, timestamp, and Merkle root, wherein the block hash of the genesis block is empty.

6. The blockchain-based cross-domain authentication system for dynamic updating of user credentials as described in claim 5, characterized in that, The registered node interacts with each blockchain node through a consortium consensus ledger.

Images