Cross-domain identity authentication and access authorization method, system, equipment and medium

Abstract

The invention discloses a cross-domain identity authentication and access authorization method, system and device and a medium, and belongs to the field of Internet of Things. According to the method, a unified identity authentication mechanism and a dynamic authority control model are constructed based on a decentralized identifier and a block chain technology. Firstly, an Internet of Things entity submits decentralized identifier information through an identity authentication request; the system generates identity metadata according to the request and records the identity metadata to an identity registry, and meanwhile, constructs a decentration identification document and stores the decentration identification document to a verifiable data registry. And then, the authorizer executes point-to-point trust evaluation based on the identity data and the on-chain traceability information, and generates a verifiable certificate with an encrypted signature. And the verifier completes certificate verification through an intra-domain or cross-domain verification mode, and dynamically grants the authority according to the trust value and the access policy directory. Cross-domain trust migration and dynamic permission adjustment are supported, and the identity authentication security and the access control flexibility in the multi-domain environment of the Internet of Things are improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things, and in particular to a cross-domain identity authentication and access authorization method, system, device and medium. Background Art

[0002] With the continuous advancement of information technology, the Internet of Things (IoT) has been widely applied in many fields, including smart cities, intelligent manufacturing, and smart healthcare. In the IoT environment, various intelligent terminals and edge devices access the network in a diverse and distributed manner, and information interaction and collaborative operations between devices are becoming increasingly frequent. In this context, information resources in different organizations, platforms, or regions urgently need to be efficiently and securely shared and interoperable through the network. This is especially true in the context of the convergence of cloud computing, edge computing, and big data platforms, where interoperability between information systems becomes crucial. However, in distributed IoT systems, due to the strong heterogeneity of devices and the complex and diverse access entities, traditional access control mechanisms are no longer able to meet practical needs.

[0003] The system must not only implement cross-domain identity authentication but also support fine-grained access control policies based on user attributes or behavior to dynamically respond to environmental changes and security threats, while ensuring controlled access to information resources and the implementation of the principle of least privilege. Currently, widely used centralized identity management solutions typically rely on a single authentication service provider to maintain user identity data and authentication processes. While this approach offers certain management conveniences in closed or single systems, it exposes numerous limitations in large-scale distributed IoT environments.

[0004] On the one hand, the lack of unified identity identification and authentication protocols across different systems prevents identity data from interoperating, hindering seamless authentication and resource access for users in multi-domain environments. On the other hand, centralized structures present a single point of failure risk. A failure or attack on the authentication server could paralyze the entire system's authentication services. Furthermore, centralized storage of user identity information can also lead to serious privacy breaches, especially when transparency around data usage is low, making it difficult for users to independently control and audit their identity data. Summary of the Invention

[0005] The present invention proposes a cross-domain identity authentication and access authorization method, system, device and medium, which solves the problems of identity islands, high system coupling and low authentication credibility existing in the traditional centralized identity management model in the distributed environment of the Internet of Things.

[0006] The present invention provides a cross-domain identity authentication and access authorization method, comprising the following steps:

[0007] S1: Receive an identity authentication request and initial identity data sent by an IoT entity, wherein the identity authentication request includes a decentralized identifier;

[0008] S2: Generate identity metadata according to the identity authentication request, and record the identity metadata in the identity registry;

[0009] S3: Constructing a corresponding decentralized identification document based on the decentralized identifier, wherein the decentralized identification document includes a user public key, a verification method, and a service address information;

[0010] S4: Storing the decentralized identification document in a verifiable data registry, where the verifiable data registry is a blockchain-based data infrastructure;

[0011] S5: Based on the identity metadata and the traceability information in the blockchain, perform a peer-to-peer trust assessment and generate a cryptographically signed verifiable credential;

[0012] S6: Verify the verifiable credential to obtain a verification result; the verification includes intra-domain verification and cross-domain verification;

[0013] S7: In the current trust domain or the target trust domain, access control is performed on the resources requested by the entity according to the access policy directory.

[0014] Preferably, it also includes:

[0015] In the blockchain network, the user's initial identity data, identity metadata and verifiable credentials are recorded in the blockchain in chronological order to achieve data traceability of the user's identity information.

[0016] This solution, through the introduction of decentralized identifiers and a blockchain-based verifiable data registry, achieves decentralized management of IoT entity identities, avoiding the single point of failure risk inherent in traditional centralized identity systems and improving system security and reliability. By constructing a decentralized identification document containing public keys, verification methods, and service address information and storing it on the blockchain, identity data is tamper-resistant and traceable during storage and transmission, thereby enhancing the credibility of the authentication process.

[0017] Preferably, in step S5, the step of generating a verifiable credential with an encrypted signature includes:

[0018] S51: Generate an asymmetric key including a public key and a private key;

[0019] S52: Create an authorization statement, which includes the identity of the authorizer, the trust value of the trustee, and the validity period of the authorization;

[0020] S53: Use its private key to digitally sign the authorization statement to obtain a signature;

[0021] S54: Broadcast the authorization statement and its signature to the network.

[0022] Preferably, the trust value calculation includes:

[0023]

[0024] Where A is the number of times user u's historical access behaviors are evaluated as passed; B1 is the number of times user u's historical access behaviors within the domain are evaluated as failed; B2 is the number of times user u's historical cross-domain access behaviors are evaluated as failed; δ a (t) is the time decay factor of the ath successful access; δ i (t), δ j (t) represents the time decay factor of failed access within the domain and across domains respectively; c i is the penalty coefficient when a request fails within the domain; c j is the penalty coefficient when a cross-domain request fails; α is the weight for distinguishing the impact of the calculated trust on the historical access behavior within the domain and across domains; the decay factor is calculated using the decay exponential method: exponential decay: δ(t) = e -λt .

[0025] In the above scheme, by generating an asymmetric key pair and signing the authorization statement based on the private key, the integrity and non-repudiation of the authorization content can be ensured; the trust value and validity period contained in the authorization statement can be used to achieve dynamic quantitative management of the trustee's access rights; the signed authorization statement is broadcast to the network, which improves the verifiability and shareability of the credentials.

[0026] Preferably, in step S6, the intra-domain verification step includes:

[0027] S61: Obtain authorization statement and signature;

[0028] S62: Extract the public key identifier of the authorizer from the statement and search for the corresponding public key;

[0029] S63: Verify the authenticity of the signature using the public key of the authorizer;

[0030] S64: Check the validity period in the declaration to ensure that the current time does not exceed the validity period of the authorization;

[0031] S65: Check the trust value in the declaration to ensure that the current trust value exceeds the minimum trust threshold;

[0032] S66: When all the above verifications are passed, the trustee is deemed to have access rights.

[0033] In this solution, multiple verification operations are performed within the domain, not only verifying the integrity and authenticity of authorization statements to prevent forgery or tampering, but also dynamically determining validity based on validity periods and trust values ​​to prevent unauthorized access by expired or low-trust entities. This efficient, flexible, and scalable verification mechanism can adapt to the authentication needs of diverse devices and their dynamic trust relationships in IoT environments, thereby enhancing overall system security and trusted access capabilities.

[0034] Preferably, in step S6, the cross-domain verification step includes:

[0035] Calculate the dynamic trust evaluation value of user u in domain A:

[0036]

[0037] Among them, T u represents the trust score of the current user, specifically the trust value of the trustee; s represents the weight of the sth successful access to domain A; f represents the penalty coefficient of the fth failed access; δ(t s ) represents the time decay factor of the sth successful access in domain A; δ(t f ) represents the time decay factor of the fth failed access in domain A;

[0038] Domain B performs weighted processing based on the dynamic trust evaluation value of domain A, specifically:

[0039]

[0040] Among them, β∈[0,1] represents the cross-domain trust weight, Represents the original trust value of domain B during the cross-domain process of user u.

[0041] In this solution, by introducing a cross-domain trust evaluation mechanism, users' historical behavioral trust in Domain A can be incorporated into the trust evaluation system of Domain B, effectively alleviating the trust silos caused by the independence of identity systems across domains. By weightedly integrating trust values ​​across domains, a dynamic, quantifiable, and transferable trust propagation mechanism can be implemented. This enables trusted interoperability of cross-domain identity authentication and access authorization without exposing sensitive identity information, further enhancing the system's security collaboration and flexibility.

[0042] Preferably, in step S7, the step of performing access control on the resources requested by the entity according to the access policy directory includes:

[0043] After the user passes the identity authentication, access rights are dynamically allocated based on the permission information and trust level in the verifiable credentials; at the same time, the user's behavior data is tracked and analyzed to continuously optimize the access policy and build an access policy catalog.

[0044] Preferably, a cross-domain identity authentication and access authorization system applies the cross-domain identity authentication and access authorization method, including:

[0045] a request distribution module, configured to receive an identity authentication request sent by an IoT entity, wherein the request includes a decentralized identifier;

[0046] An identity registry module, configured to generate identity metadata according to the identity authentication request and record the identity metadata in an identity registry;

[0047] A decentralized identification document generation module, configured to construct a corresponding decentralized identification document based on the decentralized identifier, wherein the decentralized identification document includes a user public key, a verification method, and a service address information;

[0048] A verifiable data registry module, configured to store the decentralized identification document in a verifiable data registry, which is a blockchain-based data infrastructure used to support the parsing and verification of the decentralized identification document;

[0049] A credential generation module, configured to perform a peer-to-peer trust assessment based on the identity metadata and provenance information in the blockchain, and generate a cryptographically signed verifiable credential;

[0050] The credential verification module is used to verify the verifiable credentials submitted by the trustee, including intra-domain verification and cross-domain verification;

[0051] The access control module is used to perform access control on resources requested by an entity according to the access policy directory in the current trust domain or the target trust domain.

[0052] Preferably, a terminal device includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and the processor implements the cross-domain identity authentication and access authorization method when executing the computer program.

[0053] Preferably, a computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the cross-domain identity authentication and access authorization method.

[0054] The present invention discloses a cross-domain identity authentication and access authorization method and system, which has the following beneficial effects compared with the prior art:

[0055] (1) Adopt decentralized identifiers and verifiable credential technologies to achieve autonomous control and cross-domain mutual recognition of user identities, abandon reliance on network boundaries, and ensure that every access request undergoes strict identity authentication and attribute verification, thereby improving the security and flexibility of the overall system;

[0056] (2) The decentralized peer-to-peer trust evaluation model integrates information such as user historical behavior and introduces a time decay factor, making the trust evaluation more dynamic and reasonable. At the same time, the combination of blockchain or distributed ledger technology makes the trust evaluation process transparent and tamper-proof, thereby enhancing the reliability of the trust mechanism.

[0057] (3) The cross-domain dynamic access authorization model is based on fine-grained control of user behavior and continuous trust assessment to reduce system risks and ensure system security. It improves the granularity and adaptability of authorization policies, protects user identity privacy information, and improves the security and flexibility of cross-domain identity authentication and access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 This is a flow chart of a cross-domain identity authentication and access authorization method provided by the present invention;

[0059] Figure 2 This is a schematic diagram of an embodiment of decentralized cross-domain identity authentication provided by the present invention;

[0060] Figure 3 Schematic diagram of a specific embodiment of a point-to-point trust evaluation model for an access system provided by the present invention;

[0061] Figure 4 This is a schematic diagram of a specific embodiment of the cross-domain dynamic access authorization model provided by the present invention;

[0062] Figure 5 This is a module diagram of a cross-domain identity authentication and access authorization system provided by the present invention;

[0063] Figure 6 This is the cross-domain identity authentication architecture provided by the present invention. DETAILED DESCRIPTION

[0064] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0065] like Figure 1 As shown, the present invention provides:

[0066] S1: Receive an identity authentication request and initial identity data sent by an IoT entity, wherein the identity authentication request includes a decentralized identifier;

[0067] S2: Generate identity metadata according to the identity authentication request, and record the identity metadata in the identity registry;

[0068] S3: Constructing a corresponding decentralized identification document based on the decentralized identifier, wherein the decentralized identification document includes a user public key, a verification method, and a service address information;

[0069] S4: Storing the decentralized identification document in a verifiable data registry, where the verifiable data registry is a blockchain-based data infrastructure;

[0070] like Figure 2 As shown, in a specific embodiment, taking an IoT entity cross-domain identity authentication process as an example, the implementation process of the present invention is described in detail:

[0071] First, an IoT entity, such as a smart camera, sensor, or edge computing node, initiates an identity authentication request to the system. This request is received by the request dispatcher and contains the device's unique identifier, basic attributes (such as type, manufacturer, and firmware version), and its corresponding decentralized identifier. To ensure the credibility and traceability of this data, the request dispatcher invokes the identity registration smart contract deployed on the blockchain and writes the device's initial identity data to the blockchain as a transaction. This ensures the immutability of the device's identity data and facilitates subsequent tracking, auditing, and verification.

[0072] The request dispatcher then redirects the identity request to the Identity Registry module, which serves as the system's registration information management hub. This module is responsible for parsing the device attribute information in the request and performing identity duplication checks or registration based on existing records. The Identity Registry module uses a metadata structure to record device information, including attribute key-value pairs, registration timestamps, and authentication status. It ensures the consistency and integrity of this metadata by synchronizing it with the blockchain state.

[0073] The Identity Registry module then submits the processed user identity information to the Decentralized Identifier module. This module constructs a decentralized identification document for each IoT device, containing fields such as the device's public key, supported authentication methods, and the address of the service endpoint. The generated identification document is stored in a verifiable data registry built on the blockchain, ensuring its openness, accessibility, and tamper-resistance.

[0074] Through the above-mentioned whole process, the present invention realizes a decentralized identity authentication and access authorization system that supports data traceability, adapts to cross-domain collaboration, and has the ability of dynamic evolution of trust. It is particularly suitable for the Internet of Things environment with heterogeneous devices and complex scenarios, and significantly improves the system's security, scalability and trust autonomy capabilities.

[0075] like Figure 3 As shown, the present invention provides a method for intra-domain access, including:

[0076] S5: Based on the identity metadata and the traceability information in the blockchain, perform a peer-to-peer trust assessment and generate a cryptographically signed verifiable credential;

[0077] S6: Verify the verifiable credential to obtain a verification result; the verification includes intra-domain verification and cross-domain verification;

[0078] S7: In the current trust domain or the target trust domain, access control is performed on the resources requested by the entity according to the access policy directory.

[0079] In a specific embodiment, the complete implementation process of the point-to-point trust evaluation in the access system of the present invention is described:

[0080] First, during the system startup or access control initialization phase, an authorized subject such as a system administrator, gateway device, or master node generates an asymmetric key pair, including a public key PK A and private key SK A This key pair is used for the subsequent digital signature and verification of the authorization statement, ensuring the security and non-repudiation of the entire trust evaluation process.

[0081] Subsequently, the authorizer constructs an authorization statement S based on the current target entity, the trustee’s behavior record and identity information. The statement clearly lists the trustee’s identity ID B , the currently calculated trust value T u , the specific content of the authorized access rights and the validity period of the authorization T valid This authorization statement serves as the core carrier of the trust certificate and is the basis for the verifier to make judgments.

[0082] After the statement is constructed, the authorizer uses its private key SK A Perform digital signature operation on the authorization statement S and obtain the signature result Sig=Sign(SK A ,S). The introduction of digital signatures not only ensures the integrity of the statement during transmission in the network, but also prevents tampering by middlemen. Then, the authorizer broadcasts the authorization statement S and its signature Sig to the blockchain network, ensuring that all network participants can publicly access and verify this statement. Trust value T uThe calculation of is highly interpretable and dynamically adaptable in the present invention, taking into account the success and failure records of historical user accesses. The specific formula is as follows:

[0083]

[0084] Where A is the number of times user u's historical access behaviors are evaluated as passed; B1 is the number of times user u's historical access behaviors within the domain are evaluated as failed; B2 is the number of times user u's historical cross-domain access behaviors are evaluated as failed; δ a (t) is the time decay factor of the ath successful access; δ i (t), δ j (t) represents the time decay factor of failed access within the domain and across domains respectively; c i is the penalty coefficient when a request fails within the domain; c j is the penalty coefficient when a cross-domain request fails; α is the weight for distinguishing the impact of the calculated trust on the historical access behavior within the domain and across domains; the decay factor is calculated using the decay exponential method: exponential decay: δ(t) = e -λt .

[0085] Next, the verifier at the receiving end, such as the access control server or the target domain gateway, starts the verification process after receiving the authorization statement and signature information. The verifier first parses the statement S and extracts the authorizer ID A And retrieve the ID through the on-chain verifiable data registry or identity registry A Corresponding public key PK A This step ensures that the verifier obtains the correct key material and prevents man-in-the-middle attacks that forge identities.

[0086] After obtaining the public key, the verifier uses the public key to verify the signature Sig, that is, to execute Verify(PK A ,Sig,S). If the verification is successful, it means that the statement is indeed made by the ID A It is issued by the corresponding authorized person and has not been tampered with during transmission.

[0087] After completing the signature verification, the verifier continues to check the rest of the declaration, mainly including the following two aspects:

[0088] Validity check: Read the T in the authorization statement valid , and the current system time T current Compare to ensure that the current time does not exceed the authorization validity period, that is, T current ≤T valid ;

[0089] Trust value threshold judgment: verify the trust value T in the statement uWhether it is higher than the minimum trust threshold set by the system to ensure that only entities with sufficient credibility are allowed to obtain permissions.

[0090] When all of the above verification steps are met, the system deems the trustee to have the access rights described in the declaration. The verifier then updates the entity's status in the access control module and grants access to the corresponding resources. The system also logs the authorization event and may provide feedback to the behavior analysis module for subsequent behavior modeling, trust value updates, and access policy optimization.

[0091] Through the above process, the peer-to-peer trust assessment model of this invention implements a trusted authorization mechanism without the need for a centralized management node, effectively solving the identity trust and access decision-making issues among distributed devices in the IoT environment. By integrating cryptographic security techniques with behavioral assessment mechanisms, it makes trust establishment more rational and dynamic, and offers excellent security, transparency, and system scalability.

[0092] like Figure 4 As shown, the present invention provides a cross-domain access method, including:

[0093] S5: Based on the identity metadata and the traceability information in the blockchain, perform a peer-to-peer trust assessment and generate a cryptographically signed verifiable credential;

[0094] S6: Verify the verifiable credential to obtain a verification result; the verification includes intra-domain verification and cross-domain verification;

[0095] S7: In the current trust domain or the target trust domain, access control is performed on the resources requested by the entity according to the access policy directory.

[0096] In a specific embodiment, the complete implementation process of the cross-domain dynamic access authorization model proposed by the present invention is described in detail:

[0097] First, in source trust domain A, the system analyzes and evaluates user u's behavior history based on the unified identity authentication completed. This evaluation mechanism not only focuses on whether the user has passed authentication, but also further collects information on their specific access behaviors, including the number, duration, and results of successful and failed accesses, thereby achieving fine-grained control and continuous trust tracking. During the trust value calculation process, the system uses the following trust evaluation model:

[0098]

[0099] Among them, T u represents the trust score of the current user, that is, the trust value of the trustee; s represents the weight of the sth successful access to domain A, and f represents the penalty coefficient of the fth failed access; δ(t s) represents the time decay factor of the sth successful access in domain A; similarly, δ(t f ) represents the time decay factor of the f-th failed access in domain A. After calculating the dynamic trust evaluation value of user u in domain A, permissions can be granted according to the trust value level set by the system. When user u performs well in domain A continuously and the trust level remains at a high level for a long time, domain A regards it as a trusted user. At this time, in order to support its access needs in other trust domains, domain A can generate and issue a "trust certificate" for it. The certificate contains the user's identity, trust score in domain A, certificate issuance time, signature information, validity period, etc. The trust certificate is encrypted by digital signature to prevent forgery and tampering.

[0100] Subsequently, user u submits the trust certificate to the target trust domain B. After receiving the certificate, domain B first performs verification, including verifying the legitimacy of the signature, whether the certificate is within the validity period, and whether the trust value meets the requirements.

[0101] After verification, domain B will use this trust credential in combination with its own policy model and domain A's trust score for weighted processing to calculate the user's initial cross-domain trust value. The specific weighted calculation formula is as follows:

[0102] T u,B =βT u,A +(1-β)T u,B0

[0103] Among them, β∈[0,1] represents the cross-domain trust weight, This represents the initial trust value assigned by domain B to user u during the cross-domain process. The system can set this value based on actual security policies, for example, setting a higher β value for the highly trusted domain A. Based on this initial trust value, domain B grants the user corresponding permissions, granting different levels of resource access permissions, such as read-only, partial control, or full control.

[0104] Furthermore, users' access to Domain B does not always maintain their original permissions; instead, they are continuously subject to a control mechanism that tracks behavior and dynamically adjusts their trust. The system records all user behavior data in Domain B in real time, including access frequency, abnormal operations, response time, resource consumption, and other data. It periodically updates their trust score and dynamically adjusts user permissions accordingly, gradually increasing, maintaining, or decreasing permissions. For example, if a user is initially granted medium permissions but their behavior remains safe, stable, and reliable, the system can automatically raise their trust level to a higher level. Conversely, if they engage in access anomalies or violations, the system can immediately downgrade or even freeze their access rights to prevent the spread of system risks.

[0105] Through the above process, the cross-domain dynamic access authorization model of the present invention not only realizes fine-grained control based on behavior, but also introduces a dynamic trust propagation mechanism of "trust credentials + weight fusion + behavior evaluation", which solves the problem of permission setting and access control caused by differences in subjects and different security requirements in the multi-domain system of the Internet of Things, and significantly improves the security, controllability and intelligent adaptability of the system.

[0106] like Figure 5 As shown, the present invention provides:

[0107] S101: A request distribution module is configured to receive an identity authentication request sent by an IoT entity, wherein the request includes a decentralized identifier;

[0108] S102: an identity registry module, configured to generate identity metadata according to the identity authentication request, and record the identity metadata in the identity registry to ensure the uniqueness and traceability of the entity identity;

[0109] S103: A decentralized identification document generation module is configured to construct a corresponding decentralized identification document based on the decentralized identifier. The decentralized identification document includes, but is not limited to, information such as the user's public key, a verification method for identity authentication, and a service interaction address to support decentralized identity verification operations.

[0110] S104: A verifiable data registry module is configured to store the decentralized identification document in a verifiable data registry, which is a blockchain-based data infrastructure used to support parsing and verification of the decentralized identification document.

[0111] S105: A credential generation module is configured to perform a peer-to-peer trust evaluation based on the identity metadata and the traceability information in the blockchain, and calculate the trust value of the trustee in a specific trust domain; when the trust value meets the preset authorization conditions, generate a cryptographically signed verifiable credential containing the subject's identity, permission information, validity period, etc.

[0112] S106: Credential Verification Module, used to verify the verifiable credentials submitted by the trustee, including intra-domain verification and cross-domain verification. In cross-domain access scenarios, the module combines the trust evaluation mechanism of the target domain with the verifiable data on the chain to determine the authenticity and permission boundaries of the credentials, thereby supporting trusted access between multiple domains for the trustee.

[0113] S107: Access Control Module, used to control access to resources requested by entities within the current or target trust domain according to the access policy catalog. This module supports resource access control within the current trust domain and also supports dynamic authorization decisions in conjunction with the target domain policy in cross-domain access scenarios, achieving fine-grained and traceable resource protection.

[0114] like Figure 6 As shown, in another embodiment provided by the present invention, a cross-domain identity authentication architecture is provided, specifically including:

[0115] Infrastructure layer: This includes a decentralized blockchain network and decentralized identifiers. After an IoT entity sends a decentralized identity request to the request distributor, metadata is recorded in conjunction with the blockchain network to form an identity registry. A decentralized identification document is constructed under the decentralized identifier, forming a verifiable data registry.

[0116] Functional layer: Under the action of blockchain network, realize the data traceability of user identity;

[0117] Logical layer: decentralized identity, under peer-to-peer trust evaluation, combines the data traceability of user identity to obtain verifiable credentials;

[0118] Application layer: After the user passes identity authentication, the system's access control layer dynamically authorizes the user's permissions, tracks and analyzes the user's behavior data, and builds an access policy directory.

[0119] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A cross-domain identity authentication and access authorization method, characterized in that: The following steps are involved: S1: Receive an identity authentication request and initial identity data sent by an IoT entity, wherein the identity authentication request includes a decentralized identifier; S2: Generate identity metadata according to the identity authentication request, and record the identity metadata in the identity registry; S3: Constructing a corresponding decentralized identification document based on the decentralized identifier, wherein the decentralized identification document includes a user public key, a verification method, and a service address information; S4: Storing the decentralized identification document in a verifiable data registry, where the verifiable data registry is a blockchain-based data infrastructure; S5: Based on the identity metadata and the traceability information in the blockchain, perform a peer-to-peer trust assessment and generate a cryptographically signed verifiable credential; S6: Verify the verifiable credential to obtain a verification result; the verification includes intra-domain verification and cross-domain verification; S7: In the current trust domain or the target trust domain, access control is performed on the resources requested by the entity according to the access policy directory.

2. The cross-domain identity authentication and access authorization method according to claim 1, characterized in that: Also includes: In the blockchain network, the user's initial identity data, identity metadata and verifiable credentials are recorded in the blockchain in chronological order to achieve data traceability of the user's identity information.

3. The cross-domain identity authentication and access authorization method according to claim 1, characterized in that: In step S5, the step of generating a cryptographically signed verifiable credential includes: S51: Generate an asymmetric key including a public key and a private key; S52: Create an authorization statement, which includes the identity of the authorizer, the trust value of the trustee, and the validity period of the authorization; S53: Use its private key to digitally sign the authorization statement to obtain a signature; S54: Broadcast the authorization statement and its signature to the network.

4. The cross-domain identity authentication and access authorization method according to claim 3, characterized in that: The trust value calculation includes: Where A is the number of times user u's historical access behaviors are evaluated as passed; B1 is the number of times user u's historical access behaviors within the domain are evaluated as failed; B2 is the number of times user u's historical cross-domain access behaviors are evaluated as failed; δ a (t) is the time decay factor of the ath successful access; δ i (t), δ j (t) represents the time decay factor of failed access within the domain and across domains respectively; c i is the penalty coefficient when a request fails within the domain; c j is the penalty coefficient when a cross-domain request fails; α is the weight for distinguishing the impact of the calculated trust on the historical access behavior within the domain and across domains; the decay factor is calculated using the decay exponential method: exponential decay: δ(t) = e -λt .

5. The cross-domain identity authentication and access authorization method according to claim 3, characterized in that: In step S6, the intra-domain verification step includes: S61: Obtain authorization statement and signature; S62: Extract the public key identifier of the authorizer from the statement and search for the corresponding public key; S63: Verify the authenticity of the signature using the public key of the authorizer; S64: Check the validity period in the declaration to ensure that the current time does not exceed the validity period of the authorization; S65: Check the trust value in the declaration to ensure that the current trust value exceeds the minimum trust threshold; S66: When all the above verifications are passed, the trustee is deemed to have access rights.

6. The cross-domain identity authentication and access authorization method according to claim 5, characterized in that: In step S6, the cross-domain verification step includes: Calculate the dynamic trust evaluation value of user u in domain A: Among them, T u represents the trust score of the current user, specifically the trust value of the trustee; s represents the weight of the sth successful access to domain A; f represents the penalty coefficient of the fth failed access; δ(t s ) represents the time decay factor of the sth successful access in domain A; δ(t f ) represents the time decay factor of the fth failed access in domain A; Domain B performs weighted processing based on the dynamic trust evaluation value of domain A, specifically: Among them, β∈[0,1] represents the cross-domain trust weight, Represents the original trust value of domain B during the cross-domain process of user u.

7. The cross-domain identity authentication and access authorization method according to claim 1, characterized in that: In step S7, the step of performing access control on the resource requested by the entity according to the access policy directory includes: After the user passes the identity authentication, access rights are dynamically allocated based on the permission information and trust level in the verifiable credentials; at the same time, the user's behavior data is tracked and analyzed to continuously optimize the access policy and build an access policy catalog.

8. A cross-domain identity authentication and access authorization system, applying the cross-domain identity authentication and access authorization method according to any one of claims 1 to 7, characterized in that: include: a request distribution module, configured to receive an identity authentication request sent by an IoT entity, wherein the request includes a decentralized identifier; An identity registry module, configured to generate identity metadata according to the identity authentication request and record the identity metadata in an identity registry; A decentralized identification document generation module, configured to construct a corresponding decentralized identification document based on the decentralized identifier, wherein the decentralized identification document includes a user public key, a verification method, and a service address information; A verifiable data registry module, configured to store the decentralized identification document in a verifiable data registry, which is a blockchain-based data infrastructure used to support parsing and verification of the decentralized identification document; A credential generation module, configured to perform a peer-to-peer trust assessment based on the identity metadata and provenance information in the blockchain, and generate a cryptographically signed verifiable credential; The credential verification module is used to verify the verifiable credentials submitted by the trustee, including intra-domain verification and cross-domain verification; The access control module is used to perform access control on resources requested by an entity according to the access policy directory in the current trust domain or the target trust domain.

9. A terminal device, characterized in that: The invention comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the cross-domain identity authentication and access authorization method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the cross-domain identity authentication and access authorization method according to any one of claims 1 to 7.

Images