Identity authentication method and device, equipment and storage medium

Abstract

The invention discloses an identity authentication method and device, equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: determining a target authentication peer and a plurality of witness nodes from a peer-to-peer computer network; the target authentication peer and the witness node are nodes passing identity authentication in the peer-to-peer computer network, and the witness node is different from the target authentication peer; sending an identity authentication request message of the target authentication request body to each witness node, and receiving each initial credibility generated by each witness node; weighting each initial credibility to obtain an aggregation credibility, and fusing the aggregation credibility with the credibility of the target authentication request body on the target authentication peer to obtain the target credibility of the target authentication request body; and if the target credibility is greater than or equal to a preset threshold value, updating the target authentication request body into a new authentication peer in the peer-to-peer computer network. According to the invention, a safer and more reliable identity authentication mechanism can be constructed to resist network attacks.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an identity authentication method, apparatus, device, and storage medium. Background Technology

[0002] Most existing network environments are built on the TCP / IP (Transmission Control Protocol / Internet Protocol) network protocol stack, and often use a C / S (Client / Server) architecture to implement user-server interaction. The core functionality relies on the server for authentication and data storage. In this model, users must first establish a connection with the server, then submit their identity information for the server to compare and verify with the database, thereby obtaining resource access permissions.

[0003] To address the risk of identity information leakage, existing technologies often employ double encryption with digital envelopes and hash-based storage, but significant security vulnerabilities remain. The openness of the TCP / IP protocol and its "connect first, authenticate later" characteristic allow attackers to use man-in-the-middle attacks to forge servers, replace certificates, and steal keys and authentication information. Even with hash-based storage, attackers can use tools like rainbow tables to perform inverse hash operations, cracking ciphertext stored in the database to obtain plaintext identity information. These problems not only threaten personal property and data security but can also cause serious losses to businesses.

[0004] In conclusion, how to build a more secure and reliable identity authentication mechanism to resist cyberattacks and ensure the authenticity and confidentiality of information transmission is a pressing technical problem that needs to be solved. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide an identity authentication method, apparatus, device, and storage medium, capable of constructing a more secure and reliable identity authentication mechanism to resist network attacks and ensure the authenticity and confidentiality of information transmission. The specific solution is as follows:

[0006] Firstly, this application provides an authentication method applied to a target authentication request body, wherein the target authentication request body is a node requesting authentication in a peer-to-peer computer network; wherein the method includes:

[0007] A target authentication peer and several witness nodes are determined from a peer-to-peer computer network; the target authentication peer and the witness nodes are nodes that have passed identity authentication in the peer-to-peer computer network, and the witness nodes are different from the target authentication peer;

[0008] The identity authentication request message corresponding to the target authentication request body is sent to each of the witness nodes, and the initial credibility generated by each of the witness nodes is received; the initial credibility is the credibility generated by the witness node based on the historical interaction success rate and the time decay factor corresponding to the historical interaction success rate, the historical interaction success rate is the interaction success rate with the target authentication request body determined by the witness node based on the historical interaction record, and the historical interaction record is the interaction record with the target authentication request body determined by the witness node based on the identity authentication request message;

[0009] The initial credibility is weighted to obtain the aggregate credibility, and the aggregate credibility is fused with the trust level of the target authentication request body to the target authentication peer to obtain the target credibility of the target authentication request body;

[0010] If the target credibility is greater than or equal to a preset threshold, the target authentication request body is updated to a new authentication peer in the peer-to-peer computer network.

[0011] Optionally, determining the target authentication peer and several witness nodes from the peer-to-peer computer network includes:

[0012] Obtain the global role registry corresponding to the peer-to-peer computer network; the global role registry records the identity information of each authenticated peer in the peer-to-peer computer network, and the authenticated peer is a node in the peer-to-peer computer network that has passed identity authentication;

[0013] The target authentication peer and the role identifier corresponding to the target authentication peer are determined from the global role registry.

[0014] Obtain a reputation graph; the nodes in the reputation graph are the target authentication request body and each authentication peer in the peer-to-peer computer network other than the target authentication peer, and the edges in the reputation graph represent the reputation weight of the target authentication request body to each authentication peer;

[0015] Based on the reputation weights of each authentication peer in the reputation graph and their order from high to low, several authentication peers are selected as witness nodes.

[0016] Optionally, before sending the identity authentication request message corresponding to the target authentication request body to each of the witness nodes, the method further includes:

[0017] The identity authentication request message corresponding to the target authentication request body is generated based on the ID of the target authentication request body, the ID of the target authentication peer, the current timestamp, and a preset random number; the preset random number serves as the identifier of the identity authentication request message.

[0018] Accordingly, sending the identity authentication request message corresponding to the target authentication request body to each of the witness nodes includes:

[0019] Based on a preset broadcast protocol, the identity authentication request message corresponding to the target authentication request body is sent to each of the witness nodes.

[0020] Optionally, the weighting of each initial confidence level to obtain the aggregate confidence level includes:

[0021] The accuracy of the role identifier corresponding to the target authentication peer is verified to obtain the corresponding verification result.

[0022] Based on the reputation weight corresponding to each witness node, the verification result, and the initial credibility generated by each witness node, the initial attention weight corresponding to each witness node is determined;

[0023] The initial attention weights are normalized to obtain the target attention weights corresponding to each witness node.

[0024] Based on the target attention weights corresponding to each witness node, the aggregated credibility is obtained by weighting the initial credibility generated by each witness node.

[0025] Optionally, before fusing the aggregated trustworthiness with the trust level of the target authentication request body towards the target authentication peer, the method further includes:

[0026] If there is an interaction history between the target authentication request body and the target authentication peer, then the trust level of the target authentication request body towards the target authentication peer is determined based on the interaction history.

[0027] If there is no interaction history between the target authentication request body and the target authentication peer, then the trust level of the target authentication request body towards the target authentication peer is set to a preset value.

[0028] Accordingly, the step of fusing the aggregated trustworthiness with the trust level of the target authentication request body towards the target authentication peer to obtain the target trustworthiness of the target authentication request body includes:

[0029] The aggregate credibility and the trust level are fused by a weighted average method or a Bayesian model to obtain the target credibility of the target authentication request body.

[0030] Optionally, after updating the target authentication request body to the new authentication peer in the peer-to-peer computer network, the method further includes:

[0031] Determine the data encryption key between the new authentication peer and the target server, and use the new authentication peer to request resources from the target server through a client-server architecture;

[0032] Obtain the target encrypted data returned by the target server; the target encrypted data is the encrypted data obtained by the target server encrypting the target resource data using the data encryption key;

[0033] The target encrypted data is decrypted using the data encryption key to obtain the target resource data.

[0034] Secondly, this application provides an authentication method applied to any witness node of a target authentication request body, wherein the witness node is a node in a peer-to-peer computer network that has already passed authentication, and the target authentication request body is a node in the peer-to-peer computer network requesting authentication; wherein the method includes:

[0035] The witness node receives the identity authentication request message sent by the target authentication request body, and determines the historical interaction records between the witness node and the target authentication request body based on the identity authentication request message.

[0036] Based on the historical interaction records, the historical interaction success rate between the witness node and the target authentication request body is determined, and an initial credibility is generated based on the historical interaction success rate and the time decay factor corresponding to the historical interaction success rate.

[0037] The initial credibility is sent to the target authentication request body, so that the target authentication request body weights each initial credibility to obtain an aggregate credibility, and merges the aggregate credibility with the target authentication request body's trust in the target authentication peer to obtain the target credibility of the target authentication request body; if the target credibility is greater than or equal to a preset threshold, the target authentication request body is updated to a new authentication peer in the peer-to-peer computer network; the target authentication peer is a node that has passed identity authentication determined by the target authentication request body from the peer-to-peer computer network, and the witness node is different from the target authentication peer.

[0038] Thirdly, this application provides an identity authentication device applied to a target authentication request body, wherein the target authentication request body is a node requesting identity authentication in a peer-to-peer computer network; wherein the device includes:

[0039] A witness node determination module is used to determine a target authentication peer and several witness nodes from a peer-to-peer computer network; the target authentication peer and the witness nodes are nodes in the peer-to-peer computer network that have passed identity authentication, and the witness nodes are different from the target authentication peer;

[0040] An initial credibility receiving module is used to send the identity authentication request message corresponding to the target authentication request body to each of the witness nodes, and to receive each initial credibility generated by each of the witness nodes; the initial credibility is the credibility generated by the witness node based on the historical interaction success rate and the time decay factor corresponding to the historical interaction success rate, the historical interaction success rate is the interaction success rate with the target authentication request body determined by the witness node based on the historical interaction records, and the historical interaction records are the interaction records with the target authentication request body determined by the witness node based on the identity authentication request message;

[0041] The target credibility determination module is used to weight each of the initial credibility to obtain an aggregate credibility, and to fuse the aggregate credibility with the trust of the target authentication request body in the target authentication peer to obtain the target credibility of the target authentication request body;

[0042] The target authentication request body update module is used to update the target authentication request body to a new authentication peer in the peer computer network if the target credibility is greater than or equal to a preset threshold.

[0043] Fourthly, this application provides an electronic device, comprising:

[0044] Memory, used to store computer programs;

[0045] A processor is used to execute the computer program to implement the aforementioned authentication method.

[0046] Fifthly, this application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned authentication method.

[0047] In this application, for a target authentication request body requesting identity authentication in a peer-to-peer computer network, firstly, a target authentication peer and several witness nodes are determined from the peer-to-peer computer network; the target authentication peer and the witness nodes are all nodes in the peer-to-peer computer network that have passed identity authentication, and the witness nodes are different from the target authentication peer; then, the identity authentication request message corresponding to the target authentication request body is sent to each of the witness nodes, and each witness node generates an initial trust level; the initial trust level is a trust level generated by the witness nodes based on the historical interaction success rate and the time decay factor corresponding to the historical interaction success rate. The historical interaction success rate is the interaction success rate between the witness node and the target authentication request body determined by the witness node based on the historical interaction records, where the historical interaction records are the interaction records between the witness node and the target authentication request body determined by the identity authentication request message. Subsequently, the initial trust scores are weighted to obtain an aggregate trust score, and the aggregate trust score is fused with the trust score of the target authentication request body for the target authentication peer to obtain the target trust score of the target authentication request body. If the target trust score is greater than or equal to a preset threshold, the target authentication request body is updated to a new authentication peer in the peer-to-peer computer network. As can be seen from the above, this application, for a target authentication request body in a peer-to-peer computer network, first selects a target authentication peer that has passed identity authentication and several different witness nodes from the peer-to-peer computer network; then, it sends an identity authentication request message to each witness node, and receives the initial trustworthiness generated by the witness nodes based on the historical success rate of interactions with the target authentication request body and the corresponding time decay factor; subsequently, it weights each initial trustworthiness to obtain an aggregate trustworthiness, and merges the aggregate trustworthiness with the target authentication peer's trust in the target authentication peer to obtain the target trustworthiness of the target authentication request body; if the target trustworthiness reaches a preset threshold, the target authentication request body passes identity authentication and is updated to a new authentication peer in the peer-to-peer computer network. In this way, this application utilizes nodes that have passed identity authentication in the peer-to-peer computer network to collaboratively verify the target authentication request body, constructing a secure and reliable identity authentication mechanism to resist network attacks and ensure the authenticity and confidentiality of information transmission. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0049] Figure 1 A schematic diagram of the system framework applicable to an identity authentication scheme disclosed in this application;

[0050] Figure 2 A flowchart of an identity authentication method provided in this application;

[0051] Figure 3 A flowchart of a specific identity authentication method provided in this application;

[0052] Figure 4 A flowchart of a specific identity authentication method provided in this application;

[0053] Figure 5 A schematic diagram of an identity authentication device provided in this application;

[0054] Figure 6 This application provides a structural diagram of an electronic device. Detailed Implementation

[0055] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] Most existing network environments are built on the TCP / IP network protocol stack and often use a client / server architecture to implement user-server interaction, relying on the server for identity authentication and data storage. In this model, users must first establish a connection with the server and then submit their identity information for comparison and verification between the server and the database to obtain resource access permissions. To address the risk of identity information leakage, existing technologies often employ methods such as digital envelope double encryption and hash storage, but significant security vulnerabilities remain: the openness of the TCP / IP protocol and its "connect first, authenticate later" characteristic allow attackers to use man-in-the-middle attacks to forge servers, replace certificates, and steal keys and authentication information; even with hashing, attackers can use tools such as rainbow tables to perform inverse hash operations, cracking the ciphertext stored in the database to obtain plaintext identity information. These problems not only threaten personal property and data security but can also cause serious losses to enterprises. Therefore, this application provides an identity authentication scheme that can build a more secure and reliable identity authentication mechanism to resist network attacks and ensure the authenticity and confidentiality of information transmission.

[0057] It should be noted that the system framework used in the identity authentication scheme of this embodiment can be found in [reference needed]. Figure 1As shown, in a P2P network (Peer-to-peer network), there are three resource requesting hosts: Client 1, Client 2, and Client 3. These hosts need to access the server providing the service via the Internet. During access, the server compares the identity information transmitted by the clients with the account information stored in its database to verify and authenticate legitimate users. It should be noted that Client 1 and Client 3 have already passed authentication and established a legitimate connection with the server. In this embodiment, such clients are called Authentication Peers (APs). When an AP completes its connection, it sends its registered AP identity information to the server. Client 2, however, has not yet established a legitimate connection with the server and needs to undergo authentication. In this embodiment, such a client is called an Authentication Requestor (AR). This embodiment will utilize collective intelligence to achieve reliable and fault-tolerant authentication of the AP node's identity.

[0058] See Figure 2 As shown, this embodiment of the invention discloses an identity authentication method applied to a target authentication request body, wherein the target authentication request body is a node requesting identity authentication in a peer-to-peer computer network; wherein, the method may include:

[0059] Step S11: Determine the target authentication peer and several witness nodes from the peer-to-peer computer network; the target authentication peer and the witness nodes are nodes in the peer-to-peer computer network that have passed identity authentication, and the witness nodes are different from the target authentication peer.

[0060] In this embodiment, the target authentication request body (AR) first needs to determine the target authentication peer and several witness nodes from the P2P network. The specific process may include: firstly, obtaining the global role registry corresponding to the peer-to-peer computer network; the global role registry records the identity information of each authentication peer in the peer-to-peer computer network, where each authentication peer is a node that has passed identity authentication in the peer-to-peer computer network; then, determining the target authentication peer and its corresponding role identifier from the global role registry; subsequently, obtaining a reputation graph; the nodes in the reputation graph are the target authentication request body and all other authentication peers in the peer-to-peer computer network besides the target authentication peer, and the edges in the reputation graph represent the reputation weight of the target authentication request body to each authentication peer; finally, based on the reputation weights of each authentication peer in the reputation graph and their descending order, selecting several authentication peers as witness nodes.

[0061] Specifically, the target authentication request body (AR) retrieves the role identifier (Role_APi) declared by the target authentication peer (APi) from the global role registry. The global role registry is a read-only list maintained in a P2P network via a distributed ledger or Gossip protocol, recording the identity information of each authenticated peer in the P2P network. Then, the target authentication request body (AR) queries a decentralized reputation graph. In this context, nodes are the authenticated peers in the AR and peer-to-peer computer network, excluding the APi, and edges are... The weight is , indicating that node AR is related to node The reputation evaluation, or reputation weight, is then used by the target authentication request body AR. Sort the nodes from highest to lowest, and select the top K (Top-K) highly reliable neighbor nodes. This serves as a set of witness nodes for identity authentication. It should be noted that the target authentication request body (AR) can also obtain the recent behavior level (Level_APi) of the target authentication peer (APi) from the behavior hierarchy cache; the behavior hierarchy cache records the recent authentication behavior results of each authenticated peer in the P2P network that has already passed identity authentication.

[0062] It's important to note that when the target authentication request entity (AR) initiates an authentication request to the server, the server returns the number and location information of the authentication peers (APs) in the current P2P network. This allows the AR to transmit authentication information to the target authentication peer (APi) with better communication status within the P2P network during peer authentication, using simple network latency detection and random algorithms. However, when the AR is the first node to access the P2P network for authentication, the server cannot return the authentication peer (AP) information to it.

[0063] Step S12: Send the identity authentication request message corresponding to the target authentication request body to each of the witness nodes, and receive the initial credibility generated by each of the witness nodes; the initial credibility is the credibility generated by the witness node based on the historical interaction success rate and the time decay factor corresponding to the historical interaction success rate, the historical interaction success rate is the interaction success rate with the target authentication request body determined by the witness node based on the historical interaction record, and the historical interaction record is the interaction record with the target authentication request body determined by the witness node based on the identity authentication request message.

[0064] In this embodiment, an authentication request message corresponding to the target authentication request body is generated based on the target authentication request body's ID, the target authentication peer's ID, the current timestamp, and a preset random number; the preset random number serves as the identifier of the authentication request message. Specifically, the authentication request message Req(AR, AP, T, Nonce) consists of the ID of the target authentication request body AR, the ID of the target authentication peer APi, the current timestamp T, and the preset random number Nonce; wherein, the current timestamp T is used to prevent replay attacks, and the preset random number Nonce serves as the identifier of the authentication request message to ensure the uniqueness of the request. In addition, the authentication request message may also include the recent behavior level Level_APi of the target authentication peer APi for the witness node to reference.

[0065] It should be noted that sending the authentication request message corresponding to the target authentication request body to each witness node can specifically include: sending the authentication request message corresponding to the target authentication request body to each witness node based on a preset broadcast protocol. Specifically, in this embodiment, a probabilistic broadcast protocol, such as the Gossip protocol, can be used to send the authentication request message to each witness node. This ensures that the authentication request message can reach the witness nodes with a high probability in an asynchronous network environment, while avoiding network flooding.

[0066] In this embodiment, each witness node that receives the identity authentication request message sent by the target authentication request body AR Working independently, it generates an initial trust level, also known as a local assertion, based on the interaction history with the target authentication request body (AR), and then returns it to the target authentication request body (AR). The specific process may include: first, the witness node... Query the local database to retrieve historical interaction records with the target authentication request body AR. Each historical interaction record includes information such as interaction type, result (success / failure), and timestamp; subsequently, witness nodes... Based on the historical interaction record History_i, determine the historical interaction success rate Base_Trust_i with the target authentication request body AR, and apply the time decay factor. The function determines the time decay factor corresponding to the historical interaction success rate Base_Trust_i, thus giving higher credibility to recent interactions; finally, the witness node... The initial credibility s_i of the target authentication request body AR is determined based on the historical interaction success rate and the corresponding time decay factor; where, The function can be as follows:

[0067] ;

[0068] in, Indicates the current time. Indicates witness node Historical interaction time with the target authentication request body AR This is the preset attenuation coefficient.

[0069] Step S13: Weight each initial credibility to obtain an aggregate credibility, and fuse the aggregate credibility with the trust level of the target authentication request body to the target authentication peer to obtain the target credibility of the target authentication request body.

[0070] In this embodiment, after the target authentication request body (AR) collects the initial credibility scores generated by each witness node, it needs to perform weighted aggregation. The aggregation process is not a simple averaging, but rather uses the concept of graph attention networks for intelligent aggregation. Specifically, it weights each initial credibility score to obtain an aggregated credibility score. The specific process may include: first, verifying the accuracy of the role identifier corresponding to the target authentication peer to obtain the corresponding verification result; then, based on the reputation weight of each witness node, the verification result, and the initial credibility scores generated by each witness node, determining the initial attention weight of each witness node; subsequently, normalizing each initial attention weight to obtain the target attention weight of each witness node; and finally, weighting each initial credibility score generated by each witness node based on the target attention weight of each witness node to obtain the aggregated credibility score.

[0071] Specifically, in this embodiment, a graph structure can be constructed to model the current problem as a graph; wherein, the target authentication request body AR, the target authentication peer body APi, and all witness nodes are included. These are all nodes in the graph. The Target Authentication Request (AR) calculates its own authentication for each witness node based on the constructed graph structure. The attention coefficient, i.e., the initial attention weight e_Ai, is determined by the target authentication request body (AR) in the reputation graph towards the witness node. It should be noted that the initial attention weight depends not only on the AR's interaction with the witness node in the reputation graph. Reputation weight It also depends on the context of this authentication: each witness node The accuracy of the initial trust scores s_i and the role identifier Role_APi claimed by the target authentication peer APi generated by the target authentication request body AR is assessed. Subsequently, the initial attention weights are normalized to obtain the target attention weights. Finally, use each witness node. Corresponding target attention weights For each witness node The initial confidence scores s_i are weighted and summed to obtain the aggregate confidence score S_agg.

[0072] It should be noted that the target authentication request body AR will aggregate various witness nodes. The final decision is made by integrating the opinions of the target authentication request body (AR) with its own direct experience. To determine the trust level of the target authentication peer (APi) to the target authentication request body (AR), the specific process may include: if there is an interaction history between the target authentication request body and the target authentication peer, then the trust level of the target authentication request body to the target authentication peer is determined based on the interaction history; if there is no interaction history between the target authentication request body and the target authentication peer, then the trust level of the target authentication request body to the target authentication peer is set to a preset value. Specifically, if there is an interaction history between the target authentication request body (AR) and the target authentication peer (APi), the trust level S_self is calculated based on the historical interaction success rate corresponding to the interaction history and the corresponding time decay factor; if there is no interaction history between the target authentication request body (AR) and the target authentication peer (APi), the trust level S_self can be set to a preset value, such as a neutral value or a default value based on the role of the APi.

[0073] In this embodiment, the aggregated credibility and the trust level of the target authentication request body towards the target authentication peer are fused to obtain the target credibility of the target authentication request body. The specific process may include: fusing the aggregated credibility and the trust level using a weighted average method or a Bayesian model to obtain the target credibility of the target authentication request body. Specifically, this embodiment can use a weighted average method or a Bayesian model to fuse the aggregated credibility S_self and the trust level S_agg. Taking the weighted average method as an example: set the confidence weight w_self of the target authentication request body AR regarding its own experience; for example, the weight is greater when the number of interactions is high. Set the confidence weight w_agg of the aggregated credibility; for example, it depends on the number of witness nodes and the average reputation. Finally, calculate the target credibility s_final, as shown in the following formula:

[0074] .

[0075] Step S14: If the target credibility is greater than or equal to a preset threshold, then update the target authentication request body to a new authentication peer in the peer computer network.

[0076] In one specific implementation, if the target credibility s_final is greater than or equal to a preset acceptance threshold... If the authentication request body (AR) is successfully authenticated, it indicates that the AR has been successfully authenticated. The AR can then be updated to a new authentication peer in the P2P network, enabling the new peer to request resources from the target server. The specific process may include: determining the data encryption key between the new peer and the target server, and using the new peer to request resources from the target server through a client-server architecture; obtaining the target encrypted data returned by the target server; the target encrypted data being the encrypted data obtained by the target server encrypting the target resource data using the data encryption key; and decrypting the target encrypted data using the data encryption key to obtain the target resource data.

[0077] In another specific implementation, if the target confidence level s_final is less than or equal to the preset rejection threshold... If the result is negative, it indicates that the AR authentication of the target authentication request body has failed.

[0078] In the third specific implementation, if the target credibility s_final is between the preset acceptance threshold... and preset rejection threshold Between these, secondary authentication can be triggered, such as requiring the target authentication request body (AR) to provide more proof, or expanding the scope of witness nodes for re-authentication.

[0079] It should be noted that the authentication result of the target authentication request body AR can be used as a new data point and fed back to the target authentication request body AR and the witness node. The local behavior model is used to update the target authentication request body (AR) and the witness node. The behavioral level (APi) of the target authentication peer is calculated, for example, by using incremental learning to update the recent behavioral level (Level_APi). Furthermore, if the system integrates lightweight GAN (Generative Adversarial Networks) training, the current authentication result of the target authentication requester (AR) can serve as a supervisory signal to fine-tune the target attention weights, making the next aggregation more accurate. Additionally, the current authentication result of the target authentication requester (AR) can be conditionally propagated in a P2P network via the Gossip protocol, achieving progressive synchronization of the global state.

[0080] In one specific implementation, the identity authentication process for the target authentication request body AR is described below. Figure 3As shown. After identity authentication, once the target authentication request body (AR) is deemed legitimate, since it has been registered as a new authentication peer within the P2P network, it can assist other authentication request bodies (ARs) in their identity authentication when they join the P2P network and require authentication. Thus, the reliability and complexity of identity authentication can increase as the number of registered authentication peers within the P2P network increases. With a larger number of registered authentication peers, the authentication request body can more randomly select a peer with better network communication status for peer authentication. This not only improves the encryption level during identity authentication but also increases the transmission paths of user information, inheriting the decentralization, scalability, and robustness of the P2P network concept.

[0081] As can be seen from the above, in this embodiment, for a target authentication request body requesting identity authentication in a peer-to-peer computer network, the target authentication peer and several witness nodes are first determined from the peer-to-peer computer network; the target authentication peer and the witness nodes are all nodes in the peer-to-peer computer network that have passed identity authentication, and the witness nodes are different from the target authentication peer; then, the identity authentication request message corresponding to the target authentication request body is sent to each of the witness nodes, and the initial trustworthiness generated by each of the witness nodes is received; the initial trustworthiness is generated by the witness nodes based on the historical interaction success rate and the time decay factor corresponding to the historical interaction success rate. The credibility is defined as follows: the historical interaction success rate is the interaction success rate between the witness node and the target authentication request body determined by the witness node based on the historical interaction records, where the historical interaction records are the interaction records between the witness node and the target authentication request body determined by the identity authentication request message; then, the initial credibility is weighted to obtain the aggregate credibility, and the aggregate credibility is fused with the target authentication request body's trust in the target authentication peer to obtain the target credibility of the target authentication request body; if the target credibility is greater than or equal to a preset threshold, the target authentication request body is updated to a new authentication peer in the peer-to-peer computer network. As can be seen from the above, in this embodiment, for the target authentication request body in a peer-to-peer computer network, a target authentication peer that has passed identity authentication and several different witness nodes are first selected from the peer-to-peer computer network; then, an identity authentication request message is sent to each witness node, and the initial credibility generated by the witness nodes based on the historical success rate of interactions with the target authentication request body and the corresponding time decay factor is received; subsequently, the initial credibility is weighted to obtain an aggregate credibility, and the aggregate credibility is fused with the target authentication request body's trust in the target authentication peer to obtain the target credibility of the target authentication request body; if the target credibility reaches a preset threshold, the target authentication request body passes identity authentication and is updated to a new authentication peer in the peer-to-peer computer network. In this way, this embodiment utilizes the collaborative verification of the target authentication request body by nodes that have passed identity authentication in the peer-to-peer computer network to construct a secure and reliable identity authentication mechanism to resist network attacks and ensure the authenticity and confidentiality of information transmission.

[0082] See Figure 4 As shown, this embodiment of the invention further discloses an identity authentication method, applied to any witness node of a target authentication request body, wherein the witness node is a node in a peer-to-peer computer network that has already passed identity authentication, and the target authentication request body is a node in the peer-to-peer computer network requesting identity authentication; wherein, the method may include:

[0083] Step S21: Receive the identity authentication request message sent by the target authentication request body using the witness node, and determine the historical interaction records between the witness node and the target authentication request body based on the identity authentication request message.

[0084] Step S22: Determine the historical interaction success rate between the witness node and the target authentication request body based on the historical interaction records, and generate an initial credibility based on the historical interaction success rate and the time decay factor corresponding to the historical interaction success rate.

[0085] Step S23: Send the initial credibility to the target authentication request body so that the target authentication request body can weight each initial credibility to obtain an aggregate credibility, and fuse the aggregate credibility with the target authentication request body's trust in the target authentication peer to obtain the target credibility of the target authentication request body; if the target credibility is greater than or equal to a preset threshold, then update the target authentication request body to a new authentication peer in the peer-to-peer computer network; the target authentication peer is a node that has passed identity authentication determined by the target authentication request body from the peer-to-peer computer network, and the witness node is different from the target authentication peer.

[0086] For more detailed processing procedures of steps S21 to S23, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0087] As can be seen from the above, in this embodiment, after receiving the identity authentication request message sent by the target authentication request body, the witness node first determines the historical interaction records with the target authentication request body, then determines the historical interaction success rate based on the historical interaction records, and generates an initial credibility by combining the historical interaction records and the corresponding time decay factor, and feeds it back to the target authentication request body. This allows the target authentication request body to weight each initial credibility to obtain an aggregate credibility. The aggregate credibility is then fused with the target authentication request body's trust in the target authentication peer to obtain the target credibility of the target authentication request body. If the target credibility reaches a preset threshold, the target authentication request body passes identity authentication and updates to a new authentication peer in the peer-to-peer computer network. In this way, this embodiment utilizes witness nodes that have already passed identity authentication in the peer-to-peer computer network to collaboratively verify the target authentication request body, constructing a secure and reliable identity authentication mechanism to resist network attacks and ensure the authenticity and confidentiality of information transmission.

[0088] Accordingly, see Figure 5 As shown in the illustration, this application also provides an identity authentication device applied to a target authentication request body, wherein the target authentication request body is a node requesting identity authentication in a peer-to-peer computer network; wherein, the device may include:

[0089] Witness node determination module 11 is used to determine a target authentication peer and a number of witness nodes from a peer-to-peer computer network; the target authentication peer and the witness nodes are nodes in the peer-to-peer computer network that have passed identity authentication, and the witness nodes are different from the target authentication peer;

[0090] The initial credibility receiving module 12 is used to send the identity authentication request message corresponding to the target authentication request body to each of the witness nodes, and to receive each initial credibility generated by each of the witness nodes; the initial credibility is the credibility generated by the witness node based on the historical interaction success rate and the time decay factor corresponding to the historical interaction success rate, the historical interaction success rate is the interaction success rate with the target authentication request body determined by the witness node based on the historical interaction record, and the historical interaction record is the interaction record with the target authentication request body determined by the witness node based on the identity authentication request message;

[0091] The target credibility determination module 13 is used to weight each of the initial credibility to obtain an aggregate credibility, and to fuse the aggregate credibility with the trust of the target authentication request body in the target authentication peer to obtain the target credibility of the target authentication request body;

[0092] The target authentication request body update module 14 is used to update the target authentication request body to a new authentication peer in the peer computer network if the target credibility is greater than or equal to a preset threshold.

[0093] In some specific embodiments, the witness node determination module 11 may include:

[0094] A global role registry acquisition unit is used to acquire the global role registry corresponding to the peer-to-peer computer network; the global role registry records the identity information of each authenticated peer in the peer-to-peer computer network, and the authenticated peer is a node in the peer-to-peer computer network that has passed identity authentication;

[0095] The target authentication peer determination unit is used to determine the target authentication peer and the role identifier corresponding to the target authentication peer from the global role registry.

[0096] A reputation graph acquisition unit is used to acquire a reputation graph; the nodes in the reputation graph are the target authentication request body and each authentication peer in the peer-to-peer computer network other than the target authentication peer, and the edges in the reputation graph represent the reputation weight of the target authentication request body to each authentication peer;

[0097] The witness node determination unit is used to select several certified peers as witness nodes based on the reputation weights of each certified peer in the reputation graph and their order from high to low.

[0098] In some specific embodiments, the identity authentication device may further include:

[0099] An identity authentication request message generation module is used to generate an identity authentication request message corresponding to the target authentication request body based on the ID of the target authentication request body, the ID of the target authentication peer, the current timestamp, and a preset random number; the preset random number serves as the identifier of the identity authentication request message.

[0100] Accordingly, the initial credibility receiving module 12 may include:

[0101] The identity authentication request message sending unit is used to send the identity authentication request message corresponding to the target authentication request body to each of the witness nodes based on a preset broadcast protocol.

[0102] In some specific embodiments, the target credibility determination module 13 may include:

[0103] An accuracy verification unit is used to verify the accuracy of the role identifier corresponding to the target authentication peer and obtain the corresponding verification result.

[0104] The initial attention weight determination unit is used to determine the initial attention weight of each witness node based on the reputation weight of each witness node, the verification result, and the initial credibility generated by each witness node.

[0105] The target attention weight determination unit is used to normalize each of the initial attention weights to obtain the target attention weights corresponding to each witness node.

[0106] The aggregate credibility determination unit is used to weight the initial credibility generated by each witness node based on the target attention weight corresponding to each witness node to obtain the aggregate credibility.

[0107] In some specific embodiments, the identity authentication device may further include:

[0108] The trust determination module is used to determine the trust level of the target authentication request body to the target authentication peer based on the interaction history if there is an interaction history between the target authentication request body and the target authentication peer.

[0109] The trust setting module is used to set the trust level of the target authentication request body to the target authentication peer to a preset value if there is no interaction history between the target authentication request body and the target authentication peer.

[0110] Accordingly, the target credibility determination module 13 may include:

[0111] The target credibility determination unit is used to fuse the aggregate credibility and the trust level through a weighted average method or a Bayesian model to obtain the target credibility of the target authentication request body.

[0112] In some specific embodiments, the identity authentication device may further include:

[0113] The resource request module is used to determine the data encryption key between the new authentication peer and the target server, and to request resources from the target server through a client-server architecture using the new authentication peer.

[0114] The target encrypted data acquisition module is used to acquire the target encrypted data returned by the target server; the target encrypted data is the encrypted data obtained by the target server encrypting the target resource data using the data encryption key;

[0115] The target resource data determination module is used to decrypt the target encrypted data using the data encryption key to obtain the target resource data.

[0116] Furthermore, embodiments of this application also disclose an electronic device, Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the authentication method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0117] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0118] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0119] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be a Windows server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the authentication method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0120] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed authentication method. The specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0121] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0122] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0123] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0124] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0125] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. An identity authentication method, characterized in that, Applied to a target authentication request body, wherein the target authentication request body is a node in a peer-to-peer computer network requesting identity authentication; wherein, the method includes: A target authentication peer and several witness nodes are determined from a peer-to-peer computer network; the target authentication peer and the witness nodes are nodes that have passed identity authentication in the peer-to-peer computer network, and the witness nodes are different from the target authentication peer; The identity authentication request message corresponding to the target authentication request body is sent to each of the witness nodes, and the initial credibility generated by each of the witness nodes is received; the initial credibility is the credibility generated by the witness node based on the historical interaction success rate and the time decay factor corresponding to the historical interaction success rate, the historical interaction success rate is the interaction success rate with the target authentication request body determined by the witness node based on the historical interaction record, and the historical interaction record is the interaction record with the target authentication request body determined by the witness node based on the identity authentication request message; The initial credibility is weighted to obtain the aggregate credibility, and the aggregate credibility is fused with the trust level of the target authentication request body to the target authentication peer to obtain the target credibility of the target authentication request body; If the target credibility is greater than or equal to a preset threshold, the target authentication request body is updated to a new authentication peer in the peer-to-peer computer network.

2. The identity authentication method according to claim 1, characterized in that, The process of determining the target authentication peer and several witness nodes from the peer-to-peer computer network includes: Obtain the global role registry corresponding to the peer-to-peer computer network; the global role registry records the identity information of each authenticated peer in the peer-to-peer computer network, and the authenticated peer is a node in the peer-to-peer computer network that has passed identity authentication; The target authentication peer and the role identifier corresponding to the target authentication peer are determined from the global role registry. Obtain a reputation graph; the nodes in the reputation graph are the target authentication request body and each authentication peer in the peer-to-peer computer network other than the target authentication peer, and the edges in the reputation graph represent the reputation weight of the target authentication request body to each authentication peer; Based on the reputation weights of each authentication peer in the reputation graph and their order from high to low, several authentication peers are selected as witness nodes.

3. The identity authentication method according to claim 1, characterized in that, Before sending the identity authentication request message corresponding to the target authentication request body to each of the witness nodes, the method further includes: The identity authentication request message corresponding to the target authentication request body is generated based on the ID of the target authentication request body, the ID of the target authentication peer, the current timestamp, and a preset random number; the preset random number serves as the identifier of the identity authentication request message. Accordingly, sending the identity authentication request message corresponding to the target authentication request body to each of the witness nodes includes: Based on a preset broadcast protocol, the identity authentication request message corresponding to the target authentication request body is sent to each of the witness nodes.

4. The identity authentication method according to claim 2, characterized in that, The weighting of each initial confidence level to obtain the aggregate confidence level includes: The accuracy of the role identifier corresponding to the target authentication peer is verified to obtain the corresponding verification result. Based on the reputation weight corresponding to each witness node, the verification result, and the initial credibility generated by each witness node, the initial attention weight corresponding to each witness node is determined; The initial attention weights are normalized to obtain the target attention weights corresponding to each witness node. Based on the target attention weights corresponding to each witness node, the aggregated credibility is obtained by weighting the initial credibility generated by each witness node.

5. The identity authentication method according to claim 1, characterized in that, Before fusing the aggregated trustworthiness with the trust level of the target authentication request body towards the target authentication peer, the method further includes: If there is an interaction history between the target authentication request body and the target authentication peer, then the trust level of the target authentication request body towards the target authentication peer is determined based on the interaction history. If there is no interaction history between the target authentication request body and the target authentication peer, then the trust level of the target authentication request body towards the target authentication peer is set to a preset value. Accordingly, the step of fusing the aggregated trustworthiness with the trust level of the target authentication request body towards the target authentication peer to obtain the target trustworthiness of the target authentication request body includes: The aggregate credibility and the trust level are fused by a weighted average method or a Bayesian model to obtain the target credibility of the target authentication request body.

6. The authentication method according to any one of claims 1 to 5, characterized in that, After updating the target authentication request body to the new authentication peer in the peer computer network, the method further includes: Determine the data encryption key between the new authentication peer and the target server, and use the new authentication peer to request resources from the target server through a client-server architecture; Obtain the target encrypted data returned by the target server; the target encrypted data is the encrypted data obtained by the target server encrypting the target resource data using the data encryption key; The target encrypted data is decrypted using the data encryption key to obtain the target resource data.

7. An identity authentication method, characterized in that, The method is applied to any witness node in the target authentication request body, wherein the witness node is a node in the peer-to-peer computer network that has already passed identity authentication, and the target authentication request body is a node in the peer-to-peer computer network that requests identity authentication; wherein, the method includes: The witness node receives the identity authentication request message sent by the target authentication request body, and determines the historical interaction records between the witness node and the target authentication request body based on the identity authentication request message. Based on the historical interaction records, the historical interaction success rate between the witness node and the target authentication request body is determined, and an initial credibility is generated based on the historical interaction success rate and the time decay factor corresponding to the historical interaction success rate. The initial credibility is sent to the target authentication request body, so that the target authentication request body weights each initial credibility to obtain an aggregate credibility, and merges the aggregate credibility with the target authentication request body's trust in the target authentication peer to obtain the target credibility of the target authentication request body; if the target credibility is greater than or equal to a preset threshold, the target authentication request body is updated to a new authentication peer in the peer-to-peer computer network; the target authentication peer is a node that has passed identity authentication determined by the target authentication request body from the peer-to-peer computer network, and the witness node is different from the target authentication peer.

8. An identity authentication device, characterized in that, Applied to a target authentication request body, wherein the target authentication request body is a node in a peer-to-peer computer network requesting identity authentication; wherein, the device includes: A witness node determination module is used to determine a target authentication peer and several witness nodes from a peer-to-peer computer network; the target authentication peer and the witness nodes are nodes in the peer-to-peer computer network that have passed identity authentication, and the witness nodes are different from the target authentication peer; An initial credibility receiving module is used to send the identity authentication request message corresponding to the target authentication request body to each of the witness nodes, and to receive each initial credibility generated by each of the witness nodes; the initial credibility is the credibility generated by the witness node based on the historical interaction success rate and the time decay factor corresponding to the historical interaction success rate, the historical interaction success rate is the interaction success rate with the target authentication request body determined by the witness node based on the historical interaction records, and the historical interaction records are the interaction records with the target authentication request body determined by the witness node based on the identity authentication request message; The target credibility determination module is used to weight each of the initial credibility to obtain an aggregate credibility, and to fuse the aggregate credibility with the trust of the target authentication request body in the target authentication peer to obtain the target credibility of the target authentication request body; The target authentication request body update module is used to update the target authentication request body to a new authentication peer in the peer computer network if the target credibility is greater than or equal to a preset threshold.

9. An electronic device, characterized in that, The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the authentication method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store a computer program, which, when executed by a processor, implements the authentication method as described in any one of claims 1 to 7.

Images