Computer network hardware security authentication system based on block chain

Abstract

The invention discloses a computer network hardware security authentication system based on a block chain, and relates to the technical field of information transmission, and the system comprises an identity collection module, a certificate generation module, an on-chain certificate storage module, a link binding module and a consensus verification module. According to the method, a hardware firmware level bottom layer driving interface is integrated at a target hardware terminal to be accessed to a network, multi-dimensional non-tampering hardware feature information is collected, a unique hardware feature abstract is generated, a public and private key pair exclusive to target hardware is generated in combination with the unique hardware feature abstract, and a distributed identity certificate is made. And synchronizing to each consensus node of the block chain to complete uplink right confirmation and construct a hardware identity account book, so that the hardware identity is deeply bound with the physical characteristics of the hardware identity account book, the exclusive generation of the hardware identity credential is realized, and the tampering-free storage of the distributed identity credential is realized based on the characteristics of the block chain. The verification of the hardware identity has a credible on-chain basis, and credible acquisition and right confirmation of the identity information are realized from the bottom layer of the hardware.

Description

Technical Field

[0001] This invention relates to the field of information transmission technology, specifically to a blockchain-based computer network hardware security authentication system. Background Technology

[0002] With the rapid development of computer network technology, the number and types of hardware terminals accessing the network are constantly increasing, and the application scope of distributed network architecture is also expanding. Cross-scenario access of hardware terminals has become the norm. As the basic carrier of information transmission, the security protection of network hardware during access and transmission has become a core component of the network security system. With the continuous upgrading of network attack methods, hardware-level security threats are becoming increasingly prominent, and the industry has put forward higher practical requirements for the credibility of hardware identity authentication and the security of the transmission process.

[0003] However, existing security authentication schemes for computer network hardware mostly fail to collect unique feature information from the hardware's underlying layer. The generation of identity credentials is not fixedly related to the physical attributes of the hardware, making it prone to identity spoofing. Furthermore, hardware identity credentials do not rely on blockchain for immutable storage, lacking credible verification evidence. At the same time, existing schemes do not bind hardware identity to transmission link characteristics, making it impossible to promptly identify changes in link characteristics. They also do not employ a distributed consensus mechanism for full-process verification, making single-point verification mode easily breached and the reliability of verification results insufficient, making it difficult to adapt to the security authentication requirements of distributed networks. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of existing technologies and provide a blockchain-based computer network hardware security authentication system. This invention integrates a hardware firmware-level low-level driver interface into the target hardware terminal to be connected to the network, collects multi-dimensional, tamper-proof hardware feature information, generates a unique hardware feature digest, combines the unique hardware feature digest to generate a public-private key pair specific to the target hardware, and creates a distributed identity credential. The distributed identity credential is then synchronized to various consensus nodes on the blockchain to complete on-chain verification and construct a hardware identity ledger, allowing the hardware identity to be deeply bound to its physical characteristics, achieving the personalized generation of the hardware identity credential. Simultaneously, relying on the characteristics of blockchain, the distributed identity credential is immutably stored, providing a reliable on-chain basis for hardware identity verification, thus achieving reliable collection and verification of identity information from the hardware level.

[0005] To address the aforementioned technical problems, this invention provides the following technical solution: a blockchain-based computer network hardware security authentication system, comprising: Identity collection module: Integrates a hardware firmware-level low-level driver interface into the target hardware terminal to be connected to the network. In the initial stage of the target hardware accessing the network, it collects multi-dimensional and tamper-proof hardware feature information of the target hardware, performs hash operation, and generates a unique hardware feature digest. Credential generation module: Deploy a credential issuance execution unit at the network access node, receive a unique hardware feature digest, and generate a public-private key pair specific to the target hardware through the credential issuance execution unit. Combine the unique hardware feature digest with the public key information in the public-private key pair to generate a distributed identity credential specific to the target hardware. On-chain evidence storage module: Deploys evidence storage execution unit and establishes data connection with each consensus node of the blockchain, receives distributed identity credentials and synchronizes them to each consensus node of the blockchain, completes on-chain rights confirmation, builds hardware identity ledger, and opens on-chain real-time verification interface; Link Binding Module: Deploys the link association execution unit and establishes data interface with the target hardware transmission layer. When the target hardware initiates digital information transmission, it retrieves the distributed identity credential through the on-chain real-time verification interface and collects the real-time link feature information of the current transmission link. It then associates and binds the distributed identity credential with it and embeds the on-chain hardware identity verification field in each data frame to be transmitted. Consensus Verification Module: Distributed verification execution units are deployed on each consensus node of the blockchain. During the entire process of digital information transmission, the hardware identity ledger is retrieved, and the on-chain hardware identity verification field and real-time link feature information carried in the data frame are verified in a distributed real-time manner. When the verification fails, a transmission blocking instruction is generated, and the abnormal behavior information is written to each consensus node of the blockchain simultaneously.

[0006] Furthermore, in the identity acquisition module, a direct communication link is established with the target hardware chip through the hardware firmware-level low-level driver interface, bypassing the operating system layer of the target hardware. The module reads the multi-dimensional, tamper-proof hardware feature information of the target hardware, including its unique physical identifier, chip serial number, MAC address, and hardware operating environment fingerprint. The module then splices the multi-dimensional, tamper-proof hardware feature information and performs a hash operation using a multi-dimensional hardware feature fusion hash formula to generate a unique hardware feature digest.

[0007] Furthermore, in the identity acquisition module, the multi-dimensional hardware feature fusion hash formula is: ,in, A unique hardware feature summary The SM3 cryptographic hash algorithm is used for hash operations. The total number of dimensions for the collected multidimensional, tamper-proof hardware feature information. For the first The weighting coefficients corresponding to the hardware feature information are determined by the firmware attributes that correspond to the hardware feature information. For the first The binary conversion value of the hardware feature information.

[0008] Furthermore, in the credential generation module, the credential issuance execution unit uses the SM2 elliptic curve public-key cryptography algorithm to generate a public-private key pair specific to the target hardware. It completes the calculation using the SM2 hardware-specific public-private key generation association formula, and then writes the private key from the public-private key pair into the secure encryption chip of the target hardware for local storage. The SM2 hardware-specific public-private key generation association formula is as follows: ,in, A private SM2 key specific to the target hardware. A public SM2 key specific to the target hardware. A unique hardware feature summary For fixed-length truncation operations, The truncation length for fixed-length truncation operations is determined by the firmware attributes of the target hardware's security encryption chip. The base point of the SM2 elliptic curve is determined by the SM2 elliptic curve public-key cryptography algorithm. The generated distributed identity credential contains a unique hardware feature digest, public key information in the public-private key pair, hardware access permission scope, identity validity period, and unique credential number. All fields in the distributed identity credential are digitally signed by the private key in the public-private key pair, and the generation of the public-private key pair is fixedly associated with the unique hardware feature digest.

[0009] Furthermore, in the on-chain evidence storage module, the evidence storage execution unit adopts a practical Byzantine fault-tolerant consensus mechanism to synchronize the distributed identity certificate to all consensus nodes of the blockchain. The constructed hardware identity ledger is stored in a key-value pair structure, with the unique certificate number as the key and the full content of the distributed identity certificate as the value. The open on-chain real-time verification interface supports three types of query requests: distributed identity certificate hash value verification, distributed identity certificate full content retrieval, and hardware identity permission verification.

[0010] Furthermore, in the link binding module, during the handshake phase of digital information transmission initiated by the target hardware, the link association execution unit retrieves the distributed identity credential through the on-chain real-time verification interface, collects the real-time link characteristic information of the current transmission link, including IP address, port number, transmission protocol, and data transmission path, and generates a binding relationship summary by combining the distributed identity credential and the real-time link characteristic information using the hardware identity-transmission link binding verification value formula. The hash value of the distributed identity credential, the hash value of the real-time link characteristic information, and the binding relationship summary are combined into an on-chain hardware identity verification field, which is embedded in the frame header extension field of each data frame to be transmitted. During digital information transmission, the link association execution unit monitors the transmission link status of the target hardware in real time. When any feature of the transmission link, such as IP address, port number, transmission protocol, or data transmission path, changes, the unit re-collects the changed real-time link characteristic information, updates the association binding relationship between the distributed identity credential and the real-time link characteristic information, and synchronously updates the on-chain hardware identity verification field embedded in the data frame.

[0011] Furthermore, in the link binding module, the formula for the hardware identity-transmission link binding verification value is: ,in, For the binding relationship summary, The SM3 cryptographic hash algorithm is used for hash operations. A unique hardware feature summary The hash value is the real-time link feature information, determined by processing all collected real-time link feature information using the SM3 cryptographic hash algorithm. This is the bitwise XOR operator used for byte concatenation.

[0012] Furthermore, in the consensus verification module, the distributed verification execution unit captures the data frame during transmission at each forwarding node of the data frame, extracts the on-chain hardware identity verification field within the data frame, retrieves the hardware identity ledger, and obtains the full content of the corresponding distributed identity credential. Each consensus node independently verifies the compliance of the on-chain hardware identity verification field, the matching of real-time link feature information and binding relationship, and obtains the verification results of each node. The distributed consensus verification pass rate is calculated using the distributed consensus verification node pass rate formula. When the distributed consensus verification pass rate exceeds 2 / 3, a data frame transmission permission instruction is generated; when the distributed consensus verification pass rate does not exceed 2 / 3, a transmission blocking instruction is generated.

[0013] Furthermore, in the consensus verification module, the formula for the pass rate of the distributed consensus verification node is: ,in, For distributed consensus verification pass rate, This represents the total number of blockchain consensus nodes. For the first The verification result of the consensus node, when the first consensus node... Each consensus node verifies the binding relationship digest within the data frame and calculates it. When consistent, The value is 1; if they are inconsistent, The value is 0. This is a summary of the binding relationship.

[0014] Furthermore, in the consensus verification module, during the distributed real-time verification process, if any of the following occurs: the on-chain hardware identity verification field does not match the hardware identity ledger content, the real-time link feature information does not match the binding relationship, the digital signature verification fails, or the transmission path is changed without authorization, the distributed verification execution unit directly determines that the verification fails and generates and issues a transmission blocking instruction to the network security gateway device. The distributed verification execution unit writes abnormal behavior information of each consensus node in the blockchain, including the unique identifier of the abnormal hardware, the timestamp of the abnormality, the real-time link feature information of the abnormal transmission link, the specific reason for the verification failure, and the hash value of the abnormal data frame. The abnormal behavior information is synchronized to all consensus nodes in the blockchain through a practical Byzantine fault-tolerant consensus mechanism.

[0015] Compared with existing technologies, this blockchain-based computer network hardware security authentication system has the following advantages: I. This invention integrates a hardware firmware-level underlying driver interface into the target hardware terminal to be connected to the network, collects multi-dimensional and tamper-proof hardware feature information and generates a unique hardware feature digest, combines the unique hardware feature digest to generate a public-private key pair specific to the target hardware and create a distributed identity certificate, synchronizes the distributed identity certificate to each consensus node of the blockchain to complete on-chain confirmation and build a hardware identity ledger, so that the hardware identity is deeply bound to its own physical characteristics, realizes the exclusive generation of hardware identity certificates, and at the same time relies on the characteristics of blockchain to realize the tamper-proof storage of distributed identity certificates, so that the verification of hardware identity has a credible on-chain basis, realizing the reliable collection and confirmation of identity information from the hardware bottom layer.

[0016] Second, this invention associates and binds hardware distributed identity credentials with real-time feature information of the transmission link, embeds an on-chain hardware identity verification field in each data frame to be transmitted, deploys distributed verification execution units on each consensus node of the blockchain to perform full-process distributed real-time verification of the data frames, and sets up a direct verification rejection mechanism for special abnormal situations. This achieves a strong association between hardware identity and transmission link, ensuring a unique correspondence between the data transmission link and hardware identity. Relying on distributed consensus verification, it achieves reliable verification of the entire data transmission process, promptly identifies and blocks abnormal transmission behavior, and writes abnormal information into the blockchain for immutable retention.

[0017] Other advantages, objectives and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination or study, or may be learned from the practice of the invention. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0019] Figure 1 A flowchart of a blockchain-based computer network hardware security authentication system; Figure 2 This is a framework diagram of a blockchain-based computer network hardware security authentication system. Figure 3 This is a flowchart of a credential generation module in a blockchain-based computer network hardware security authentication system. Detailed Implementation

[0020] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0021] Example 1: In a scenario involving the secure authentication of hardware access and data transmission for production management application servers within a large manufacturing enterprise's intranet, the enterprise has established a dedicated intranet covering its headquarters data center and various production workshops. This intranet facilitates the secure interaction of production management system data, equipment operating parameters, and work order information. The enterprise intranet also features a dedicated consortium blockchain network, with consensus nodes deployed at the enterprise headquarters' security management server, core switching devices in each workshop, and data center storage nodes. The target hardware to be connected to the network is the newly added application server for the production management system. This application server, deployed in the enterprise data center, is specifically designed to aggregate and analyze workshop production data. It needs to connect to the enterprise intranet to enable data interaction with terminals in each workshop. The entire process of secure authentication from access to data transmission for this application server must be completed to ensure the secure transmission of the enterprise's core production data.

[0022] The application server integrates a hardware firmware-level low-level driver interface. This integration is completed during the application server firmware flashing and configuration phase, ensuring compatibility with the application server's hardware chip. After maintenance personnel submit the application server's network access application to the enterprise intranet management platform, in the initial stage of the application server's intranet access application, a direct communication link is established with the application server's hardware chip through the hardware firmware-level low-level driver interface. This bypasses the application server's operating system layer, avoiding the data collection risks associated with operating system tampering. It accurately collects multi-dimensional, tamper-proof hardware feature information consisting of the application server's unique physical identifier, chip serial number, MAC address, and hardware operating environment fingerprint. All collected multi-dimensional, tamper-proof hardware feature information is concatenated in a preset order of hardware identifier, chip serial number, MAC address, and operating environment fingerprint. A multi-dimensional hardware feature fusion hash formula is used to perform a hash operation on the concatenated information, generating a unique hardware feature digest unique to the application server, serving as the core identifier of the hardware. The multi-dimensional hardware feature fusion hash formula is as follows: ,in, A unique hardware feature summary The SM3 cryptographic hash algorithm is used for hash operations. The total number of dimensions for the collected multidimensional, tamper-proof hardware feature information. For the first The weighting coefficients corresponding to the hardware feature information are determined by the firmware attributes that correspond to the hardware feature information. For the first The binary conversion value of the hardware feature information.

[0023] A credential issuance execution unit is deployed at the core network access node of the enterprise intranet. This core network access node serves as the intranet access authentication server for the enterprise headquarters, specifically responsible for generating access credentials for all hardware terminals within the intranet. The credential issuance execution unit receives the unique hardware feature digest of the application server in real time, uses the SM2 elliptic curve public-key cryptography algorithm, and completes the calculation using the SM2 hardware-specific public-private key generation association formula to generate a public-private key pair unique to the application server. Then, through low-level hardware communication, the private key from the public-private key pair is written into the application server's secure encryption chip for local storage, ensuring the security of the private key. The SM2 hardware-specific public-private key generation association formula is as follows: ,in, A private SM2 key specific to the target hardware. A public SM2 key specific to the target hardware. A unique hardware feature summary For fixed-length truncation operations, The truncation length for fixed-length truncation operations is determined by the firmware attributes of the target hardware's security encryption chip. The base point of the SM2 elliptic curve is determined using the SM2 elliptic curve public-key cryptography algorithm; then, combined with the unique hardware feature digest and the public key information in the public-private key pair, a distributed identity credential specific to the application server is generated, such as... Figure 1 As shown, the distributed identity credential contains a unique hardware feature digest, public key information in the public-private key pair, the scope of intranet hardware access permissions for the application server, the validity period of the identity, and a unique credential number that is unique across the entire network. All fields in the distributed identity credential are digitally signed by the private key in the public-private key pair, realizing a fixed association between the public-private key pair and the unique hardware feature digest, and deeply binding the distributed identity credential to the physical attributes of the hardware.

[0024] An independent evidence storage execution unit is deployed and establishes stable data communication interfaces with each consensus node of the enterprise intranet consortium blockchain. After receiving the distributed identity credential from the application server, the evidence storage execution unit uses a practical Byzantine fault-tolerant consensus mechanism to synchronize the distributed identity credential to all consensus nodes of the enterprise intranet blockchain, completing the on-chain confirmation of the distributed identity credential and ensuring that the storage of the distributed identity credential has the characteristic of being tamper-proof. At the same time, a unified hardware identity ledger is constructed based on the distributed identity credentials of all hardware terminals on the entire network. This hardware identity ledger uses a key-value pair structure for standardized storage, with the unique credential number as the unique key and the full content of the distributed identity credential as the corresponding value, facilitating fast retrieval and verification. A standardized on-chain real-time verification interface is also provided, such as... Figure 2 As shown, the on-chain real-time verification interface is open to all authentication nodes within the enterprise intranet, supporting three types of query requests: distributed identity credential hash value verification, distributed identity credential full content retrieval, and hardware identity permission verification, thus meeting the verification needs of different nodes within the intranet.

[0025] The link association execution unit is deployed and establishes a data interface with the network transport layer of the application server to achieve real-time data collection and interaction at the transport layer. After the application server successfully connects to the enterprise intranet, it initiates the first business data transmission request for production workshop data aggregation. During the data transmission handshake phase, the link association execution unit accurately retrieves the distributed identity credential of the application server from the hardware identity ledger through the on-chain real-time verification interface. Simultaneously, it collects real-time link characteristic information consisting of the IP address, port number, transmission protocol, and data transmission path of the current data transmission link. This link is a dedicated transmission link from the data center application server to the core switches in each workshop. Subsequently, the distributed identity credential and real-time link characteristic information are used to generate a binding relationship summary using the hardware identity-transmission link binding verification value formula. The hardware identity-transmission link binding verification value formula is: ,in, For the binding relationship summary, The SM3 cryptographic hash algorithm is used for hash operations. A unique hardware feature summary The hash value is the real-time link feature information, determined by processing all collected real-time link feature information using the SM3 cryptographic hash algorithm. Byte concatenation is performed using the bitwise XOR operator. Then, the hash value of the distributed identity credential, the hash value of the real-time link characteristic information, and the binding relationship digest are combined in a fixed order to form an on-chain hardware identity verification field. This on-chain hardware identity verification field is fully embedded in the frame header extension field of each production business data frame to be transmitted, without occupying the effective payload space of the data frame. During the continuous transmission of production data by the application server, the link association execution unit continuously monitors the server's transmission link status in real time. When any feature of the transmission link—IP address, port number, transmission protocol, or data transmission path—changes due to reasons such as debugging of workshop network equipment or optimization of transmission paths, the unit immediately re-collects the changed real-time link characteristic information, quickly updates the association binding relationship between the distributed identity credential and the real-time link characteristic information, and synchronously updates the on-chain hardware identity verification field embedded in all data frames to be transmitted, ensuring that the binding between the link and the identity remains effective.

[0026] Each consensus node in the enterprise intranet blockchain deploys an independent distributed verification execution unit to achieve distributed verification across all nodes. During the entire transmission process of application server production business data, each node's distributed verification execution unit can retrieve the constructed unified hardware identity ledger in real time. At each hop of the data frame transmission, it accurately captures the production business data frames in the transmission process, extracts the on-chain hardware identity verification field from the frame header extension field, and simultaneously obtains the full content of the corresponding application server's distributed identity credential from the hardware identity ledger. Each consensus node independently conducts verification work, comprehensively verifying the compliance of the on-chain hardware identity verification field and the matching of real-time link feature information and binding relationships, obtaining independent verification results. The distributed consensus verification pass rate is then uniformly calculated using the distributed consensus verification node pass rate formula, which is: ,in, For distributed consensus verification pass rate, This represents the total number of blockchain consensus nodes. For the first The verification result of the consensus node, when the first consensus node... Each consensus node verifies the binding relationship digest within the data frame and calculates it. When consistent, The value is 1; if they are inconsistent, The value is 0. This serves as a summary of the binding relationship. When the distributed consensus verification pass rate exceeds 2 / 3, a data frame transmission permission instruction is immediately generated to ensure normal data interaction. When the distributed consensus verification pass rate does not exceed 2 / 3, a transmission blocking instruction is immediately generated to stop data transmission. If, during the entire distributed real-time verification process, any of the following occurs: the on-chain hardware identity verification field does not match the hardware identity ledger content, the real-time link feature information does not match the binding relationship, the digital signature verification fails, or the transmission path is changed without authorization, each consensus node does not need to calculate the pass rate. Instead, it directly determines that the verification fails, immediately generates and issues a transmission blocking instruction to the core network security gateway device of the enterprise intranet, and simultaneously writes the complete abnormal behavior information to each consensus node of the enterprise intranet blockchain. The abnormal behavior information includes the unique identifier of the application server, the precise timestamp of the abnormal occurrence, the real-time link feature information of the abnormal transmission link, the specific reason for the verification failure, and the hash value of the abnormal data frame. This abnormal behavior information is synchronized to all consensus nodes of the enterprise intranet blockchain through a practical Byzantine fault-tolerant consensus mechanism, achieving tamper-proof retention and full network synchronization of abnormal information.

[0027] In summary, this approach implements end-to-end security authentication for the network access and data transmission of application servers in the production management system. It leverages a dedicated consortium blockchain network to reliably collect server hardware characteristics and generate and upload exclusive distributed identity credentials to the blockchain, achieving precise binding between hardware identity and transmission links. Distributed consensus verification enables end-to-end verification of production business data transmission. In special abnormal situations, transmission is directly interrupted, and relevant information is synchronously uploaded to the blockchain for storage. This effectively ensures the security of core production data transmission within the enterprise intranet and perfectly meets the security protection needs of enterprise blockchain-based intranets.

[0028] Example 2: In the scenario of hardware access and data transmission security authentication for industrial IoT temperature and humidity sensor terminals in an automotive manufacturing workshop, the company's painting and welding workshops have extremely high requirements for environmental temperature and humidity. They need to collect real-time environmental data through temperature and humidity sensor terminals to ensure the stability of the production process. The company has built a dedicated industrial IoT for the two production workshops for real-time uploading of temperature and humidity sensor terminal data and the issuance of process control commands. A dedicated consortium blockchain network has been built within the IoT, with consensus nodes deployed at the workshop edge computing gateway, the factory IoT management platform, and the cloud data center nodes. The target hardware to be connected to the network consists of multiple newly added temperature and humidity sensor terminals in the two workshops. These terminals are deployed around the production lines and need to be connected to the industrial IoT to complete real-time uploading of temperature and humidity data. The entire process from access to data transmission security authentication must be completed to prevent the sensor data from being tampered with or forged, ensuring the accuracy of production environment monitoring.

[0029] Each temperature and humidity sensor terminal integrates a hardware firmware-level low-level driver interface. This interface is compatible with the embedded hardware chip of the temperature and humidity sensor and is integrated during the factory configuration phase. After production line maintenance personnel submit a network access application for the temperature and humidity sensor terminal to the factory's IoT management platform, in the initial stage of the industrial IoT access application, a direct communication link is established between the temperature and humidity sensor terminal and its hardware chip through the hardware firmware-level low-level driver interface. This bypasses the embedded operating system layer of the temperature and humidity sensor, avoiding feature acquisition errors caused by malicious tampering of the embedded system. It accurately collects multi-dimensional, tamper-proof hardware feature information for each temperature and humidity sensor terminal, consisting of a unique physical identifier, chip serial number, MAC address, and hardware operating environment fingerprint. All collected multi-dimensional, tamper-proof hardware feature information is concatenated in a fixed order, and a hash operation is performed on the concatenated information using a multi-dimensional hardware feature fusion hash formula. This generates a unique hardware feature digest for each temperature and humidity sensor terminal, serving as the core identifier for the sensor's hardware identity, enabling accurate differentiation of individual temperature and humidity sensors. The multi-dimensional hardware feature fusion hash formula is as follows: .

[0030] A credential issuance execution unit is deployed at the core network access node of the Industrial Internet of Things (IIoT). This core network access node serves as the IoT access authentication gateway for the factory area, specifically responsible for generating access credentials for all temperature and humidity sensor terminals within the IoT network. The credential issuance execution unit receives the unique hardware feature digest of each temperature and humidity sensor terminal in real time. Using the SM2 elliptic curve public-key cryptography algorithm, it performs calculations through the SM2 hardware-specific public-private key generation association formula to generate a unique public-private key pair for each temperature and humidity sensor terminal. Subsequently, through low-level hardware communication, the private key from the public-private key pair is written into the corresponding temperature and humidity sensor terminal's secure encryption chip for local storage, ensuring that the private key is not leaked. The SM2 hardware-specific public-private key generation association formula is as follows: Then, by combining the unique hardware feature digest with the public key information in the public-private key pair, a unique distributed identity credential is generated for each temperature and humidity sensor terminal, such as... Figure 3 As shown, the distributed identity credential includes a unique hardware feature digest of the temperature and humidity sensor terminal, public key information in the public-private key pair, IoT hardware access permission scope of the temperature and humidity sensor, identity validity period, and a unique credential number unique across the entire network. All fields in the distributed identity credential are digitally signed by the private key in the corresponding public-private key pair, realizing a fixed association between the public-private key pair and the unique hardware feature digest, so that the credential of the temperature and humidity sensor terminal is deeply bound to its own physical attributes, preventing identity spoofing.

[0031] An independent evidence storage execution unit is deployed and establishes wireless data communication interfaces with each consensus node of the Industrial Internet of Things (IIoT) blockchain. Adapting to the wireless transmission characteristics of IIoT, the evidence storage execution unit receives the distributed identity credentials generated for each temperature and humidity sensor terminal and uses a practical Byzantine fault-tolerant consensus mechanism to synchronize all distributed identity credentials to all consensus nodes of the IIoT blockchain. This completes the on-chain confirmation of the distributed identity credentials for each temperature and humidity sensor terminal, giving the distributed identity credentials the characteristics of being tamper-proof and verifiable across the entire network. Simultaneously, based on the distributed identity credentials of the temperature and humidity sensor terminals on the entire network, a unified hardware identity ledger is constructed. This hardware identity ledger uses a key-value pair structure for standardized storage, with the unique credential number as the unique key and the full content of the distributed identity credential as the corresponding value, facilitating quick retrieval and verification by each node. At the same time, a standardized on-chain real-time verification interface is opened. This on-chain real-time verification interface is open to all authentication nodes of the IIoT and supports three types of query requests: distributed identity credential hash value verification, distributed identity credential full content retrieval, and hardware identity permission verification, meeting the verification needs of different nodes in the IoT.

[0032] Each temperature and humidity sensor terminal is equipped with a corresponding link association execution unit, which establishes a data interface with the network transmission layer of the temperature and humidity sensor terminal to achieve real-time data acquisition and interaction at the transmission layer. After the temperature and humidity sensor terminal successfully connects to the Industrial Internet of Things (IIoT), it initiates its first real-time upload request for workshop temperature and humidity data. During the data transmission handshake phase, the link association execution unit retrieves the distributed identity credential of the temperature and humidity sensor terminal from the hardware identity ledger through the on-chain real-time verification interface. Simultaneously, it collects real-time link characteristic information consisting of the IP address, port number, transmission protocol, and data transmission path of the current wireless data transmission link. This link is a dedicated wireless transmission link from the temperature and humidity sensor terminal to the workshop edge computing gateway. Subsequently, the distributed identity credential and real-time link characteristic information are used to generate a binding relationship summary using the hardware identity-transmission link binding verification value formula. The hardware identity-transmission link binding verification value formula is as follows: The hash value of the distributed identity credential, the hash value of the real-time link feature information, and the binding relationship digest are then combined in a fixed order to form an on-chain hardware identity verification field. This on-chain hardware identity verification field is fully embedded in the frame header extension field of each temperature and humidity data frame to be transmitted, without occupying the effective payload space of the data frame, thus adapting to the small frame transmission characteristics of sensor data. During the continuous uploading of temperature and humidity data by the temperature and humidity sensor terminal, the link association execution unit continuously monitors the wireless transmission link status of the sensor in real time. When any feature of the transmission link, such as IP address, port number, transmission protocol, or data transmission path, changes due to factors such as optimization of the workshop wireless signal or fine-tuning of the temperature and humidity sensor position, the unit immediately re-collects the changed real-time link feature information, quickly updates the association binding relationship between the distributed identity credential and the real-time link feature information, and synchronously updates the on-chain hardware identity verification field embedded in all data frames to be transmitted, ensuring that the identity of the temperature and humidity sensor terminal and the transmission link are always uniquely bound.

[0033] Each consensus node in the industrial IoT blockchain deploys an independent distributed verification execution unit to adapt to the distributed deployment characteristics of industrial IoT. During the entire process of uploading environmental data from temperature and humidity sensor terminals, each node's distributed verification execution unit can retrieve the unified hardware identity ledger in real time. At each hop of the wireless data frame transmission, it accurately captures the temperature and humidity data frames during transmission, extracts the on-chain hardware identity verification field from the frame header extension field, and simultaneously obtains the full content of the distributed identity credential of the corresponding temperature and humidity sensor terminal from the hardware identity ledger. Each consensus node independently conducts verification work, comprehensively verifying the compliance of the on-chain hardware identity verification field and the matching of real-time link feature information and binding relationships. Each node obtains its own independent verification result, and then the distributed consensus verification pass rate is uniformly calculated using the distributed consensus verification node pass rate formula. The distributed consensus verification node pass rate formula is as follows: When the distributed consensus verification pass rate exceeds 2 / 3, a data frame transmission permission instruction is immediately generated to ensure real-time uploading of temperature and humidity data. When the distributed consensus verification pass rate does not exceed 2 / 3, a transmission blocking instruction is immediately generated to stop data transmission. If, during the entire distributed real-time verification process, any of the following occurs: the on-chain hardware identity verification field does not match the hardware identity ledger content, the real-time link feature information does not match the binding relationship, the digital signature verification fails, or the transmission path is changed without authorization, each consensus node does not need to calculate the pass rate; it directly determines that the verification fails and immediately generates and issues a transmission blocking instruction to the core network security gateway device of the industrial IoT. At the same time, the abnormal behavior information is completely written into each consensus node of the industrial IoT blockchain. The abnormal behavior information includes the unique identifier of the temperature and humidity sensor terminal, the precise timestamp of the abnormal occurrence, the real-time link feature information of the abnormal transmission link, the specific reason for the verification failure, and the hash value of the abnormal data frame. This abnormal behavior information is synchronized to all consensus nodes of the industrial IoT blockchain through a practical Byzantine fault-tolerant consensus mechanism, realizing the immutable retention and full network synchronization of abnormal information, which facilitates subsequent investigation of IoT security issues by operation and maintenance personnel.

[0034] In summary, this approach implements end-to-end security authentication for temperature and humidity sensor terminals during network access and environmental data upload. By leveraging the wireless transmission characteristics of the Industrial Internet of Things (IIoT), it accurately collects sensor hardware features and generates and uploads exclusive distributed identity credentials to the blockchain. This ensures continuous binding between the temperature and humidity sensor's identity and the wireless transmission link. Distributed consensus verification completes the entire process of temperature and humidity data upload. In case of anomalies, transmission is directly blocked and the anomaly information is synchronized to all blockchain nodes, preventing sensor data from being tampered with or forged. This guarantees the accuracy of production environment monitoring data and is compatible with the distributed deployment and wireless transmission requirements of the IIoT.

[0035] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A blockchain-based computer network hardware security authentication system, characterized in that, The system includes: Identity collection module: Integrates a hardware firmware-level low-level driver interface into the target hardware terminal to be connected to the network. In the initial stage of the target hardware accessing the network, it collects multi-dimensional and tamper-proof hardware feature information of the target hardware, performs hash operation, and generates a unique hardware feature digest. Credential generation module: Deploy a credential issuance and execution unit at the network access node, receive a unique hardware feature digest, and generate a public-private key pair specific to the target hardware through the credential issuance and execution unit. Combine the unique hardware feature digest with the public key information in the public-private key pair to generate a distributed identity credential specific to the target hardware. On-chain evidence storage module: Deploys evidence storage execution unit and establishes data connection with each consensus node of the blockchain, receives distributed identity credentials and synchronizes them to each consensus node of the blockchain, completes on-chain rights confirmation, builds hardware identity ledger, and opens on-chain real-time verification interface; Link Binding Module: Deploys the link association execution unit and establishes data interface with the target hardware transmission layer. When the target hardware initiates digital information transmission, it retrieves the distributed identity credential through the on-chain real-time verification interface and collects the real-time link feature information of the current transmission link. It then associates and binds the distributed identity credential with it and embeds the on-chain hardware identity verification field in each data frame to be transmitted. Consensus Verification Module: Distributed verification execution units are deployed on each consensus node of the blockchain. During the entire process of digital information transmission, the hardware identity ledger is retrieved, and the on-chain hardware identity verification field and real-time link feature information carried in the data frame are verified in a distributed real-time manner. When the verification fails, a transmission blocking instruction is generated, and the abnormal behavior information is written to each consensus node of the blockchain simultaneously.

2. The blockchain-based computer network hardware security authentication system according to claim 1, characterized in that, In the identity acquisition module, a direct communication link is established with the target hardware chip through the hardware firmware-level low-level driver interface. The module reads the target hardware's unique physical identifier, chip serial number, MAC address, and hardware operating environment fingerprint, as well as multi-dimensional, tamper-proof hardware feature information. The module then splices the multi-dimensional, tamper-proof hardware feature information and performs a hash operation using a multi-dimensional hardware feature fusion hash formula to generate a unique hardware feature digest.

3. The blockchain-based computer network hardware security authentication system according to claim 2, characterized in that, In the identity acquisition module, the multi-dimensional hardware feature fusion hash formula is: ,in, A unique hardware feature summary The SM3 cryptographic hash algorithm is used for hash operations. The total number of dimensions for the collected multidimensional, tamper-proof hardware feature information. For the first The weighting coefficients corresponding to the dimensional hardware feature information For the first The binary conversion value of the hardware feature information.

4. The blockchain-based computer network hardware security authentication system according to claim 1, characterized in that, In the credential generation module, the credential issuance execution unit uses the SM2 elliptic curve public-key cryptography algorithm to generate a public-private key pair specific to the target hardware. It then completes the calculation using the SM2 hardware-specific public-private key generation association formula, and finally writes the private key from the public-private key pair into the target hardware's secure encryption chip for local storage. The SM2 hardware-specific public-private key generation association formula is as follows: ,in, A private SM2 key specific to the target hardware. A public SM2 key specific to the target hardware. A unique hardware feature summary For fixed-length truncation operations, The truncation length for fixed-length truncation operations. The base point of the SM2 elliptic curve is used; the generated distributed identity credential contains a unique hardware feature digest, public key information in the public-private key pair, hardware access permission scope, identity validity period, and unique credential number. All fields in the distributed identity credential are digitally signed using the private key in the public-private key pair, and the generation of the public-private key pair is fixedly associated with the unique hardware feature digest.

5. A blockchain-based computer network hardware security authentication system according to claim 1, characterized in that, In the on-chain evidence storage module, the evidence storage execution unit adopts a practical Byzantine fault-tolerant consensus mechanism to synchronize the distributed identity certificate to all consensus nodes of the blockchain. The constructed hardware identity ledger is stored in a key-value pair structure, with the unique certificate number as the key and the full content of the distributed identity certificate as the value. The open on-chain real-time verification interface supports three types of query requests: distributed identity certificate hash value verification, distributed identity certificate full content retrieval, and hardware identity permission verification.

6. The blockchain-based computer network hardware security authentication system according to claim 1, characterized in that, In the link binding module, during the handshake phase when the target hardware initiates digital information transmission, the link association execution unit retrieves the distributed identity credential through the on-chain real-time verification interface, collects the real-time link characteristic information of the current transmission link, including IP address, port number, transmission protocol, and data transmission path, and generates a binding relationship summary by combining the distributed identity credential and the real-time link characteristic information using the hardware identity-transmission link binding verification value formula. The hash value of the distributed identity credential, the hash value of the real-time link characteristic information, and the binding relationship summary are combined into an on-chain hardware identity verification field, which is then embedded in the frame header extension field of each data frame to be transmitted. During the digital information transmission process, the link association execution unit monitors the transmission link status of the target hardware in real time. When any feature of the transmission link, such as IP address, port number, transmission protocol, or data transmission path, changes, it re-collects the changed real-time link feature information, updates the association and binding relationship between the distributed identity credential and the real-time link feature information, and synchronously updates the on-chain hardware identity verification field embedded in the data frame.

7. A blockchain-based computer network hardware security authentication system according to claim 6, characterized in that, In the link binding module, the formula for the hardware identity-transmission link binding verification value is: ,in, For the binding relationship summary, The SM3 cryptographic hash algorithm is used for hash operations. A unique hardware feature summary This is the hash value of real-time link characteristic information. This is the bitwise XOR operator used for byte concatenation.

8. A blockchain-based computer network hardware security authentication system according to claim 1, characterized in that, In the consensus verification module, the distributed verification execution unit captures the data frame during transmission at each forwarding node of the data frame, extracts the on-chain hardware identity verification field within the data frame, retrieves the hardware identity ledger, and obtains the full content of the corresponding distributed identity credential. Each consensus node independently verifies the compliance of the on-chain hardware identity verification field, the matching of real-time link feature information and binding relationship, and obtains the verification results of each node. The distributed consensus verification pass rate is calculated using the distributed consensus verification node pass rate formula. When the distributed consensus verification pass rate exceeds 2 / 3, a data frame transmission permission instruction is generated; when the distributed consensus verification pass rate does not exceed 2 / 3, a transmission blocking instruction is generated.

9. A blockchain-based computer network hardware security authentication system according to claim 8, characterized in that, In the consensus verification module, the formula for the pass rate of the distributed consensus verification node is: ,in, For distributed consensus verification pass rate, This represents the total number of blockchain consensus nodes. For the first The verification result of the consensus node, when the first consensus node... Each consensus node verifies the binding relationship digest within the data frame and calculates it. When consistent, The value is 1; if they are inconsistent, The value is 0. This is a summary of the binding relationship.

10. A blockchain-based computer network hardware security authentication system according to claim 8, characterized in that, In the consensus verification module, during the distributed real-time verification process, if any of the following situations occur, such as the on-chain hardware identity verification field not matching the hardware identity ledger content, the real-time link feature information not matching the binding relationship, digital signature verification failure, or unauthorized change of the transmission path, the distributed verification execution unit will directly determine that the verification fails and generate and issue a transmission blocking instruction to the network security gateway device. The distributed verification execution unit writes abnormal behavior information to each consensus node of the blockchain, including the unique identifier of the abnormal hardware, the timestamp of the abnormality, the real-time link characteristics of the abnormal transmission link, the specific reason for the verification failure, and the hash value of the abnormal data frame. The abnormal behavior information is synchronized to all consensus nodes of the blockchain through a practical Byzantine fault-tolerant consensus mechanism.

Images