Method, device, system and storage medium for distributed data system identity authentication

Abstract

This application relates to the field of computer technology, disclosing a method, apparatus, system, and storage medium for identity authentication in a distributed data system. The distributed data system includes a consortium blockchain and multiple application blockchains. Each application blockchain includes a terminal device node, an edge node, and a blockchain light node. The consortium blockchain includes the blockchain light node in each application blockchain. The method includes: upon receiving a first current identity authentication request initiated by a first terminal device node from a different domain, obtaining first identity authentication information determined by the consortium blockchain and first data integrity verification information of the first terminal device node's block information stored in the consortium blockchain through the blockchain light node corresponding to the local application blockchain; and performing identity authentication of the first terminal device node based on the first identity authentication information and the first data integrity verification information. This further improves the security of the Internet of Things (IoT).

Description

Technical Field

[0001] This application relates to the field of computer technology, such as methods, apparatus, systems, and storage media for identity authentication in distributed data systems. Background Technology

[0002] Currently, the number of IoT devices, such as sensors and smart terminals, connected to networks is growing exponentially and is widely used in consumer internet, smart homes, smart healthcare, smart cities, and industrial internet scenarios. IoT terminal devices are characterized by their wide distribution, large number, and involvement in multiple management domains. Compared to traditional internet terminals, IoT terminals are more vulnerable to attacks, making cross-domain identity authentication in multiple application scenarios a crucial security defense for data sharing among internet devices. Faced with cross-domain security issues such as privacy leaks, data misuse, and data deletion / modification of user data across multiple IoT devices and platforms, there is an urgent need to establish a cross-domain trusted identity authentication mechanism for the IoT.

[0003] Currently, cross-domain identity authentication primarily employs PKI and IBC public key authentication mechanisms. In this model, the authentication mechanism is built upon the PKI system, with the Certificate Authority (CA) acting as a trusted third party, providing a root of trust for all PKI certificates. However, this approach incurs high management costs and also faces the potential risk of CAs being vulnerable to attacks. IBC, on the other hand, is not suitable for cross-domain device authentication in large-scale networks.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not intended as a general commentary, nor is it intended to identify key / important components or describe the scope of protection of these embodiments, but rather as a prelude to the detailed description that follows.

[0006] This disclosure provides methods, apparatus, systems, and storage media for identity authentication in distributed data systems to address the technical problem of insufficient security in Internet of Things (IoT) systems. The distributed data system includes a consortium blockchain and multiple application blockchains, wherein each application blockchain includes terminal device nodes, edge nodes, and a blockchain light node, and the consortium blockchain includes the blockchain light node in each application blockchain.

[0007] In some embodiments, the method includes:

[0008] In the case of receiving a first current identity authentication request initiated by the first terminal device node in the external application blockchain, the first identity authentication information determined by the consortium blockchain based on the first current identity authentication request is obtained through the blockchain light node corresponding to the local application blockchain, and the first data integrity verification information is obtained by the consortium blockchain storing the first block information of the first terminal device node, wherein the block information is generated when the first terminal device node registers the external application blockchain;

[0009] The identity authentication of the first terminal device node is performed based on the first identity authentication information and the first data integrity verification information.

[0010] In some embodiments, it also includes:

[0011] If it is determined that the current terminal device node that initiated the registration request belongs to the same application blockchain, the blockchain light node triggers a smart contract to generate a unique identity identifier for the current terminal device node.

[0012] Based on a unique identity and signature, a blockchain light node generates and stores the block information of the current terminal device node on the blockchain, and sends the block information to the consortium blockchain for storage.

[0013] The blockchain light node returns registration information, including block information, to the current terminal device node.

[0014] In some embodiments, obtaining the first identity authentication information determined by the consortium blockchain based on the first current identity authentication request includes:

[0015] The first current identity authentication request is sent to the consortium blockchain through the blockchain light node corresponding to the local application blockchain. The first current identity authentication request includes: the unique identity identifier of the first terminal device node and the identification information of the blockchain light node corresponding to the external application blockchain.

[0016] The first identity authentication information sent by the consortium blockchain is obtained by the consortium blockchain based on the first identity authentication information and the first block information when it finds the first block information that matches the first current identity authentication request in the stored block information.

[0017] In some embodiments, the authentication of the first terminal device node includes:

[0018] Determine the first hash value of the first identity authentication information, and determine the Merkle root hash value corresponding to the hash value of each path in the first data integrity verification information according to the Merkle tree path;

[0019] If the first hash value matches the Merkle root hash value, the signature carried in the first identity authentication information is determined to be valid.

[0020] In some embodiments, it also includes:

[0021] Based on the two-way anchoring protocol, the identity authentication result sent by the consortium blockchain is received. The identity authentication result is obtained by the edge node in the external application blockchain authenticating the identity of the local terminal device node in the local application blockchain.

[0022] After signing the authentication result, the signature result is sent to the local terminal device node, so that the local terminal device node can perform authentication based on the authentication information and data integrity verification information in the authentication result.

[0023] In some embodiments, it also includes:

[0024] In the case of receiving a second current identity authentication request initiated by a second terminal device node in the local application blockchain, determine the second identity authentication information corresponding to the second current identity authentication request, and obtain the second data integrity verification information of the second block information of the second terminal device node in the local application blockchain;

[0025] Based on the second identity authentication information and the second data integrity verification information, the identity authentication of the second terminal device node is performed, and the corresponding identity authentication result is sent to the second terminal.

[0026] In some embodiments, the apparatus for authentication of a distributed data system includes a processor and a memory storing program instructions, the processor being configured to execute the above-described method for authentication of a distributed data system when executing the program instructions.

[0027] In some embodiments, the distributed data system includes: a consortium blockchain and multiple application blockchains, wherein each application blockchain includes: terminal device nodes, edge nodes, and a blockchain light node, and the consortium blockchain includes: the blockchain light node in each application blockchain, wherein...

[0028] A consortium blockchain is configured to store block information for each terminal device node. This block information is generated when the terminal device node registers the corresponding application blockchain.

[0029] The edge node is configured to, upon receiving a first current identity authentication request initiated by a first terminal device node in an external application blockchain, obtain first identity authentication information determined by the consortium blockchain based on the first current identity authentication request, and first data integrity verification information stored in the consortium blockchain for the first terminal device node, through the blockchain light node corresponding to the local application blockchain, and perform identity authentication of the first terminal device node based on the first identity authentication information and the first data integrity verification information.

[0030] In some embodiments, the storage medium stores program instructions that, when executed, perform the above-described method for identity authentication in a distributed data system.

[0031] The method, apparatus, and system for identity authentication in a distributed data system provided in this disclosure can achieve the following technical effects:

[0032] The distributed data system includes a consortium blockchain and multiple application blockchains. Each application blockchain includes terminal device nodes, edge nodes, and a blockchain light node. The consortium blockchain includes the blockchain light node in each application blockchain. Terminal devices in the Internet of Things (IoT) can be terminal device nodes in the distributed data system. When a first current identity authentication request is received from a first terminal device node in an external application blockchain, the edge node in the local application blockchain can obtain the first identity authentication information determined by the consortium blockchain based on the first current identity authentication request, and the first data integrity verification information of the first block information of the first terminal device node stored in the consortium blockchain, through the corresponding blockchain light node. Based on the first identity authentication information and the first data integrity verification information, the edge node performs identity authentication for the first terminal device node. By introducing edge nodes, the authentication service is closer to the IoT terminal, and the authentication information of the terminal device does not need to be fully uploaded to the core network, reducing latency and storage pressure. Furthermore, by sharing authentication requests between the application blockchain and the consortium blockchain, dependence on third-party trusted institutions is avoided, further improving the security of the IoT.

[0033] The above general description and the description below are exemplary and illustrative only and are not intended to limit this application. Attached Figure Description

[0034] One or more embodiments are illustrated by way of example with reference to the accompanying drawings. These illustrations and drawings do not constitute a limitation on the embodiments. Elements having the same reference numerals in the drawings are shown as similar elements. The drawings are not to be scaled. And wherein:

[0035] Figure 1 This is a schematic diagram of the architecture of a distributed data system provided in an embodiment of this disclosure;

[0036] Figure 2 This is a schematic diagram of a process for registering devices in a distributed data system, provided by an embodiment of this disclosure;

[0037] Figure 3 This is a flowchart illustrating an identity authentication method for a distributed data system provided in an embodiment of this disclosure;

[0038] Figure 4This is a schematic diagram of signaling interaction for identity authentication in a distributed data system provided in an embodiment of this disclosure;

[0039] Figure 5 This is a schematic diagram of signaling interaction for identity authentication in a distributed data system provided in an embodiment of this disclosure;

[0040] Figure 6 This is a schematic diagram of the structure of an identity authentication device for a distributed data system provided in an embodiment of this disclosure;

[0041] Figure 7 This is a schematic diagram of the structure of an identity authentication device for a distributed data system provided in an embodiment of this disclosure;

[0042] Figure 8 This is a schematic diagram of a device provided in an embodiment of this disclosure. Detailed Implementation

[0043] To provide a more detailed understanding of the features and technical content of the embodiments of this disclosure, the implementation of the embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for illustrative purposes only and are not intended to limit the embodiments of this disclosure. In the following technical description, for ease of explanation, several details are used to provide a full understanding of the disclosed embodiments. However, one or more embodiments may still be implemented without these details. In other cases, well-known structures and devices may be simplified in their depiction to simplify the drawings.

[0044] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this disclosure described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion.

[0045] Unless otherwise stated, the term "multiple" means two or more.

[0046] In this embodiment of the disclosure, the character " / " indicates that the objects before and after it are in an "or" relationship. For example, A / B means: A or B.

[0047] The term "and / or" describes an association between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or A and B.

[0048] The distributed data system comprises a consortium blockchain and multiple application blockchains. Each application blockchain includes terminal device nodes, edge nodes, and a blockchain light node. The consortium blockchain includes the blockchain light node (Simplified Payment Verification node, SPV) within each application blockchain, which connects the application domain blockchain and the consortium blockchain, serving as a communication hub between the two chains. Of course, the terminal device nodes in this distributed data system can be corresponding terminal devices in the Internet of Things (IoT). In this embodiment of the disclosure, when a first current identity authentication request is received from a first terminal device node in an external application blockchain, the edge node in the local application blockchain can obtain the first identity authentication information determined by the consortium blockchain based on the first current identity authentication request, and the first data integrity verification information stored in the consortium blockchain for the first terminal device node, through the corresponding blockchain light node. Based on the first identity authentication information and the first data integrity verification information, the edge node performs identity authentication for the first terminal device node. In this way, by introducing edge nodes, the authentication service is closer to the IoT terminal, and the authentication information of the terminal device does not need to be fully uploaded to the core network, which can reduce latency and storage pressure. At the same time, by sharing authentication requests between the application blockchain and the consortium blockchain, the dependence on authorization from a third-party trusted institution is avoided, further improving the security of the Internet of Things.

[0049] Figure 1 This is a schematic diagram of the architecture of a distributed data system provided in an embodiment of this disclosure, such as... Figure 1 As shown, the distributed data system includes a consortium blockchain and multiple application blockchains. Each application blockchain includes a terminal device node, an edge node, and a blockchain light node. The consortium blockchain includes the blockchain light node in each application blockchain.

[0050] In applied blockchain, terminal devices can be terminal device nodes, which are devices in the Internet of Things (IoT), such as refrigerators, air conditioners, washing machines, etc. Terminal device nodes can sense the physical environment to obtain data and can communicate and obtain data within the IoT. Therefore, each applied blockchain can have one, two, or more terminal device nodes.

[0051] Edge nodes can include server devices deployed close to users and can communicate with each end-device node. Similarly, each application blockchain can have one, two, or more edge nodes.

[0052] Each application blockchain can have a corresponding Light Provider Virtualization (SPV), which manages the blockchain nodes within the corresponding application domain blockchain. For example... Figure 1As shown, the SPV is located in the corresponding application blockchain and also in the consortium blockchain. Therefore, the SPV connects the application domain blockchain and the consortium blockchain and is the communication hub between the two chains.

[0053] In distributed data systems, the consortium blockchain serves as the main chain of the entire system. The consortium blockchain and multiple application domain blockchains form a master-slave chain relationship through SPVs. The nodes in the system cooperate with each other to complete intra-domain identity authentication and cross-domain identity authentication.

[0054] In an application domain, terminal device nodes need to register their identities through a blockchain light node before joining the Internet of Things (IoT), thus becoming a device within the IoT. Therefore, in some embodiments, when it is determined that the current terminal device node that initiated the registration request belongs to the same application blockchain, the blockchain light node triggers a smart contract to generate a unique identifier for the current terminal device node. Based on the unique identifier and signature, the blockchain light node generates block information for the current terminal device node and stores it on the blockchain, and also sends the block information to the consortium blockchain for storage. Finally, the blockchain light node returns registration information, including the block information, to the current terminal device node. In this way, not only is the block information of the registered terminal device nodes stored in the application blockchain, but the block information of the registered terminal device nodes is also stored in the consortium blockchain. Of course, successfully registered terminal device nodes also receive registration information including the block information.

[0055] Figure 2 This is a schematic diagram of a process for registering devices in a distributed data system, provided by an embodiment of this disclosure. Figure 2 As shown, the device registration process includes:

[0056] Step 201: The blockchain light node SPV receives the registration request initiated by the current terminal device node.

[0057] Currently, terminal devices can send registration requests to the blockchain light node SPV within the same blockchain. The registration request carries information including terminal device information, a timestamp, the blockchain light node's identifier, a signature encrypted using the terminal device's private key, and the signature's validity period. For example: combining... Figure 1 Terminal device node T1 in application blockchain 1 sends a registration request to SPV1 in application blockchain 1, and SPV1 receives the registration request initiated by terminal device node T1. Alternatively, terminal device node T2 in application blockchain 2 sends a registration request to SPV2 in application blockchain 2, and SPV2 receives the registration request initiated by terminal device node T2.

[0058] Step 202: Determine whether the current terminal device node is included in the registered terminal device nodes. If yes, the process ends; otherwise, proceed to step 203.

[0059] Step 203: Determine if it is in the same application blockchain as the current terminal device node? If yes, proceed to step 204; otherwise, the process ends.

[0060] Step 204: The blockchain light node SPV triggers a smart contract to generate a unique identity identifier for the current terminal device node.

[0061] Step 205: The blockchain light node SPV generates the block information of the current terminal device node based on the unique identity and signature, stores it on the chain, and sends the block information to the consortium blockchain for storage.

[0062] For example, SPV1 can generate the block information of the current terminal device node based on T1's unique identity and signature and upload it to the application blockchain 1. At the same time, it can also store the block information in the consortium blockchain. That is, both the application blockchain 1 and the consortium blockchain store T1's block information.

[0063] Step 206: The blockchain light node SPV returns the registration information, which includes block information, to the current terminal device node.

[0064] Thus, the current terminal device node can obtain registration information including block information, thereby completing the registration process of the current terminal device node.

[0065] Through the registration process described above, each terminal device joining the Internet of Things (IoT) becomes a terminal device node within the corresponding application blockchain. The block information corresponding to each terminal device node is stored not only on the application blockchain but also on the consortium blockchain. This block information may include: the terminal device node's unique identifier, signature, and identification information for blockchain light nodes, among other things.

[0066] Of course, edge nodes can also register with an SPV within the same application blockchain, ensuring that their block information is stored on both the application blockchain and the consortium blockchain. The registration process for edge nodes is the same as that for terminal device nodes, so it will not be repeated here.

[0067] After a terminal device in the Internet of Things (IoT) is successfully registered, it becomes a corresponding terminal device node in the distributed data system. Furthermore, the consortium blockchain of this distributed data system stores the block information corresponding to each terminal device node. Thus, each edge node in the application blockchain can perform identity authentication of terminal device nodes within its domain, as well as identity authentication of terminal device nodes across domains.

[0068] Figure 3 This is a flowchart illustrating an identity authentication method for a distributed data system provided in this disclosure embodiment, combined with... Figure 1 , Figure 3 The identity authentication process includes:

[0069] Step 301: In the case of receiving the first current identity authentication request initiated by the first terminal device node in the external application blockchain, the first identity authentication information determined by the consortium blockchain according to the first current identity authentication request is obtained through the blockchain light node corresponding to the local application blockchain, and the first data integrity verification information of the first block information of the first terminal device node stored in the consortium blockchain is obtained. The block information is generated when the first terminal device node registers the external application blockchain.

[0070] Figure 1 In the distributed data system shown, any application blockchain can be considered a local application blockchain. Therefore, other application blockchains can be considered external application blockchains relative to that local application blockchain. For terminal device nodes in different application blockchains to communicate with each other, cross-domain authentication is required. For example, when terminal device node T2 in application blockchain 2 needs to access the network or data in application blockchain 3, the edge node E3 in application blockchain 3 needs to authenticate terminal device node T2. Similarly, when terminal device node T1 in application blockchain 1 needs to access the network or data in application blockchain 2, the edge node E2 in application blockchain 2 needs to authenticate terminal device node T1.

[0071] At this point, the application blockchain where the edge node performing identity authentication resides is the local application blockchain, while the application blockchain where the terminal device node initiating the access resides is the external application blockchain. That is, the first terminal device node in the external application blockchain sends a first current identity authentication request to the edge node in the local application blockchain; that is, the edge node receives the first current identity authentication request initiated by the first terminal device node in the external application blockchain. For example, E3 receives an identity authentication request from T2, or E2 receives an identity authentication request from T1. The information carried in the identity authentication request may include: terminal device information, the blockchain number to which the terminal device belongs, the identification information of the blockchain light node, and a signature encrypted using the terminal device's private key.

[0072] After receiving the first current identity authentication request, the edge node in the local application blockchain can obtain the first identity authentication information determined by the consortium blockchain based on the first current identity authentication request, and the first data integrity verification information stored by the consortium blockchain for the first terminal device node, through the blockchain light node corresponding to the local application blockchain. In some embodiments, obtaining the first identity authentication information determined by the consortium blockchain based on the first current identity authentication request may include: sending the first current identity authentication request to the consortium blockchain through the blockchain light node corresponding to the local application blockchain, wherein the first current identity authentication request includes: the unique identity identifier of the first terminal device node and the identification information of the blockchain light node corresponding to the external application blockchain; receiving the first identity authentication information sent by the consortium blockchain, wherein the first identity authentication information is obtained by the consortium blockchain based on the first identity authentication information and the first block information when it finds the first block information matching the first current identity authentication request in the stored block information.

[0073] Edge nodes in the local application block send the first identity authentication information to the corresponding blockchain light node SPV. In this way, the blockchain light node SPV can send the first identity authentication information to the consortium blockchain. For example, E3 can send the first identity authentication information to the consortium blockchain through SPV3, or E2 can send the first identity authentication information to the consortium blockchain through SPV2.

[0074] In this way, the consortium blockchain can search its stored block information based on the unique identifier of the first terminal device node carried in the first identity authentication information and the identifier information of the blockchain light node corresponding to the external application blockchain. If a first block matching the first current identity authentication request is found in the stored block information, it can be determined that the first terminal device node had already registered its identity in the corresponding external blockchain before sending the first identity authentication request to the local application blockchain. Thus, the consortium blockchain can obtain the identity authentication information of the current terminal device node based on its identity authentication request. Of course, the identity authentication information includes: the unique identifier of the terminal device node, the number of the external application blockchain, the identifier information of the blockchain light node corresponding to the external application blockchain, etc.

[0075] As described above, if the consortium blockchain finds the block information corresponding to T2's registration in its stored block information, it can determine that T2 had already registered its identity in application blockchain 2 before sending the identity authentication request to application blockchain 3. In this case, the consortium blockchain can obtain T2's identity authentication information based on T2's identity authentication request. Alternatively, if the consortium blockchain finds the block information corresponding to T1's registration in its stored block information, it can determine that T1 had already registered its identity in application blockchain 1 before sending the identity authentication request to application blockchain 2. In this case, the consortium blockchain can obtain T1's identity authentication information based on T1's identity authentication request.

[0076] After the consortium blockchain obtains the first identity authentication information, the local application blockchain can retrieve the first identity authentication information from the consortium blockchain through the corresponding SPV. In this embodiment, while determining the first identity authentication information based on the first current identity authentication request, the consortium blockchain can also obtain the first data integrity verification information that stores the first block information of the first terminal device node based on the first identity authentication information. Thus, the local application blockchain can also obtain the first data integrity verification information from the consortium blockchain through the corresponding SPV. As in the example above, the consortium blockchain obtains the first data integrity verification information of the blockchain storing T2 block information based on the first identity authentication information.

[0077] Step 302: Perform identity authentication for the first terminal device node based on the first identity authentication information and the first data integrity verification information.

[0078] In a local application blockchain, edge nodes obtain first identity authentication information and first data integrity verification information from the consortium blockchain through their corresponding SPVs. They then perform corresponding calculations and verify identity based on the calculation results. In some embodiments, the first data integrity verification information may be the hash values ​​of each path in the Merkle tree of the blockchain storing the first block information. Therefore, authenticating the first terminal device node includes: determining the first hash value of the first identity authentication information; determining the Merkle root hash value corresponding to the hash value of each path in the first data integrity verification information based on the Merkle tree path; and determining the validity of the signature carried in the first identity authentication information if the first hash value matches the Merkle root hash value.

[0079] In the example above, E3 can calculate the hash value of the first identity authentication information corresponding to T2, and calculate the Merkle root hash value corresponding to the hash value of each path according to the Merkle tree path. The two calculation results are matched to verify the validity of the signature carried in the first identity authentication information. If they match, E3 can confirm that T2's identity is valid, i.e., identity authentication is successful. Alternatively, E2 can calculate the hash value of the first identity authentication information corresponding to T1, and calculate the Merkle root hash value corresponding to the hash value of each path according to the Merkle tree path. The two calculation results are matched to verify the validity of the signature carried in the first identity authentication information. If they match, E2 can confirm that T1's identity is valid, i.e., identity authentication is successful.

[0080] As can be seen, in this embodiment, when a first current identity authentication request is received from a first terminal device node in an external application blockchain, the edge node in the local application blockchain can obtain the first identity authentication information determined by the consortium blockchain based on the first current identity authentication request, and the first data integrity verification information stored in the consortium blockchain for the first terminal device node, through the corresponding blockchain light node. Based on the first identity authentication information and the first data integrity verification information, the edge node performs identity authentication for the first terminal device node. Thus, by introducing edge nodes, the authentication service is closer to the IoT terminal, and the authentication information of the terminal device does not need to be fully uploaded to the core network, reducing latency and storage pressure. Cross-domain authentication is also achieved, improving the security of the IoT. Furthermore, by sharing authentication requests between the application blockchain and the consortium blockchain, reliance on authorization from trusted third-party institutions is avoided, further enhancing the security of the IoT.

[0081] To further enhance the security of the Internet of Things (IoT), after edge nodes authenticate terminal device nodes, terminal device nodes can also authenticate edge nodes, i.e., two-way authentication. Therefore, in some embodiments, the authentication process further includes: receiving the authentication result sent by the consortium blockchain based on a two-way anchoring protocol, wherein the authentication result is obtained after the edge node in the external application blockchain authenticates the local terminal device node in the local application blockchain; signing the authentication result and sending the signed result to the local terminal device node, enabling the local terminal device node to perform authentication based on the authentication information and data integrity verification information in the authentication result.

[0082] In this embodiment of the disclosure, any edge node can perform cross-domain identity authentication on terminal device nodes, and can also perform identity authentication on the external domain blockchain after the terminal device node in the same application blockchain has been authenticated by the edge node of the external domain blockchain.

[0083] For example, after E3 verifies the validity of the signature carried in T2's first identity authentication information, the consortium blockchain can send the identity authentication result to the edge node E2 of application blockchain 2. The identity authentication result includes: the first identity authentication information corresponding to T2 and the first data integrity verification information. The first data integrity verification information can be the hash values ​​of each path in the Merkle tree of the blockchain storing the first block information. Therefore, E2 uses its private key to sign and forwards the signature and identity authentication result to T2. Upon receiving the signature and identity authentication result, T2 also calculates the hash value of the first identity authentication information and, based on the Merkle tree path, calculates the Merkle root hash value corresponding to the hash value of each path. The two calculation results are matched. If they match, T2 can determine that the identity is valid, i.e., two-way identity authentication is successful.

[0084] It is evident that in distributed data systems, edge node authentication services are closer to IoT terminals. Terminal authentication information does not need to be fully uploaded to the core network, which can reduce latency and storage pressure, further improving the effectiveness of identity authentication. At the same time, two-way authentication can be performed between edge nodes and terminal device nodes, further improving the reliability of cross-domain authentication in IoT, thereby further enhancing the security of IoT.

[0085] Of course, each edge node in the application blockchain can also perform identity authentication of terminal device nodes within the domain. That is, in some embodiments, identity authentication may also include: in the case of receiving a second current identity authentication request initiated by a second terminal device node in the local application blockchain, determining the second identity authentication information corresponding to the second current identity authentication request, and obtaining the second data integrity verification information of the second block information of the second terminal device node in the local application blockchain; performing identity authentication of the second terminal device node based on the second identity authentication information and the second data integrity verification information, and sending the corresponding identity authentication result to the second terminal.

[0086] An edge node in the local application blockchain receives a second current identity authentication request initiated by a second terminal device node in the same application blockchain. This authentication request may include: terminal device information, the blockchain number to which the terminal device belongs, the identification information of the blockchain light node, a signature encrypted using the terminal device's private key, etc. Then, based on the second current identity authentication request, the edge node can confirm the second identity information corresponding to the second current identity authentication request from the second block information stored in the local application blockchain, and obtain the second data integrity verification information of the second block information of the second terminal device node in the local application blockchain. The data integrity verification information may also be the hash values ​​of each path in the blockchain storing the block information. Thus, the edge node can determine the second hash value of the second identity authentication information and, based on the Merkle tree path, determine the Merkle root hash value corresponding to the hash values ​​of each path in the second data integrity verification information; if the second hash value matches the Merkle root hash value, the signature carried in the second identity authentication information is deemed valid. The valid authentication information can then be fed back to the second terminal device node, completing the intra-domain identity authentication. Of course, if the second hash value does not match the Merkle root hash value, the edge node will also send an authentication failure message back to the second terminal device.

[0087] As can be seen, by using edge nodes for intra-domain identity authentication, the authentication service is closer to the IoT terminal. The terminal's authentication information does not need to be uploaded to the core network, which can reduce latency and storage pressure and further improve authentication efficiency.

[0088] The following describes the operation process in a specific embodiment, illustrating the identity authentication process for a distributed data system provided by the embodiments of the present invention.

[0089] In some embodiments of this disclosure, such as Figure 1 As shown, the distributed data system includes a consortium blockchain and multiple application blockchains. Application blockchain 1 includes a terminal device node T1, an edge node E1, and a light block node SPV1; application blockchain 2 includes a terminal device node T2, an edge node E2, and a light block node SPV2; application blockchain 3 includes a terminal device node T3, an edge node E3, and a light block node SPV3; ... and SPV1, SPV2, SPV3... form the consortium blockchain. Furthermore, T1 has registered with SPV1, T2 has registered with SPV2, T3 has registered with SPV3... meaning that each device in the Internet of Things (terminal device T1, terminal device T2, terminal device T3...) has registered in the distributed data system, thus the consortium blockchain stores the block information of each terminal device node.

[0090] One embodiment of this disclosure, Figure 4This is a schematic diagram of signaling interaction for an identity authentication method in a distributed data system, provided by an embodiment of this disclosure. In this embodiment, T1 wants to access data within application blockchain 1, combined with... Figure 1 , Figure 4 The authentication process in a distributed data system includes:

[0091] Step 401: Terminal device node T1 in application blockchain 1 sends a second current identity authentication request for intra-domain access to edge node E1 within application blockchain 1.

[0092] The second current identity authentication request carries information including terminal device T1 information, the blockchain 1 number to which terminal device T1 belongs, the identification information of blockchain light node SPV1, and the signature encrypted using the private key of terminal device T1, etc.

[0093] Step 402: Edge node E1 determines the second identity authentication information corresponding to the second current identity authentication request based on the second current identity authentication request.

[0094] Step 403: Edge node E1 obtains the hash values ​​of each path in the Merkle tree of the blockchain that stores the second block information of terminal device node T1 from the application blockchain 1, based on the unique identity identifier of terminal device node T1 in the second identity authentication information.

[0095] Step 404: Edge node E1 calculates the second hash value of the second identity authentication information, and calculates the Merkle root hash value corresponding to the hash value of each path according to the Merkle tree path.

[0096] Step 405: Determine if the second hash value matches the Merkle root hash value. If yes, proceed to step 406; otherwise, proceed to step 407.

[0097] Step 406: Edge node E1 sends the successful authentication information of valid authentication within the domain back to terminal device node T1.

[0098] Step 407: Edge node E1 sends the authentication failure information of the domain authentication failure to terminal device node T1.

[0099] As can be seen, in this embodiment, edge nodes can authenticate the grounding electrode of terminal devices in the same application blockchain. In this way, the authentication service is closer to the IoT terminal, and the authentication information of the terminal does not need to be uploaded to the core network. This can reduce latency and storage pressure, further improve authentication efficiency, and also improve the security of the IoT.

[0100] One embodiment of this disclosure, Figure 5This is a schematic diagram of signaling interaction for an identity authentication method in a distributed data system, provided by an embodiment of this disclosure. In this embodiment, terminal device node T2 in application blockchain 2 wants to access data within application blockchain 3, combined with... Figure 1 , Figure 5 The authentication process in a distributed data system includes:

[0101] Step 501: Terminal device node T2 in application blockchain 2 sends the first current identity authentication request for intra-domain access to edge node E3 in application blockchain 3.

[0102] The information carried in the first current identity authentication request includes terminal device T2 information, the blockchain 2 number to which terminal device T2 belongs, the identification information of blockchain light node SPV2, and the signature encrypted using the private key of terminal device T2, etc.

[0103] Step 502: Edge node E3 sends the first current identity authentication request to the blockchain light node SPV3 within application blockchain 3.

[0104] Step 503: The blockchain light node SPV3 sends the first current identity authentication request to the consortium blockchain.

[0105] Step 504: Based on the unique identity identifier of T2 carried in the first current identity authentication request and the identification information of the blockchain light node SPV2, the consortium blockchain determines whether the first block information of T2 can be found in the saved block information. If yes, proceed to step 505; otherwise, the process ends.

[0106] Step 505: The consortium blockchain determines the first identity authentication information corresponding to the first current identity authentication request, and obtains the hash values ​​of each path in the Merkle tree of the blockchain that stores the first block information.

[0107] Step 506: Edge node E3 obtains the first identity authentication information and the hash values ​​of each path in the Merkle tree from the consortium blockchain.

[0108] Step 507: Edge node E3 calculates the first hash value of the first identity authentication information, and calculates the Merkle root hash value corresponding to the hash value of each path according to the Merkle tree path.

[0109] Step 508: Determine if the first hash value matches the Merkle root hash value. If yes, proceed to step 509; otherwise, the process ends.

[0110] Step 509: The consortium blockchain feeds back the identity authentication result obtained by edge node E3 to edge node E2 of application blockchain 2.

[0111] Step 510: After signing the authentication result, edge node E2 sends the signature result to terminal device node T2.

[0112] Step 511: Terminal device node T2 calculates the corresponding third hash value based on the identity authentication information in the identity authentication result, and calculates the Merkle root hash value corresponding to the hash value of each path carried in the identity authentication result.

[0113] Step 512: Determine if the third hash value matches the Merkle root hash value. If yes, proceed to step 513; otherwise, the process ends.

[0114] Step 513: Terminal device node T2 confirms successful identity authentication.

[0115] As can be seen, in this embodiment, edge nodes can perform identity authentication on terminal device nodes across domains. In this way, by applying blockchain and sharing authentication requests with consortium blockchains, the reliance on authorization from trusted third-party institutions is avoided, further improving the security of the Internet of Things.

[0116] Based on the above process for identity authentication in distributed data systems, a device for identity authentication in distributed data systems can be constructed.

[0117] Figure 6 This is a schematic diagram of the structure of an identity authentication device for a distributed data system provided in an embodiment of this disclosure. Figure 6 As shown, the identity authentication device 600 for a distributed data system includes: a first acquisition and parsing module 610 and a first identity authentication module 620.

[0118] The first acquisition and parsing module 610 is configured to, in the event of a first current identity authentication request initiated by the first terminal device node in the received external application blockchain, obtain the first identity authentication information determined by the consortium blockchain based on the first current identity authentication request, and obtain the first data integrity verification information of the first block information of the first terminal device node stored in the consortium blockchain through the blockchain light node corresponding to the local application blockchain. The block information is generated when the first terminal device node registers the external application blockchain.

[0119] The first identity authentication module 620 is configured to perform identity authentication of the first terminal device node based on the first identity authentication information and the first data integrity verification information.

[0120] In some embodiments, the first acquisition and parsing module 610 includes:

[0121] The sending unit is configured to send a first current identity authentication request to the consortium blockchain through the blockchain light node corresponding to the local application blockchain. The first current identity authentication request includes: the unique identity identifier of the first terminal device node and the identification information of the blockchain light node corresponding to the external application blockchain.

[0122] The receiving unit is configured to receive the first identity authentication information sent by the consortium blockchain. The first identity authentication information is obtained by the consortium blockchain based on the first identity authentication information and the first block information when it finds the first block information that matches the first current identity authentication request in the stored block information.

[0123] In some embodiments, the first identity authentication module 620 includes:

[0124] The first determining unit is configured to determine the first hash value of the first identity authentication information, and to determine the Merkle root hash value corresponding to the hash value of each path in the first data integrity verification information according to the Merkle tree path.

[0125] The second determining unit is configured to determine the validity of the signature carried in the first identity authentication information if the first hash value matches the Merkle root hash value.

[0126] In some embodiments, it also includes:

[0127] The authentication receiving module is configured to receive the identity authentication result sent by the consortium blockchain based on a two-way anchoring protocol. The identity authentication result is obtained by the edge node in the external application blockchain authenticating the identity of the local terminal device node in the local application blockchain.

[0128] The signature sending module is configured to sign the identity authentication result and send the signature result to the local terminal device node, so that the local terminal device node can perform identity authentication based on the identity authentication information and data integrity verification information in the identity authentication result.

[0129] In some embodiments, it also includes:

[0130] The second acquisition and parsing module is configured to, in the case of a second current identity authentication request initiated by a second terminal device node in the local application blockchain, determine the second identity authentication information corresponding to the second current identity authentication request, and acquire the second data integrity verification information of the second block information of the second terminal device node in the local application blockchain;

[0131] The second identity authentication module is configured to authenticate the second terminal device node based on the second identity authentication information and the second data integrity verification information, and send the corresponding identity authentication result to the second terminal.

[0132] As can be seen, in this embodiment, the distributed data system includes a consortium blockchain and multiple application blockchains. Each application blockchain includes a terminal device node, an edge node, and a blockchain light node. The consortium blockchain includes the blockchain light node in each application blockchain. When a first current identity authentication request is received from a first terminal device node in an external application blockchain, the identity authentication device of the distributed data system can obtain the first identity authentication information determined by the consortium blockchain based on the first current identity authentication request, and the first data integrity verification information stored by the consortium blockchain on the first block information of the first terminal device node through the corresponding blockchain light node. Based on the first identity authentication information and the first data integrity verification information, the first terminal device node is authenticated. In this way, by introducing edge nodes, the authentication service is closer to the IoT terminal. The authentication information of the terminal device does not need to be fully uploaded to the core network, which can reduce latency and storage pressure, and realize cross-domain authentication, thereby improving the security of the IoT. At the same time, by sharing authentication requests between the application blockchain and the consortium blockchain, the dependence on authorization from a third-party trusted institution is avoided, further improving the security of the IoT.

[0133] In some embodiments, such as Figure 1 As shown, the distributed data system includes a consortium blockchain and multiple application blockchains. Each application blockchain includes a terminal device node, an edge node, and a blockchain light node. The consortium blockchain includes the blockchain light node in each application blockchain.

[0134] A consortium blockchain is configured to store block information for each terminal device node. This block information is generated when the terminal device node registers the corresponding application blockchain.

[0135] The edge node is configured to, upon receiving a first current identity authentication request initiated by a first terminal device node in an external application blockchain, obtain first identity authentication information determined by the consortium blockchain based on the first current identity authentication request, and first data integrity verification information stored in the consortium blockchain for the first terminal device node, through the blockchain light node corresponding to the local application blockchain, and perform identity authentication of the first terminal device node based on the first identity authentication information and the first data integrity verification information.

[0136] In some embodiments, a terminal device node is configured to initiate a registration request to a blockchain light node belonging to the same application blockchain, and receive registration information including block information returned by the blockchain light node.

[0137] A blockchain light node is configured to trigger a smart contract to generate a unique identifier for the terminal device node when it is determined that the terminal device node belongs to the same application blockchain as the terminal device node. Based on the unique identifier and signature, the node generates block information for the terminal device node and stores it on the blockchain, and sends the block information to the consortium blockchain for storage.

[0138] In some embodiments, the edge node is specifically configured to send a first current identity authentication request to the consortium blockchain through the blockchain light node corresponding to the local application blockchain, and receive the first identity authentication information sent by the consortium blockchain. The first current identity authentication request includes: the unique identity identifier of the first terminal device node and the identification information of the blockchain light node corresponding to the external application blockchain.

[0139] The consortium blockchain is specifically configured to, in the case of finding a first block information in the stored block information that matches the first current identity authentication request, obtain the first identity authentication information based on the first identity authentication information and the first block information, and send it to the edge node.

[0140] In some embodiments, the edge node is specifically configured to determine a first hash value of the first identity authentication information, and to determine the Merkle root hash value corresponding to the hash value of each path in the first data integrity verification information according to the Merkle tree path; if the first hash value matches the Merkle root hash value, it is determined that the signature carried in the first identity authentication information is valid.

[0141] In some embodiments, the edge node is further configured to receive the authentication result sent by the consortium blockchain based on a two-way anchoring protocol, wherein the authentication result is obtained by the edge node in the external application blockchain authenticating the local terminal device node in the local application blockchain; and after signing the authentication result, the signed result is sent to the local terminal device node.

[0142] The terminal device node is also configured to perform identity authentication based on the identity authentication information and data integrity verification information in the identity authentication result.

[0143] In some embodiments, the edge node is further configured to, upon receiving a second current identity authentication request initiated by a second terminal device node in the local application blockchain, determine second identity authentication information corresponding to the second current identity authentication request, and obtain second data integrity verification information of the second block information of the second terminal device node in the local application blockchain; and, based on the second identity authentication information and the second data integrity verification information, perform identity authentication of the second terminal device node, and send the corresponding identity authentication result to the second terminal.

[0144] It is evident that using blockchain and consortium blockchain to share authentication requests in distributed data systems avoids reliance on authorization from trusted third-party institutions and improves the security of the Internet of Things by authenticating the identities of nodes between terminal devices in the same or different domains through edge nodes.

[0145] Combination Figure 7 This disclosure provides an apparatus 700 for identity authentication in a distributed data system, comprising:

[0146] The processor 1000 and memory 1001 may further include a communication interface 1002 and a bus 1003. The processor 1000, communication interface 1002, and memory 1001 can communicate with each other via the bus 1003. The communication interface 1002 can be used for information transmission. The processor 1000 can invoke logical instructions stored in the memory 1001 to execute the method for authentication in a distributed data system as described in the above embodiments.

[0147] Furthermore, the logic instructions in the aforementioned memory 1001 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.

[0148] The memory 1001, as a computer-readable storage medium, can be used to store software programs and computer-executable programs, such as program instructions / modules corresponding to the methods in the embodiments of this disclosure. The processor 1000 executes functional applications and data processing by running the program instructions / modules stored in the memory 1001, that is, it implements the method for identity authentication in a distributed data system as described in the above method embodiments.

[0149] The memory 1001 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the terminal device. Furthermore, the memory 1001 may include high-speed random access memory and may also include non-volatile memory.

[0150] This disclosure provides an identity authentication device for a distributed data system, comprising: a processor and a memory storing program instructions, wherein the processor is configured to execute a method for identity authentication in a distributed data system when executing the program instructions.

[0151] This disclosure provides a system for identity authentication in a distributed data system, comprising: a consortium blockchain and multiple application blockchains, wherein each application blockchain includes: terminal device nodes, edge nodes, and a blockchain light node; the consortium blockchain includes: the blockchain light node in each application blockchain; and the edge node includes: a device body, such as: a server device, including device body 800, such as... Figure 8 As shown, the aforementioned device 600 (700) for identity authentication in a distributed data system is installed within the device body 800. The installation relationship described herein is not limited to placement within the product, but also includes installation connections with other components of the product, including but not limited to physical connections, electrical connections, or signal transmission connections. Those skilled in the art will understand that the device 600 (700) for identity authentication in a distributed data system can be adapted to suitable corresponding device bodies to achieve other feasible embodiments.

[0152] This disclosure provides a storage medium storing program instructions that, when executed, perform the method for identity authentication in a distributed data system as described above.

[0153] This disclosure provides a computer program product, which includes a computer program stored on a storage medium. The computer program includes program instructions, which, when executed by a computer, cause the computer to perform the above-described method for identity authentication in a distributed data system.

[0154] The aforementioned storage medium can be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

[0155] The technical solutions of this disclosure can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes one or more instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in this disclosure. The aforementioned storage medium can be a non-transitory storage medium, including: a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and other media capable of storing program code; it can also be a transient storage medium.

[0156] The foregoing description and accompanying drawings fully illustrate embodiments of the present disclosure to enable those skilled in the art to practice them. Other embodiments may include structural, logical, electrical, procedural, and other changes. The embodiments represent only possible variations. Individual components and functions are optional unless explicitly required, and the order of operation may vary. Parts and features of some embodiments may be included or replace parts and features of other embodiments. The scope of the embodiments of this disclosure includes the entire scope of the claims and all available equivalents of the claims. While the terms “first,” “second,” etc., may be used in this application to describe elements, these elements should not be limited by these terms. These terms are used only to distinguish one element from another. For example, a first element may be called a second element without changing the meaning of the description, and similarly, a second element may be called a first element, provided that all occurrences of “first element” are consistently renamed and all occurrences of “second element” are consistently renamed. First and second elements are both elements, but may not be the same element. Moreover, the terminology used in this application is only for describing embodiments and is not intended to limit the claims. As used in the description of the embodiments and claims, unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “the” are intended to also include the plural forms. Similarly, the term “and / or” as used herein means including one or more of the associated listed elements and all possible combinations thereof. Additionally, when used herein, the terms “comprise” and its variations “comprises” and / or “comprising” refer to the presence of stated features, integrals, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof. Without further limitations, an element defined by the phrase “comprising an…” does not exclude the presence of additional identical elements in the process, method, or apparatus that includes said element. In this document, each embodiment may focus on the differences from other embodiments, and similar or identical parts between embodiments can be referred to mutually. For methods, products, etc., disclosed in the embodiments, if they correspond to the method section disclosed in the embodiments, the relevant parts can be referred to the description of the method section.

[0157] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this disclosure. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0158] The methods and products (including but not limited to devices and equipment) disclosed in the embodiments herein can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units may be merely a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the shown or discussed units may be through some interfaces, and the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to implement this embodiment according to actual needs. Furthermore, the functional units in the embodiments of this disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0159] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than that shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. In the descriptions corresponding to the flowcharts and block diagrams in the accompanying drawings, the operations or steps corresponding to different blocks may also occur in a different order than disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. Each block in a block diagram and / or flowchart, and combinations of blocks in a block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

Claims

1. A method for identity authentication in a distributed data system, characterized in that, The distributed data system includes a consortium blockchain and multiple application blockchains. Each application blockchain includes terminal device nodes, edge nodes, and a blockchain light node. The consortium blockchain includes the blockchain light node in each application blockchain. The method includes: In the case of receiving a first current identity authentication request initiated by the first terminal device node in the external application blockchain, the first identity authentication information determined by the consortium blockchain based on the first current identity authentication request is obtained through the blockchain light node corresponding to the local application blockchain, and the first data integrity verification information is obtained by the consortium blockchain storing the first block information of the first terminal device node, wherein the block information is generated when the first terminal device node registers the external application blockchain; The identity authentication of the first terminal device node is performed based on the first identity authentication information and the first data integrity verification information.

2. The method according to claim 1, characterized in that, Also includes: If it is determined that the current terminal device node that initiated the registration request belongs to the same application blockchain, the blockchain light node triggers a smart contract to generate a unique identity identifier for the current terminal device node. Based on a unique identity and signature, a blockchain light node generates and stores the block information of the current terminal device node on the blockchain, and sends the block information to the consortium blockchain for storage. The blockchain light node returns registration information, including block information, to the current terminal device node.

3. The method according to claim 1, characterized in that, The acquisition of the first identity authentication information determined by the consortium blockchain based on the first current identity authentication request includes: The first current identity authentication request is sent to the consortium blockchain through the blockchain light node corresponding to the local application blockchain. The first current identity authentication request includes: the unique identity identifier of the first terminal device node and the identification information of the blockchain light node corresponding to the external application blockchain. The first identity authentication information sent by the consortium blockchain is obtained by the consortium blockchain based on the first identity authentication information and the first block information when it finds the first block information that matches the first current identity authentication request in the stored block information.

4. The method according to claim 1, characterized in that, The authentication of the first terminal device node includes: Determine the first hash value of the first identity authentication information, and determine the Merkle root hash value corresponding to the hash value of each path in the first data integrity verification information according to the Merkle tree path; If the first hash value matches the Merkle root hash value, the signature carried in the first identity authentication information is determined to be valid.

5. The method according to any one of claims 1-4, characterized in that, Also includes: Based on the two-way anchoring protocol, the identity authentication result sent by the consortium blockchain is received. The identity authentication result is obtained by the edge node in the external application blockchain authenticating the identity of the local terminal device node in the local application blockchain. After signing the authentication result, the signature result is sent to the local terminal device node, so that the local terminal device node can perform authentication based on the authentication information and data integrity verification information in the authentication result.

6. The method according to any one of claims 1-4, characterized in that, Also includes: In the case of receiving a second current identity authentication request initiated by a second terminal device node in the local application blockchain, determine the second identity authentication information corresponding to the second current identity authentication request, and obtain the second data integrity verification information of the second block information of the second terminal device node in the local application blockchain; Based on the second identity authentication information and the second data integrity verification information, the identity authentication of the second terminal device node is performed, and the corresponding identity authentication result is sent to the second terminal.

7. An apparatus for identity authentication in a distributed data system, the apparatus comprising a processor and a memory storing program instructions, characterized in that, The processor is configured to, when executing the program instructions, perform the method for authentication in a distributed data system as described in any one of claims 1 to 6.

8. A distributed data system, characterized in that, include: The blockchain comprises a consortium blockchain and multiple application blockchains. Each application blockchain includes: terminal device nodes, edge nodes, and a blockchain light node. The consortium blockchain includes: the blockchain light node in each application blockchain. A consortium blockchain is configured to store block information for each terminal device node. This block information is generated when the terminal device node registers the corresponding application blockchain. The edge node is configured to, upon receiving a first current identity authentication request initiated by a first terminal device node in an external application blockchain, obtain first identity authentication information determined by the consortium blockchain based on the first current identity authentication request, and first data integrity verification information stored in the consortium blockchain for the first terminal device node, through the blockchain light node corresponding to the local application blockchain, and perform identity authentication of the first terminal device node based on the first identity authentication information and the first data integrity verification information.

9. The system according to claim 8, characterized in that, The terminal device node is configured to initiate a registration request to a blockchain light node belonging to the same application blockchain, and receive registration information including block information returned by the blockchain light node. A blockchain light node is configured to trigger a smart contract to generate a unique identifier for the terminal device node when it is determined that the terminal device node belongs to the same application blockchain as the terminal device node. Based on the unique identifier and signature, the node generates block information for the terminal device node and stores it on the blockchain, and sends the block information to the consortium blockchain for storage.

10. A storage medium storing program instructions, characterized in that, When the program instructions are executed, they perform the method for identity authentication in a distributed data system as described in any one of claims 1 to 6.

Images