Software system authentication method and related device

Abstract

The embodiment of the application provides a software system identity authentication method and related equipment, and belongs to the technical field of information security. The method comprises the following steps: in response to first identity information input by a target object, performing hash encryption on the first identity information to obtain identity encryption data; verifying the identity encryption data through a block chain system to obtain a first verification result; in response to second identity information input by the target object, generating zero-knowledge proof of the second identity information through zero-knowledge proof technology; verifying the zero-knowledge proof through the block chain system to obtain a second verification result; and in the case that the first verification result and the second verification result both indicate that the verification is passed, determining that the target object passes the software system identity authentication. The embodiment of the application can improve user account security, reduce the risk of user privacy information leakage in the identity authentication process, and improve the identity authentication efficiency.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a software system identity authentication method and related equipment. Background Technology

[0002] In the field of software system identity authentication, traditional authentication methods rely on simple means such as usernames and passwords, but these methods are vulnerable to attacks and pose significant security risks. With technological advancements, modern software systems have gradually introduced more advanced identity authentication methods, such as two-factor authentication, biometrics, and behavioral analysis. The widespread adoption of the internet has provided a wider range of application scenarios for identity authentication, but it has also brought new security challenges. Especially in cloud computing and big data environments, protecting user privacy and account security has become a pressing issue. Against this backdrop, the continuous development and innovation of identity authentication technology has become crucial in the field of information security. In the network environment, identity authentication must not only address threats such as account theft and data breaches, but also attacks such as identity forgery and phishing.

[0003] Blockchain is a distributed ledger technology that ensures data security, transparency, and immutability through decentralization and encryption. Smart contracts are programs built on the blockchain, enabling the digital transformation of contracts. These programs run automatically according to preset logic, executing the rules of the agreement without third-party intervention. Blockchain technology provides a new approach to building decentralized identity authentication systems. Combining smart contracts with automated authentication rule execution can improve verification efficiency while protecting privacy and effectively preventing fraud. However, current authentication methods typically generate encrypted identity information on the user's end and send it to the blockchain for authentication. This encrypted identity information includes user privacy information such as account passwords and biometrics, a process that can easily lead to the leakage of user privacy information.

[0004] Zero-knowledge proofs are cryptographic protocols that allow a user, acting as a prover, to demonstrate the truth of a statement to a software system acting as a verifier without revealing any additional information. This ensures the reliability and completeness of the proof while protecting privacy. However, generating zero-knowledge proofs is a computationally intensive process, leading to low efficiency in the entire identity authentication process. Summary of the Invention

[0005] The main objective of this application is to propose a software system identity authentication method and related equipment, which aims to improve user account security, reduce the risk of leakage of user privacy information during the identity authentication process, and improve identity authentication efficiency.

[0006] To achieve the above objectives, one aspect of this application proposes a software system authentication method, comprising the following steps: In response to the first identity information input by the target object, the first identity information is hashed and encrypted to obtain encrypted identity data; The encrypted identity data is verified using a blockchain system to obtain a first verification result; In response to the second identity information input by the target object, a zero-knowledge proof is generated for the second identity information using zero-knowledge proof technology; The zero-knowledge proof is verified using a blockchain system to obtain a second verification result; If both the first verification result and the second verification result indicate that the verification is successful, it is determined that the target object has passed the software system's identity authentication.

[0007] In some embodiments, the first identity information is account password information and the second identity information is biometric information; or, the first identity information is biometric information and the second identity information is account password information.

[0008] In some embodiments, the first identity information is account password information, and the second identity information is biometric information; the software system identity authentication method further includes the following steps: In response to the registration request, the account and password information indicated in the registration request is reviewed. If the account password information is approved, the account password information is hashed and encrypted and then stored in the blockchain system, and a biometric input prompt area is displayed to collect biometric information. The biometric information is validated. If the entered biometric information is valid, it is hashed, encrypted, and then stored in the blockchain system.

[0009] In some embodiments, prior to the step of generating a zero-knowledge proof for the second identity information in response to input from the target object using zero-knowledge proof technology, the software system authentication method further includes the following steps: If the first verification result indicates that the verification failed, it is determined that the target object has not passed the software system's identity authentication. If the first verification result indicates that the verification is successful, the step of generating a zero-knowledge proof for the second identity information in response to the input of the target object is executed using zero-knowledge proof technology.

[0010] In some embodiments, the first identity information is account password information, and the second identity information is biometric information; the step of generating a zero-knowledge proof for the second identity information using zero-knowledge proof technology includes the following steps: Based on the account information of the account password entered by the target object, the corresponding biometric information is obtained from the blockchain system, and the biometric information obtained from the blockchain system is used as a common input; The biometric information input by the target object is used as private input; The circuit constraints are determined based on the private inputs and the common inputs; A zero-knowledge proof is generated based on the public input, the private input, and the circuit constraints using a zero-knowledge proof algorithm.

[0011] In some embodiments, verifying the zero-knowledge proof through a blockchain system to obtain a second verification result includes the following steps: The zero-knowledge proof is sent to the blockchain system, so that the blockchain system can perform bilinear mapping verification on the zero-knowledge proof using the corresponding public input and verification key to obtain a second verification result.

[0012] To achieve the above objectives, another aspect of this application proposes a software system identity authentication system, comprising: The encryption processing module is used to perform hash encryption on the first identity information input by the target object to obtain encrypted identity data. The first verification module is used to verify the encrypted identity data through the blockchain system to obtain a first verification result; The zero-knowledge proof generation module is used to generate a zero-knowledge proof on the second identity information input by the target object using zero-knowledge proof technology. The second verification module is used to verify the zero-knowledge proof through the blockchain system to obtain a second verification result; The identity authentication module is used to determine that the target object has passed the software system identity authentication when both the first verification result and the second verification result indicate that the verification is successful.

[0013] To achieve the above objectives, another aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0014] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0015] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0016] The embodiments of this application include at least the following beneficial effects: This application provides a software system identity authentication method and related equipment. In response to first identity information input by a target object, the method hashes and encrypts the first identity information to obtain encrypted identity data. Then, it verifies the encrypted identity data through a blockchain system to obtain a first verification result. Further, in response to second identity information input by the target object, a zero-knowledge proof is generated for the second identity information using zero-knowledge proof technology. The zero-knowledge proof is then verified through a blockchain system to obtain a second verification result. If both the first and second verification results indicate successful verification, the target object is determined to have passed the software system identity authentication. This application first employs a two-factor authentication method to improve user account security. Simultaneously, a portion of the identity information is verified using identity hash encryption, while another portion is verified based on zero-knowledge proof technology, reducing the risk of user privacy information leakage during the identity authentication process and improving identity authentication efficiency. Attached Figure Description

[0017] Figure 1 This is a flowchart of the software system identity authentication method provided in the embodiments of this application; Figure 2 This is a flowchart of a software system authentication method provided in another embodiment of this application; Figure 3 yes Figure 1 The flowchart of step S103 in the process; Figure 4 This is a schematic diagram illustrating the implementation framework of the dual authentication process provided in the embodiments of this application; Figure 5 This is a schematic diagram of the overall process of dual authentication in the software system provided in the embodiments of this application; Figure 6 This is a schematic diagram of the software system identity authentication system provided in the embodiments of this application; Figure 7 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0019] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0020] Before providing a detailed description of the embodiments of this application, some of the nouns and terms involved in the embodiments of this application will be explained first. The nouns and terms involved in the embodiments of this application are subject to the following interpretations.

[0021] Blockchain, a distributed ledger technology, is characterized by decentralization, transparency, and immutability. Unlike traditional centralized databases, blockchain relies on multiple nodes to jointly maintain data, ensuring its authenticity and security. In a blockchain system, all records are open to participants, and anyone can verify them, increasing the transparency of data processing. More importantly, blockchain uses encryption technology to ensure that once data is written, it cannot be modified or deleted, thus avoiding the risk of data tampering and enhancing the system's reliability and trustworthiness.

[0022] Smart contracts, a key concept in blockchain technology, refer to automatically executing, immutable code that automatically executes contract terms when certain predetermined conditions are met. Smart contracts operate without relying on traditional intermediaries or third parties, thus reducing human intervention, increasing efficiency, and lowering costs.

[0023] Facial recognition is a type of biometric identification technology that uses computer vision and machine learning algorithms to verify or identify a person's identity by analyzing and recognizing facial features.

[0024] Zero-knowledge proof is a cryptographic protocol that allows a prover to demonstrate the truth of a statement to a verifier without revealing any additional information. This protocol ensures the reliability and completeness of the proof process while effectively protecting privacy.

[0025] Among related technologies, blockchain systems can be used for identity authentication to ensure user data security. However, regarding the authentication rules, this involves generating encrypted identity information on the user's end and sending it to the blockchain for authentication. This encrypted identity information contains user privacy information such as account passwords and biometrics, a process that is prone to leakage of user privacy information. Alternatively, zero-knowledge proof technology can be used, allowing the user's end to act as a prover, proving the truthfulness of a statement to the software system acting as a verifier without disclosing any additional information. This ensures the reliability and completeness of the proof while protecting privacy. However, generating zero-knowledge proofs is a computationally intensive process, resulting in low efficiency in the entire identity authentication process.

[0026] In view of this, this application provides a software system identity authentication method and related equipment. The scheme first adopts a two-factor authentication method to improve the security of user accounts. At the same time, a part of the identity information is verified by identity hash encryption, and another part of the identity information is verified based on zero-knowledge proof technology, thereby reducing the risk of leakage of user privacy information during the identity authentication process and improving the efficiency of identity authentication.

[0027] The software system authentication method provided in this application relates to the field of information security technology. The software system authentication method provided in this application can be applied to a terminal, a server, or software running on a terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or in-vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the software system authentication method, but is not limited to the above forms.

[0028] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0029] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the proper functioning of these embodiments acquired.

[0030] In some embodiments, the authentication method of this application can be applied to a system architecture consisting of a user terminal and a server terminal. The server terminal is used to provide services of a certain software system to the user terminal. When the user terminal uses the software system, it needs to authenticate its identity before logging into the software system. The authentication process of the software system is implemented based on blockchain technology, that is, the blockchain system is used to store the identity information of registered users. When the user terminal sends an authentication request, it triggers the smart contract of the blockchain system to automatically execute the authentication process. This authentication process is implemented based on the authentication method of this application.

[0031] Figure 1 This is an optional flowchart of the software system authentication method provided in the embodiments of this application. Figure 1 The method may include, but is not limited to, steps S101 to S105.

[0032] S101, in response to the first identity information input by the target object, perform hash encryption on the first identity information to obtain encrypted identity data; S102, the encrypted identity data is verified through the blockchain system to obtain the first verification result; S103, in response to the second identity information input by the target object, generate a zero-knowledge proof for the second identity information using zero-knowledge proof technology; S104, the zero-knowledge proof is verified through the blockchain system to obtain the second verification result; S105, if both the first and second verification results indicate that the verification is successful, the target object is determined to have passed the software system's identity authentication.

[0033] Steps S101 to S105 as shown in the embodiments of this application improve the security of user accounts by adopting a two-factor authentication method. At the same time, part of the identity information is verified by identity hash encryption, and the other part of the identity information is verified based on zero-knowledge proof technology, thereby reducing the risk of leakage of user privacy information during the identity authentication process and improving the efficiency of identity authentication.

[0034] In step S101 of some embodiments, the user terminal responds to the first identity information input by the target object, such as account password information, hashes and encrypts the first identity information to obtain encrypted identity data, and sends the encrypted identity data to the blockchain system.

[0035] In step S102 of some embodiments, after the user sends the encrypted identity data to the blockchain system, the blockchain system verifies the encrypted identity data using the stored user registration information to obtain a first verification result indicating whether the first identity information verification is successful or unsuccessful. For example, after receiving the encrypted identity data, the blockchain system decompresses the encrypted identity data to obtain the user ID and the hash value of the first identity information. Then, it queries the corresponding hash value of the first identity information stored in the blockchain based on the user ID to determine if the two are consistent, thus obtaining a first verification result indicating successful verification. If the corresponding hash value of the first identity information cannot be found in the blockchain system based on the user ID, or if the hash value from the user input is inconsistent with the hash value stored in the blockchain, a first verification result indicating unsuccessful verification is obtained. It is understood that the user ID can be a mobile phone number, system account, or user terminal device identifier, etc.

[0036] In step S103 of some embodiments, the user terminal, in response to the second identity information input by the target object, such as biometric information, generates a zero-knowledge proof for the second identity information using zero-knowledge proof technology, and sends the zero-knowledge proof to the blockchain system. It is understood that the first identity information in this application embodiment can be account password information, and the second identity information can be biometric information; or, the first identity information can be biometric information, and the second identity information can be account password information. Biometric information can be fingerprint feature information, facial feature information, or pupil feature information, etc., and this application embodiment does not impose specific limitations.

[0037] In step S104 of some embodiments, after the user sends the zero-knowledge proof to the blockchain system, the blockchain system verifies the zero-knowledge proof and obtains a second verification result indicating whether the second identity information verification passes or fails. The zero-knowledge proof algorithm in this application embodiment can be Groth16, PLONK, Halo2, Bulletproofs, zk-STARKs, etc., and this application embodiment does not impose specific limitations.

[0038] Taking the Groth16 algorithm as an example, the user terminal obtains the corresponding second identity information (or the hash value of the second identity information) from the blockchain system based on the target object ID (i.e., the user ID), and uses the second identity information obtained from the blockchain system as the public input; the target object inputs its second identity information on the user terminal as the private input; circuit constraints are determined based on the private and public inputs; and a zero-knowledge proof is generated using a zero-knowledge proof algorithm based on the public, private, and circuit constraints. The user terminal sends the zero-knowledge proof to the blockchain system, so that the blockchain system can perform bilinear mapping verification on the zero-knowledge proof using the corresponding public input and verification key to obtain the second verification result.

[0039] In step S105 of some embodiments, if both the first verification result and the second verification result are successful, the blockchain system can notify the software system to open the service to the user terminal. The blockchain system can return the first verification result and the second verification result to the user terminal, or return the identity authentication result. If the user terminal determines that both the first verification result and the second verification result are successful, or the identity authentication result is successful, it can further access and use the software system. In another example, if both the first verification result and the second verification result are successful, the blockchain system can generate a hash-encrypted identity credential, and then notify the software system server and the user terminal of the identity credential respectively. Subsequently, the user terminal can use the identity credential to directly log in to the software system server. An expiration date can be set for the identity credential. After the identity credential expires, the software system identity authentication method of this application embodiment, i.e., steps S101 to S105, can be re-executed to update the identity credential.

[0040] In one example, the user can simultaneously input first and second identity information. That is, the system can execute in parallel the steps of responding to the first identity information input by the target object, hashing and encrypting the first identity information to obtain encrypted identity data, verifying the encrypted identity data through the blockchain system to obtain a first verification result, and executing the steps of responding to the second identity information input by the target object, generating a zero-knowledge proof for the second identity information through zero-knowledge proof technology, verifying the zero-knowledge proof through the blockchain system to obtain a second verification result. Then, the first verification result and the second verification result are combined to determine whether the target object has passed the software system's identity authentication.

[0041] In another example, the user can first input first identity information. The system then responds to the first identity information input by the target object by hashing and encrypting it to obtain encrypted identity data. The encrypted identity data is then verified through the blockchain system to obtain a first verification result. If the first verification result indicates that the user has passed the verification, the system then responds to the second identity information input by the target object by generating a zero-knowledge proof for the second identity information using zero-knowledge proof technology. The zero-knowledge proof is then verified through the blockchain system to obtain a second verification result. Finally, the system determines whether the target object has passed the software system's identity authentication based on the second verification result.

[0042] In some embodiments, please refer to Figure 2 The software system authentication method in this application embodiment may also include, but is not limited to, the following steps: S201, In response to the registration request, the account and password information indicated in the registration request is verified; S202, if the account password information is approved, the account password information is hashed and encrypted and then stored in the blockchain system, and a biometric input prompt area is displayed to collect biometric information; S203 verifies the validity of biometric information. If the entered biometric information is valid, it is hashed, encrypted, and then stored in the blockchain system.

[0043] In this embodiment, during the registration phase, the user enters their account and password information and generates a software system registration request, which is then sent to the server. The server responds to the registration request by verifying the account and password information indicated in the request. This verification includes, but is not limited to, checking whether the account and password formats meet the requirements, whether the account and password information is empty, and whether the account has already been registered. If the account and password information passes verification, the server hashes and encrypts the information before storing it in the blockchain system and displays a biometric data entry prompt area to collect biometric information. If the account and password information fails verification, the server returns a registration failure message to the user.

[0044] Users input their biometric information through the biometric input prompt area displayed on the user's device. The server verifies the validity of the biometric information, including but not limited to whether the input biometrics are complete or meet format requirements (such as image data) and content requirements (such as facial or fingerprint data). If the input biometric information is valid, the server hashes and encrypts the biometric information before storing it in the blockchain system.

[0045] This embodiment provides a data foundation for system verification of identity authentication methods in subsequent software systems by adopting a two-factor identity registration process that first registers account and password information and then enters biometric information, thereby improving the reliability of the identity authentication system.

[0046] In some embodiments, prior to step S103, the software system authentication method of this application may also include, but is not limited to, the following steps: If the first verification result indicates that the verification failed, it is determined that the target object has not passed the software system's identity authentication. If the first verification result indicates that the verification is successful, the next step is to generate a zero-knowledge proof for the second identity information in response to the input of the target object, using zero-knowledge proof technology.

[0047] In this embodiment, taking account password information as the first identity information and biometric information as the second identity information as an example, the user first enters account password information. The system first executes the steps of responding to the account password information entered by the target object, hashing and encrypting the account password information to obtain encrypted identity data, and verifying the encrypted identity data through the blockchain system to obtain a first verification result. If the first verification result indicates failure, it is directly determined that the target object has failed identity authentication and feedback the identity failure information is provided. If the first verification result indicates success, the system then obtains the biometric information entered by the user by displaying the biometric input prompt area, executes the steps of responding to the biometric information entered by the target object, generating a zero-knowledge proof for the second identity information through zero-knowledge proof technology, and verifying the zero-knowledge proof through the blockchain system to obtain a second verification result. Finally, based on the second verification result, it is determined whether the target object has passed the software system identity authentication.

[0048] This embodiment first verifies the hash-encrypted account password information sent by the user. If the verification is successful, it uses a complex but privacy-preserving zero-knowledge proof technique to verify the biometric information. If the account key verification fails, it directly confirms that the identity authentication has failed. This can further reduce the waste of computing resources in the identity authentication process, improve authentication efficiency, and avoid the leakage of the biometric information entered by the user.

[0049] In some embodiments, please refer to Figure 3 The step S103, which involves generating a zero-knowledge proof for the second identity information using zero-knowledge proof technology, may include, but is not limited to, the following steps: S301, based on the account information entered by the target object, obtain the corresponding biometric information from the blockchain system, and use the biometric information obtained from the blockchain system as public input; S302, the biometric information input by the target object is used as private input; S303 determines circuit constraints based on private and common inputs; S304 generates a zero-knowledge proof based on the public input, private input, and circuit constraints using a zero-knowledge proof algorithm.

[0050] In this embodiment, during the biometric authentication stage, a Groth16 zero-knowledge proof algorithm is designed to generate zero-knowledge proofs and verify them via the blockchain. Groth16 is an efficient zero-knowledge proof algorithm widely used in blockchain and privacy protection fields. It generates public parameters through trusted settings, the prover generates a compact proof, and the verifier verifies its validity through simple computation. Groth16 proofs are very small, and the verification process is fast and does not require multiple rounds of interaction, making it very suitable for resource-constrained environments such as blockchain. The design of the dual authentication zero-knowledge algorithm for the software system can be divided into three main stages: initialization, generating zero-knowledge proofs, and verifying zero-knowledge proofs. First, in the initialization stage, a private input containing user privacy information such as facial biometric information is designed. Simultaneously, the public input is the user's facial biometric information encrypted by the blockchain system. Through this process, a circuit constraint is output to determine whether the private and public inputs match, thereby generating the corresponding public parameters. Next, the Groth16 zero-knowledge proof is generated using the aforementioned public parameters. Finally, the blockchain system confirms the validity of the authentication by viewing and verifying the zero-knowledge proof.

[0051] In some embodiments, step S104 may include, but is not limited to, the following steps: The zero-knowledge proof is sent to the blockchain system, which then uses the corresponding public input and verification key to perform bilinear mapping verification on the zero-knowledge proof, thus obtaining a second verification result.

[0052] In this embodiment, the user terminal sends the generated zero-knowledge proof to the blockchain system for verification. The zero-knowledge proof contains three elliptic curve elements A, B, and C. Bilinear mapping verification is achieved by comparing the bilinear pairing operation e(A,B) with the pre-calculated value, resulting in a second verification result. After successful verification, the verifier confirms that the user terminal does indeed possess the secret information corresponding to the registered identity and has not disclosed any content of that secret information.

[0053] The following is a detailed description and explanation of the solutions in the embodiments of the present invention, using specific application examples: Please refer to Figure 4 The diagram illustrates the implementation framework of the dual authentication process. The overall framework includes the user client, the supervisor, the blockchain, and the database, as detailed below: The user end: is the entity that authenticates the identity of the software system.

[0054] The regulator is responsible for monitoring the identity authentication process of the software system to ensure its legality and compliance.

[0055] Blockchain: This platform uses smart contracts to achieve identity authentication in software systems, ensuring a smooth authentication process. It can be used to record authentication information, guaranteeing data integrity and authenticity, while also protecting identity privacy using cryptographic technologies.

[0056] Database: Used to store user identity information, that is, facial biometric features that have been hashed.

[0057] Please refer to Figure 5 The diagram illustrates the overall process of dual authentication in the software system, dividing it into two stages: identity registration and facial recognition registration. The dual authentication stage utilizes both account password and facial recognition. First, logging in with the registered account password constitutes the first layer of authentication. Then, a second layer of authentication is performed by generating a zero-knowledge proof using facial biometric data.

[0058] The identity registration process is as follows: When registering identity information on a blockchain platform, users must first enter their username and password. Registration will fail if the input is empty; registration will also fail if the account has already been registered. If the account is not registered, the system will hash and encrypt the username and password, and store the encrypted information on the blockchain. A "SUCCESS" message will be returned upon successful registration.

[0059] In addition to registering an account and password, users also need to register their facial information. The system will prompt users to input facial images and extract facial features through a facial recognition module. First, the system will check if there is valid facial information input; if not, registration fails. If the input is valid, the system will hash and encrypt the facial feature data. The encrypted facial information will always be processed and stored in encrypted form to protect user privacy and enhance data security. Next, the system will check if the encrypted facial information already exists in the registration records. If it already exists, registration fails; if there is no duplicate record, the system will store the encrypted facial information in the database and return "SUCCESS" to indicate successful registration.

[0060] The identity verification process is as follows: After completing dual-identity registration, users enter the authentication phase when authenticating their identity with the software system. This phase first requires the user to enter their username and password. The system checks if the input is empty; if empty, authentication fails. If not empty, it checks the blockchain to see if the account has a registration record. If not registered, authentication fails; if registered, it further verifies if the entered username and password match. If they match successfully, it returns "SUCCESS," indicating successful authentication.

[0061] In addition to successfully verifying account and password identity, facial recognition is also required. This stage uses a zero-knowledge proof algorithm to process biometric features, ensuring that the necessary identity verification is generated and verified without exposing any personal privacy. Specifically, the system will prompt the user to input the verification certificate generated by the zero-knowledge proof algorithm. If the certificate is successfully verified, the system will return "TRUE," indicating that facial recognition verification has passed.

[0062] Specifically, the verification process for facial feature information based on Groth16 zero-knowledge proof technology is illustrated in the following embodiment, where the character H(x) represents a hash function and m represents the maximum number of constraints in the circuit. , , , , Both represent random numbers; [X]1 indicates that X·g1 is generated by the random number generator. Group 1 Operations on 1; [X]2 represents X·g2 with generators of Group 2 Operations on 2; Represents a circuit polynomial; a( ),b( ),c( () represents private input, public input, and output; Representing prime numbers, The base point represents the constraint. Represents the product polynomial of all constraint points; All represent random numbers; Indicates the witness value; Y(x) represents zero-knowledge proof; Y(x) represents a low-order polynomial.

[0063] Initialization: Circuit parameters are generated based on polynomials a(x), b(x), and c(x), where a(x) is the private input of the user's privacy identity information, i.e., the facial feature information entered by the user during authentication; b(x) is the public input of encrypted facial biometric information in the database; and c(x) is the output for determining whether they are equal. If the output is 0, they are equal; otherwise, they are not equal. The circuit is initially configured, and a common parameter P is generated based on the designed circuit, including the initial settings and circuit parameters as shown in equation (1).

[0064] For zero-knowledge proofs of user identity, assuming the account is Zhang xx, the password is zs234234, and the facial feature information is [218,116,418,693,303,82,239], the hash function encrypted value is: 0x88db1ae2b8883024dbc91d4267145f571f169d6cdae2f61ecf48f26ced80bd62. The user will then generate a zero-knowledge proof about the face information, where a(x)=[218,116,418,693,303,82,239], b(x)=0x88db1ae2b8883024dbc91d4267145f571f169d6cdae2f61ecf48f26ced80bd62, and c(x)=H(a(x))-b(x).

[0065] (1) in, , , It is a secret random number generated during the system initialization and trusted setup phase. It is a check polynomial, generated for each public input of the circuit, which converts the circuit's logic ( , , ) using secret value They are bound together to prevent tampering.

[0066] Generating zero-knowledge proofs: Generating zero-knowledge proofs based on common parameters P consists of the following two steps: Calculate the proof key during the system initialization and trusted setup phases. and verification key , respectively, as shown in equations (2) and (3).

[0067] (2) (3) The system sends the proof key to the prover (i.e. the user) for use in the identity authentication process to generate zero-knowledge proofs, and sends the verification key to the blockchain or regulator for verification of the zero-knowledge proofs.

[0068] When a user needs to perform facial recognition authentication after verifying their account and password, the user calculates a zero-knowledge proof. As shown in equations (6), (7), and (8), where equation (4) is the witness polynomial and equation (5) is the constraint polynomial.

[0069] (4) (5) (6) (7) (8) The user terminal substitutes the specific input values ​​into the circuit template. In this process, a specific polynomial is formed, specifically for this certification. , , , These are three core polynomials derived from user input (i.e., private and public input), which together encode the constraint c(x)=0. Through the formula... to Generating zero-knowledge proofs .

[0070] Regulators and blockchain verify zero-knowledge proofs: Regulators and blockchain examine the generated proofs. Whether the elements in the group satisfy the properties of the group and the field is first calculated based on the common input, according to equation (9).

[0071] (9) (10) It is a coefficient relating to the public input submitted by the user (i.e., the hash value b(x)). This represents a pre-calculated element in the verification key. Verification is performed using the bilinear mapping in equation (10). If the equation holds true, it indicates that the input identity authentication information is consistent with the actual information, signifying successful facial recognition authentication. If the equation does not hold true, it indicates that the input identity authentication information is inconsistent with the actual information, potentially indicating identity forgery, and the regulatory authorities will further intervene to conduct an investigation.

[0072] This embodiment addresses the risks of privacy leakage, credential forgery, and the trade-off between authentication efficiency and security in software system identity authentication. It proposes a dual identity authentication method for software systems based on zero-knowledge proofs, which optimizes the authenticity and reliability of identity during the software system identity authentication process, while protecting privacy information and improving authentication efficiency.

[0073] Please refer to Figure 6 This application also provides a software system identity authentication system, including: The encryption processing module is used to perform hash encryption on the first identity information input by the target object to obtain encrypted identity data. The first verification module is used to verify the encrypted identity data through the blockchain system and obtain the first verification result; The zero-knowledge proof generation module is used to generate a zero-knowledge proof for the second identity information input by the target object through zero-knowledge proof technology. The second verification module is used to verify the zero-knowledge proof through the blockchain system and obtain the second verification result; The identity authentication module is used to determine whether the target object has passed the software system's identity authentication if both the first and second verification results indicate that the verification has passed.

[0074] It is understood that the methods described in the above method embodiments are applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0075] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method. This electronic device can be any smart terminal, including tablet computers and computers.

[0076] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0077] Please see Figure 7, Figure 7 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 902 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901. The input / output interface 903 is used to implement information input and output; The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904); The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0078] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0079] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0080] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0081] It is understood that the content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0082] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0083] The software system authentication method and related equipment provided in this application have at least one of the following beneficial effects: (1) Based on Groth16 zero-knowledge proof and combined with biometrics, the system’s identity authentication is guaranteed to be true and reliable. Compared with existing solutions, it improves authentication efficiency and protects user privacy and security.

[0084] (2) Based on the dual identity authentication mechanism of account password and face recognition, this innovative approach combines biometric information, which is highly secure authentication information, with account password to form dual authentication, thus ensuring the security and authenticity of identity authentication.

[0085] (3) The authentication system is designed based on the blockchain platform. It combines smart contracts to automatically execute the corresponding code and protocols. Compared with the existing identity authentication, it has advantages such as decentralization and anti-tampering, ensuring the security and reliability of identity authentication.

[0086] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0087] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0088] The system embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0089] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0090] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or modules is not necessarily limited to those steps or modules explicitly listed, but may include other steps or modules not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0091] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0092] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of modules described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0093] The modules described above as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0094] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0095] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0096] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A software system authentication method, characterized in that, Includes the following steps: In response to the first identity information input by the target object, the first identity information is hashed and encrypted to obtain encrypted identity data; The encrypted identity data is verified using a blockchain system to obtain a first verification result; In response to the second identity information input by the target object, a zero-knowledge proof is generated for the second identity information using zero-knowledge proof technology; The zero-knowledge proof is verified using a blockchain system to obtain a second verification result; If both the first verification result and the second verification result indicate that the verification is successful, it is determined that the target object has passed the software system's identity authentication.

2. The software system identity authentication method according to claim 1, characterized in that, The first identity information is account password information, and the second identity information is biometric information; or, the first identity information is biometric information, and the second identity information is account password information.

3. The software system identity authentication method according to claim 1, characterized in that, The first identity information is account password information, and the second identity information is biometric information; the software system identity authentication method further includes the following steps: In response to the registration request, the account and password information indicated in the registration request is reviewed. If the account password information is approved, the account password information is hashed and encrypted and then stored in the blockchain system, and a biometric input prompt area is displayed to collect biometric information. The biometric information is validated. If the entered biometric information is valid, it is hashed, encrypted, and then stored in the blockchain system.

4. The software system identity authentication method according to claim 1, characterized in that, Before the step of generating a zero-knowledge proof for the second identity information in response to input from the target object using zero-knowledge proof technology, the software system identity authentication method further includes the following steps: If the first verification result indicates that the verification failed, it is determined that the target object has not passed the software system's identity authentication. If the first verification result indicates that the verification is successful, the step of generating a zero-knowledge proof for the second identity information in response to the input of the target object is executed using zero-knowledge proof technology.

5. The software system identity authentication method according to claim 1, characterized in that, The first identity information is account password information, and the second identity information is biometric information; the step of generating a zero-knowledge proof for the second identity information using zero-knowledge proof technology includes the following steps: Based on the account information of the account password entered by the target object, the corresponding biometric information is obtained from the blockchain system, and the biometric information obtained from the blockchain system is used as a common input; The biometric information input by the target object is used as private input; The circuit constraints are determined based on the private inputs and the common inputs; A zero-knowledge proof is generated based on the public input, the private input, and the circuit constraints using a zero-knowledge proof algorithm.

6. The software system identity authentication method according to claim 5, characterized in that, The verification of the zero-knowledge proof through a blockchain system to obtain a second verification result includes the following steps: The zero-knowledge proof is sent to the blockchain system, so that the blockchain system can perform bilinear mapping verification on the zero-knowledge proof using the corresponding public input and verification key to obtain a second verification result.

7. A software system identity authentication system, characterized in that, include: The encryption processing module is used to perform hash encryption on the first identity information input by the target object to obtain encrypted identity data. The first verification module is used to verify the encrypted identity data through the blockchain system to obtain a first verification result; The zero-knowledge proof generation module is used to generate a zero-knowledge proof on the second identity information input by the target object using zero-knowledge proof technology. The second verification module is used to verify the zero-knowledge proof through the blockchain system to obtain a second verification result; The identity authentication module is used to determine that the target object has passed the software system identity authentication when both the first verification result and the second verification result indicate that the verification is successful.

8. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.

Images